diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..2778083
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,10 @@
+// Ignore everything
+*
+
+// Allow what is needed
+!crates
+!tests
+!resources
+
+!Cargo.lock
+!Cargo.toml
diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 0000000..8567387
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,11 @@
+# https://EditorConfig.org
+root = true
+
+[*]
+charset = utf-8
+indent_size = 4
+indent_style = space
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+max_line_length = 100
diff --git a/.github/DISCUSSION_TEMPLATE/community-discussions.yml b/.github/DISCUSSION_TEMPLATE/community-discussions.yml
new file mode 100644
index 0000000..5e1cd21
--- /dev/null
+++ b/.github/DISCUSSION_TEMPLATE/community-discussions.yml
@@ -0,0 +1,30 @@
+body:
+ - type: markdown
+ attributes:
+ value: |
+ > [!IMPORTANT]
+ > **Stalwart support has moved to [support.stalw.art](https://support.stalw.art).**
+ >
+ > For an official response from the Stalwart maintainers, please post your question on the support portal. You can sign in there with your existing GitHub account; no separate registration is required.
+ >
+ > You are welcome to start a discussion here and other community members may still reply, but the maintainers no longer answer support questions through GitHub Discussions, so your question may go unanswered unless you also post it at [support.stalw.art](https://support.stalw.art).
+ >
+ > Before opening a new report, please review the [documentation](https://stalw.art/docs/) and the [FAQ](https://stalw.art/docs/faq). Most reported issues turn out to be configuration problems rather than actual bugs.
+ - type: textarea
+ attributes:
+ label: Topic
+ description: Describe the question, problem, or topic you want to discuss with the community.
+ placeholder: |
+ I am trying to configure SMTP relay with Stalwart and I am running into ...
+ validations:
+ required: true
+ - type: checkboxes
+ attributes:
+ label: Acknowledgement
+ options:
+ - label: I have reviewed the [documentation](https://stalw.art/docs/) and the [FAQ](https://stalw.art/docs/faq) and confirm that my question is not addressed there.
+ required: true
+ - label: I understand that maintainers no longer answer support questions through GitHub Discussions, and that for an official response from the Stalwart team I need to post my question at [support.stalw.art](https://support.stalw.art).
+ required: true
+ - label: I agree to follow the project's [Code of Conduct](https://github.com/stalwartlabs/.github/blob/main/CODE_OF_CONDUCT.md).
+ required: true
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..18d59f1
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,17 @@
+blank_issues_enabled: false
+contact_links:
+ - name: Report an Issue
+ url: https://support.stalw.art
+ about: Report a potential bug at support.stalw.art. Confirmed bugs will be converted to Issues. Sign in with your GitHub account.
+ - name: Questions & Support
+ url: https://support.stalw.art
+ about: Get help with configuration, troubleshooting, or general questions at support.stalw.art. Sign in with your GitHub account.
+ - name: Feature Requests
+ url: https://support.stalw.art
+ about: Suggest new features or improvements at support.stalw.art. Sign in with your GitHub account.
+ - name: Join Stalwart's Reddit
+ url: https://www.reddit.com/r/stalwartlabs
+ about: Join our subreddit for community discussions and release announcements.
+ - name: Join Stalwart's Discord
+ url: https://discord.com/servers/stalwart-923615863037390889
+ about: Join our Discord server for community chat and release announcements.
diff --git a/.github/ISSUE_TEMPLATE/confirmed_issue.yml b/.github/ISSUE_TEMPLATE/confirmed_issue.yml
new file mode 100644
index 0000000..3851955
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/confirmed_issue.yml
@@ -0,0 +1,25 @@
+name: Bug Report (auto-closed)
+description: Issues opened here are automatically closed. Please report bugs at support.stalw.art instead.
+labels: ["bug"]
+title: "🪲: "
+body:
+ - type: markdown
+ attributes:
+ value: |
+ > [!CAUTION]
+ > **Issues opened directly in this repository are automatically closed and locked.**
+ >
+ > All bug reports must first be triaged at our support portal: **[support.stalw.art](https://support.stalw.art)**. If a maintainer confirms that your report is a genuine bug, they will create an Issue on your behalf; you do not need to (and should not) open one yourself.
+ >
+ > You can sign in to support.stalw.art with your existing GitHub account, so no separate registration is required.
+ >
+ > **What to do instead:**
+ > - Suspected bug, question, or feature request? Post it at [support.stalw.art](https://support.stalw.art).
+ >
+ > If you proceed and submit this form anyway, your issue will be closed automatically and a comment will be posted explaining this policy.
+ - type: checkboxes
+ attributes:
+ label: Acknowledgement
+ options:
+ - label: I understand that this issue will be automatically closed and that I should post my report at [support.stalw.art](https://support.stalw.art) instead.
+ required: true
diff --git a/.github/allowed-pr-authors.txt b/.github/allowed-pr-authors.txt
new file mode 100644
index 0000000..6476bd8
--- /dev/null
+++ b/.github/allowed-pr-authors.txt
@@ -0,0 +1,2 @@
+# GitHub usernames allowed to open pull requests directly.
+mdecimus
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..1d8bc93
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,19 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+ - package-ecosystem: "cargo" # See documentation for possible values
+ directory: "/" # Location of package manifests
+ schedule:
+ interval: "weekly"
+
+ # Enable version updates for GitHub Actions
+ - package-ecosystem: "github-actions"
+ # Workflow files stored in the default location of `.github/workflows`
+ # You don't need to specify `/.github/workflows` for `directory`. You can use `directory: "/"`.
+ directory: "/"
+ schedule:
+ interval: "weekly"
diff --git a/.github/workflows/auto-close-issues.yml b/.github/workflows/auto-close-issues.yml
new file mode 100644
index 0000000..6c34762
--- /dev/null
+++ b/.github/workflows/auto-close-issues.yml
@@ -0,0 +1,67 @@
+name: Auto-close untriaged issues
+
+on:
+ issues:
+ types: [opened, reopened]
+
+permissions:
+ issues: write
+
+jobs:
+ auto-close:
+ runs-on: ubuntu-latest
+ steps:
+ - name: Close issues from non-allowed authors
+ uses: actions/github-script@v7
+ with:
+ script: |
+ // Users allowed to open issues directly. All other authors will have
+ // their issues auto-closed. Add GitHub usernames (lowercase) here to
+ // grant additional contributors permission to open issues.
+ const allowedAuthors = [
+ 'mdecimus',
+ ];
+
+ const issue = context.payload.issue;
+ const author = (issue.user && issue.user.login) || '';
+
+ if (allowedAuthors.includes(author.toLowerCase())) {
+ core.info(`Issue #${issue.number} opened by allowed author '${author}'. Skipping.`);
+ return;
+ }
+
+ const comment = [
+ `Hi @${author}, thanks for taking the time to file this report.`,
+ ``,
+ `This issue is being **automatically closed** because all bug reports must first be triaged at our support portal: **[support.stalw.art](https://support.stalw.art)**. Please re-post this report there so that a maintainer can review it; once confirmed as a bug, an Issue will be created on your behalf.`,
+ ``,
+ `You can sign in to support.stalw.art with your existing GitHub account, so no separate registration is required.`,
+ ``,
+ `Thank you for understanding.`,
+ ].join('\n');
+
+ await github.rest.issues.createComment({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ issue_number: issue.number,
+ body: comment,
+ });
+
+ await github.rest.issues.update({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ issue_number: issue.number,
+ state: 'closed',
+ state_reason: 'not_planned',
+ });
+
+ try {
+ await github.rest.issues.lock({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ issue_number: issue.number,
+ lock_reason: 'off-topic',
+ });
+ } catch (err) {
+ core.warning(`Could not lock issue #${issue.number}: ${err.message}`);
+ }
diff --git a/.github/workflows/auto-close-prs.yml b/.github/workflows/auto-close-prs.yml
new file mode 100644
index 0000000..fffd048
--- /dev/null
+++ b/.github/workflows/auto-close-prs.yml
@@ -0,0 +1,131 @@
+name: Auto-close PRs from non-allowed authors
+
+on:
+ pull_request_target:
+ types: [opened, reopened]
+
+permissions:
+ pull-requests: write
+ issues: write
+
+jobs:
+ auto-close:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v7
+ with:
+ sparse-checkout: .github/allowed-pr-authors.txt
+ sparse-checkout-cone-mode: false
+
+ - name: Close PRs from non-allowed authors
+ uses: actions/github-script@v7
+ with:
+ script: |
+ const fs = require('fs');
+
+ let allowedAuthors = [];
+ try {
+ allowedAuthors = fs.readFileSync('.github/allowed-pr-authors.txt', 'utf8')
+ .split('\n')
+ .map(line => line.trim())
+ .filter(line => line && !line.startsWith('#'))
+ .map(line => line.toLowerCase());
+ } catch (err) {
+ core.warning(`Could not read allowed-pr-authors.txt: ${err.message}`);
+ }
+
+ const pr = context.payload.pull_request;
+ const author = (pr.user && pr.user.login) || '';
+ const login = author.toLowerCase();
+
+ if (author.endsWith('[bot]')) {
+ core.info(`PR #${pr.number} opened by bot '${author}'. Skipping.`);
+ return;
+ }
+
+ if (allowedAuthors.includes(login)) {
+ core.info(`PR #${pr.number} opened by allowed author '${author}'. Skipping.`);
+ return;
+ }
+
+ const actor = (context.payload.sender && context.payload.sender.login) || '';
+
+ const isCollaborator = async (username) => {
+ if (!username) {
+ return false;
+ }
+ try {
+ const { data: perm } = await github.rest.repos.getCollaboratorPermissionLevel({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ username,
+ });
+ return perm.permission === 'admin' || perm.permission === 'write';
+ } catch (err) {
+ core.info(`Could not resolve collaborator permission for '${username}': ${err.message}`);
+ return false;
+ }
+ };
+
+ if (await isCollaborator(author)) {
+ core.info(`PR #${pr.number} author '${author}' is a collaborator. Skipping.`);
+ return;
+ }
+
+ if (actor.toLowerCase() !== login && await isCollaborator(actor)) {
+ core.info(`PR #${pr.number} action triggered by collaborator '${actor}'. Skipping.`);
+ return;
+ }
+
+ const contributingUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/blob/HEAD/CONTRIBUTING.md`;
+
+ const haystack = `${pr.title || ''}\n${pr.body || ''}`;
+ const aiPatterns = [
+ /[—―]/,
+ ];
+ const looksAiGenerated = aiPatterns.some(re => re.test(haystack));
+
+ const aiMessage = [
+ `Hi @${author}, thanks for your interest in contributing.`,
+ ``,
+ `This pull request is being **automatically closed and locked**. The description contains strong indicators of AI-generated content, and this project does not accept AI-generated code or unsolicited machine-authored contributions.`,
+ ``,
+ `Please read [CONTRIBUTING.md](${contributingUrl}) to learn what kinds of contributions are currently accepted. If this is a genuine hand-written change that fits those guidelines, please open a discussion at **[support.stalw.art](https://support.stalw.art)** before submitting.`,
+ ].join('\n');
+
+ const standardMessage = [
+ `Hi @${author}, thanks for taking the time to open this pull request.`,
+ ``,
+ `This PR is being **automatically closed** because it was submitted by an author who is not on the list of approved contributors. This policy helps us keep review capacity focused and filter out unsolicited or low-quality contributions.`,
+ ``,
+ `Please read [CONTRIBUTING.md](${contributingUrl}) to learn what kinds of contributions are currently accepted. If your change fits those guidelines, please first discuss it at our support portal: **[support.stalw.art](https://support.stalw.art)**. You can sign in with your existing GitHub account.`,
+ ``,
+ `Thank you for understanding.`,
+ ].join('\n');
+
+ await github.rest.issues.createComment({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ issue_number: pr.number,
+ body: looksAiGenerated ? aiMessage : standardMessage,
+ });
+
+ await github.rest.pulls.update({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pr.number,
+ state: 'closed',
+ });
+
+ if (looksAiGenerated) {
+ try {
+ await github.rest.issues.lock({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ issue_number: pr.number,
+ lock_reason: 'spam',
+ });
+ } catch (err) {
+ core.warning(`Could not lock PR #${pr.number}: ${err.message}`);
+ }
+ }
diff --git a/.github/workflows/auto-redirect-discussions.yml b/.github/workflows/auto-redirect-discussions.yml
new file mode 100644
index 0000000..3405d94
--- /dev/null
+++ b/.github/workflows/auto-redirect-discussions.yml
@@ -0,0 +1,47 @@
+name: Redirect new discussions to the support portal
+
+on:
+ discussion:
+ types: [created]
+
+permissions:
+ discussions: write
+
+jobs:
+ redirect:
+ runs-on: ubuntu-latest
+ steps:
+ - name: Post support portal redirect
+ uses: actions/github-script@v7
+ with:
+ script: |
+ const discussion = context.payload.discussion;
+ const author = (discussion.user && discussion.user.login) || '';
+
+ const body = [
+ `Hi @${author}, thanks for posting!`,
+ ``,
+ `Stalwart support has moved to **[support.stalw.art](https://support.stalw.art)**. The support portal is now the canonical place to ask questions, request help, and report issues for triage. Other community members may still reply here, but the maintainers no longer answer support questions through GitHub Discussions, so your question may go unanswered unless you also post it on the portal.`,
+ ``,
+ `You can sign in to support.stalw.art with your existing GitHub account, so no separate registration is required. Google, Discord, LinkedIn, and email/password sign-in are also available.`,
+ ``,
+ `**Why we are unifying our support channels**`,
+ ``,
+ `Until now, Stalwart support has been spread across GitHub Discussions, Discord, Matrix, and Reddit. As the project has grown, tracking parallel inboxes and deduplicating threads has become unsustainable; the result has been slower answers, repeated work for the people helping out, and good information buried in chat scrollback where the next person with the same question would never find it.`,
+ ``,
+ `[support.stalw.art](https://support.stalw.art) is a Discourse instance that we operate ourselves, hosted at Hetzner in Germany and GDPR-compliant.`,
+ ``,
+ `Thank you for helping us keep the conversation in one place.`,
+ ].join('\n');
+
+ await github.graphql(
+ `mutation($discussionId: ID!, $body: String!) {
+ addDiscussionComment(input: { discussionId: $discussionId, body: $body }) {
+ comment { id }
+ }
+ }`,
+ {
+ discussionId: discussion.node_id,
+ body,
+ }
+ );
diff --git a/.github/workflows/ci-retry.yml b/.github/workflows/ci-retry.yml
new file mode 100644
index 0000000..83f41bf
--- /dev/null
+++ b/.github/workflows/ci-retry.yml
@@ -0,0 +1,29 @@
+name: "CI retry"
+
+on:
+ workflow_run:
+ workflows: ["CI"]
+ types: [completed]
+
+permissions:
+ actions: write
+
+jobs:
+ rerun:
+ name: Re-run failed jobs
+ if: >
+ github.event.workflow_run.conclusion == 'failure' &&
+ github.event.workflow_run.run_attempt < 3
+ runs-on: ubuntu-latest
+ steps:
+ - name: Re-run failed jobs
+ env:
+ GH_TOKEN: ${{ secrets.CI_RETRY_TOKEN || github.token }}
+ GH_REPO: ${{ github.repository }}
+ RUN_ID: ${{ github.event.workflow_run.id }}
+ RUN_ATTEMPT: ${{ github.event.workflow_run.run_attempt }}
+ run: |
+ set -eu
+ echo "Run $RUN_ID failed on attempt $RUN_ATTEMPT, re-running failed jobs"
+ sleep 60
+ gh run rerun "$RUN_ID" --failed
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..ab2691f
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,567 @@
+name: "CI"
+
+on:
+ workflow_dispatch:
+ inputs:
+ Docker:
+ required: false
+ default: false
+ type: boolean
+ Release:
+ required: false
+ default: false
+ type: boolean
+ push:
+ tags: ["v*.*.*"]
+
+env:
+ SCCACHE_GHA_ENABLED: true
+ RUSTC_WRAPPER: sccache
+ CARGO_TERM_COLOR: always
+ CARGO_NET_RETRY: 10
+ CARGO_NET_GIT_FETCH_WITH_CLI: true
+ AWS_LC_SYS_PREBUILT_NASM: 1
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true
+
+jobs:
+ multiarch:
+ strategy:
+ fail-fast: false
+ matrix:
+ include:
+ - variant: gnu
+ - variant: musl
+ name: Merge image / ${{matrix.variant}}
+ runs-on: ubuntu-latest
+ permissions:
+ id-token: write
+ contents: read
+ attestations: write
+ packages: write
+ needs: [linux]
+ if: github.event_name == 'push' || inputs.Docker
+ steps:
+ - name: Install Cosign
+ uses: sigstore/cosign-installer@v4.1.2
+ - name: Log In to GitHub Container Registry
+ uses: docker/login-action@v4
+ with:
+ registry: ghcr.io
+ username: ${{github.repository_owner}}
+ password: ${{github.token}}
+
+ - name: Log In to DockerHub
+ uses: docker/login-action@v4
+ with:
+ username: ${{secrets.DOCKERHUB_USERNAME}}
+ password: ${{secrets.DOCKERHUB_TOKEN}}
+
+ - name: Download ${{matrix.variant}} meta bake definition
+ uses: actions/download-artifact@v8
+ with:
+ name: bake-meta-${{matrix.variant}}
+ path: ${{ runner.temp }}/${{matrix.variant}}
+
+ - name: Download ${{matrix.variant}} digests
+ uses: actions/download-artifact@v8
+ with:
+ path: ${{ runner.temp }}/${{matrix.variant}}/digests
+ pattern: digests-${{matrix.variant}}-*
+ merge-multiple: true
+
+ - name: Create ${{matrix.variant}} manifest list and push
+ working-directory: ${{ runner.temp }}/${{matrix.variant}}/digests
+ run: |
+ docker buildx imagetools create $(jq -cr '.target."docker-metadata-action".tags | map(select(startswith("ghcr.io/${{github.repository}}")) | "-t " + .) | join(" ")' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json) \
+ $(printf 'ghcr.io/${{github.repository}}@sha256:%s ' *)
+ docker buildx imagetools create $(jq -cr '.target."docker-metadata-action".tags | map(select(startswith("index.docker.io/${{github.repository}}")) | "-t " + .) | join(" ")' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json) \
+ $(printf 'index.docker.io/${{github.repository}}@sha256:%s ' *)
+
+ - name: Inspect ${{matrix.variant}} image
+ id: manifest-digest
+ run: |
+ docker buildx imagetools inspect --format '{{json .Manifest}}' ghcr.io/${{github.repository}}:$(jq -r '.target."docker-metadata-action".args.DOCKER_META_VERSION' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json) | jq -r '.digest' > GHCR_DIGEST_SHA
+ echo "GHCR_DIGEST_SHA=$(cat GHCR_DIGEST_SHA)" | tee -a "${GITHUB_ENV}"
+ docker buildx imagetools inspect --format '{{json .Manifest}}' index.docker.io/${{github.repository}}:$(jq -r '.target."docker-metadata-action".args.DOCKER_META_VERSION' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json) | jq -r '.digest' > DOCKERHUB_DIGEST_SHA
+ echo "DOCKERHUB_DIGEST_SHA=$(cat DOCKERHUB_DIGEST_SHA)" | tee -a "${GITHUB_ENV}"
+ cosign sign --yes $(jq --arg GHCR_DIGEST_SHA "$(cat GHCR_DIGEST_SHA)" -cr '.target."docker-metadata-action".tags | map(select(startswith("ghcr.io/${{github.repository}}")) | . + "@" + $GHCR_DIGEST_SHA) | join(" ")' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json)
+ cosign sign --yes $(jq --arg DOCKERHUB_DIGEST_SHA "$(cat DOCKERHUB_DIGEST_SHA)" -cr '.target."docker-metadata-action".tags | map(select(startswith("index.docker.io/${{github.repository}}")) | . + "@" + $DOCKERHUB_DIGEST_SHA) | join(" ")' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json)
+
+ - name: Attest GHCR
+ uses: actions/attest-build-provenance@v4
+ with:
+ subject-name: ghcr.io/${{github.repository}}
+ subject-digest: ${{ env.GHCR_DIGEST_SHA }}
+ push-to-registry: true
+
+ - name: Attest Dockerhub
+ uses: actions/attest-build-provenance@v4
+ with:
+ subject-name: index.docker.io/${{github.repository}}
+ subject-digest: ${{ env.DOCKERHUB_DIGEST_SHA }}
+ push-to-registry: true
+
+ linux:
+ permissions:
+ id-token: write
+ contents: write
+ attestations: write
+ packages: write
+ strategy:
+ fail-fast: false
+ matrix:
+ include:
+ - target: x86_64-unknown-linux-gnu
+ platform: linux/amd64
+ suffix: ""
+ build_env: ""
+ - target: x86_64-unknown-linux-musl
+ platform: linux/amd64
+ suffix: "-alpine"
+ build_env: ""
+ - target: aarch64-unknown-linux-gnu
+ platform: linux/arm64
+ suffix: ""
+ build_env: "JEMALLOC_SYS_WITH_LG_PAGE=16 "
+ - target: aarch64-unknown-linux-musl
+ platform: linux/arm64
+ suffix: "-alpine"
+ build_env: "JEMALLOC_SYS_WITH_LG_PAGE=16 "
+ - target: armv7-unknown-linux-gnueabihf
+ platform: linux/arm/v7
+ suffix: ""
+ build_env: "JEMALLOC_SYS_WITH_LG_PAGE=16 "
+ - target: armv7-unknown-linux-musleabihf
+ platform: linux/arm/v7
+ suffix: "-alpine"
+ build_env: "JEMALLOC_SYS_WITH_LG_PAGE=16 "
+ - target: arm-unknown-linux-gnueabihf
+ platform: linux/arm/v6
+ suffix: ""
+ build_env: ""
+ - target: arm-unknown-linux-musleabihf
+ platform: linux/arm/v6
+ suffix: "-alpine"
+ build_env: ""
+ name: Build / ${{matrix.target}}
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v7
+
+ - name: Free disk space (heavy ARM targets)
+ if: contains(matrix.target, 'arm') || contains(matrix.target, 'aarch64')
+ run: |
+ df -h /mnt /
+ sudo rm -rf /usr/share/dotnet /opt/ghc /usr/local/lib/android /usr/local/.ghcup /usr/local/share/powershell /usr/share/swift /opt/hostedtoolcache/CodeQL
+ sudo docker image prune --all --force || true
+ df -h /mnt /
+
+ - name: Add swap (heavy ARM targets)
+ if: contains(matrix.target, 'arm') || contains(matrix.target, 'aarch64')
+ run: |
+ mnt_avail=$(df --output=avail -k /mnt | tail -1)
+ if [ "$mnt_avail" -lt 18874368 ]; then
+ echo "Insufficient space on /mnt (${mnt_avail}K available), aborting swap setup"
+ exit 1
+ fi
+ sudo fallocate -l 16G /mnt/swapfile
+ sudo chmod 600 /mnt/swapfile
+ sudo mkswap /mnt/swapfile
+ sudo swapon /mnt/swapfile
+ sudo sysctl vm.swappiness=80
+ free -h
+ swapon --show
+
+ - name: Set up QEMU
+ uses: docker/setup-qemu-action@v4
+ with:
+ platforms: "arm64,arm"
+
+ - name: Set up Docker Buildx
+ uses: docker/setup-buildx-action@v4
+ with:
+ buildkitd-config-inline: |
+ [registry."docker.io"]
+ mirrors = ["https://mirror.gcr.io"]
+ driver-opts: |
+ network=host
+
+ - name: Log In to GitHub Container Registry
+ uses: docker/login-action@v4
+ with:
+ registry: ghcr.io
+ username: ${{github.repository_owner}}
+ password: ${{github.token}}
+
+ - name: Log In to DockerHub
+ uses: docker/login-action@v4
+ with:
+ username: ${{secrets.DOCKERHUB_USERNAME}}
+ password: ${{secrets.DOCKERHUB_TOKEN}}
+
+ - name: Calculate shasum of external deps
+ id: cal-dep-shasum
+ run: |
+ echo "checksum=$(yq -p toml -oy '.package[] | select((.source | contains("")) or (.checksum | contains("")))' Cargo.lock | sha256sum | awk '{print $1}')" >> "$GITHUB_OUTPUT"
+
+ - name: Cache apt
+ uses: actions/cache@v6.1.0
+ id: apt-cache
+ with:
+ path: |
+ var-cache-apt
+ var-lib-apt
+ key: apt-cache-${{ hashFiles('Dockerfile.build') }}
+
+ - name: Cache Cargo
+ uses: actions/cache@v6.1.0
+ id: cargo-cache
+ with:
+ path: |
+ usr-local-cargo-registry
+ usr-local-cargo-git
+ key: cargo-cache-${{ steps.cal-dep-shasum.outputs.checksum }}
+
+ - name: Inject cache into docker
+ uses: reproducible-containers/buildkit-cache-dance@v3.4.0
+ with:
+ cache-map: |
+ {
+ "var-cache-apt": "/var/cache/apt",
+ "var-lib-apt": "/var/lib/apt",
+ "usr-local-cargo-registry": "/usr/local/cargo/registry",
+ "usr-local-cargo-git": "/usr/local/cargo/git"
+ }
+ skip-extraction: ${{ steps.cargo-cache.outputs.cache-hit }} && ${{ steps.apt-cache.outputs.cache-hit }}
+
+ - name: Extract Metadata for Docker
+ uses: docker/metadata-action@v6
+ id: meta
+ with:
+ images: |
+ index.docker.io/${{github.repository}}
+ ghcr.io/${{github.repository}}
+ flavor: |
+ suffix=${{matrix.suffix}},onlatest=true
+ tags: |
+ type=ref,event=tag
+ type=ref,event=branch,prefix=branch-
+ type=edge,branch=main
+ type=semver,pattern=v{{major}}.{{minor}}
+
+ - name: Build Artifact
+ id: bake
+ uses: docker/bake-action@v7
+ env:
+ DOCKER_BUILD_RECORD_UPLOAD: false
+ TARGET: ${{matrix.target}}
+ GHCR_REPO: ghcr.io/${{github.repository}}
+ BUILD_ENV: ${{matrix.build_env}}
+ DOCKER_PLATFORM: ${{matrix.platform}}
+ SUFFIX: ${{matrix.suffix}}
+ with:
+ source: .
+ set: |
+ *.tags=
+ image.output=type=image,"name=ghcr.io/${{github.repository}},index.docker.io/${{github.repository}}",push-by-digest=true,name-canonical=true,push=true,compression=zstd,compression-level=9,force-compression=true,oci-mediatypes=true
+ files: |
+ docker-bake.hcl
+ ${{ steps.meta.outputs.bake-file }}
+ targets: ${{(github.event_name == 'push' || inputs.Docker) && 'build,image' || 'build'}}
+
+ - name: Upload Artifacts
+ uses: actions/upload-artifact@v7.0.1
+ with:
+ name: artifact-${{matrix.target}}
+ path: |
+ artifact
+ !artifact/*.json
+
+ - name: Export digest & Rename meta bake definition file
+ if: github.event_name == 'push' || inputs.Docker
+ run: |
+ mv "${{ steps.meta.outputs.bake-file }}" "${{ runner.temp }}/bake-meta.json"
+ mkdir -p ${{ runner.temp }}/digests
+ digest="${{ fromJSON(steps.bake.outputs.metadata).image['containerimage.digest'] }}"
+ touch "${{ runner.temp }}/digests/${digest#sha256:}"
+
+ - name: Upload digest
+ if: github.event_name == 'push' || inputs.Docker
+ uses: actions/upload-artifact@v7.0.1
+ with:
+ name: digests-${{matrix.suffix == '' && 'gnu' || 'musl'}}-${{ matrix.target }}
+ path: ${{ runner.temp }}/digests/*
+ if-no-files-found: error
+ retention-days: 1
+
+ - name: Upload GNU meta bake definition
+ uses: actions/upload-artifact@v7.0.1
+ if: (github.event_name == 'push' || inputs.Docker) && endsWith(matrix.target,'gnu') && startsWith(matrix.target,'x86')
+ with:
+ name: bake-meta-gnu
+ path: ${{ runner.temp }}/bake-meta.json
+ if-no-files-found: error
+ retention-days: 1
+
+ - name: Upload musl meta bake definition
+ uses: actions/upload-artifact@v7.0.1
+ if: (github.event_name == 'push' || inputs.Docker) && endsWith(matrix.target,'musl') && startsWith(matrix.target,'x86')
+ with:
+ name: bake-meta-musl
+ path: ${{ runner.temp }}/bake-meta.json
+ if-no-files-found: error
+ retention-days: 1
+
+ windows:
+ name: Build / ${{matrix.target}}
+ runs-on: windows-latest
+ strategy:
+ fail-fast: false
+ matrix:
+ include:
+ # - target: aarch64-pc-windows-msvc
+ - target: x86_64-pc-windows-msvc
+
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v7
+
+ - name: Run sccache-cache
+ uses: mozilla-actions/sccache-action@v0.0.11
+ with:
+ disable_annotations: true
+
+ - name: Build
+ run: |
+ rustup target add ${{matrix.target}}
+ cargo build --release --target ${{matrix.target}} -p stalwart --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise"
+ mkdir -p artifacts
+ mv ./target/${{matrix.target}}/release/stalwart.exe ./artifacts/stalwart.exe
+
+ - name: Upload Artifacts
+ uses: actions/upload-artifact@v7.0.1
+ with:
+ name: artifact-${{matrix.target}}
+ path: artifacts
+
+ macos:
+ name: Build / ${{matrix.target}}
+ runs-on: macos-latest
+ strategy:
+ fail-fast: false
+ matrix:
+ include:
+ - target: aarch64-apple-darwin
+ - target: x86_64-apple-darwin
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v7
+
+ - name: Run sccache-cache
+ uses: mozilla-actions/sccache-action@v0.0.11
+ with:
+ disable_annotations: true
+
+ #- name: Build FoundationDB Edition
+ # env:
+ # GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ # run: |
+ # rustup target add ${{matrix.target}}
+ # # Pin FoundationDB 7.4.x (Apple publishes these as prereleases)
+ # curl --retry 5 -Lso foundationdb.pkg "$(gh api -X GET /repos/apple/foundationdb/releases --jq '[.[] | select(.tag_name | startswith("7.4."))] | sort_by(.tag_name | split(".") | map(tonumber)) | reverse | .[0].assets[] | select(.name | test("${{startsWith(matrix.target, 'x86') && 'x86_64' || 'arm64'}}" + ".pkg$")) | .browser_download_url')"
+ # echo "=== Package contents ==="
+ # pkgutil --payload-files foundationdb.pkg || true
+ # sudo installer -allowUntrusted -verbose -dumplog -pkg foundationdb.pkg -target /
+ # cargo build --release --target ${{matrix.target}} -p stalwart --no-default-features --features "foundationdb s3 redis nats enterprise"
+ # mkdir -p artifacts
+ # mv ./target/${{matrix.target}}/release/stalwart ./artifacts/stalwart-foundationdb
+
+ - name: Build
+ run: |
+ rustup target add ${{matrix.target}}
+ cargo build --release --target ${{matrix.target}} -p stalwart --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise"
+ mkdir -p artifacts
+ mv ./target/${{matrix.target}}/release/stalwart ./artifacts/stalwart
+
+ - name: Upload Artifacts
+ uses: actions/upload-artifact@v7.0.1
+ with:
+ name: artifact-${{matrix.target}}
+ path: artifacts
+
+ freebsd:
+ name: Build / ${{matrix.target}}
+ runs-on: ubuntu-latest
+ timeout-minutes: 360
+ strategy:
+ fail-fast: false
+ matrix:
+ include:
+ - target: x86_64-unknown-freebsd
+ arch: x86_64
+ # - target: aarch64-unknown-freebsd
+ # arch: aarch64
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v7
+
+ - name: Build in FreeBSD VM
+ uses: vmactions/freebsd-vm@v1
+ with:
+ release: "15.1"
+ arch: ${{matrix.arch}}
+ usesh: true
+ mem: 14336
+ cpu: 4
+ sync: rsync
+ copyback: true
+ # gmake: required by jemalloc-sys on BSD hosts
+ # llvm: provides libclang for bindgen (librocksdb-sys)
+ # rust: libsqlite3-sys 0.38 uses cfg_select!, stabilized in Rust
+ # 1.95. The default 'quarterly' pkg repo still ships rust 1.94, so
+ # switch to the 'latest' repo (currently 1.96.1). rustup is not an
+ # option here: aarch64-unknown-freebsd has no rustup toolchains yet.
+ prepare: |
+ set -e
+ mkdir -p /usr/local/etc/pkg/repos
+ echo 'FreeBSD: { url: "pkg+https://pkg.freebsd.org/${ABI}/latest", mirror_type: "srv" }' > /usr/local/etc/pkg/repos/FreeBSD.conf
+ pkg update -f
+ env ASSUME_ALWAYS_YES=yes pkg bootstrap -f
+ pkg update -f
+ pkg install -y rust gmake llvm rocksdb
+ rustc --version
+ run: |
+ set -e
+ export CARGO_TARGET_DIR=/tmp/target
+ export CARGO_TERM_COLOR=always
+ export CARGO_NET_RETRY=10
+ cargo build --release -p stalwart --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise"
+ mkdir -p artifacts
+ cp /tmp/target/release/stalwart artifacts/stalwart
+
+ - name: Upload Artifacts
+ uses: actions/upload-artifact@v7.0.1
+ with:
+ name: artifact-${{matrix.target}}
+ path: artifacts
+
+ release:
+ name: Release
+ permissions:
+ id-token: write
+ contents: write
+ attestations: write
+ if: github.event_name == 'push' || inputs.Release
+ needs: [linux, windows, macos, freebsd]
+ runs-on: ubuntu-latest
+ steps:
+ # Must run before artifacts are downloaded — checkout cleans the workspace.
+ - name: Checkout (for CHANGELOG)
+ if: startsWith(github.ref, 'refs/tags/')
+ uses: actions/checkout@v7
+
+ - name: Download Artifacts
+ uses: actions/download-artifact@v8
+ with:
+ path: archive
+ pattern: artifact-*
+
+ - name: Compress
+ run: |
+ set -eux
+ BASE_DIR="$(pwd)/archive"
+ compress_files() {
+ local dir="$1"
+ local archive_dir_name="${dir#artifact-}"
+ cd "$dir"
+ # Process each file in the directory
+ for file in `ls`; do
+ filename="${file%.*}"
+ extension="${file##*.}"
+ if [ "$extension" = "exe" ]; then
+ 7z a -tzip "${filename}-${archive_dir_name}.zip" "$file" > /dev/null
+ else
+ tar -czf "${filename}-${archive_dir_name}.tar.gz" "$file"
+ fi
+ done
+ cd $BASE_DIR
+ }
+ cd $BASE_DIR
+ for arch_dir in `ls`; do
+ dir_name=$(basename "$arch_dir")
+ compress_files "$dir_name"
+ done
+
+ - name: Attest binary
+ id: attest
+ uses: actions/attest-build-provenance@v4
+ with:
+ subject-path: |
+ archive/**/*.tar.gz
+ archive/**/*.zip
+
+ - name: Use cosign to sign existing artifacts
+ uses: sigstore/gh-action-sigstore-python@v3.5.0
+ with:
+ inputs: |
+ archive/**/*.tar.gz
+ archive/**/*.zip
+
+ - name: Build release body
+ run: |
+ if [ "${{ startsWith(github.ref, 'refs/tags/') }}" = "true" ]; then
+ awk '/^## \[/{c++} c==1' CHANGELOG.md > release_body.md
+ echo "" >> release_body.md
+ else
+ : > release_body.md
+ fi
+ cat >> release_body.md <
+
+ ### Check binary attestation [here](${{ steps.attest.outputs.attestation-url }})
+ EOF
+
+ - name: Release
+ uses: softprops/action-gh-release@v3
+ with:
+ files: |
+ archive/**/*.tar.gz
+ archive/**/*.zip
+ archive/**/*.sigstore.json
+ prerelease: ${{!startsWith(github.ref, 'refs/tags/') || null}}
+ tag_name: ${{!startsWith(github.ref, 'refs/tags/') && 'nightly' || null}}
+ # Tag-push releases are created as drafts; the `publish` job un-drafts
+ # them only after all build jobs succeed, so watcher notifications
+ # don't fire on broken builds.
+ draft: ${{ startsWith(github.ref, 'refs/tags/') || null }}
+ body_path: release_body.md
+
+ publish:
+ name: Publish release
+ needs: [linux, windows, macos, freebsd, multiarch, release]
+ if: startsWith(github.ref, 'refs/tags/')
+ runs-on: ubuntu-latest
+ permissions:
+ contents: write
+ steps:
+ - name: Un-draft release
+ env:
+ GH_TOKEN: ${{ github.token }}
+ run: gh release edit "${{ github.ref_name }}" --draft=false --latest --repo "${{ github.repository }}"
+
+ cleanup:
+ name: Cleanup failed release
+ needs: [linux, windows, macos, freebsd, multiarch, release]
+ if: failure() && startsWith(github.ref, 'refs/tags/') && github.run_attempt >= 3
+ runs-on: ubuntu-latest
+ permissions:
+ contents: write
+ steps:
+ - name: Delete draft release and tag
+ env:
+ GH_TOKEN: ${{ github.token }}
+ run: gh release delete "${{ github.ref_name }}" --yes --cleanup-tag --repo "${{ github.repository }}" || true
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
new file mode 100644
index 0000000..97c4d70
--- /dev/null
+++ b/.github/workflows/scorecard.yml
@@ -0,0 +1,78 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+ # For Branch-Protection check. Only the default branch is supported. See
+ # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+ branch_protection_rule:
+ # To guarantee Maintained check is occasionally updated. See
+ # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+ schedule:
+ - cron: '31 6 * * 0'
+ push:
+ branches: [ "main" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+ analysis:
+ name: Scorecard analysis
+ runs-on: ubuntu-latest
+ # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
+ if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
+ permissions:
+ # Needed to upload the results to code-scanning dashboard.
+ security-events: write
+ # Needed to publish results and get a badge (see publish_results below).
+ id-token: write
+ # Uncomment the permissions below if installing in a private repository.
+ # contents: read
+ # actions: read
+
+ steps:
+ - name: "Checkout code"
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4.2.2
+ with:
+ persist-credentials: false
+
+ - name: "Run analysis"
+ uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+ with:
+ results_file: results.sarif
+ results_format: sarif
+ # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+ # - you want to enable the Branch-Protection check on a *public* repository, or
+ # - you are installing Scorecard on a *private* repository
+ # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+ # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+ # Public repositories:
+ # - Publish results to OpenSSF REST API for easy access by consumers
+ # - Allows the repository to include the Scorecard badge.
+ # - See https://github.com/ossf/scorecard-action#publishing-results.
+ # For private repositories:
+ # - `publish_results` will always be set to `false`, regardless
+ # of the value entered here.
+ publish_results: true
+
+ # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
+ # file_mode: git
+
+ # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+ # format to the repository Actions tab.
+ - name: "Upload artifact"
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ with:
+ name: SARIF file
+ path: results.sarif
+ retention-days: 5
+
+ # Upload the results to GitHub's code scanning dashboard (optional).
+ # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+ - name: "Upload to code-scanning"
+ uses: github/codeql-action/upload-sarif@v4.37.4
+ with:
+ sarif_file: results.sarif
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..daadca3
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,57 @@
+name: Test
+
+on:
+ workflow_dispatch:
+
+jobs:
+ style:
+ name: Check Style
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v7
+
+ - name: Check Style
+ run: cargo fmt --all --check
+
+ test:
+ name: Test
+ needs: style
+ runs-on: ubuntu-latest
+
+ env:
+ STORE: RocksDb
+ RUST_MIN_STACK: "16777216"
+
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v7
+
+ # External services (OpenLDAP, Keycloak, PostgreSQL, MySQL, Redis, NATS,
+ # MinIO, OpenSearch, Meilisearch) are provisioned on demand by the test
+ # suite via testcontainers using the Docker daemon available on the
+ # runner; see tests/src/utils/containers.rs.
+
+ - name: Rust Cache
+ uses: Swatinem/rust-cache@v2
+
+ - name: JMAP Protocol Tests
+ run: cargo test -p jmap_proto -- --nocapture
+
+ - name: IMAP Protocol Tests
+ run: cargo test -p imap_proto -- --nocapture
+
+ - name: Full-text search Tests
+ run: cargo test -p store -- --nocapture
+
+ - name: Directory Tests
+ run: cargo test -p tests directory -- --nocapture
+
+ - name: SMTP Tests
+ run: cargo test -p tests smtp -- --nocapture
+
+ - name: IMAP Tests
+ run: cargo test -p tests imap -- --nocapture
+
+ - name: JMAP Tests
+ run: cargo test -p tests jmap -- --nocapture
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
new file mode 100644
index 0000000..9fb5148
--- /dev/null
+++ b/.github/workflows/trivy.yml
@@ -0,0 +1,41 @@
+# trivy ci workflow
+name: trivy
+
+on:
+ workflow_dispatch:
+ push:
+ branches: [ "main" ]
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: [ "main" ]
+ schedule:
+ - cron: '00 12 * * *'
+
+permissions:
+ contents: read
+
+jobs:
+ build:
+ permissions:
+ contents: read # for actions/checkout to fetch code
+ security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+ actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+ name: Check
+ runs-on: ubuntu-latest
+ steps:
+ - name: Checkout code
+ uses: actions/checkout@v7
+
+ - name: Run Trivy vulnerability scanner
+ uses: aquasecurity/trivy-action@master
+ with:
+ scan-type: 'fs'
+ ignore-unfixed: true
+ format: 'sarif'
+ output: 'trivy-results.sarif'
+ severity: 'CRITICAL,HIGH'
+
+ - name: Upload Trivy scan results to GitHub Security tab
+ uses: github/codeql-action/upload-sarif@v4.37.4
+ with:
+ sarif_file: 'trivy-results.sarif'
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..d6d2a48
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,9 @@
+/target
+*.failed
+*_failed
+run.sh
+.*
+!.gitignore
+!.gitattributes
+!.github
+CLAUDE.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..6cf7732
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,1968 @@
+# Change Log
+
+All notable changes to this project will be documented in this file. This project adheres to [Semantic Versioning](http://semver.org/).
+
+## [0.16.22] - 2026-09-13
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+
+## Changed
+
+## Fixed
+- WebDAV: `PROPFIND` responses do not declare the namespace of every requested property on the `DAV:multistatus` element.
+- MTA:
+ - SMTP session state obtained before `STARTTLS` is discarded once the TLS handshake completes, as required by RFC 3207.
+ - Inbound throttle, outbound throttle and queue quota `match` expressions evaluate their `if`/`then` conditions.
+ - DMARC: Messages without an aligned SPF or DKIM pass from a domain that publishes a DMARC policy are reported as `fail` instead of `none` in logs.
+ - DMARC: A temporary DNS error on an SPF or DKIM check whose identifier aligns with the author domain produces `temperror` instead of `fail`.
+ - DMARC: A policy record without a `p` tag is only applied, as `p=none`, when it contains a `rua` tag, even if it declares `sp` or `np`.
+- iMIP: Notification subjects and bodies omit the event start date, time and timezone for recurring events.
+- OIDC: Discovery is retried for 30 seconds before the directory is marked as unavailable, so a provider that is still starting up no longer requires a restart.
+- WebUI: The cached bundle of an `Application` is discarded when its `resourceUrl` changes or the record is deleted, so the next unpack fetches the new resource.
+- DNS: Append `.` to MX record hostnames.
+- Recovery mode: Automatic IP banning is disabled during recovery and initial setup.
+- FoundationDB: The cached read version is invalidated when a queue refresh or registry change broadcast is received.
+- Sieve: Messages filed with `fileinto` by a user script are treated as ham and are no longer moved to Junk when classified as spam.
+- IMAP:
+ - `SELECT`, `EXAMINE` and `STATUS` on a shared mailbox require the `r` (read) right.
+ - `AUTHENTICATE` is refused on clear-text connections unless `allowPlainTextAuth` is enabled, and the greeting and `CAPABILITY` response advertise `LOGINDISABLED` instead of the `AUTH=` mechanisms in that case.
+- IMAP, POP3, ManageSieve: Partial commands received before `STARTTLS` or `STLS` are discarded once the TLS handshake completes.
+- Network: Inbound TLS handshakes, both implicit and `STARTTLS`, are aborted after the listener's `tlsTimeout`, releasing the connection slot.
+- OAuth: A random key is used when the OIDC provider's `encryptionKey` or HMAC `signatureKey` cannot be read, instead of an empty key.
+- LDAP: The `{local}` and `{domain}` filter placeholders are escaped.
+- JMAP:
+ - `CalendarEvent/set` stores `useDefaultAlerts` per user, and `CalendarEvent/get` returns `false` when it was never set.
+ - `CalendarEvent/get` returns `null` for `baseEventId` unless the id is a synthetic recurrence instance.
+ - `CalendarEvent/get` returns `null` for requested `recurrenceRule` and `recurrenceOverrides` properties on synthetic recurrence instances.
+ - `CalendarEvent/get` and `ContactCard/get` return only `id` when the `properties` argument is an empty list, instead of every property.
+
+## [0.16.21] - 2026-09-06
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+
+## Changed
+- Sieve: Messages generated by user scripts are DKIM signed through the new `SieveUserInterpreter.dkimSignDomain` setting, which defaults to the account's own domain.
+
+## Fixed
+- JMAP:
+ - `CalendarEvent/set` requests that ask for scheduling messages are rejected with a `forbidden` error when the account cannot send them.
+ - `Calendar/get` and `AddressBook/get` return every property when the `properties` argument is omitted or `null`.
+ - EventSource `ping` events advertise the interval in seconds rather than milliseconds.
+ - Calendar synthetic ids returned when expanding recurrences identify an occurrence by its recurrence id.
+- IMAP: Every command in a pipelined `STATUS` or `FETCH` batch receives its tagged completion, instead of the first failing command dropping the responses for all commands queued behind it.
+- WebDAV: Accounts without a storage quota no longer advertise a 4 GiB limit in `DAV:quota-available-bytes`.
+- MTA: Inbound DMARC and TLS aggregate reports that a reporter sends more than once are imported again as a duplicate entry.
+- Spam filter: Domain and URL blocklists are queried only for text written as a link.
+- iTIP: Detaching an occurrence that the recurrence rule already generates is sent as a `METHOD:REQUEST` carrying the `RECURRENCE-ID` instead of a `METHOD:ADD`.
+- Sieve: `fileinto :specialuse` and `specialuse_exists` accept special-use attributes in the `\Trash` form.
+- LDAP: Active Directory servers that answer an unauthenticated bind (a non-empty DN with a zero-length password) with success no longer authenticate accounts without a password.
+- Network: Listeners bound to the unspecified IPv6 address (`[::]`) fall back to IPv4 when socket creation fails with `EPROTONOSUPPORT`.
+- OpenTelemetry: log exporter does not include the parent span's attributes.
+
+## [0.16.20] - 2026-08-30
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+- System for Cross-domain Identity Management (SCIM) v2 (*Enterprise*):
+ - Core Schema ([RFC 7643](https://www.rfc-editor.org/rfc/rfc7643.html))
+ - Protocol ([RFC 7644](https://www.rfc-editor.org/rfc/rfc7644.html))
+ - Cursor-Based Pagination ([RFC 9865](https://www.rfc-editor.org/rfc/rfc9865.html))
+ - Interoperability Profile ([draft-zollner-scim-interop-profile](https://datatracker.ietf.org/doc/draft-zollner-scim-interop-profile/))
+ - IPSIE lifecycle profile ([draft-schreiber-scim-ipsie-profile](https://datatracker.ietf.org/doc/draft-schreiber-scim-ipsie-profile/))
+- JMAP: `CalendarEvent/set` support for updating and deleting synthetic ids (#2925).
+- Calendar:
+ - Conference links in calendar invites and email alarms.
+ - Translations for Arabic, Brazilian Portuguese, Bulgarian, Chinese Simplified, Chinese Traditional, Croatian, Czech, Finnish, Hebrew, Hindi, Hungarian, Indonesian, Japanese, Korean, Lithuanian, Norwegian Bokmål, Persian, Romanian, Russian, Slovak, Slovenian, Thai, Turkish, Ukrainian and Vietnamese.
+
+## Changed
+- Calendar: Updated HTTP RSVP page.
+
+## Fixed
+- DANE:
+ - `TLSA` records are looked up whenever the MX RRset is signed, even when the MX host's own zone is not.
+ - Mandatory DANE failures are permanent rather than temporary, bouncing messages that should be delayed.
+ - Valid but unusable `TLSA` records fall back to the configured TLS strategy, permitting cleartext delivery where TLS is required.
+- S3: Fix outdated upstream `af-south-1` region configuration.
+- Setup wizard: SQL directories set to use the main data store are now validated against the data store being configured.
+- CardDAV: Delete default address book id when deleting the default address book.
+- Redis: Sentinel deployments configured with `rediss://` URLs now connect to the master over TLS instead of silently falling back to cleartext.
+- Email: Generated `Message-ID` headers use the hostname of the node that built the message instead of the configured server hostname.
+- MTA:
+ - Do not send DMARC reports to local domains.
+ - Messages addressed to an `inboundReportAddresses` match are only discarded when they actually contain a report (#1088).
+- Directory: Impersonation using the recovery admin fails when the impersonated account has not logged in before (LDAP and SQL directories).
+- WebUI: Failed logins open the browser's native credential prompt.
+- Cluster: Expired node id leases are released periodically rather than only during startup, so entries for removed nodes no longer remain `Stale` or `Inactive` indefinitely.
+
+## [0.16.19] - 2026-08-24
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+- WebUI: `oauthClientId` setting in `Application`, which allows the WebUI to use a different OAuth client than the default.
+- Sieve: `env.spam.score` and `env.spam.is_spam` variables, which expose the spam filter result to system scripts running at the `DATA` stage.
+- CalDAV: `vCardVersion` setting in `AddressBook`, which allows the default vCard version to be specified when the client does not request a specific version.
+
+## Changed
+- MySQL & MariaDB: Key columns are now `VARBINARY(255)` with a full-length primary key instead of `TINYBLOB`. Note: Existing deployments should run, once per table, for each of the tables `a`, `d`, `e`, `f`, `g`, `h`, `j`, `k`, `l`, `m`, `n`, `o`, `p`, `q`, `r`, `s`, `t`, `u`, `w`, `x` and `y` the command `ALTER TABLE a MODIFY k VARBINARY(255) NOT NULL;`.
+
+## Fixed
+- ACME:
+ - Order and authorization failures are never logged, so an order rejected by the CA.
+ - An order rejected by the CA marks the renewal task as permanently failed.
+- CalDAV:
+ - Attendee addresses whose `mailto:` URI percent-encodes a full `name-addr` are silently dropped from the scheduling snapshot.
+ - Attendees whose calendar user address cannot be parsed should be flagged with `SCHEDULE-STATUS=3.7`.
+ - The RSVP link in an iMIP invitation stamps `PARTSTAT` on the organizer's copy of the event only, leaving a local attendee's own copy at `NEEDS-ACTION` and sending the organizer no reply.
+ - `MKCALENDAR`, `MKCOL` and `PROPPATCH` store the display name, description, time zone and the other per-user properties under the authenticated account rather than the account that owns the collection.
+- Directory:
+ - An empty column, attribute or claim returned by an external directory is synchronized as an empty string rather than a missing value.
+ - `/api/discover` splits the account name on `@` without accounting for the `%` master user separator or the recovery administrator.
+- FoundationDB: Older chunked entries are not deleted.
+- IMAP: `SETACL` and `DELETEACL` fail to resolve an identifier spelled with uppercase characters.
+- iMIP: Invitations, replies and cancellations reference a `TZID` parameter with no matching `VTIMEZONE` component whenever the event was stored without one.
+- JMAP:
+ - `AddressBook/get`: A new account's default address book is never recorded.
+ - `Email/get` and `Email/parse` with `fetchAllBodyValues` return body values only for the parts listed in `textBody` or `htmlBody`, omitting every other `text/*` part in `bodyStructure`.
+ - `Email/set` writes display names as an RFC 2047 encoded-word wrapped in a quoted-string, which RFC 2047 forbids.
+ - `Mailbox/set`, `AddressBook/set` and `Calendar/set` store `isSubscribed` and the other per-user properties under the authenticated account rather than the account named in the request.
+ - `Principal/query` returns no results when the `name` or `email` filter is spelled with uppercase characters.
+ - `FileNode/set`: File nodes created over JMAP are returned with a `` holding the raw name over WebDAV.
+- Meilisearch:
+ - Queries return at most 1000 results, as the `maxTotalHits` pagination setting is left at the Meilisearch default.
+ - Searches combining several terms return documents that match only some of them.
+ - A task confirmation timeout is reported as a success when `failOnTimeout` is disabled.
+- Import: `--import` always aborts with the target database already containing data in the key range being imported.
+- MTA:
+ - A domain `catchAllAddress` pointing to a mailing list or a sub-addressed mailbox is accepted at `RCPT TO` and then rejected at local delivery with `550 5.5.0 Mailbox not found`.
+ - `is_local_address()` and `is_local_domain()` expression functions do not match an address or domain spelled with uppercase characters.
+ - Relay routes are rejected with `host resolves loopback address`, which prevents relaying through a local proxy or tunnel.
+- MySQL, MariaDB & PostgreSQL: Range scans, range deletions and store purges run as a single unbounded statement, so on servers that enforce a statement timeout they abort on large accounts and tasks such as account deletion can never complete.
+- Network: `local_port` and `local_ip` report the address Stalwart is bound to rather than the address the client connected to when the connection arrives through a trusted proxy.
+- Task manager:
+ - `totalDeadline` is not enforced on tasks that fail with a specific retry time.
+ - Indexing tasks are dropped after `maxAttempts` failures, so a search store that is unavailable or overloaded leaves messages permanently missing from the index.
+ - Indexing tasks are dropped when the document metadata read returns no data, which can happen on SQL read replicas that have not yet caught up with the primary.
+ - The DNS management task republishes the DKIM records of retired keys that the DKIM rotation task had already removed from the zone.
+- Sieve: `spamtest` returns only `1` or `10` (and `spamtest :percent` only `0` or `100`), so scripts cannot act on intermediate spam scores.
+- Spam filter: `MIME_BAD` is tagged whenever the declared `Content-Type` of an attachment is not byte identical to the type detected from its magic bytes.
+
+## [0.16.18] - 2026-08-17
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+- Reporting: `inboundReportMaxSize` setting, which bounds the size of a decompressed inbound DMARC or TLS report (default 25MB).
+- RocksDB: `cacheSize` setting, which bounds the total memory shared by the block caches of every column family (default 128MB).
+
+## Changed
+- ASN & GeoIP: Default data source URLs now point at the ip-location-db GitHub releases, as the previously used npm packages are no longer updated. Existing installations keep their configured URLs and should update them following the [ASN and GeoIP documentation](https://stalw.art/docs/server/asn).
+- JMAP: `Identity/get` keeps identities in sync with the account's e-mail addresses.
+- MTA: Queue scheduler no longer rescans the queue from the earliest pending event and coalesces bursts of delivery completions into a single scan.
+- RocksDB:
+ - Column families are tuned for the access pattern of the data they hold.
+ - Range iteration uses bounded iterators and no longer reads values when only keys were requested.
+
+## Fixed
+- JMAP:
+ - Setting `uploadTtl` to 1ms triggers panic.
+ - `CalendarEvent/set` does not assign `organizerCalendarAddress` nor send scheduling messages when an event is created with participants.
+ - `CalendarEvent/get` omits `isOrigin` when it is listed explicitly in `properties`.
+ - `CalendarEventNotification/changes` and `FileNode/changes` reject with `cannotCalculateChanges` the state that `/get` returned for an account with no change history.
+ - `CalendarEvent/set` and `ContactCard/set` do not write a vanished tombstone for the previous CalDAV/CardDAV href when `calendarIds` or `addressBookIds` moves an item between collections.
+- CalDAV: Attendee addresses that percent-encode a display name into the `mailto:` URI are queued verbatim.
+- Calendar: Recurring events disappear from CalDAV time-range `REPORT`s and JMAP `CalendarEvent/query` results a few years after their first occurrence.
+- WebDAV:
+ - When a file node references a parent folder that no longer exists, any request on a file collection panics.
+ - `MOVE` on a folder honors a `Depth` header of `0` or `1` instead of always moving the whole subtree.
+- MTA:
+ - DSN bounces are emitted with a malformed `Message-ID` wrapped in doubled angle brackets.
+ - Delivery to any MX host whose name is an IDN A-label fails permanently.
+ - Queue strategy and quota expressions that branch on `source` never match at enqueue.
+ - MTA-STS:
+ - Policies in `testing` mode are enforced, turning any TLS error into a permanent failure.
+ - `mx` patterns published as U-labels never authorize the MX host they name.
+ - DMARC:
+ - Alignment compares identifiers in their A-label form.
+ - External reporting addresses published as U-labels are rejected as unauthorized.
+- Spam filter:
+ - Some rules misfire on internationalized addresses when the envelope and the headers spell the same domain in different label forms.
+ - Punycode labels that do not re-encode to the label they came from are no longer decoded.
+- WebPush: Validate push URL and use `application/octet-stream` as `Content-Type` for encrypted payloads.
+- Directory:
+ - Local group membership is cleared when the external directory is configured with a group claim or attribute that it does not return.
+ - LDAP: Directories that store aliases as additional values of the primary address attribute provision no aliases.
+ - Mail addressed to a domain alias is rejected with `550 Relay not allowed`, unless the domain's primary name happened to be resolved earlier and is still cached.
+- RocksDB: `bufferSize` setting was applied to the unused default column family and had no effect.
+- Sieve: `include` statements fail to find system and user global scripts whose name contains uppercase characters.
+- Task manager: `totalDeadline` is measured from the time a task was created instead of its first failed attempt.
+
+## [0.16.17] - 2026-08-10
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+- IMAP:
+ - `UIDBATCHES` extension ([RFC 10022](https://www.rfc-editor.org/rfc/rfc10022.html)).
+ - `UIDONLY` extension ([RFC 9586](https://www.rfc-editor.org/rfc/rfc9586.html)).
+ - `MESSAGELIMIT` and `SAVELIMIT` extensions ([RFC 9738](https://www.rfc-editor.org/rfc/rfc9738.html)).
+- WebDAV: `Range` and `If-Range` header support on file downloads ([RFC 7233](https://www.rfc-editor.org/rfc/rfc7233.html)) (#2377).
+- Spam filter: `url_original` expression variable for `Url` rules.
+
+## Changed
+- Memory allocator: Replaced the unmaintained `jemallocator` crate with `tikv-jemallocator` (contributed by @checkraisefold).
+- ACME registry: Use `description` as label property.
+
+## Fixed
+- MTA:
+ - Certificates for domains publishing an enforcing MTA-STS policy are always validated, even in the fallback TLS strategy.
+ - DSN delivery date uses wrong timestamp.
+ - `FUTURERELEASE HOLDUNTIL` uses Unix timestamps instead of RFC 3339 date-times.
+- JMAP:
+ - `EmailSubmission/query` filtering on `undoStatus` contradicts `EmailSubmission/get`, reporting held `FUTURERELEASE` submissions as `final` instead of `pending`.
+ - `EmailSubmission/get` requests without an `ids` argument iterates the wrong index.
+- CardDAV: `Accept: text/vcard` version negotiation is ignored whenever another parameter such as `q` or `charset` follows `version=`.
+- Calendar: Server-side scheduling messages place the `text/calendar` part outside the `multipart/alternative` and disposed as an attachment.
+- Sharing: Accounts holding the `impersonate` permission never have their ACL grants collected, so shared items are never listed in JMAP sessions, CalDAV/CardDAV discovery or IMAP.
+- IMAP:
+ - `COPY`/`MOVE` into a shared folder fails with `NO [ALREADYEXISTS]` when the destination account already holds the message, leaving the message in the source mailbox and clients in a retry loop.
+ - `BODYSTRUCTURE` and `ENVELOPE` return MIME parameters, `Content-Description`, subjects and display names as raw UTF-8 even to sessions that never enabled `UTF8=ACCEPT`.
+
+## [0.16.16] - 2026-08-02
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+- JMAP Email Delivery Push Notifications ([draft-ietf-jmap-emailpush-03](https://datatracker.ietf.org/doc/draft-ietf-jmap-emailpush/))
+- MTA: Allow System Sieve scripts to access `orcpt` during the `DATA` stage.
+
+## Changed
+- S3: `accessKey` can now be read from an environment variable or file.
+
+## Fixed
+- Meilisearch: Verify index existence using `GET` instead of creating a new task which times out on busy servers.
+- Branding: Stalwart logo flashes before the per-tenant logo is loaded on the login page.
+- Calendar: iMIP and alarm notification messages embed the default logo using bare `LF` line endings, producing a single 4247 octet line that strict SMTP relays reject with `line too long`.
+- DMARC: Failure reports state `Identity-Alignment: none` when a mechanism authenticated successfully but against an identity that is not aligned with the `From` domain.
+- Redis: Task and queue locks are never released after a worker dies, because failed lock attempts refresh the lock expiry.
+- Recovery mode: Download WebUI if missing.
+- Logging: The systemd journal tracer omits the parent span's fields.
+- MTA:
+ - `BDAT` chunks sent without a valid `MAIL FROM` are answered with `552 5.3.4 Message too big for system` instead of `503 5.5.1`.
+ - A `maxMessageSize` of `0` rejects every message with `552 5.3.4 Message too big for system` instead of disabling the size limit.
+- Windows: Listeners bound to the unspecified IPv6 address (`[::]`), including all defaults, refuse IPv4 connections such as `127.0.0.1`, since `IPV6_V6ONLY` is enabled by default on Windows.
+
+## [0.16.15] - 2026-07-26
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+
+## Changed
+
+## Fixed
+- JMAP:
+ - `Email/copy` should return `alreadyExists` when copying a message to a mailbox that already contains it.
+ - `Email/copy` with `onSuccessDestroyOriginal` destroys the copy's creation id instead of the source Email id.
+ - `CalendarEvent/set` does not generate a `uid` on create when the client omits it.
+ - `CalendarEvent/set` does not refresh the `updated` property (iCalendar `DTSTAMP`) on create or update.
+ - `EmailSubmission/set` rejects valid recipients whose domain is itself a public suffix (e.g. `gov.in`, `co.uk`).
+ - Requests are rejected with `notRequest` when a method name contains a JSON-escaped solidus (e.g. `Core\/echo`).
+- MTA: Panic when MTA-STS is disabled and a remote MTA fetched `/.well-known/mta-sts.txt`.
+- Auth: Scoped credentials with `SysApiKeyCreate` or `SysApiKeyUpdate` permissions can regain its own account's full rights.
+- Web Push: Valid VAPID keys are rejected when PEM-encoded with explicit EC parameters, in SEC1 (`EC PRIVATE KEY`) format, or with a leading byte-order mark.
+- Encryption at rest: Appended messages are encrypted for accounts that did not opt in to `encryptOnAppend`.
+- Cache: Account caches silently discard entries larger than a single `quick-cache` shard, causing constant database rebuilds.
+- Registry: Id references (e.g. `#certificate-...`) fail to resolve on `defaultCertificateId`, `defaultAdminRoleIds`, `listenerIds` and `publicKey`.
+- Search: `reindex` drops calendar and contact index tasks for accounts with fewer than a full batch of items.
+- Migration: Abort `--import` when the target already contains data in the key range being imported.
+- Cluster: Broadcast subscriber re-subscribes after every message, losing bursts of cluster broadcasts during the reconnect window.
+- Enterprise: Per-tenant logo is not shown on the OAuth login password and OTP screens, which are served from the server's canonical host rather than the tenant domain.
+
+## [0.16.14] - 2026-07-20
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+- Use of Voluntary Application Server Identification (VAPID) in JMAP Web Push ([RFC 9749](https://datatracker.ietf.org/doc/html/rfc9749)).
+
+## Changed
+
+## Fixed
+- IMAP:
+ - Mailbox object-quota only enforced in JMAP.
+ - Pipelined `STORE` and `EXPUNGE` can execute out of order.
+- JMAP:
+ - Read-only sharee cannot set `isSubscribed` on a shared mailbox.
+ - Web Push payloads with `Content-Encoding: aes128gcm` should not be base64-encoded but sent as raw bytes.
+ - Stale push subscription can block verification of a new one.
+ - `PushSubscription/set` rejects the unpadded base64url keys the W3C Push API produces.
+ - `Email/import` does not send push notifications for imported messages.
+ - `CalendarEvent/set` silently ignores `ifInState`.
+- CalDAV: `calendar-query` REPORT returns empty calendar-data for JMAP-created events.
+- MTA:
+ - DMARC is skipped when MAIL FROM SPF is unavailable.
+ - `queue_name` variable not available in rate limiter expressions.
+- Calendar:
+ - No expanded occurrences are returned for a daily recurrences crossing DST.
+ - Uppercase `MAILTO` calendar addresses become invalid SMTP recipients.
+ - Scheduling invitations on a shared, non-owned calendar fail with `MAIL FROM unauthorized`.
+- HTTP: Disable `allowedEndpoints` expression in recovery mode.
+- Telemetry: Tasks are serialized to the wrong store when using separate stores for telemetry and data.
+
+## [0.16.13] - 2026-07-12
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+- FreeBSD support.
+
+## Changed
+
+## Fixed
+- OAuth resource indicators: Accept `imap`, `smtp`, `pop3` and `sieve` as valid resource indicators for OAuth access tokens.
+- PostgreSQL: Incomplete channel binding implementation.
+- JMAP:
+ - VacationResponse: `isEnabled` reset to false whenever properties are changed.
+ - Capabilities: Return RFC-3339-conformant UTCDate literals in capabilities: min `0001-01-01T00:00:00Z`, max `9999-12-31T23:59:59Z`.
+- Directory: Update local groups only when the external directory includes a group attribute.
+- DNS Management:
+ - CAA management deletes too third-party CAA entries.
+ - Multiple provider fixes (see `dns-update` crate changelog).
+- Reject invalid duration values (e.g. `1h30m`).
+- Branding: Custom logos for domains do not work.
+- Sieve: add `Received` headers to auto-generated messages and detect loops.
+- MTA: Resume queue processing does not work.
+- Misconfigured in-memory store cannot be recovered in recovery mode.
+
+## [0.16.12] - 2026-07-06
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+- DKIM2 implementation ([draft-ietf-dkim-dkim2-spec-04](https://datatracker.ietf.org/doc/draft-ietf-dkim-dkim2-spec/)).
+- DMARCbis implementation:
+ - Domain-based Message Authentication, Reporting, and Conformance (DMARC) ([RFC 9989](https://datatracker.ietf.org/doc/html/rfc9989))
+ - DMARC Aggregate Reporting ([RFC 9990](https://datatracker.ietf.org/doc/html/rfc9990))
+ - DMARC Failure Reporting ([RFC 9991](https://datatracker.ietf.org/doc/html/rfc9991))
+
+## Changed
+
+## Fixed
+- DANE: Treat DNSSEC `bogus` as a temporary failures to prevent downgrade attacks.
+- OIDC provider:
+ - `ECDSA` private key support for `SEC1` format.
+ - Allow ports in `redirect_uri` for loopback addresses.
+- OIDC directory:
+ - Removing a user from all groups does not sync the changes correctly.
+ - Fetch `name` and `group` claims from userinfo endpoint when missing from the JWT token.
+- PostgreSQL: Include error chain in error messages.
+- Prometheus: event counters are exported with incorrect metric names.
+- Registry: Changing the type of an existing account from `user` to `group` panics.
+- Masked emails: Return `UnknownRecipient` only for disabled or expired masked emails.
+- IDN: `sanitize_email` rejects valid Punycode domains.
+- Auto-ban: IP block expiration ignores per-reason ban durations.
+- Meilisearch: Limit the text search scope using `attributesToSearchOn`.
+- CalDAV: `calendar-query` REPORT returns invalid HTTP `404` when no events match the query.
+- Snowflake past id generation fails when the provided duration is longer than 4 years.
+- Calendar scheduling: Wrong RSVP base URL is used.
+- Network listener: Accept loop spins all CPU cores with no back-off when the process hits `EMFILE` (too many open files).
+- Cluster: Broadcast MTA queue refresh events to all nodes.
+
+## [0.16.11] - 2026-06-25
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+- Encryption-at-rest: Support for `AES-256-GCM` and `ChaCha20-Poly1305` for S/MIME (#161).
+- S3: Support for `allowInvalidCerts` option to allow connecting to S3 endpoints with invalid TLS certificates.
+- Redis Sentinel support as an in-memory store and cluster coordinator backend (#2430).
+
+## Changed
+
+## Fixed
+- DANE: Verify DNSSEC is supported by the resolver before attempting to validate TLSA records.
+- TLS: Update search index when file-backed certificates are refreshed.
+- JMAP: `Principal/query` returns broad results when a `name` or `email` filter cannot be resolved.
+- Webhooks: event IDs collide for same event type emitted in the same second.
+
+## [0.16.10] - 2026-06-21
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+- International Domain Names (IDN) support (#207).
+- OAuth:
+ - OAuth Profile for Open Public Clients ([draft-ietf-mailmaint-oauth-public](https://datatracker.ietf.org/doc/draft-ietf-mailmaint-oauth-public/))
+ - Client secret verification for confidential clients.
+- HTTP: Add `redirectRoot` option to `Http` object to allow redirecting requests to the root path to a different path (e.g. `/account`).
+- ACME: `reuseKey` option to allow reusing private keys in renewals.
+- IMAP:
+ - IMAP Extension for Object Identifiers ([draft-ietf-mailmaint-imap-objectid-bis](https://datatracker.ietf.org/doc/draft-ietf-mailmaint-imap-objectid-bis/))
+ - `GETJMAPACCESS` command to discover the JMAP session resource URL (#2736).
+
+## Changed
+
+## Fixed
+- JMAP conformance (pass the [jmap-test-suite](https://github.com/jmapio/jmap-test-suite) tests):
+ - Methods are only available if their capability is in `using`.
+ - Reject requests that do not specify `application/json` in the `Content-Type` header.
+ - Require `accountId` argument on requests.
+ - Return unparsable ids in `notFound` / `notUpdated` / `notDestroyed` / `notCopied` instead of dropping them.
+ - Default calendars and address books are not subscribed by default.
+ - `*/set`: Unchanged immutable `id` property is rejected on update.
+ - `*/query` and `*/queryChanges`: null` rejected as `notRequest`.
+ - `Email/query`:
+ * Improper `anchor` handling.
+ * Total miscount when `collapseThreads` is enabled.
+ * Wrong sort order on `hasKeyword`, `allInThreadHaveKeyword`, and `someInThreadHaveKeyword` conditions.
+ * Non-standard header values are not searchable.
+ - `Email/copy`: Take the source message id from the value's `id` property.
+ - `Email/set`: Bump reference-resolution max_depth from 1 to 2.
+ - `Email/import`: Reject blobs that do not contain valid messages.
+ - `EmailSubmission/set`: return `sendAt` and `undoStatus` in the created response.
+ - `Mailbox/set`: Return `alreadyExists` instead of `invalidProperties` when creating a mailbox with an existing name.
+ - `SearchSnippet/get`: incorrect response structure.
+ - `Thread/changes`: emit a container delete when a thread becomes empty.
+ - `VacationResponse/set`: incorrect singleton handling.
+- IMAP: Discard oversized non-synchronizing literals (#2768).
+- DANE: Improper `TLSA` record validation (#2328 - credits to @vdukhovni).
+- OIDC: Add default domain name to groups that are not email addresses.
+- RocksDB: Enable blob garbage collection to reclaim disk space from deleted blobs.
+- Sieve: `include` statements ignore capitalisation of sub-script names (#1643)
+- Cache: Invalidate negative email caches when an account is created.
+- Troubleshoot tool: Use the configured source IP address when connecting to remote servers (#2867).
+
+## [0.16.9] - 2026-06-15
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+- ACME: Allow specifying a preferred certificate chain.
+
+## Changed
+
+## Fixed
+- JMAP: `*/changes` methods leak ids of non-shared objects (reported by @5ud0er).
+- Sieve: Do not allow invalid certs in `http_header` function.
+- FoundationDB: Fix read version cache expiration logic.
+- MTA: Re-scheduling or editing a queued message reports success but persists nothing for recipients in a non-`default` virtual queue.
+- CardDAV: Version requests included in `address-data` are ignored.
+- ACME: Add freshness check when renewing certificates.
+- Autodiscover v2: Read email address from query parameters.
+- Sieve: Do not keep copies of redirected messages when `keep` is not specified.
+- Registry: Object ids are parsed as numbers.
+
+## [0.16.8] - 2026-06-06
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+
+## Changed
+- OAuth: Rework access tokens to an `AES-256-GCM-SIV` AEAD format that carries the account name for proxy routing.
+- Added more internal TLDs to the domain validation.
+
+## Fixed
+- MTA:
+ - Sub-addressing with external directories returns `550 Mailbox not found`.
+ - Disabled aliases continue receiving messages.
+- JMAP for File Storage: `FileNode/get` returns a stale state string.
+- Make `SieveSystemInterpreter.defaultReturnPath` and `MtaQueueQuota.match` optional expressions.
+- Rate limiter panics when periods under 1 second are used.
+- CalDAV/CardDAV: Calendar events, contacts, calendars and address books deleted via JMAP do not write a vanished tombstone.
+- DNS updater: bump to `dns-update-v0.5.1`.
+
+## [0.16.7] - 2026-05-28
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+- RateLimit header fields for HTTP ([draft-ietf-httpapi-ratelimit-headers-10](https://datatracker.ietf.org/doc/html/draft-ietf-httpapi-ratelimit-headers-10))
+- MTA: Implement `spamtest` in trusted Sieve scripts.
+
+## Changed
+
+## Fixed
+- Log rejected messages to tracing store.
+- MTA:
+ - Always update next DSN notify times.
+ - Expand lists and resolve catch-all addresses when building autogenerated messages.
+- Sharing: Includes resource that themselves carry a direct ACL grant and are leaves.
+- Tasks cannot be deleted in OSS builds.
+- Directory: Per-domain external directory resolution fails.
+- DNS updater: Keep external `TXT` records when updating RRSet.
+- HTTP: Reject requests from blocked IPs when `Keep-Alive` is enabled.
+
+## [0.16.6] - 2026-05-20
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+- Added 58 new DNS provider integrations (see [dns-update](https://github.com/stalwartlabs/dns-update/blob/main/CHANGELOG.md#dns-update-040) crate for details).
+- DNS updater: Log DNS record types and values.
+- Sieve: Allow User Sieve scripts to access `orcpt`.
+- MTA: Log when messages are rejected or discarded by the spam classifier.
+
+## Changed
+- Bump JMAP File Storage to [draft-ietf-jmap-filenode-14](https://datatracker.ietf.org/doc/html/draft-ietf-jmap-filenode-14).
+- Accept password hashes with `$` or `{` prefixes as secure secrets.
+
+## Fixed
+- DAV: `acl-principal-prop-set` REPORT enforced the wrong privilege.
+- JMAP: `Thread/get` did not filter by per-mailbox ACLs on shared accounts.
+- IMAP: `UID FETCH N:*` could miss messages moved into a SELECTed mailbox by another connection.
+- DNS updater:
+ - Skip `v=spf1 a -all` records for apex domains.
+ - RFC2136 TSIG: regression related to multiplexer.
+ - Route53: Chunk `TXT` records when they exceed 255 characters.
+- ACME:
+ - Update `defaultCertificateId` when renewing a certificate that is currently set as default.
+ - Perform `DNS-01` authorizations sequentially to avoid race conditions in some DNS providers.
+- Allow internal TLDs and special characters in e-mail addresses.
+- Websocket: Perform case insensitive matching during upgrade.
+- LDAP: Synchronize accounts when expanding mailing list recipients.
+- Sieve: `replace` action adds an extra `From` header.
+- ACL: Orphaned ACL entries for deleted accounts cause JMAP session errors.
+
+## [0.16.5] - 2026-05-11
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+- `is_ip_in_cidr` expression function for CIDR matching.
+
+## Changed
+- Bump `mail-auth` to 0.9 (which bumps `hickory-resolver` to 0.26).
+- Deprecated RFC2136 SIG(0) support as it is no longer supported by `hickory`.
+
+## Fixed
+- JMAP:
+ - Patching ids containing digits in JSON Pointers fails.
+ - Patching nested objects with `null` values fails.
+- External directories:
+ - SQL: Return `Failed` instead of `Error` when the query returns no results.
+ - LDAP: Impersonation fails when the user has not logged in before.
+- Network: Attempt binding to IPv4 when binding to IPv6 fails with `EAFNOSUPPORT` error.
+- Bootstrap: Timeout after 30 seconds when probing the data store.
+- HTTP: Use permissive CORS headers for `.well-known` endpoints.
+- ACME:
+ - Include apex domains when requesting certificates for subdomains.
+ - Use the public suffix list to determine the zone name when no origin is provided.
+- MTA:
+ - Allow rescheduling recipients with permanent failures.
+ - Process reports using original `RCPT` before rewriting.
+- Autodiscover v2 endpoint unreachable.
+- DNS update (via `dns-update` crate):
+ - OVH + Google Cloud DNS: Fix FQDN handling for `MX` and `SRV` records.
+ - Route53: Fix changeset error resolution.
+ - deSEC: Use empty `subname` for apex records instead of `@`, which the API rejects.
+ - Cloudflare: Wrap `TXT` record content in double quotes (RFC 1035) to suppress dashboard warnings.
+- iCalendar/JSCalendar (via `calcard` crate):
+ - Support `STATUS:CANCELLED` mapping from `VTODO` to JSCalendar.
+ - Fixed duration parsing for zero duration `PT0S`.
+
+## [0.16.4] - 2026-05-05
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+
+## Changed
+
+## Fixed
+- Live tracing in community and OSS versions.
+- Timezone changes from the `AccountSettings` object return `invalidProperties`.
+- `mail-parser` panic with certain messages containing corrupted attachments.
+- Pagination by anchor for queued messages, tasks and metrics.
+- Spam filter: Use original instead of rewritten `RCPT` on checks.
+- JMAP:
+ - References in nested objects not resolved.
+ - `AddressBook/query` fetches wrong resources.
+- Import tool fails to restore registry entries.
+- FDB: Allow multiple FoundationDB instances in the same process.
+- Autoconfig: Return `%EMAILADDRESS%` when no email address is provided.
+- Quota: Include Sieve scripts in quota recalculations.
+
+## [0.16.3] - 2026-04-30
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+
+## Changed
+- Replaced `STALWART_HTTPS_PORT` with `STALWART_PUBLIC_URL`.
+- App Passwords now begin with `app_` instead of `app ` to avoid issues with some clients that do not support spaces in passwords.
+
+## Fixed
+- Directory:
+ - Invalidate caches when group memberships change on an external directory.
+ - OIDC: errors instead of "failed to decode token".
+ - OIDC: Recovery admin access.
+ - User impersonation.
+- Tasks:
+ - Delete locked tasks.
+ - Queue pagination by anchor.
+- Log viewer: All events show as `INFO`.
+- Registry: Allow changing object variants.
+- Node id renewal.
+- DNS Updater: Fix Route53 serialization format.
+
+## [0.16.2] - 2026-04-28
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+- OIDC: Fallback to `userinfo` endpoint when JWT token does not contain an email claim.
+- S3: `verifyAfterWrite` option to verify that objects have persisted after writing.
+
+## Changed
+- Allow HTTP to be used for configuring the server.
+
+## Fixed
+- LDAP: Generate valid `credentialId` when there are password changes.
+- TLS: Disable cipher suited option disables wrong ciphers.
+- DNS Updater:
+ - BunnyDNS: Use subdomain as name of record instead of FQDN.
+ - RFC2136: Chunk TXT records.
+- Skip invalid entries in log files.
+
+## [0.16.1] - 2026-04-25
+
+If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+- OIDC: Extract username from JWT token.
+- `system('node_hostname')` and `system('node_role')` expression variables to retrieve the local node hostname and cluster role respectively.
+
+## Changed
+
+## Fixed
+- JMAP:
+ - Invalid `receivedAt` headers after importing (#2939).
+ - Sorting order issues when emails lack `receivedAt` headers.
+- IMAP: Fix `BINARY` fetch responses (#2940).
+- WebDAV: Fix ACL validation for target folders.
+- ACME: Allow requesting apex domain certificates.
+- Hostname issues:
+ - Accept RFC 6761 reserved TLDs during bootstrap.
+ - Allow hostnames without TLDs in remote server settings.
+- Reverse proxy issues.
+- OSS builds.
+- DNS Updater:
+ - RFC2136: TSIG secret not base64 decoded.
+ - Google DNS: Chunk TXT records when they exceed 255 characters.
+ - Cloudflare:
+ - Fix `CAA` record updates.
+ - Check zone subdomains when finding zones
+
+## [0.16.0] - 2026-04-20
+
+This version includes **multiple breaking changes**. If you are upgrading from v0.15.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_16.md) for more information on how to upgrade from previous versions.
+
+## Added
+- [Web UI](https://github.com/stalwartlabs/webui) rewritten from the ground up using the JMAP management API, featuring a refreshed design and addressing 76 enhancement requests and bug fixes.
+- [CLI](https://github.com/stalwartlabs/cli) rewritten from the ground up to use the JMAP management API.
+- Security enhancements:
+ - Password strength enforcement using the `zxcvbn` algorithm
+ - Password expiration, rotation policies and IP address restrictions for user accounts
+ - App Passwords with limited access (#1609), labels (#2255), IP address restrictions and expiration dates
+ - API keys with limited access, labels, IP address restrictions and expiration dates
+ - Auto-ban comments and details about the triggering event (#1321)
+ - Auto-ban expiration after a configurable time period (#964)
+- DNS Management:
+ - Automatic DNS management of `MX`, `TXT`, `CNAME`, `SRV`, `CAA` and `TLSA` records (#463 #1017 #1419 #2438 #1370 #1406 #1371)
+ - Automatic update of `TLSA` records when ACME certificates change (#1664)
+ - RFC2136 `SIG(0)` support (#856)
+ - Route53 provider support (contributed by @jimmystewpot)
+ - Google Cloud DNS provider support (contributed by @jimmystewpot)
+ - Bunny provider support (contributed by @angeloanan)
+ - Porkbun provider support (contributed by @jeffesquivels)
+ - DNSimple provider support (contributed by @NelsonVides)
+ - Spaceship provider support (contributed by @matserix)
+- DKIM:
+ - Automatic DKIM key generation, rotation and DNS management (#368 #961)
+ - Store DKIM keys in the database (#1264)
+ - Ignore insecure signatures when verifying DKIM (#1068 #467)
+- ACME/TLS:
+ - `DNS-PERSIST-01` ACME challenge support (#2837)
+ - Renew certificates on demand, view certificate details (#675 #1162 #2566)
+ - `CAA` record support (#468) with `accounturi` parameter (#1933)
+ - `TLSA` records publishing restricted to `3 1 1` and `2 1 1` (#2193)
+- OIDC and OAuth:
+ - JWT token validation without requesting userinfo from the OIDC provider.
+ - Audience (`aud`) claim (#2603) and scope validation support.
+ - Groups support (#1448)
+ - RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients
+- LDAP:
+ - Separate filter for groups (#1841)
+ - Improve support for OpenLDAP schemas (#760)
+ - Improve and simplify LDAP settings (#2194 #2174)
+- Directory:
+ - Masked email addresses for enhanced privacy (*Enterprise*)
+ - Domain aliases (#583)
+ - E-mail alias descriptions and option to disable aliases (#506)
+ - Account archiving and un-deletion (#2767) (*Enterprise*)
+ - Per-domain directory backends (*Enterprise*)
+- Account configuration and discovery:
+ - Automatic Configuration of Email, Calendar, and Contact Server Settings ([draft-mailmaint-uaautoconf-04](https://datatracker.ietf.org/doc/html/draft-eggert-mailmaint-uaautoconf-04)) (#2201)
+ - MS Autodiscover V2 support (#679)
+- Sieve: Allow deactivating scripts without deleting them (#1251).
+- Tracing: Enable events only mode (#2276)
+- Clustering:
+ - Automatic cluster node ID generation and management.
+ - Unified cluster management (#960)
+ - Outbound MTA role (#1692)
+
+## Changed
+- Replaced REST API with JMAP API (#2262 #959 #1480)
+- Removed support for Authenticated Received Chain (ARC) sealing ([learn more](https://mailarchive.ietf.org/arch/msg/dmarc/KvX3-H1SL0Gh3IDl7FuR2hoR87M/)).
+- Directory: Removed `smtp`, `imap` and `memory` directory backends.
+- Use `aws-lc` for cryptographic operations instead of `ring`.
+- Use `rustls-platform-verifier` for TLS certificate verification instead of `webpki` (#247).
+
+## Fixed
+- Directory:
+ - Cannot remove built-in "admin" role from user once it was assigned (#1467)
+ - Delete associated records (#963)
+ - Updated Role permissions not applied (#2038)
+ - Recreated account cannot log in until server is restarted (#1469)
+ - Subaddressing does not work for groups (#475)
+ - New LDAP aliases are rejected (#1318).
+ - Validate account and group names (#2209)
+- MTA:
+ - RCPT TO stage settings improvements (#2217 #394)
+ - Relay to IP addresses (#838)
+ - Duplicate delivery inverted check
+ - SASL challenge responses include invalid `Go ahead` text
+- JMAP:
+ - Fix `inMailboxOtherThan` query logic.
+ - Fix `hasAttachment` search field (#2778)
+- IMAP:
+ - Increment argument max length to `8000` bytes
+ - ACL: Add `RIGHTS` capability (#2762)
+ - ACL: Fix `ACL SET` permission override.
+- WebDAV:
+ - Return `304` `NOT_MODIFIED` on `If-None-Match`
+ - Use RFC 2616 instead of RFC 1123 for date formatting
+ - Fix ACL container/item mismatch in reports.
+ - CalDAV: Allow organized properties to be present in `PUT` requests if they are equal to the existing ones.
+ - CalDAV: Enforce cumulative iCalendar instances cap in CalDAV free-busy REPORT handler
+- Configuration: Prefix parsing issues (#2495)
+- OIDC: JWKS Exposes Symmetric Signing Key
+- SQLite: Fix thread pool exhaustion.
+- PostgreSQL: Use clean recycling method on connection pool
+- Meilisearch: Make `id` sorteable.
+- ACME: Fix wrong origin for subdomain updates (#2360)
+- Spam filter: Skip invalid messages during training.
+- Calendar: Include minutes in localized invite templates (#2828)
+- HTTP: Fix `204` CORS preflight responses
+
+## [0.15.5] - 2026-02-14
+
+If you are upgrading from v0.14.x and below, this version includes **multiple breaking changes**. Please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_15.md) for more information on how to upgrade from previous versions.
+If you are upgrading from v0.15.x, replace the binary and update the webadmin.
+
+## Added
+
+## Changed
+
+## Fixed
+- IMAP/JMAP: OOM when `mail-parser` returns cyclical MIME structures [CVE-2026-26312](https://github.com/stalwartlabs/stalwart/security/advisories/GHSA-jm95-876q-c9gw).
+- Tracing: Fix tracing indexing when using separate stores.
+- JMAP: Fix `upToId` computation in `*/queryChanges`.
+- JMAP: Include createdIds when the property is present.
+- JMAP: Respect query arguments in `Email/queryChanges`.
+- JMAP: Return the correct container/item change id when there are no changes.
+
+## [0.15.4] - 2026-01-19
+
+If you are upgrading from v0.14.x and below, this version includes **multiple breaking changes**. Please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_15.md) for more information on how to upgrade from previous versions.
+If you are upgrading from v0.15.x, replace the binary and update the webadmin.
+
+## Added
+- IMAP: Map `HEADER SUBJECT/FROM/TO` searches to `SUBJECT/FROM/TO` queries.
+- Sieve: Update spam status on user scripts.
+
+## Changed
+
+## Fixed
+- Search: Return all document ids when no filters are provided.
+- Search: Filters not applied when a single message is in the account.
+- IMAP: Return `ALREADYEXISTS` code when creating existing mailboxes.
+- IMAP: Do not return quota resources if no quota is set.
+- JMAP/changes: Update `newState` with last changeId if an invalid fromChangeId is provided.
+- JMAP/CalendarIdentity: Do not update invalid calendar identities.
+- AI API: Include request error details if available.
+
+## [0.15.3] - 2025-12-29
+
+If you are upgrading from v0.14.x and below, this version includes **multiple breaking changes**. Please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_15.md) for more information on how to upgrade from previous versions.
+If you are upgrading from v0.15.x, replace the binary and update the webadmin.
+
+## Added
+- Polish locale support (contributed by @mrxkp) (#2480)
+
+## Changed
+
+## Fixed
+- Meilisearch: Return correct error messages when failing to create indexes (#2574)
+- PostgreSQL search: Truncate emails to 650kb for full-text search indexing.
+- FoundationDB search: Batch large transactions (#2567).
+- Spam filter: Fix training sample size checks
+- IMAP: Fix UTF7 encoding with Emojis (contributed by @dojiong) (#2564).
+
+## [0.15.2] - 2025-12-22
+
+If you are upgrading from v0.14.x and below, this version includes **multiple breaking changes**. Please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_15.md) for more information on how to upgrade from previous versions.
+If you are upgrading from v0.15.x, replace the binary and update the webadmin.
+
+## Added
+- OAuth: Add device authorization endpoint (#2225).
+
+## Changed
+- Antispam: Only auto-learn spam from traps or multiple RBL hits.
+
+## Fixed
+- mySQL search: Use `MEDIUMTEXT` field type for email body and attachments (#2544).
+- PostgreSQL search: Truncate large text fields.
+- ElasticSearch: Implement pagination (#2551).
+- Antispam: Fix `NO_SPACE_IN_FROM` spam tag detection logic (#2372).
+- IMAP: Fix shared folder double nesting (test suite credits to @ochnygosch) (#2358).
+- JMAP: Use latest `Received` header in JMAP `Email/import` (credits to @apexskier) (#2374).
+- JMAP: Return unsorted search results when the index is not ready (#2544).
+- LDAP: Lowercase attribute comparison (credits to @pdf) (#2363).
+- CLI: Fix same-host JMAP redirection on non-standard ports (#2271).
+
+## [0.15.1] - 2025-12-17
+
+This version includes **multiple breaking changes**. If you are upgrading from v0.14.x and below, please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_15.md) for more information on how to upgrade from previous versions.
+
+## Added
+
+## Changed
+
+## Fixed
+- PostgreSQL: Sanitize search index values (#2533)
+- Elasticsearch: Ignore `resource_already_exists_exception` errors when creating indexes (#2535)
+- Migrate 0.13.x data (#2534)
+
+## [0.15.0] - 2025-12-16
+
+This version includes **multiple breaking changes**. Please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_15.md) for more information on how to upgrade from previous versions.
+
+## Added
+- Linear spam classifier using FTRL-Proximal and feature/cuckoo hashing.
+- Meilisearch store backend implementation (#1482).
+- PostgreSQL and mySQL native full-text search support.
+- Multiple performance improvements and database access optimizations.
+- Encryption-at-rest: Spam training privacy setting.
+- Enterprise: Undelete e-mail feature now includes From/Subject/Received information.
+- IMAP: Implemented new keywords and mailbox attributes described in [draft-ietf-mailmaint-messageflag-mailboxattribute-13](https://datatracker.ietf.org/doc/html/draft-ietf-mailmaint-messageflag-mailboxattribute-13)
+
+## Changed
+- IMAP: Always return special use flags in responses.
+
+## Fixed
+- JMAP: `FileNode/set` fails to delete files (#2485).
+- JMAP: Return error when using `blobId` in JSContact and JSCalendar (#2431).
+- Directory: Deletion of list or domain issues (#2415).
+- MTA: Headers and body stripped from mail delivery subsystem failure notifications (#2344).
+- MTA: Hooks only run if sieve script, milter or rewrite is configured (#2317).
+- Autodiscover: Endpoint should be case insensitive (#2440).
+- Housekeeper: Panic during DST transition (#2366).
+- Import/Export: Fix import/export utility (#1882).
+- Enterprise: Remove tenant admin permissions when license is invalid.
+
+## [0.14.1] - 2025-10-28
+
+If you are upgrading from v0.13.4 and below, this version includes **breaking changes** to the internal directory, calendar and contacts. Please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_14.md) for more information on how to upgrade from previous versions.
+
+## Added
+- Autoconfig for CalDAV, CardDAV and WebDAV (#1937)
+
+## Changed
+- HTTP: Remove HTTP STS `preload` directive.
+
+## Fixed
+- Directory: Keep OTP Auth and AppPasswords unless the remote directory provides new ones (#2319)
+- JMAP: Fix `ContactCard/set` and `CalendarEvent/set` destroy methods (#2308).
+
+## [0.14.0] - 2025-10-22
+
+If you are upgrading from v0.13.4 and below, this version includes **breaking changes** to the internal directory, calendar and contacts. Please read the [upgrading documentation](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING/v0_14.md) for more information on how to upgrade from previous versions.
+
+## Added
+- JMAP for Calendars ([draft-ietf-jmap-calendars](https://datatracker.ietf.org/doc/draft-ietf-jmap-calendars/)).
+- JMAP for Contacts ([RFC 9610](https://datatracker.ietf.org/doc/rfc9610/)).
+- JMAP for File Storage ([draft-ietf-jmap-filenode](https://datatracker.ietf.org/doc/draft-ietf-jmap-filenode/)).
+- JMAP Sharing ([RFC 9670](https://datatracker.ietf.org/doc/rfc9670/))
+- CalDAV: support for `supported-calendar-component-set` (#1893)
+- i18n: Greek language support (contributed by @infl00p)
+- i18n: Swedish language support (contributed by @purung)
+
+## Changed
+- **Breaking Database Changes** (migrated automatically on first start):
+ - Internal directory schema changed.
+ - Calendar and Contacts storage schema changed.
+ - Sieve scripts storage schema changed.
+ - Push Subscriptions storage schema changed.
+- Replaced `sieve.untrusted.limits.max-scripts` and `jmap.push.max-total` with `object-quota.*` settings.
+- Cluster node roles now allow sharding.
+
+
+## Fixed
+- Push Subscription: Clean-up of expired subscriptions and cluster notification of changes (#1248)
+- CalDAV: Per-user CalDAV properties (#2058)
+
+## [0.13.4] - 2025-09-30
+
+If you are upgrading from v0.11.x or v0.12.x, this version includes **breaking changes** to the message queue and MTA configuration. Please read the [UPGRADING.md](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING.md) file for more information on how to upgrade from previous versions.
+
+## Added
+
+## Changed
+- JMAP: Protocol layer rewrite for zero-copy deserialization and architectural improvements.
+
+## Fixed
+- IMAP: Unbounded memory allocation in request parser ([CVE-2025-61600 ](https://github.com/stalwartlabs/stalwart/security/advisories/GHSA-8jqj-qj5p-v5rr)).
+- IMAP: Wrong permission checked for GETACL.
+- JMAP: References to previous method fail when there are no results (#1507).
+- JMAP: Enforce quota checks on `Blob/copy`.
+- JMAP: `Mailbox/get` fails without `accountId` argument (#1936).
+- JMAP: Do not return `invalidProperties` when email update doesn't contain changes (#1139)
+- iTIP: Include date properties in `REPLY` (#2102).
+- OIDC: Do not set `username` field if it is the same as the `email` field.
+- Telemetry: Fix `calculateMetrics` housekeeper task (#2155).
+- Directory: Always use `rsplit` to extract the domain part from email addresses.
+
+## [0.13.3] - 2025-09-10
+
+If you are upgrading from v0.11.x or v0.12.x, this version includes **breaking changes** to the message queue and MTA configuration. Please read the [UPGRADING.md](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING.md) file for more information on how to upgrade from previous versions.
+
+## Added
+- CLI: Health checks (contributed by @Codekloeppler)
+
+## Changed
+- WebDAV: Assisted discovery v2
+
+## Fixed
+- iTIP: Do not send a REPLY when deleting an event that was not accepted.
+- iTIP: Include event details in REPLY messages (#2102).
+- iTIP: Add organizer to iMIP replies if missing to deal with MS Exchange 2010 bug.
+- OIDC: Do not overwrite locally defined aliases (#2065).
+- HTTP: Scan ban should only be triggered by HTTP parse errors.
+- HTTP: Skip scanner fail2ban checks when the proxy client IP can't be parsed (#2121).
+- JMAP: Do not allow roles to be removed from system mailboxes (#1977).
+- JMAP WS: Fix panic when using invalid server url.
+- SMTP: Do no send `EHLO` twice when `STARTTLS` is unavailable (#2050).
+- IMAP: Allow `ENABLE UTF8` in IMAPrev1.
+- IMAP: Include `administer` permission in ACL responses.
+- IMAP: Add owner rights to ACL get responses.
+- IMAP: Do not auto-train Bayes when moving messages from Junk to Trash.
+- IMAP/ManageSieve: Increase maximum quoted argument size (#2039).
+- CalDAV: Limit recurrence expansions in calendar reports ([CVE-2025-59045](https://github.com/stalwartlabs/stalwart/security/advisories/GHSA-xv4r-q6gr-6pfg)).
+- WebDAV: Do not fix percent encoding on WebDAV FS (#2036).
+
+## [0.13.2] - 2025-07-28
+
+If you are upgrading from v0.11.x or v0.12.x, this version includes **breaking changes** to the message queue and MTA configuration. Please read the [UPGRADING.md](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING.md) file for more information on how to upgrade from previous versions.
+
+## Added
+- ACME: DeSEC cloud DNS provider support (contributed by @Tyr3al).
+- ACME: OVH cloud DNS provider support (contributed by @srachner).
+- CalDAV Scheduling: Catalan language support (contributed by @jolupa) (#1873).
+- MTA: Allow to send e-mails as group, while member of that group (#485).
+- OIDC: Allow local access tokens to be used with third-party OIDC backends (#1311 stalwartlabs/webadmin#52).
+
+## Changed
+- IMAP: Return `OK` when moving/copying non-existent messages (#670).
+- IMAP: Copy flags when copying/moving messages between accounts.
+
+## Fixed
+- MTA: Do not convert e-mail local parts to lowercase (#1916).
+- Sieve: `fileinto` should override spam filter (#1917).
+- JMAP: Incorrect `accountId` used in email set and import methods (#1777).
+- WebDAV: Always return `MULTISTATUS` when calendar-query yields no results.
+- LDAP: Only set account name if not returned in LDAP query (#1471).
+- Enterprise: Invalidate logo cache when changes are made (#1856).
+- Enterprise: Fix tenant quota update API.
+
+## [0.13.1] - 2025-07-16
+
+If you are upgrading from v0.11.x or v0.12.x, this version includes **breaking changes** to the message queue and MTA configuration. Please read the [UPGRADING.md](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING.md) file for more information on how to upgrade from previous versions.
+
+## Added
+- ACME: DigitalOcean cloud DNS provider support (#1667).
+
+## Changed
+
+## Fixed
+- Migration: Old queue events not deleted causing high CPU usage in some deployments (#1833).
+- MTA: `mta-sts` setting parsing issue (#1830).
+- JMAP: `sortOrder` should not be null (#1831).
+- Allow invalid TOML when parsing database settings (#1822).
+
+## [0.13.0] - 2025-07-15
+
+If you are upgrading from v0.11.x or v0.12.x, this version includes **breaking changes** to the message queue and MTA configuration. Please read the [UPGRADING.md](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING.md) file for more information on how to upgrade from previous versions.
+
+## Added
+- MTA queue enhancements (#1246 #1035 #457).
+- Danish locale support (contributed by @Fadil2k) (#1772).
+- DKIM support for `stalwart-cli` (contributed by @rmsc) (#1804).
+
+## Changed
+- Invalidate access token caches in a cluster using pub/sub (#1741).
+- Allow updating secrets for all directory types.
+
+## Fixed
+- WebDAV: Return all shared resources in `calendar-home-set` and `addressbook-home-set` (#1796).
+- WebDAV ACL: Fix write permission and `multiget` reports (#1768).
+- CalDAV Scheduling: Include `DTSTART`/`DTEND` properties in iMIP `CANCEL` messages (#1775).
+- HTTP: Do not include `WWW-Authenticate` headers in API responses (#1795).
+- API: Allow API keys to be used with external directories (#1815).
+- IMAP: Fix issue creating subfolders under INBOX for group shared folder (#1817).
+- IMAP: Custom Name for Shared Folders ignored (#1620).
+- LDAP: `local` placeholder should return username when its not an email address (#1784).
+
+## [0.12.5] - 2025-06-25
+
+If you are upgrading from v0.11.x, this version includes **breaking changes** to the database layout and requires a migration. Please read the [UPGRADING.md](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING.md) file for more information on how to upgrade from previous versions.
+
+## Added
+- Calendar Scheduling Extensions to CalDAV - RFC6368 (#1514)
+- Calendar E-Mail Notifications (#1514)
+- Limited i18n support for calendaring events.
+- Assisted CalDAV/CardDAV shared resource discovery (#1691).
+
+## Changed
+- JMAP: Allow unauthenticated access to JMAP session object.
+
+## Fixed
+- WebDAV: Return NOTFOUND error instead of MULTISTATUS on empty PROPFIND responses (#1657).
+- WebDAV: Update account name when refreshing DAV caches (#1694).
+- JMAP: Do not include email address in identity names (#1688).
+- IMAP: Normalize `INBOX` name when creating/renaming folders (#1636).
+- LDAP: Request `secret-changed` attribute in LDAP queries (#1409).
+- Branding: Unable to change logos (#1652).
+- Antispam: Skip `card-is-ham` override when sender does not pass DMARC (#1648).
+- FoundationDB: Renew old/expired FDB read transactions after the `1007` error code is received rather than estimating expiration time.
+
+## [0.12.4] - 2025-06-03
+
+If you are upgrading from v0.11.x, this version includes **breaking changes** to the database layout and requires a migration. Please read the [UPGRADING.md](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING.md) file for more information on how to upgrade from previous versions.
+
+## Added
+- LDAP authentication enhancements (#1269 #1471 #795 #1496).
+- MTA: Return Queue IDs during message acceptance (#927).
+
+## Changed
+- LDAP: `bind.auth.enable` is now `bind.auth.method`, read the updated [LDAP documentation](https://stalw.art/docs/auth/backend/ldap) for more information.
+
+## Fixed
+- DNS: `hickory-resolver` bug hitting 100% CPU usage when resolving DNSSEC records.
+- IMAP: Return the message UID in the destination mailbox if the message already exists (#1201).
+- MTA: TLS reports being issued for sent TLS reports (infinite loop) (#1301).
+- WebDAV: Return `CTag` on `/dav/cal/account` resources to force iOS synchronize.
+- CardDAV: Strict vCard parsing (#1607).
+- WebDAV: Dead property updates (#1611).
+- WebDAV: Use last change id in `CTag`.
+
+## [0.12.3] - 2025-05-30
+
+If you are upgrading from v0.11.x, this version includes **breaking changes** to the database layout and requires a migration. Please read the [UPGRADING.md](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING.md) file for more information on how to upgrade from previous versions.
+
+## Added
+- Store vanished IMAP UIDs and WebDAV paths in the changelog.
+
+## Changed
+
+## Fixed
+- XML `CDATA` injection (credits to @andreymal for the report).
+- Macro references are replaced with their content when writing config file (#1595).
+- Double nested CalDAV and CardDAV property tags (#1591).
+- Allow empty properties in PROPPATCH requests (#1580).
+
+## [0.12.2] - 2025-05-27
+
+If you are upgrading from v0.11.x, this version includes **breaking changes** to the database layout and requires a migration. Please read the [UPGRADING.md](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING.md) file for more information on how to upgrade from previous versions.
+
+## Added
+- CardDAV: Legacy vCard 2.1 and 3.0 serialization support.
+- WebDAV: Add SRV Records to help DAV autodiscovery (closes #1565).
+
+## Changed
+
+## Fixed
+- Report list attempts to deserialize empty values (#1562)
+- Refresh expired FoundationDB transactions while retrieving large blobs (#1555).
+
+## [0.12.1] - 2025-05-26
+
+If you are upgrading from v0.11.x, this version includes **breaking changes** to the database layout and requires a migration. Please read the [UPGRADING.md](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING.md) file for more information on how to upgrade from previous versions.
+
+## Added
+
+## Changed
+
+## Fixed
+- Migration tool to generate the correct next id (#1561).
+- Failed to parse setting dav.lock.max-timeout (closes #1559).
+- Failed to build OpenTelemetry span exporter: no http client specified (#1571).
+
+## [0.12.0] - 2025-05-26
+
+This version includes **breaking changes** to the database layout and requires a migration. Please read the [UPGRADING.md](https://github.com/stalwartlabs/stalwart/blob/main/UPGRADING.md) file for more information on how to upgrade from previous versions.
+
+### Added
+- [Collaboration](https://stalw.art/docs/collaboration/overview) features including [Calendars over CalDAV](https://stalw.art/docs/http/calendar/), [Contacts over CardDAV](https://stalw.art/docs/http/contact/) and [File Storage over WebDAV](https://stalw.art/docs/http/file-storage/).
+- Peer-to-peer [cluster coordination](https://stalw.art/docs/cluster/coordination/overview) or with Apache Kafka, Redpanda, NATS or Redis.
+- Incremental caching of emails, calendars, contacts and file metadata.
+- Zero-copy deserialization.
+- Train spam messages as ham when the sender is in the user's address book.
+- `XOAUTH2` SASL mechanism support (#1194 #1369).
+- Support for RFC9698, the `JMAPACCESS` Extension for IMAP.
+- Search index for accounts and other principals (#1368).
+- Add `description` property to OIDC ID token (#1234).
+
+### Changed
+- Deprecated gossip protocol in favor of the new [coordinator](https://stalw.art/docs/cluster/coordination/overview) options.
+- Renamed Git repository from `stalwartlabs/mail-server` to `stalwartlabs/stalwart` and the Docker image from `stalwartlabs/mail-server` to `stalwartlabs/stalwart`.
+- Renamed multiple settings:
+ - `server.http.*` to `http.*`.
+ - `jmap.folders.*` to `email.folders.*`.
+ - `jmap.account.purge.frequency` to `account.purge.frequency`.
+ - `jmap.email.auto-expunge` to `email.auto-expunge`.
+ - `jmap.protocol.changes.max-history` to `changes.max-history`.
+ - `storage.encryption.*` to `email.encryption.*`.
+- Deprecated `lookup.default.*` settings in favor of `server.hostname` and `report.domain`. v0.11 and before supported both, v0.12 will only support the new settings.
+
+### Fixed
+- Allow undiscovered UIDs to be used in IMAP `COPY`/`MOVE` operations (#1201).
+- Refuse loopback SMTP delivery (#1377).
+- Hide the current server version (#1435).
+- Use the newest `X-Spam-Status` Header (#1308).
+- MySQL Driver error: Transactions couldn't be nested (#1271).
+- Spawn a delivery thread for `EmailSubmission/set` requests (#1540).
+- ACME: Don't restrict challenge types (#1522).
+- Autoconfig: return `%EMAILADDRESS%` if no e-mail address is provided (#1537).
+
+## [0.11.8] - 2025-04-30
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin.
+
+### Added
+
+### Changed
+
+### Fixed
+- Allow undiscovered UIDs to be used in `COPY`/`MOVE` operations (#1201).
+
+## [0.11.7] - 2025-03-23
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin.
+
+### Added
+- LDAP attribute to indicate password change (#1156).
+
+### Changed
+- Lazy DKIM key parsing (#1211).
+- Enable `edns0` for system resolver by default (#1282).
+- Bump FoundationDB to `7.3`.
+
+### Fixed
+- Fix incorrect `UIDNEXT` when mailbox is empty (#1201).
+- Sender variable not set when evaluating `must-match-sender` (#1294).
+- Do not panic when mailboxId is not found (#1293).
+- Prioritize local over span keys when serializing webhook payloads (#1250).
+- Allow TLS name mismatch as per RFC7671 Section 5.1.
+- Try with implicit MX when no MX records are found.
+- SQL `secrets` directory query.
+
+## [0.11.5] - 2025-02-01
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin.
+
+### Added
+
+### Changed
+- Open source third party OIDC support.
+
+### Fixed
+- Case insensitive flag parsing (#1138).
+- BCC not removed from JMAP EmailSubmissions (#618).
+- Group pipelined IMAP FETCH and STATUS operations (#1096).
+
+## [0.11.4] - 2025-01-29
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin.
+
+### Added
+- RFC 9208 - IMAP QUOTA Extension (#484).
+
+### Changed
+- `session.throttle.*` is now `queue.limiter.inbound.*`.
+- `queue.throttle.*` is now `queue.limiter.outbound.*`.
+- Changed DNSBL error level to debug (#1107).
+
+### Fixed
+- Creating a mailbox in a shared folder results in wrong hierarchy (#1128).
+- IMAP LIST-STATUS (RFC 5819) returns items in wrong order (#1129).
+- Avoid non-RFC SMTP status codes (#1109).
+- Do not DNSBL check invalid domains (#1107).
+- Sieve message flag parser (#1059).
+- Sieve script import case insensitivity (#962).
+- `mailto:` parsing in HTMLs.
+
+## [0.11.2] - 2025-01-17
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin.
+
+### Added
+- Automatic revoking of access tokens when secrets, permissions, ACLs or group memberships change (#649).
+- Increased concurrency for local message delivery (configurable via `queue.threads.local`).
+- Cluster node roles.
+- `config_get` expression function.
+
+### Changed
+- `queue.outbound.concurrency` is now `queue.threads.remote`.
+- `lookup.default.hostname` is now `server.hostname`.
+- `lookup.default.domain` is now `report.domain`.
+
+### Fixed
+- Distributed locking issues in non-Redis stores (#1066).
+- S3 incorrect backoff wait time after failures.
+- Panic parsing broken HTMLs.
+- Update CLI response serializer to v0.11.x (#1082).
+- Histogram bucket counts (#1079).
+- Do not rate limit trusted IPs (#1078).
+- Avoid double encrypting PGP parts encoded as plain text (#1083).
+- Return empty SASL challenge rather than "" (#1064).
+
+## [0.11.0] - 2025-01-06
+
+This version includes breaking changes to the configuration file, please read [UPGRADING.md](UPGRADING.md) for details.
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin.
+
+### Added
+- Spam filter rewritten in Rust for a significant performance improvement.
+- Multiple spam filter improvements (#947) such as training spam/ham when moving between inbox and spam folders (#819).
+- Improved distributed locking and handling of large distributed SMTP queues.
+- ASN and GeoIP lookups.
+- Bulk operations REST endpoints (#925).
+- Faster S3-FIFO caching.
+- Support adding the `Delivered-To` header (#916).
+- Semver compatibility checks when upgrading (#844).
+- Sharded In-Memory Store.
+
+### Changed
+- Removed authentication rate limit (no longer necessary since there is fail2ban).
+- Pipes have been deprecated in favor of MTA hooks.
+
+### Fixed
+- OpenPGP EOF error (#1024).
+- Convert emails obtained from external directories to lowercase (#1004).
+- LDAP: Support both name and email fields to be mapped to the same attribute.
+- Admin role can't be assigned if an account with the same name exists.
+- Fix macro detection in DNS record generation (#978).
+- Use host FQDN in install script (#1003).
+
+## [0.10.7] - 2024-12-04
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin.
+
+### Added
+- Delivery and DMARC Troubleshooting (#420).
+- Support for external email addresses on mailing lists (#152).
+- Azure blob storage support.
+
+### Changed
+
+### Fixed
+- Some mails can't be moved out of the junk folder (#670).
+- Out of bound index error on Sieve script (#941).
+- Missing `User-Agent` header for ACME (#937).
+- UTF8 support in IMAP4rev1 (#948).
+- Account alias owner leak on autodiscover.
+- Include all events in OTEL traces + Include spanId in webhooks.
+- Implement `todo!()` causing panic on concurrency and rate limits.
+- Mark SQL store as active if used as a telemetry store.
+- Discard empty form submissions.
+
+## [0.10.6] - 2024-11-07
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin.
+
+### Added
+- Enterprise license automatic renewals before expiration (disabled by default).
+- Allow to LDAP search using bind dn instead of auth bind connection when bind auth is enabled (#873)
+
+### Changed
+
+### Fixed
+- Include `preferred_username` and `email` in OIDC `id_token`.
+- Verify roles and permissions when creating or modifying accounts (#874)
+
+## [0.10.5] - 2024-10-15
+
+To upgrade replace the `stalwart-mail` binary.
+
+### Added
+- Data store CLI.
+
+### Changed
+
+### Fixed
+- Tokenizer performance issue (#863)
+- Incorrect AI model endpoint setting.
+
+## [0.10.4] - 2024-10-08
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin.
+
+### Added
+- Detect and ban port scanners as well as other forms of abuse (#820).
+- ACME External Account Binding support (#379).
+
+### Changed
+- The settings `server.fail2ban.*` have been moved to `server.auto-ban.*`.
+- The event `security.brute-force-ban` is now `security.abuse-ban`.
+
+### Fixed
+- Do not send SPF failures reports to local domains.
+- Allow `nonce` in OAuth code requests.
+- Warn when there are errors migrating domains rather than aborting migration.
+
+## [0.10.3] - 2024-10-07
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin. Enterprise users wishing to use the new LLM-powered spam filter should also upgrade the spam filter rules.
+
+### Added
+- AI-powered Spam filtering and Sieve scripting (Enterprise feature).
+
+### Changed
+- The untrusted Sieve interpreter now has the `vnd.stalwart.expressions` extension enabled by default. This allows Sieve users to use the `eval` function to evaluate expressions in their scripts. If you would like to disable this extension, you can do so by adding `vnd.stalwart.expressions` to `sieve.untrusted.disabled-capabilities`.
+
+### Fixed
+- S3-compatible backends: Retry on `5xx` errors.
+- OIDC: Include `nonce` parameter in `id_token` response.
+
+## [0.10.2] - 2024-10-02
+
+To upgrade first upgrade the webadmin and then replace the `stalwart-mail` binary. If you read these instructions too late, you can upgrade to the latest web-admin using `curl -k -u admin:yourpass https://yourserver/api/update/webadmin`.
+
+### Added
+- OpenID Connect server (#298).
+- OpenID Connect backend support (Enterprise feature).
+- OpenID Connect Dynamic Client Registration (#4)
+- OAuth 2.0 Dynamic Client Registration Protocol ([RFC7591](https://datatracker.ietf.org/doc/html/rfc7591)) (#136)
+- OAuth 2.0 Token Introspection ([RFC7662](https://datatracker.ietf.org/doc/html/rfc7662)).
+- Contact form submission handling.
+- `webadmin.path` setting to override unpack directory (#792).
+
+### Changed
+
+### Fixed
+- Missing `LIST-STATUS` from RFC5819 in IMAP capability responses (#816).
+- Do not allow tenant domains to be deleted if they have members (#812).
+- Tenant principal limits (#810).
+
+## [0.10.1] - 2024-09-26
+
+To upgrade replace the `stalwart-mail` binary.
+
+### Added
+- `OAUTHBEARER` SASL support in all services (#627).
+
+### Changed
+
+### Fixed
+- Fixed `migrate_directory` range scan (#784).
+
+## [0.10.0] - 2024-09-21
+
+This version includes breaking changes to how accounts are stored. Please read [UPGRADING.md](UPGRADING.md) for details.
+
+### Added
+- Multi-tenancy (Enterprise feature).
+- Branding (Enterprise feature).
+- Roles and permissions.
+- Full-text search re-indexing.
+- Partial database backups (#497).
+
+### Changed
+
+### Fixed
+- IMAP `IDLE` support for command pipelining, aka the Apple Mail iOS 18 bug (#765).
+- Case insensitive INBOX `fileinto` (#763).
+- Properly decode undelete account name (#761).
+
+## [0.9.4] - 2024-09-09
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin.
+
+### Added
+- Support for global Sieve scripts that can be used by users to filter their incoming mail.
+- Allow localhost to override HTTP access controls to prevent lockouts.
+
+### Changed
+- Sieve runtime error default log level is now `debug`.
+
+### Fixed
+- Ignore INBOX case on Sieve's `fileinto` (#725)
+- Local keys parsing and retrieval issues.
+- Lookup reload does not include database settings.
+- Account count is incorrect.
+
+## [0.9.3] - 2024-08-29
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin.
+
+### Added
+- Dashboard (Enterprise feature)
+- Alerts (Enterprise feature)
+- SYN Flood (session "loitering") attack protection (#482)
+- Mailbox brute force protection (#688)
+- Mail from is allowed (`session.mail.is-allowed`) expression (#609)
+
+### Changed
+- `authentication.fail2ban` setting renamed to `server.fail2ban.authentication`.
+- Added elapsed times to message filtering events.
+
+### Fixed
+- Include queueId in MTA Hooks (#708)
+- Do not insert empty keywords in FTS index.
+
+## [0.9.2] - 2024-08-21
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin.
+
+### Added
+- Message delivery history (Enterprise feature)
+- Live tracing and logging (Enterprise feature)
+- SQL Read Replicas (Enterprise feature)
+- Distributed S3 Blob Store (Enterprise feature)
+
+### Changed
+
+### Fixed
+- Autodiscover request parser issues.
+- Do not create tables when using SQL as an external directory (fixes #291)
+- Do not hardcode logger id (fixes #348)
+- Include `Forwarded-For IP` address in `http.request-url` event (fixes #682)
+
+## [0.9.1] - 2024-08-08
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin.
+
+### Added
+- Metrics support (closes #478)
+ - OpenTelemetry Push Exporter
+ - Prometheus Pull Exporter (closes #275)
+- HTTP endpoint access controls (closes #266 #329 #542)
+- Add `options` setting to PostgreSQL driver (closes #662)
+- Add `isActive` property to defaults on Sieve/get JMAP method (closes #624)
+
+### Changed
+- Perform `must-match-sender` checks after sender rewriting (closes #394)
+- Only perform email ingest duplicate check on the target mailbox (closes #632)
+
+### Fixed
+- Properly parse `Forwarded` and `X-Forwarded-For` headers (fixes #669)
+- Resolve DKIM macros when generating DNS records (fixes #666)
+- Fixed `is_local_domain` Sieve function (fixes #622)
+
+## [0.9.0] - 2024-08-01
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin. This version includes breaking changes to the Webhooks configuration and produces a slightly different log output, read [UPGRADING.md](UPGRADING.md) for details.
+
+### Added
+- Improved and faster tracing and logging.
+- Customizable event logging levels.
+
+### Changed
+
+### Fixed
+- ManageSieve: Return capabilities after successful `STARTTLS`
+- Do not provide `{auth_authen}` Milter macro unless the user is authenticated
+
+## [0.8.5] - 2024-07-07
+
+To upgrade replace the `stalwart-mail` binary.
+
+### Added
+- Restore deleted e-mails (Enterprise Edition only)
+- Kubernetes (K8S) livenessProbe and readinessProbe endpoints.
+
+### Changed
+- Avoid sending reports for DMARC/delivery reports (#173)
+
+### Fixed
+- Refresh old FoundationDB read transactions (#520)
+- Subscribing shared mailboxes doesn't work (#251)
+
+## [0.8.4] - 2024-07-03
+
+To upgrade replace the `stalwart-mail` binary.
+
+### Added
+
+### Changed
+
+### Fixed
+- Fix TOTP validation order.
+- Increase Jemalloc page size on armv7 builds.
+
+## [0.8.3] - 2024-07-01
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin.
+
+### Added
+- Two-factor authentication with Time-based One-Time Passwords (#436)
+- Application passwords (#479).
+- Option to disable user accounts.
+
+### Changed
+- DANE success on EndEntity match regardless of TrustAnchor validation.
+
+### Fixed
+- Fix ManageSieve GETSCRIPT response: Add missing CRLF (#563)
+- Do not return CAPABILITIES after ManageSieve AUTH=PLAIN SASL exchange (#548)
+- POP3 QUIT must write a response (#568)
+
+## [0.8.2] - 2024-06-22
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin and spam filter versions.
+
+### Added
+- Webhooks support (#480)
+- MTA Hooks (like milter but over HTTP)
+- Manually train and test spam classifier (#473 #264 #257 #471)
+- Allow configuring default mailbox names, roles and subscriptions (#125 #290 #458 #498)
+- Include `robots.txt` (#542)
+
+### Changed
+- Milter support on all SMTP stages (#183)
+- Do not announce `STARTTLS` if the listener does not support it.
+
+### Fixed
+- Incoming reports stored in the wrong subspace (#543)
+- Return `OK` after a successful ManageSieve SASL authentication flow (#187)
+- Case-insensitive search in settings API (#487)
+- Fix `session.rcpt.script` default variable name (#502)
+
+## [0.8.1] - 2024-05-23
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin and spam filter versions.
+
+### Added
+- POP3 support.
+- DKIM signature length exploit protection.
+- Faster email deletion.
+- Junk/Trash folder auto-expunge and changelog auto-expiry (#403)
+- IP allowlists.
+- HTTP Strict Transport Security option.
+- Add TLS Reporting DNS entry (#464).
+
+### Changed
+- Use separate account for master user.
+- Include server hostname in SMTP greetings (#448).
+
+### Fixed
+- IP addresses trigger `R_SUSPICIOUS_URL` false positive (#461 #419).
+- JMAP identities should not return null signatures.
+- Include authentication headers and check queue quotas on Sieve message forwards.
+- ARC seal using just one signature.
+- Remove technical subdomains from MTA-STS policies and TLS records (#429).
+
+## [0.8.0] - 2024-05-13
+
+This version uses a different database layout which is incompatible with previous versions. Please read the [UPGRADING.md](UPGRADING.md) file for more information on how to upgrade from previous versions.
+
+### Added
+- Clustering support with node auto-discovery and partition-tolerant failure detection.
+- Autoconfig and MS Autodiscover support (#336)
+- New variables `retry_num`, `notify_num`, `last_error` add `last_status` available in queue expressions.
+- Performance improvements, in particular for FoundationDB.
+- Improved full-text indexing with lower disk space usage.
+- MTA-STS policy management.
+- TLSA Records generation for DANE (#397)
+- Queued message visualization from the web-admin.
+- Master user support.
+
+### Changed
+- Make `certificate.*` local keys by default.
+- Removed `server.run-as.*` settings.
+- Add Microsoft Office Macro types to bad mime types (#391)
+
+### Fixed
+- mySQL TLS support (#415)
+- Resolve file macros after dropping root privileges.
+- Updated order of SPF Records (#395).
+- Avoid duplicate accountIds when using case insensitive external directories (#399)
+- `authenticated_as` variable not usable for must-match-sender (#372)
+- Remove `StandardOutput`, `StandardError` in service (#390)
+- SMTP `AUTH=LOGIN` compatibility issues with Microsoft Outlook (#400)
+
+## [0.7.3] - 2024-05-01
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin version.
+
+### Added
+- Full database export and import functionality
+- Add --help and --version command line arguments (#365)
+- Allow catch-all addresses when validating must match sender
+
+### Changed
+- Add `groupOfUniqueNames` to the list of LDAP object classes
+
+### Fixed
+- Trim spaces in DNS-01 ACME secrets (#382)
+- Allow only one journald tracer (#375)
+- `authenticated_as` variable not usable for must-match-sender (#372)
+- Fixed `BOGUS_ENCRYPTED_AND_TEXT` spam filter rule
+- Fixed parsing of IPv6 DNS server addresses
+
+## [0.7.2] - 2024-04-17
+
+To upgrade replace the `stalwart-mail` binary and then upgrade to the latest web-admin version.
+
+### Added
+- Support for `DNS-01` and `HTTP-01` ACME challenges (#226)
+- Configurable external resources (#355)
+
+### Changed
+
+### Fixed
+- Startup failure when Elasticsearch is down/starting up (#334)
+- URL decode path elements in REST API.
+
+## [0.7.1] - 2024-04-12
+
+To upgrade replace the `stalwart-mail` binary.
+
+### Added
+- Make initial admin password configurable via env (#311)
+
+### Changed
+- WebAdmin download URL.
+
+### Fixed
+- Remove ASN.1 DER structure from DKIM ED25519 public keys.
+- Filter out invalid timestamps on log entries.
+
+## [0.7.0] - 2024-04-09
+
+This version uses a different database layout and introduces multiple breaking changes in the configuration files. Please read the [UPGRADING.md](UPGRADING.md) file for more information on how to upgrade from previous versions.
+
+### Added
+- Web-based administration interface.
+- REST API for management and configuration.
+- Automatic RSA and ED25519 DKIM key generation.
+- Support for compressing binaries in the blob store (#227).
+- Improved performance accessing IMAP mailboxes with a large number of messages.
+- Support for custom DNS resolvers.
+- Support for multiple loggers with different levels and outputs.
+
+### Changed
+
+### Fixed
+- Store quotas as `u64` rather than `u32`.
+- Second IDLE connections disconnects the first one (#280).
+- Use relaxed DNS parsing, allowing underscores in DNS labels (#172).
+- Escape regexes within `matches()` expressions (#155).
+- ManageSieve LOGOUT should reply with `OK` instead of `BYE`.
+
+## [0.6.0] - 2024-02-14
+
+This version introduces breaking changes in the configuration file. Please read the [UPGRADING.md](UPGRADING.md) file for more information on how to upgrade from previous versions.
+
+### Added
+- Distributed and fault-tolerant SMTP message queues.
+- Distributed rate-limiting and fail2ban.
+- Expressions in configuration files.
+
+### Changed
+
+### Fixed
+- Do not include `STATUS` in IMAP `NOOP` responses (#234).
+- Allow multiple SMTP `HELO` commands.
+- Redirect OAuth using a `301` instead of a `307` code.
+
+## [0.5.3] - 2024-01-14
+
+Please read the [UPGRADING.md](UPGRADING.md) file for more information on how to upgrade from previous versions.
+
+### Added
+- Built-in [fail2ban](https://stalw.art/docs/server/fail2ban) and IP address/mask blocking (#164).
+- CLI: Read URL and credentials from environment variables (#88).
+- mySQL driver: Add `max-allowed-packet` setting (#201).
+
+### Changed
+- Unified storage settings for all services (read the [UPGRADING.md](UPGRADING.md) for details)
+
+### Fixed
+- IMAP retrieval of auto-encrypted emails (#203).
+- mySQL driver: Parse `timeout.wait` property as duration (#202).
+- `X-Forwarded-For` header on JMAP Rate-Limit does not work (#208).
+- Use timeouts in install script (#138).
+
+## [0.5.2] - 2024-01-07
+
+Please read the [UPGRADING.md](UPGRADING.md) file for more information on how to upgrade from previous versions.
+
+### Added
+- [ACME](https://stalw.art/docs/server/tls/acme) support for automatic TLS certificate generation and renewal (#160).
+- TLS certificate [hot-reloading](https://stalw.art/docs/management/database/maintenance#tls-certificate-reloading).
+- [HAProxy protocol](https://stalw.art/docs/server/proxy) support (#36).
+
+### Changed
+
+### Fixed
+- IMAP command `SEARCH ` is using UIDs rather than sequence numbers.
+- IMAP responses to `APPEND` and `EXPUNGE` should include `HIGHESTMODSEQ` when `CONDSTORE` is enabled.
+
+## [0.5.1] - 2024-01-02
+
+### Added
+- SMTP smuggling protection: Sanitization of outgoing messages that do not use `CRLF` as line endings.
+- SMTP sender validation for authenticated users: Added the `session.auth.must-match-sender` configuration option to enforce that the sender address used in the `MAIL FROM` command matches the authenticated user or any of their associated e-mail addresses.
+
+### Changed
+
+### Fixed
+- Invalid DKIM signatures for empty message bodies.
+- IMAP command `SEARCH BEFORE` is not properly parsed.
+- IMAP command `FETCH` fails to parse single arguments without parentheses.
+- IMAP command `ENABLE QRESYNC` should also enable `CONDSTORE` extension.
+- IMAP response to `ENABLE` command does not include enabled capabilities list.
+- IMAP response to `FETCH ENVELOPE` should not return `NIL` when the `From` header is missing.
+
+## [0.5.0] - 2023-12-27
+
+This version requires a database migration and introduces breaking changes in the configuration file. Please read the [UPGRADING.md](UPGRADING.md) file for more information.
+
+### Added
+- Performance enhancements:
+ - Messages are parsed only once and their offsets stored in the database, which avoids having to parse them on every `FETCH` request.
+ - Background full-text indexing.
+ - Optimization of database access functions.
+- Storage layer improvements:
+ - In addition to `FoundationDB` and `SQLite`, now it is also possible to use `RocksDB`, `PostgreSQL` and `mySQL` as a storage backend.
+ - Blobs can now be stored in any of the supported data stores, it is no longer limited to the file system or S3/MinIO.
+ - Full-text searching con now be done internally or delegated to `ElasticSearch`.
+ - Spam databases can now be stored in any of the supported data stores or `Redis`. It is no longer necessary to have an SQL server to use the spam filter.
+- Internal directory:
+ - User account, groups and mailing lists can now be managed directly from Stalwart without the need of an external LDAP or SQL directory.
+ - HTTP API to manage users, groups, domains and mailing lists.
+- IMAP4rev1 `Recent` flag support, which improves compatibility with old IMAP clients.
+- LDAP bind authentication, to support some LDAP servers such as `lldap` which do not expose the userPassword attribute.
+- Messages marked a spam by the spam filter can now be automatically moved to the account's `Junk Mail` folder.
+- Automatic creation of JMAP identities.
+
+### Changed
+
+### Fixed
+- Spamhaus DNSBL return codes.
+- CLI tool reports authentication errors rather than a parsing error.
+
+## [0.4.2] - 2023-11-01
+
+### Added
+- JMAP for Quotas support ([RFC9425](https://www.rfc-editor.org/rfc/rfc9425.html))
+- JMAP Blob Management Extension support ([RFC9404](https://www.rfc-editor.org/rfc/rfc9404.html))
+- Spam Filter - Empty header rules.
+
+### Changed
+
+### Fixed
+- Daylight savings time support for crontabs.
+- JMAP `oldState` doesn’t reflect in `*/changes` (#56)
+
+## [0.4.1] - 2023-10-26
+
+### Added
+
+### Changed
+
+### Fixed
+- Dockerfile entrypoint script.
+- `bayes_is_balanced` function.
+
+## [0.4.0] - 2023-10-25
+
+This version introduces some breaking changes in the configuration file. Please read the [UPGRADING.md](UPGRADING.md) file for more information.
+
+### Added
+- Built-in Spam and Phishing filter.
+- Scheduled queries on some directory types.
+- In-memory maps and lists containing glob or regex patterns.
+- Remote retrieval of in-memory list/maps with fallback mechanisms.
+- Macros and support for including files from TOML config files.
+
+### Changed
+- `config.toml` is now split in multiple TOML files for better organization.
+- **BREAKING:** Configuration key prefix `jmap.sieve` (JMAP Sieve Interpreter) has been renamed to `sieve.untrusted`.
+- **BREAKING:** Configuration key prefix `sieve` (SMTP Sieve Interpreter) has been renamed to `sieve.trusted`.
+
+### Fixed
+
+## [0.3.10] - 2023-10-17
+
+### Added
+- Option to allow invalid certificates on outbound SMTP connections.
+- Option to disable ansi colors on `stdout`.
+
+### Changed
+- SMTP reject messages are now logged as `info` rather than `debug`.
+
+### Fixed
+
+## [0.3.9] - 2023-10-07
+
+### Added
+- Support for reading environment variables from the configuration file using the `!ENV_VAR_NAME` special keyword.
+- Option to disable ANSI color codes in logs.
+
+### Changed
+- Querying directories from a Sieve script is now done using the `query()` method from `eval`. Your scripts will need to be updated, please refer to the [new syntax](https://stalw.art/docs/smtp/filter/sieve#directory-queries).
+
+### Fixed
+- IPrev lookups of IPv4 mapped to IPv6 addresses.
+
+## [0.3.8] - 2023-09-19
+
+### Added
+- Journal logging support
+- IMAP support for UTF8 APPEND
+
+### Changed
+- Replaced `rpgp` with `sequoia-pgp` due to rpgp bug.
+
+### Fixed
+- Fix: IMAP folders that contain a & can't be used (#90)
+- Fix: Ignore empty lines in IMAP requests
+
+## [0.3.7] - 2023-09-05
+
+### Added
+- Option to disable IMAP All Messages folder (#68).
+- Option to allow unencrypted SMTP AUTH (#72)
+- Support for `rcpt-domain` key in `rcpt.relay` SMTP rule evaluation.
+
+### Changed
+
+### Fixed
+- SMTP strategy `Ipv6thenIpv4` returns only IPv6 addresses (#70)
+- Invalid IMAP `FETCH` responses for non-UTF-8 messages (#70)
+- Allow `STATUS` and `ACL` IMAP operations on virtual mailboxes.
+- IMAP `SELECT QRESYNC` without specifying a UID causes panic (#67)
+- Milter `DATA` command is sent after headers which causes ClamAV to hang.
+- Sieve `redirect` of unmodified messages does not work.
+
+## [0.3.6] - 2023-08-29
+
+### Added
+- Arithmetic and logical expression evaluation in Sieve scripts.
+- Support for storing query results in Sieve variables.
+- Results of SPF, DKIM, ARC, DMARC and IPREV checks available as environment variables in Sieve scripts.
+- Configurable protocol flags for Milter filters.
+- Fall-back to plain text when `STARTTLS` fails and `starttls` is set to `optional`.
+
+### Changed
+
+### Fixed
+- Do not panic when `hash = 0` in reports. (#60)
+- JMAP Session resource returns `EmailSubmission` capabilities using arrays rather than objects.
+- ManageSieve `PUTSCRIPT` should replace existing scripts.
+
+## [0.3.5] - 2023-08-18
+
+### Added
+- TCP listener option `nodelay`.
+
+### Changed
+
+### Fixed
+- SMTP: Allow disabling `STARTTLS`.
+- JMAP: Support for `OPTIONS` HTTP method.
+
+## [0.3.4] - 2023-08-09
+
+### Added
+- JMAP: Support for setting custom HTTP response headers (#52)
+
+### Changed
+
+### Fixed
+- SMTP: Missing envelope keys in rewrite rules (#25)
+- SMTP: Remove CRLF from Milter headers
+- JMAP/IMAP: Successful authentication requests should not count when rate limiting
+- IMAP: Case insensitive Inbox selection
+- IMAP: Automatically create Inbox for group accounts
+
+## [0.3.3] - 2023-08-02
+
+### Added
+- Encryption at rest with **S/MIME** or **OpenPGP**.
+- Support for referencing context variables from dynamic values.
+
+### Changed
+
+### Fixed
+- Support for PKCS8v1 ED25519 keys (#20).
+- Automatic retry for import/export blob downloads (#14)
+
+## [0.3.2] - 2023-07-28
+
+### Added
+- Sender and recipient address rewriting using regular expressions and sieve scripts.
+- Subaddressing and catch-all addresses using regular expressions (#10).
+- Dynamic variables in SMTP rules.
+
+### Changed
+- Added CLI to Docker container (#19).
+
+### Fixed
+- Workaround for a bug in `sqlx` that caused SQL time-outs (#15).
+- Support for ED25519 certificates in PEM files (#20).
+- Better handling of concurrent IMAP UID map modifications (#17).
+- LDAP domain lookups from SMTP rules.
+
+## [0.3.1] - 2023-07-22
+
+### Added
+- Milter filter support.
+- Match IP address type using /0 mask (#16).
+
+### Changed
+
+### Fixed
+- Support for OpenLDAP password hashing schemes between curly brackets (#8).
+- Add CA certificates to Docker runtime (#5).
+
+## [0.3.0] - 2023-07-16
+
+### Added
+- **LDAP** and **SQL** authentication.
+- **subaddressing** and **catch-all** addresses.
+- **S3-compatible** storage.
+
+### Changed
+- Merged the `stalwart-jmap`, `stalwart-imap` and `stalwart-smtp` repositories into
+ `stalwart-mail`.
+- Removed clustering module and replaced it with a **FoundationDB** backend option.
+- Integrated Stalwart SMTP into Stalwart JMAP.
+- Rewritten JMAP protocol parser.
+- Rewritten store backend.
+- Rewritten IMAP server to have direct access to the message store (no more IMAP proxy).
+- Replaced `actix` with `hyper`.
+
+### Fixed
+
diff --git a/CNAME b/CNAME
new file mode 100644
index 0000000..554a1af
--- /dev/null
+++ b/CNAME
@@ -0,0 +1 @@
+get.stalw.art
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..5081afa
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,61 @@
+# Contributing
+
+Thank you for your interest in contributing to Stalwart. We appreciate the support and enthusiasm of the open-source community. To keep the project maintainable and the review process sustainable, contributions are subject to the policies described below. Please read them in full before opening a pull request.
+
+## Vouched Contributors Only
+
+Due to the high volume of low-quality, AI-generated submissions, pull requests are limited to a list of vouched contributors. Pull requests opened by anyone who is not on this list are closed automatically.
+
+To be added as a vouched contributor, post a message at [support.stalw.art](https://support.stalw.art) explaining the code changes you would like to submit, and include a link to the proposed change (a branch, diff, or draft). Once a maintainer has reviewed your request and vouched for you, you will be able to open pull requests directly.
+
+This policy lets us focus limited review capacity on contributions from people who have taken the time to understand the codebase and discuss their changes first.
+
+## What Contributions Are Accepted
+
+At this stage of the project we accept a narrow set of contributions:
+
+- **Bug fixes.** Corrections to existing, incorrect behavior are welcome. Please include steps to reproduce the bug and describe the fix.
+- **Translations.** Additions and corrections to existing translations are welcome.
+
+New features are generally **not** accepted, unless they involve only a few lines of code. Larger features fall outside the scope of what we can review and integrate while the architecture is still evolving.
+
+If you would like to see a new feature, please request it at [support.stalw.art](https://support.stalw.art) under the **Feature Ideas** category rather than opening a pull request. This lets the community discuss and prioritize ideas before any code is written.
+
+## No AI-Generated Code
+
+AI-generated code is not accepted in this project.
+
+Even the most advanced models write inefficient Rust code. Beyond raw performance, AI creates technical debt by generating large amounts of code that not even the authors who submitted it can fully understand or maintain. Reviewing and untangling such contributions costs the maintainers far more time than it saves.
+
+Using AI as a fancy autocomplete is perfectly fine. What matters is that every line generated by a model is read, understood, and reviewed by a human before it is submitted. You are responsible for every line in your pull request, regardless of how it was produced. If you cannot explain why a change is written the way it is, it is not ready to be submitted.
+
+## Pull Request Process
+
+Once you are a vouched contributor:
+
+1. Keep each pull request small and focused on a single logical change.
+2. Match the style and conventions of the surrounding code.
+3. Make sure the project builds and the test suite passes before opening the pull request.
+4. In the pull request description, explain what the change does and why, and link to the [support.stalw.art](https://support.stalw.art) discussion where the change was vouched.
+
+## Code of Conduct
+
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation. We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
+
+You can read the full Code of Conduct [here](https://github.com/stalwartlabs/.github/blob/main/CODE_OF_CONDUCT.md).
+
+## Licensing
+
+This project is licensed under the Affero General Public License (AGPL) version 3.0. By contributing to this project, you agree that your contributions will be licensed under the AGPL-3.0 license.
+
+## Fiduciary Contributor License Agreement
+
+Before making any contributions, all contributors are required to sign the Fiduciary Contributor License Agreement (FLA). The FLA is a legal agreement that assigns the copyright of contributions to a designated fiduciary, who manages these rights on behalf of the project. This arrangement ensures that the software remains free and open, even as contributors come and go.
+
+Key points of the FLA:
+
+- Ensures the software remains free and open source
+- Protects the project from potential copyright issues
+- Includes a reversion clause: if the fiduciary violates Free Software principles, rights revert to the original contributors
+
+For more details about the FLA, please refer to the [FLA FAQ](https://fsfe.org/activities/fla/fla.en.html).
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 0000000..55cb635
--- /dev/null
+++ b/Cargo.lock
@@ -0,0 +1,10792 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "RustyXML"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b5ace29ee3216de37c0546865ad08edef58b0f9e76838ed8959a84a990e58c5"
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "adler32"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aae1277d39aeec15cb388266ecc24b11c80469deae6067e17a1a7aa9e5c1f234"
+
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common 0.1.7",
+ "generic-array 0.14.7",
+]
+
+[[package]]
+name = "aead"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
+dependencies = [
+ "crypto-common 0.2.2",
+ "inout 0.2.2",
+]
+
+[[package]]
+name = "aes"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
+dependencies = [
+ "cfg-if",
+ "cipher 0.4.4",
+ "cpufeatures 0.2.17",
+ "zeroize",
+]
+
+[[package]]
+name = "aes"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35f0f96ce78e38c3dc6d8948aa8163d06385be74000f3c7a95bf1eef35d3ea32"
+dependencies = [
+ "cipher 0.5.2",
+ "cpubits",
+ "cpufeatures 0.3.1",
+]
+
+[[package]]
+name = "aes-gcm"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
+dependencies = [
+ "aead 0.5.2",
+ "aes 0.8.4",
+ "cipher 0.4.4",
+ "ctr 0.9.2",
+ "ghash 0.5.1",
+ "subtle",
+]
+
+[[package]]
+name = "aes-gcm"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f2b8006a0c83f52b62ba44a97b58bf76fe2f70a329e588f67f89691d93d498f"
+dependencies = [
+ "aead 0.6.1",
+ "aes 0.9.3",
+ "cipher 0.5.2",
+ "ctr 0.10.1",
+ "ctutils",
+ "ghash 0.6.0",
+]
+
+[[package]]
+name = "aes-gcm-siv"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c32325128cb24de2a2d14d92da7569dae7073f9e47334521d494747fa94d902"
+dependencies = [
+ "aead 0.6.1",
+ "aes 0.9.3",
+ "cipher 0.5.2",
+ "ctr 0.10.1",
+ "ctutils",
+ "polyval 0.7.3",
+]
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "getrandom 0.3.4",
+ "once_cell",
+ "serde",
+ "version_check",
+ "zerocopy 0.8.57",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "arc-swap"
+version = "1.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b"
+dependencies = [
+ "rustversion",
+]
+
+[[package]]
+name = "arcstr"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03918c3dbd7701a85c6b9887732e2921175f26c350b4563841d0958c21d57e6d"
+
+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2 0.10.6",
+ "cpufeatures 0.2.17",
+ "password-hash 0.5.0",
+]
+
+[[package]]
+name = "argon2"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "134c52ddac6d63c576bef8168db10c83c49c26444ecbc68060fef078925a901c"
+dependencies = [
+ "base64ct",
+ "blake2 0.11.0",
+ "cpufeatures 0.3.1",
+ "password-hash 0.6.1",
+]
+
+[[package]]
+name = "array-init"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d62b7694a562cdf5a74227903507c56ab2cc8bdd1f781ed5cb4cf9c9f810bfc"
+
+[[package]]
+name = "arrayvec"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
+
+[[package]]
+name = "ascii-canvas"
+version = "4.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef1e3e699d84ab1b0911a1010c5c106aa34ae89aeac103be5ce0c3859db1e891"
+dependencies = [
+ "term",
+]
+
+[[package]]
+name = "asn1-rs"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f43a50ac4fdca5df8e885c21b835997f0a1cdee65494a6847694a98652d9d8"
+dependencies = [
+ "asn1-rs-derive",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 2.0.20",
+ "time",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "astral-tokio-tar"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b18457efd137254e016bbde5e1d88df61c4e1a5ae2223746e56123bac6af2463"
+dependencies = [
+ "futures-core",
+ "libc",
+ "portable-atomic",
+ "rustc-hash",
+ "rustix",
+ "tokio",
+ "tokio-stream",
+ "xattr",
+]
+
+[[package]]
+name = "async-channel"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81953c529336010edd6d8e358f886d9581267795c61b19475b71314bffa46d35"
+dependencies = [
+ "concurrent-queue",
+ "event-listener 2.5.3",
+ "futures-core",
+]
+
+[[package]]
+name = "async-compression"
+version = "0.4.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f10dafd0c8d2e51ae9a748805777613ed0bbe17bf586b76c8311f45c020a32f"
+dependencies = [
+ "compression-codecs",
+ "compression-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "async-lock"
+version = "3.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
+dependencies = [
+ "event-listener 5.4.2",
+ "event-listener-strategy",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-nats"
+version = "0.50.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83a251fa1a4c9d0fe6e816b7acd60549e473e08d14f27a1d992c2675abff05f"
+dependencies = [
+ "aws-lc-rs",
+ "bytes",
+ "futures-util",
+ "memchr",
+ "pin-project",
+ "portable-atomic",
+ "rand 0.10.2",
+ "regex",
+ "rustls-native-certs",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "serde",
+ "serde_json",
+ "serde_repr",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-rustls",
+ "tokio-stream",
+ "tokio-util",
+ "tokio-websockets",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "async-recursion"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "async-stream"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b5a71a6f37880a80d1d7f19efd781e4b5de42c88f0722cc13bcb6cc2cfe8476"
+dependencies = [
+ "async-stream-impl",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream-impl"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "attohttpc"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16e2cdb6d5ed835199484bb92bb8b3edd526effe995c61732580439c1a67e2e9"
+dependencies = [
+ "base64 0.22.1",
+ "http 1.5.0",
+ "log",
+ "rustls",
+ "serde",
+ "serde_json",
+ "url",
+ "webpki-roots 1.0.9",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "aws-creds"
+version = "0.39.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca3b85155d265df828f84e53886ed9e427aed979dd8a39f5b8b2162c77e142d7"
+dependencies = [
+ "attohttpc",
+ "home",
+ "log",
+ "quick-xml 0.38.4",
+ "rust-ini",
+ "serde",
+ "thiserror 2.0.20",
+ "time",
+ "url",
+]
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
+dependencies = [
+ "aws-lc-sys",
+ "untrusted 0.7.1",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+ "pkg-config",
+]
+
+[[package]]
+name = "aws-region"
+version = "0.28.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "838b36c8dc927b6db1b6c6b8f5d05865f2213550b9e83bf92fa99ed6525472c0"
+dependencies = [
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "axum"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
+dependencies = [
+ "axum-core",
+ "bytes",
+ "futures-util",
+ "http 1.5.0",
+ "http-body",
+ "http-body-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "sync_wrapper",
+ "tower",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http 1.5.0",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "azure_core"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b552ad43a45a746461ec3d3a51dfb6466b4759209414b439c165eb6a6b7729e"
+dependencies = [
+ "async-trait",
+ "base64 0.22.1",
+ "bytes",
+ "dyn-clone",
+ "futures",
+ "getrandom 0.2.17",
+ "hmac 0.12.1",
+ "http-types",
+ "once_cell",
+ "paste",
+ "pin-project",
+ "quick-xml 0.31.0",
+ "rand 0.8.8",
+ "reqwest 0.12.28",
+ "rustc_version",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "time",
+ "tracing",
+ "url",
+ "uuid",
+]
+
+[[package]]
+name = "azure_storage"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59f838159f4d29cb400a14d9d757578ba495ae64feb07a7516bf9e4415127126"
+dependencies = [
+ "RustyXML",
+ "async-lock",
+ "async-trait",
+ "azure_core",
+ "bytes",
+ "serde",
+ "serde_derive",
+ "time",
+ "tracing",
+ "url",
+ "uuid",
+]
+
+[[package]]
+name = "azure_storage_blobs"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97e83c3636ae86d9a6a7962b2112e3b19eb3903915c50ce06ff54ff0a2e6a7e4"
+dependencies = [
+ "RustyXML",
+ "azure_core",
+ "azure_storage",
+ "azure_svc_blobstorage",
+ "bytes",
+ "futures",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "time",
+ "tracing",
+ "url",
+ "uuid",
+]
+
+[[package]]
+name = "azure_svc_blobstorage"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e6c6f20c5611b885ba94c7bae5e02849a267381aecb8aee577e8c35ff4064c6"
+dependencies = [
+ "azure_core",
+ "bytes",
+ "futures",
+ "log",
+ "once_cell",
+ "serde",
+ "serde_json",
+ "time",
+]
+
+[[package]]
+name = "base16ct"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
+
+[[package]]
+name = "base32"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "022dfe9eb35f19ebbcb51e0b40a5ab759f46ad60cadf7297e0bd085afb50e076"
+
+[[package]]
+name = "base64"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
+
+[[package]]
+name = "base64"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
+[[package]]
+name = "bincode"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36eaf5d7b090263e8150820482d5d93cd964a81e4019913c972f4edcc6edb740"
+dependencies = [
+ "bincode_derive",
+ "serde",
+ "unty",
+]
+
+[[package]]
+name = "bincode_derive"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf95709a440f45e986983918d0e8a1f30a9b1df04918fc828670606804ac3c09"
+dependencies = [
+ "virtue",
+]
+
+[[package]]
+name = "bindgen"
+version = "0.72.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895"
+dependencies = [
+ "bitflags 2.13.2",
+ "cexpr",
+ "clang-sys",
+ "itertools 0.13.0",
+ "log",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash",
+ "shlex 1.3.0",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "biscuit"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dbfddc8cc5cc927876d9f138e7ded44c6116c544d3cca2c3a2759e46ba916c7"
+dependencies = [
+ "chrono",
+ "data-encoding",
+ "num-bigint 0.4.8",
+ "num-traits",
+ "once_cell",
+ "ring",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "bit-set"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
+dependencies = [
+ "bit-vec 0.8.0",
+]
+
+[[package]]
+name = "bit-set"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34ddef2995421ab6a5c779542c81ee77c115206f4ad9d5a8e05f4ff49716a3dd"
+dependencies = [
+ "bit-vec 0.9.1",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+
+[[package]]
+name = "bit-vec"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "bitpacking"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96a7139abd3d9cebf8cd6f920a389cf3dc9576172e32f4563f188cae3c3eb019"
+dependencies = [
+ "crunchy",
+]
+
+[[package]]
+name = "bitvec"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddcec3d12c579d40898fe0a9a358a803c23e9c52ca3c425707f81c9436211837"
+dependencies = [
+ "funty",
+ "radium",
+ "tap",
+ "wyz",
+]
+
+[[package]]
+name = "bitvec-nom2"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d988fcc40055ceaa85edc55875a08f8abd29018582647fd82ad6128dba14a5f0"
+dependencies = [
+ "bitvec",
+ "nom",
+]
+
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "blake2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b5d4d889834ee8ecfc0f8426ad30faf7cdcb10f741a8e6d7224d95325479f6f"
+dependencies = [
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "blake3"
+version = "1.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d9e454fc11f76977dc803893aff6304ed33d6a26efae8696573bea74baa27ae"
+dependencies = [
+ "arrayvec",
+ "cc",
+ "cfg-if",
+ "constant_time_eq",
+ "cpufeatures 0.3.1",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
+dependencies = [
+ "generic-array 0.14.7",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array 0.14.7",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array 0.4.15",
+ "zeroize",
+]
+
+[[package]]
+name = "block-padding"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
+dependencies = [
+ "generic-array 0.14.7",
+]
+
+[[package]]
+name = "block-padding"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "710f1dd022ef4e93f8a438b4ba958de7f64308434fa6a87104481645cc30068b"
+dependencies = [
+ "hybrid-array 0.4.15",
+]
+
+[[package]]
+name = "blowfish"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32fa6a061124e37baba002e496d203e23ba3d7b73750be82dbfbc92913048a5b"
+dependencies = [
+ "byteorder",
+ "cipher 0.2.5",
+ "opaque-debug",
+]
+
+[[package]]
+name = "blowfish"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e412e2cd0f2b2d93e02543ceae7917b3c70331573df19ee046bcbc35e45e87d7"
+dependencies = [
+ "byteorder",
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "bollard"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbe8358268799ebb3e4df23cb9d47f4c72bbc4f5247e2fa6a1bf7b6c0baea220"
+dependencies = [
+ "async-stream",
+ "base64 0.22.1",
+ "bitflags 2.13.2",
+ "bollard-buildkit-proto",
+ "bollard-stubs",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "home",
+ "http 1.5.0",
+ "http-body-util",
+ "hyper",
+ "hyper-named-pipe",
+ "hyper-rustls",
+ "hyper-util",
+ "hyperlocal",
+ "log",
+ "num",
+ "pin-project-lite",
+ "rand 0.10.2",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-pki-types",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "serde_urlencoded",
+ "thiserror 2.0.20",
+ "time",
+ "tokio",
+ "tokio-stream",
+ "tokio-util",
+ "tonic",
+ "tower-service",
+ "url",
+ "winapi",
+]
+
+[[package]]
+name = "bollard-buildkit-proto"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5c97450e79c7c565302dd92e86b08823b47550fcb4fc5ce910194d1b087a1a3"
+dependencies = [
+ "prost",
+ "prost-types",
+ "tonic",
+ "tonic-prost",
+]
+
+[[package]]
+name = "bollard-stubs"
+version = "1.53.1-rc.29.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce412eb6f7096743011dc3cb5c674caeb24ced61d8c498fe07cf7998a4fea889"
+dependencies = [
+ "base64 0.22.1",
+ "bollard-buildkit-proto",
+ "bytes",
+ "prost",
+ "serde",
+ "serde_json",
+ "serde_repr",
+ "time",
+]
+
+[[package]]
+name = "bs58"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "bstr"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bb31b46c14244e20ee9984b11bf5c992b91fb6939fea616e3512c8baecdbe5f"
+dependencies = [
+ "memchr",
+ "serde_core",
+]
+
+[[package]]
+name = "btoi"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b5ab9db53bcda568284df0fd39f6eac24ad6f7ba7ff1168b9e76eba6576b976"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "buffered-reader"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7531a07caf83a3fa3b47a233b437ee7910cccfb688555d224338295a0a64fcc"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "bytecheck"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26333eeac754f0ad8a6bcd0eb0ac012156302e4e16b852b72ee399aea4f12c29"
+dependencies = [
+ "bytecheck_derive",
+ "ptr_meta",
+ "rancor",
+ "simdutf8",
+]
+
+[[package]]
+name = "bytecheck_derive"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46d07918caa9eeaaf06b7873925c53a61daac173539b4f7715090745e44e4e69"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "bytecount"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "175812e0be2bccb6abe50bb8d566126198344f707e304f45c648fd8f2cc0365e"
+
+[[package]]
+name = "bytemuck"
+version = "1.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "bzip2"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3a53fac24f34a81bc9954b5d6cfce0c21e18ec6959f44f56e8e90e4bb7c346c"
+dependencies = [
+ "libbz2-rs-sys",
+]
+
+[[package]]
+name = "bzip2-sys"
+version = "0.1.13+1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225bff33b2141874fe80d71e07d6eec4f85c5c216453dd96388240f96e1acc14"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
+
+[[package]]
+name = "calcard"
+version = "0.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75b779382e675380a1ff8a4873acee5ba60158be7a00458fb98e6b85aad1f2ee"
+dependencies = [
+ "ahash",
+ "chrono",
+ "chrono-tz",
+ "hashify",
+ "jmap-tools",
+ "mail-builder 0.5.0",
+ "mail-parser",
+ "rkyv",
+ "serde",
+ "serde_json",
+ "uuid",
+]
+
+[[package]]
+name = "calendrical_calculations"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5abbd6eeda6885048d357edc66748eea6e0268e3dd11f326fff5bd248d779c26"
+dependencies = [
+ "core_maths",
+ "displaydoc",
+]
+
+[[package]]
+name = "camellia"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3264e2574e9ef2b53ce6f536dea83a69ac0bc600b762d1523ff83fe07230ce30"
+dependencies = [
+ "byteorder",
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "cast5"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b07d673db1ccf000e90f54b819db9e75a8348d6eb056e9b8ab53231b7a9911"
+dependencies = [
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "castaway"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dec551ab6e7578819132c713a93c022a05d60159dc86e7a7050223577484c55a"
+dependencies = [
+ "rustversion",
+]
+
+[[package]]
+name = "cbc"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
+dependencies = [
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "cbc"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce2dc9ee5f88d11e0beb842c88b33c8a5cf0d1329c4b19494af42b07dbfe8896"
+dependencies = [
+ "cipher 0.5.2",
+]
+
+[[package]]
+name = "cc"
+version = "1.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3eb0f42d6c360dc3f8a821f6bf2fdea7f72bfd36b3076eb0e6d1e9e0752fff4"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex 2.0.1",
+]
+
+[[package]]
+name = "cedarwood"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0524a528a6a0288df1863c3c20fe92c301875b4941e7b6c4b394ab08c5a4c55"
+dependencies = [
+ "smallvec",
+]
+
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "cfb"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a347dcabdae9c31b0825fd6a8bed285ec9c2acb89c47827126d52fa4f59cece3"
+dependencies = [
+ "fnv",
+ "uuid",
+ "web-time",
+]
+
+[[package]]
+name = "cfb-mode"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "738b8d467867f80a71351933f70461f5b56f24d5c93e0cf216e59229c968d330"
+dependencies = [
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
+[[package]]
+name = "chacha20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+dependencies = [
+ "cfg-if",
+ "cipher 0.5.2",
+ "cpufeatures 0.3.1",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "chacha20poly1305"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b89e1c441e926b9c82a8d023f6e1b7ae0adcfaa7d621814e4d60789bac751cb"
+dependencies = [
+ "aead 0.6.1",
+ "chacha20",
+ "cipher 0.5.2",
+ "poly1305",
+]
+
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "serde",
+ "wasm-bindgen",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "chrono-tz"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6139a8597ed92cf816dfb33f5dd6cf0bb93a6adc938f11039f371bc5bcd26c3"
+dependencies = [
+ "chrono",
+ "phf 0.12.1",
+]
+
+[[package]]
+name = "cipher"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f8e7987cbd042a63249497f41aed09f8e65add917ea6566effbc56578d6801"
+dependencies = [
+ "generic-array 0.14.7",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+dependencies = [
+ "crypto-common 0.1.7",
+ "inout 0.1.4",
+ "zeroize",
+]
+
+[[package]]
+name = "cipher"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
+dependencies = [
+ "block-buffer 0.12.1",
+ "crypto-common 0.2.2",
+ "inout 0.2.2",
+]
+
+[[package]]
+name = "clang-sys"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "157a8ba7b480713b56f4c09fd13fc3e0a22a5dfab8097ba61cbc5feef950788a"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
+[[package]]
+name = "cmac"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8543454e3c3f5126effff9cd44d562af4e31fb8ce1cc0d3dcd8f084515dbc1aa"
+dependencies = [
+ "cipher 0.4.4",
+ "dbl",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
+[[package]]
+name = "combine"
+version = "4.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "memchr",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
+]
+
+[[package]]
+name = "common"
+version = "0.16.22"
+dependencies = [
+ "aes-gcm-siv",
+ "ahash",
+ "arc-swap",
+ "aws-lc-rs",
+ "base64 0.23.1",
+ "bincode",
+ "calcard",
+ "chrono",
+ "compact_str",
+ "coordinator",
+ "decancer",
+ "directory",
+ "dns-update",
+ "futures",
+ "hashify",
+ "hickory-proto",
+ "hostname",
+ "hyper",
+ "idna",
+ "imagesize",
+ "infer 0.22.0",
+ "jmap_proto",
+ "jsonwebtoken",
+ "libc",
+ "lz4_flex 0.14.0",
+ "mail-auth",
+ "mail-builder 1.0.0",
+ "mail-parser",
+ "md5",
+ "nlp",
+ "nohash-hasher",
+ "opentelemetry",
+ "opentelemetry-otlp",
+ "opentelemetry-semantic-conventions",
+ "opentelemetry_sdk",
+ "p256",
+ "p384",
+ "parking_lot",
+ "pem 4.0.0",
+ "pkcs8",
+ "privdrop",
+ "prometheus",
+ "proxy-header",
+ "psl",
+ "quick-xml 0.41.0",
+ "quick_cache",
+ "rasn",
+ "rasn-pkix",
+ "rcgen",
+ "regex",
+ "registry",
+ "reqwest 0.13.5",
+ "rkyv",
+ "rsa",
+ "rustls",
+ "rustls-pemfile",
+ "rustls-pki-types",
+ "sequoia-openpgp",
+ "serde",
+ "serde_json",
+ "sha1 0.11.0",
+ "sha2 0.11.0",
+ "sieve-rs",
+ "smtp-proto",
+ "socket2 0.6.5",
+ "store",
+ "tinyvec",
+ "tokio",
+ "tokio-rustls",
+ "trc",
+ "types",
+ "unicode-security",
+ "utils",
+ "whatlang",
+ "x509-parser",
+ "xxhash-rust",
+ "zip",
+ "zxcvbn",
+]
+
+[[package]]
+name = "compact_str"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79fcda08c33bb58b97008b2cdada6622500e949e060f5913361763121abd2416"
+dependencies = [
+ "castaway",
+ "cfg-if",
+ "itoa",
+ "rkyv",
+ "serde",
+ "static_assertions",
+ "zmij",
+]
+
+[[package]]
+name = "compression-codecs"
+version = "0.4.41"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58a6d0db8759036a783bc7c3f7a07f8cef3bf9470eb1db3bc86e8bcd1c5d0fe8"
+dependencies = [
+ "compression-core",
+ "flate2",
+ "memchr",
+]
+
+[[package]]
+name = "compression-core"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e8ccc4ea9f6acc32d102c0f6d471d11d913ad15f20c04de743374861fa1d414"
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
+[[package]]
+name = "const-random"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87e00182fe74b066627d63b85fd550ac2998d4b0bd86bfed477a0ae4c7c71359"
+dependencies = [
+ "const-random-macro",
+]
+
+[[package]]
+name = "const-random-macro"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9d839f2a20b0aee515dc581a6172f2321f96cab76c1a38a4c584a194955390e"
+dependencies = [
+ "getrandom 0.2.17",
+ "once_cell",
+ "tiny-keccak",
+]
+
+[[package]]
+name = "const_format"
+version = "0.2.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4481a617ad9a412be3b97c5d403fef8ed023103368908b9c50af598ff467cc1e"
+dependencies = [
+ "const_format_proc_macros",
+ "konst",
+]
+
+[[package]]
+name = "const_format_proc_macros"
+version = "0.2.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d57c2eccfb16dbac1f4e61e206105db5820c9d26c3c472bc17c774259ef7744"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
+[[package]]
+name = "constant_time_eq"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
+
+[[package]]
+name = "coordinator"
+version = "0.16.22"
+dependencies = [
+ "async-nats",
+ "futures",
+ "rdkafka",
+ "redis",
+ "registry",
+ "store",
+ "tokio",
+ "trc",
+ "zenoh",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "core_detect"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48"
+
+[[package]]
+name = "core_maths"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77745e017f5edba1a9c1d854f6f3a52dac8a12dd5af5d2f54aecf61e43d80d30"
+dependencies = [
+ "libm",
+]
+
+[[package]]
+name = "cpubits"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc16"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "338089f42c427b86394a5ee60ff321da23a5c89c9d89514c829687b26359fcff"
+
+[[package]]
+name = "crc32fast"
+version = "1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "critical-section"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
+
+[[package]]
+name = "crossbeam"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e71406cd8807725f7ac2f999a4cdd32e98f829fdf65f528343cebf945e41df1e"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-deque",
+ "crossbeam-epoch",
+ "crossbeam-queue",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98b0cc327b5bc766e7fda9c9260cc0fa81b43a8e240440422dff70788e3f9ef1"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "622f3fc73690be383c7214310406f28a90e6edeadc3cea882f9d71e495b9711a"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc74980687109a3b14c72fd458107bf0baa1da1a1a805e178d15501ba9b86d9d"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03e8bd762f7479489c70ed6c768ddca99d7296857de437a68dcb2a94365b3fae"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
+
+[[package]]
+name = "crunchy"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
+
+[[package]]
+name = "crypto-bigint"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
+dependencies = [
+ "generic-array 0.14.7",
+ "rand_core 0.6.4",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array 0.14.7",
+ "rand_core 0.6.4",
+ "typenum",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "getrandom 0.4.3",
+ "hybrid-array 0.4.15",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "crypto-mac"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4857fd85a0c34b3c3297875b747c1e02e06b6a0ea32dd892d8192b9ce0813ea6"
+dependencies = [
+ "generic-array 0.14.7",
+ "subtle",
+]
+
+[[package]]
+name = "csv"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52cd9d68cf7efc6ddfaaee42e7288d3a99d613d4b50f76ce9827ae0c6e14f938"
+dependencies = [
+ "csv-core",
+ "itoa",
+ "ryu",
+ "serde_core",
+]
+
+[[package]]
+name = "csv-core"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "704a3c26996a80471189265814dbc2c257598b96b8a7feae2d31ace646bb9782"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "ctr"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baaca1c4b237092596f64d571e9db6ce4109c4ef9742e27590f1709594461f21"
+dependencies = [
+ "cipher 0.5.2",
+]
+
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "curve25519-dalek-derive",
+ "digest 0.10.7",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "cx448"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4c0cf476284b03eb6c10e78787b21c7abb7d7d43cb2f02532ba6b831ed892fa"
+dependencies = [
+ "crypto-bigint",
+ "elliptic-curve",
+ "rand_core 0.6.4",
+ "sha3 0.10.9",
+ "signature 2.2.0",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "darling"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
+dependencies = [
+ "darling_core 0.20.11",
+ "darling_macro 0.20.11",
+]
+
+[[package]]
+name = "darling"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
+dependencies = [
+ "darling_core 0.23.0",
+ "darling_macro 0.23.0",
+]
+
+[[package]]
+name = "darling"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed17f5901b6630b993ca003def43f2f8ef4014fc13b047b57aad617ff32bc2ec"
+dependencies = [
+ "darling_core 0.24.1",
+ "darling_macro 0.24.1",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6837e2cf7485aaae18f86181d2f0e9a7ed297a025e220aeabf63fdebd3a2ddff"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.20.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
+dependencies = [
+ "darling_core 0.20.11",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
+dependencies = [
+ "darling_core 0.23.0",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ac7135c3ef02b2f7833bbeb1be5ba7f966dcde8a87c6b87f65a778d71a02785"
+dependencies = [
+ "darling_core 0.24.1",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "dary_heap"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b1e3a325bc115f096c8b77bbf027a7c2592230e70be2d985be950d3d5e60ebe"
+
+[[package]]
+name = "data-encoding"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
+
+[[package]]
+name = "dav"
+version = "0.16.22"
+dependencies = [
+ "calcard",
+ "chrono",
+ "common",
+ "compact_str",
+ "dav-proto",
+ "directory",
+ "groupware",
+ "hashify",
+ "http_proto",
+ "hyper",
+ "percent-encoding",
+ "registry",
+ "rkyv",
+ "store",
+ "trc",
+ "types",
+ "utils",
+]
+
+[[package]]
+name = "dav-proto"
+version = "0.16.22"
+dependencies = [
+ "calcard",
+ "chrono",
+ "compact_str",
+ "hashify",
+ "hyper",
+ "mail-parser",
+ "quick-xml 0.41.0",
+ "serde",
+ "serde_json",
+ "trc",
+ "types",
+]
+
+[[package]]
+name = "dbl"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd2735a791158376708f9347fe8faba9667589d82427ef3aed6794a8981de3d9"
+dependencies = [
+ "generic-array 0.14.7",
+]
+
+[[package]]
+name = "deadpool"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e98a7e119cd347f4201e1159b19831029e203e2d8b790547708e8157b4acf1e"
+dependencies = [
+ "deadpool-runtime",
+ "tokio",
+]
+
+[[package]]
+name = "deadpool-postgres"
+version = "0.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65a536565624b97fc19f758cd01b15d12908d3344425066efc8162236fbd3749"
+dependencies = [
+ "async-trait",
+ "deadpool",
+ "getrandom 0.4.3",
+ "tokio",
+ "tokio-postgres",
+ "tracing",
+]
+
+[[package]]
+name = "deadpool-runtime"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2657f61fb1dd8bf37a8d51093cc7cee4e77125b22f7753f49b289f831bec2bae"
+dependencies = [
+ "tokio",
+]
+
+[[package]]
+name = "decancer"
+version = "3.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9244323129647178bf41ac861a2cdb9d9c81b9b09d3d0d1de9cd302b33b8a1d"
+dependencies = [
+ "lazy_static",
+ "regex",
+]
+
+[[package]]
+name = "deflate64"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac6b926516df9c60bfa16e107b21086399f8285a44ca9711344b9e553c5146e2"
+
+[[package]]
+name = "defmt"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1"
+dependencies = [
+ "bitflags 1.3.2",
+ "defmt-macros",
+]
+
+[[package]]
+name = "defmt-macros"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8"
+dependencies = [
+ "defmt-parser",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "defmt-parser"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
+dependencies = [
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid 0.9.6",
+ "pem-rfc7468",
+ "zeroize",
+]
+
+[[package]]
+name = "der-parser"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"
+dependencies = [
+ "asn1-rs",
+ "displaydoc",
+ "nom",
+ "num-bigint 0.4.8",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "derive_builder"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "507dfb09ea8b7fa618fcf76e953f4f5e192547945816d5358edffe39f6f94947"
+dependencies = [
+ "derive_builder_macro",
+]
+
+[[package]]
+name = "derive_builder_core"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8"
+dependencies = [
+ "darling 0.20.11",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "derive_builder_macro"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
+dependencies = [
+ "derive_builder_core",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "des"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffdd80ce8ce993de27e9f063a444a4d53ce8e8db4c1f00cc03af5ad5a9867a1e"
+dependencies = [
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "digest"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
+dependencies = [
+ "generic-array 0.14.7",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer 0.10.4",
+ "const-oid 0.9.6",
+ "crypto-common 0.1.7",
+ "subtle",
+]
+
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer 0.12.1",
+ "const-oid 0.10.2",
+ "crypto-common 0.2.2",
+ "ctutils",
+ "zeroize",
+]
+
+[[package]]
+name = "directory"
+version = "0.16.22"
+dependencies = [
+ "ahash",
+ "argon2 0.6.0",
+ "base64 0.23.1",
+ "deadpool",
+ "jsonwebtoken",
+ "ldap3",
+ "mail-builder 1.0.0",
+ "mail-parser",
+ "md5",
+ "nohash-hasher",
+ "pbkdf2",
+ "pwhash",
+ "registry",
+ "reqwest 0.13.5",
+ "scrypt",
+ "serde",
+ "serde_json",
+ "sha1 0.11.0",
+ "sha2 0.11.0",
+ "store",
+ "tokio",
+ "totp-rs",
+ "trc",
+ "utils",
+]
+
+[[package]]
+name = "dirs"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
+dependencies = [
+ "libc",
+ "option-ext",
+ "redox_users",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "dlv-list"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "442039f5147480ba31067cb00ada1adae6892028e40e45fc5de7b7df6dcc1b5f"
+dependencies = [
+ "const-random",
+]
+
+[[package]]
+name = "dns-update"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "887fbd45d910c4dd5808f65c0cd686d4f0f756450b9a6c7ecce4a9f450657509"
+dependencies = [
+ "aws-lc-rs",
+ "base64 0.23.1",
+ "chrono",
+ "hex",
+ "hickory-net",
+ "hickory-proto",
+ "quick-xml 0.42.0",
+ "reqwest 0.13.5",
+ "rustls",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "tokio",
+]
+
+[[package]]
+name = "docker_credential"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29547a1dc60885a552306986316bc9701ba120c1a8db6769fa68691529ad373d"
+dependencies = [
+ "base64 0.22.1",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "dsa"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48bc224a9084ad760195584ce5abb3c2c34a225fa312a128ad245a6b412b7689"
+dependencies = [
+ "digest 0.10.7",
+ "num-bigint-dig",
+ "num-traits",
+ "pkcs8",
+ "rfc6979",
+ "sha2 0.10.9",
+ "signature 2.2.0",
+ "zeroize",
+]
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
+[[package]]
+name = "eax"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9954fabd903b82b9d7a68f65f97dc96dd9ad368e40ccc907a7c19d53e6bfac28"
+dependencies = [
+ "aead 0.5.2",
+ "cipher 0.4.4",
+ "cmac",
+ "ctr 0.9.2",
+ "subtle",
+]
+
+[[package]]
+name = "ecb"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a8bfa975b1aec2145850fcaa1c6fe269a16578c44705a532ae3edc92b8881c7"
+dependencies = [
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "ecdsa"
+version = "0.16.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
+dependencies = [
+ "der",
+ "digest 0.10.7",
+ "elliptic-curve",
+ "rfc6979",
+ "signature 2.2.0",
+ "spki",
+]
+
+[[package]]
+name = "ece"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2ea1d2f2cc974957a4e2575d8e5bb494549bab66338d6320c2789abcfff5746"
+dependencies = [
+ "base64 0.21.7",
+ "byteorder",
+ "hex",
+ "hkdf 0.12.4",
+ "lazy_static",
+ "once_cell",
+ "openssl",
+ "serde",
+ "sha2 0.10.9",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "ed25519"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+dependencies = [
+ "pkcs8",
+ "signature 2.2.0",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "rand_core 0.6.4",
+ "serde",
+ "sha2 0.10.9",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "either"
+version = "1.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
+
+[[package]]
+name = "elliptic-curve"
+version = "0.13.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
+dependencies = [
+ "base16ct",
+ "base64ct",
+ "crypto-bigint",
+ "digest 0.10.7",
+ "ff",
+ "generic-array 0.14.7",
+ "group",
+ "hkdf 0.12.4",
+ "pem-rfc7468",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "sec1",
+ "serde_json",
+ "serdect",
+ "subtle",
+ "tap",
+ "zeroize",
+]
+
+[[package]]
+name = "email"
+version = "0.16.22"
+dependencies = [
+ "aes 0.9.3",
+ "aes-gcm 0.11.1",
+ "cbc 0.2.1",
+ "chacha20poly1305",
+ "common",
+ "groupware",
+ "hashify",
+ "jmap-tools",
+ "jmap_proto",
+ "mail-builder 1.0.0",
+ "mail-parser",
+ "nlp",
+ "rand 0.8.8",
+ "rasn",
+ "rasn-cms",
+ "rasn-pkix",
+ "registry",
+ "rkyv",
+ "rsa",
+ "sequoia-openpgp",
+ "sieve-rs",
+ "store",
+ "tokio",
+ "trc",
+ "types",
+ "utils",
+]
+
+[[package]]
+name = "ena"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eabffdaee24bd1bf95c5ef7cec31260444317e72ea56c4c91750e8b7ee58d5f1"
+dependencies = [
+ "log",
+]
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.41"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5ef0006ac9ab233c38522f5ae99cae3625151de8f706cacee1cba4b8e2832a"
+dependencies = [
+ "cfg-if",
+ "core_detect",
+ "multiversion",
+ "multiversion_no_op",
+ "rustversion",
+ "scopeguard",
+ "simdutf8",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "etcetera"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de48cc4d1c1d97a20fd819def54b890cadde72ed3ad0c614822a0a433361be96"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "event-listener"
+version = "2.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
+
+[[package]]
+name = "event-listener"
+version = "5.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
+dependencies = [
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener-strategy"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
+dependencies = [
+ "event-listener 5.4.2",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event_macro"
+version = "0.16.22"
+dependencies = [
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "fallible-iterator"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4443176a9f2c162692bd3d352d745ef9413eec5782a80d8fd6f8a1ac692a07f7"
+
+[[package]]
+name = "fallible-iterator"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
+
+[[package]]
+name = "fallible-streaming-iterator"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
+
+[[package]]
+name = "fancy-regex"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1e1dacd0d2082dfcf1351c4bdd566bbe89a2b263235a2b50058f1e130a47277"
+dependencies = [
+ "bit-set 0.8.0",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "fancy-regex"
+version = "0.19.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d301f5bf187b3c295fce6468d3875037a0bccc5f6b151c63cac2f85babf21912"
+dependencies = [
+ "bit-set 0.8.0",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "farmhash"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f35ce9c8fb9891c75ceadbc330752951a4e369b50af10775955aeb9af3eee34b"
+
+[[package]]
+name = "fastbloom"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef975e30683b2d965054bb0a836f8973857c4ebf6acf274fe46617cd285060d8"
+dependencies = [
+ "foldhash 0.2.0",
+ "libm",
+ "portable-atomic",
+ "siphasher",
+]
+
+[[package]]
+name = "fastrand"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e51093e27b0797c359783294ca4f0a911c270184cb10f85783b118614a1501be"
+dependencies = [
+ "instant",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "ferroid"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee93edf3c501f0035bbeffeccfed0b79e14c311f12195ec0e661e114a0f60da4"
+dependencies = [
+ "portable-atomic",
+ "rand 0.10.2",
+ "web-time",
+]
+
+[[package]]
+name = "ff"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
+dependencies = [
+ "bitvec",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e0f1c7c3a72c66fd80abe965175f7523475c0489a87d3ff9d6e8c87d87a9d2d"
+
+[[package]]
+name = "fixed_decimal"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79c3c892f121fff406e5dd6b28c1b30096b95111c30701a899d4f2b18da6d1bd"
+dependencies = [
+ "displaydoc",
+ "smallvec",
+ "writeable",
+]
+
+[[package]]
+name = "fixedbitset"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
+
+[[package]]
+name = "flate2"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
+dependencies = [
+ "crc32fast",
+ "libz-sys",
+ "miniz_oxide",
+ "zlib-rs",
+]
+
+[[package]]
+name = "flume"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "nanorand",
+ "spin 0.9.9",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
+[[package]]
+name = "form-data"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3757d8523a60f4d3516a018e767cd3bea0829a43045d290ace16dcc92ac4f4cd"
+dependencies = [
+ "bytes",
+ "http 1.5.0",
+ "httparse",
+ "memchr",
+ "mime",
+ "serde",
+ "thiserror 2.0.20",
+ "tracing",
+]
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "foundationdb"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9a0b9e89be4942ad3c6cf76789e7eaf9489fcca2b06b1449b2d9eb015424793"
+dependencies = [
+ "async-recursion",
+ "async-trait",
+ "foundationdb-gen",
+ "foundationdb-macros",
+ "foundationdb-sys",
+ "foundationdb-tuple",
+ "futures",
+ "rand 0.10.2",
+ "serde",
+ "serde_bytes",
+ "serde_json",
+ "static_assertions",
+ "uuid",
+]
+
+[[package]]
+name = "foundationdb-gen"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db58c729fca985f56d347e5f8df5c1d3135cc8211e5688eacf695e1365449594"
+dependencies = [
+ "xml-rs",
+]
+
+[[package]]
+name = "foundationdb-macros"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f51be872cad567c58cf475749b25b9bb96e9ab6063af8bbe4f965ecf40e13cb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "try_map",
+]
+
+[[package]]
+name = "foundationdb-sys"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bac3aa47fdd7af6ac1b2a8ee4684fe4ed3d6c663c7ff5888e1846a790e6601a"
+dependencies = [
+ "bindgen",
+ "libc",
+]
+
+[[package]]
+name = "foundationdb-tuple"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c5262f7a16bddd129d31d96d09de25dee2295ce7cccaa7ed6b212f391819c64"
+dependencies = [
+ "memchr",
+ "uuid",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "funty"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
+
+[[package]]
+name = "futures"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
+
+[[package]]
+name = "futures-lite"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49a9d51ce47660b1e808d3c990b4709f2f415d928835a17dfd16991515c46bce"
+dependencies = [
+ "fastrand 1.9.0",
+ "futures-core",
+ "futures-io",
+ "memchr",
+ "parking",
+ "pin-project-lite",
+ "waker-fn",
+]
+
+[[package]]
+name = "futures-macro"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+ "zeroize",
+]
+
+[[package]]
+name = "generic-array"
+version = "1.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "337d46834ee672ab3e48caca2cb0c78cc174fb12b3a68d0d88f99a0519a5e36e"
+dependencies = [
+ "rustversion",
+ "typenum",
+]
+
+[[package]]
+name = "gethostname"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bd49230192a3797a9a4d6abe9b3eed6f7fa4c8a8a4947977c6f80025f92cbd8"
+dependencies = [
+ "rustix",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi 0.9.0+wasi-snapshot-preview1",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 6.0.0",
+ "rand_core 0.10.1",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "ghash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
+dependencies = [
+ "opaque-debug",
+ "polyval 0.6.2",
+]
+
+[[package]]
+name = "ghash"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2eecf2d5dc9b66b732b97707a0210906b1d30523eb773193ab777c0c84b3e8d5"
+dependencies = [
+ "polyval 0.7.3",
+]
+
+[[package]]
+name = "git-version"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad568aa3db0fcbc81f2f116137f263d7304f512a1209b35b85150d3ef88ad19"
+dependencies = [
+ "git-version-macro",
+]
+
+[[package]]
+name = "git-version-macro"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53010ccb100b96a67bc32c0175f0ed1426b31b655d562898e57325f81c023ac0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
+
+[[package]]
+name = "group"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
+dependencies = [
+ "ff",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "groupware"
+version = "0.16.22"
+dependencies = [
+ "ahash",
+ "calcard",
+ "chrono",
+ "common",
+ "compact_str",
+ "hashify",
+ "icu_datetime",
+ "icu_locale_core",
+ "icu_plurals",
+ "icu_provider",
+ "indexmap 2.14.2",
+ "nlp",
+ "percent-encoding",
+ "registry",
+ "rkyv",
+ "serde",
+ "serde_json",
+ "store",
+ "trc",
+ "types",
+ "utils",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http 1.5.0",
+ "indexmap 2.14.2",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+dependencies = [
+ "ahash",
+ "allocator-api2",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.1.5",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.2.0",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.2.0",
+]
+
+[[package]]
+name = "hashify"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd1246c0e5493286aeb2dde35b1f4eb9c4ce00e628641210a5e553fc001a1f26"
+dependencies = [
+ "indexmap 2.14.2",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "hashlink"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a596f1b20ed2cc5ecac41a164aaebc7258057060f06c0cf7a2ba3991ee7990fb"
+dependencies = [
+ "hashbrown 0.17.1",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hermit-abi"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e17592d60ebacc7d5e169f4663c5f84f9161cc90328abcfe8456f41e4dfcb284"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hickory-net"
+version = "0.26.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c480823ed7c2c5d0f09c41020cb6b7c28029ce60ec42dc942158dcf22f8e0a4d"
+dependencies = [
+ "async-trait",
+ "aws-lc-rs",
+ "bitflags 2.13.2",
+ "bytes",
+ "cfg-if",
+ "data-encoding",
+ "futures-channel",
+ "futures-io",
+ "futures-util",
+ "h2",
+ "hickory-proto",
+ "http 1.5.0",
+ "idna",
+ "ipnet",
+ "jni",
+ "lru-cache",
+ "parking_lot",
+ "rand 0.10.2",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "thiserror 2.0.20",
+ "time",
+ "tinyvec",
+ "tokio",
+ "tokio-rustls",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "hickory-proto"
+version = "0.26.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12b92608f679a6fa515dd1d15c1ff89443026e391200a2c840c7afcba482893d"
+dependencies = [
+ "aws-lc-rs",
+ "bitflags 2.13.2",
+ "data-encoding",
+ "idna",
+ "ipnet",
+ "jni",
+ "once_cell",
+ "prefix-trie",
+ "rand 0.10.2",
+ "ring",
+ "rustls-pki-types",
+ "thiserror 2.0.20",
+ "time",
+ "tinyvec",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "hickory-resolver"
+version = "0.26.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f3da5255c95d5a716857d54b5b8f4e8d67c3484d3beaaaae2ce25063b3ba981"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "hickory-net",
+ "hickory-proto",
+ "ipconfig",
+ "ipnet",
+ "jni",
+ "moka",
+ "ndk-context",
+ "once_cell",
+ "parking_lot",
+ "rand 0.10.2",
+ "resolv-conf",
+ "rustls",
+ "smallvec",
+ "system-configuration",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-rustls",
+ "tracing",
+]
+
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac 0.12.1",
+]
+
+[[package]]
+name = "hkdf"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4aaa26c720c68b866f2c96ef5c1264b3e6f473fe5d4ce61cd44bbe913e553018"
+dependencies = [
+ "hmac 0.13.0",
+]
+
+[[package]]
+name = "hmac"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1441c6b1e930e2817404b5046f1f989899143a12bf92de603b69f4e0aee1e15"
+dependencies = [
+ "crypto-mac",
+ "digest 0.9.0",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "hmac"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
+dependencies = [
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "hostname"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "617aaa3557aef3810a6369d0a99fac8a080891b68bd9f9812a1eeda0c0730cbd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "http"
+version = "0.16.22"
+dependencies = [
+ "async-stream",
+ "base64 0.23.1",
+ "chrono",
+ "common",
+ "dav",
+ "directory",
+ "email",
+ "flate2",
+ "form-data",
+ "groupware",
+ "hashify",
+ "http-body-util",
+ "http_proto",
+ "hyper",
+ "hyper-util",
+ "jmap",
+ "jmap_proto",
+ "mail-auth",
+ "mail-builder 1.0.0",
+ "mail-parser",
+ "mime",
+ "percent-encoding",
+ "registry",
+ "rkyv",
+ "scim",
+ "serde",
+ "serde_json",
+ "services",
+ "sha2 0.11.0",
+ "smtp",
+ "store",
+ "tokio",
+ "trc",
+ "types",
+ "utils",
+]
+
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http 1.5.0",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http 1.5.0",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "http-types"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e9b187a72d63adbfba487f48095306ac823049cb504ee195541e91c7775f5ad"
+dependencies = [
+ "anyhow",
+ "async-channel",
+ "base64 0.13.1",
+ "futures-lite",
+ "infer 0.2.3",
+ "pin-project-lite",
+ "rand 0.7.3",
+ "serde",
+ "serde_json",
+ "serde_qs",
+ "serde_urlencoded",
+ "url",
+]
+
+[[package]]
+name = "http_proto"
+version = "0.16.22"
+dependencies = [
+ "common",
+ "compact_str",
+ "form_urlencoded",
+ "http-body-util",
+ "hyper",
+ "percent-encoding",
+ "registry",
+ "serde",
+ "serde_json",
+ "trc",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "humantime"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15cdd26707701c53297e2fa6afb323d55fbc1d0810c3aec078ae3ef0424c3c15"
+
+[[package]]
+name = "hybrid-array"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "891d15931895091dea5c47afa5b3c9a01ba634b311919fd4d41388fa0e3d76af"
+dependencies = [
+ "typenum",
+]
+
+[[package]]
+name = "hybrid-array"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
+dependencies = [
+ "ctutils",
+ "typenum",
+ "zeroize",
+]
+
+[[package]]
+name = "hyper"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http 1.5.0",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-named-pipe"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fab3637d6b04a8037af8a266fdf6cf92ea957e8c53981a2bf6136572531025bf"
+dependencies = [
+ "hex",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+dependencies = [
+ "http 1.5.0",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "rustls-native-certs",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots 1.0.9",
+]
+
+[[package]]
+name = "hyper-timeout"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
+dependencies = [
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http 1.5.0",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2 0.6.5",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "hyperlocal"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
+dependencies = [
+ "hex",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core 0.62.2",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_calendar"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58655df2f728e46e4eee80bddebefacf52ec3e77cdb925014b47c5a5905eb55c"
+dependencies = [
+ "calendrical_calculations",
+ "chrono",
+ "displaydoc",
+ "icu_calendar_data",
+ "icu_locale_core",
+ "icu_locale_fallback",
+ "icu_provider",
+ "ixdtf",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_calendar_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc00caaa3fb3201ff7a18aa458e8c3ab042b9da154cfdf948bdde3936c31c36e"
+
+[[package]]
+name = "icu_collections"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_datetime"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c44df99c4c5297b05653d1a1629f13bdc9fd4044acfbbaf30b15194a1eed4cd6"
+dependencies = [
+ "chrono",
+ "displaydoc",
+ "fixed_decimal",
+ "icu_calendar",
+ "icu_datetime_data",
+ "icu_decimal",
+ "icu_locale_core",
+ "icu_locale_fallback",
+ "icu_pattern",
+ "icu_plurals",
+ "icu_provider",
+ "icu_time",
+ "potential_utf",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_datetime_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8bb5555f6e4b42233f58564351ce16d73e9e6ebfce6bdcf29875d0cfc554d6a8"
+
+[[package]]
+name = "icu_decimal"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9eb8f655bba2d0c0459e43a5b0e6cd3cd388109898fb3d85d048165e8b0abd08"
+dependencies = [
+ "displaydoc",
+ "fixed_decimal",
+ "icu_decimal_data",
+ "icu_locale_core",
+ "icu_locale_fallback",
+ "icu_plurals",
+ "icu_provider",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_decimal_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4c887fc7d4c297cf3f9436864af9e3dba7f8be9415a6c2a7f392f3b1636298c"
+
+[[package]]
+name = "icu_locale"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "785f595c61ef57169a467eeed7b4b6936a66f6cacbb116a96ee86da983251bf4"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_locale_data",
+ "icu_locale_fallback",
+ "icu_provider",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "serde",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d37d91460e362a5cf58907cd7ce871411775ee6294e49a5cc8e6cec16dfa75ea"
+
+[[package]]
+name = "icu_locale_fallback"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "251af8e57c9400e3eb58242fe5b8b1152b2a64fdf4cf632f923c38ccee6f2fa9"
+dependencies = [
+ "icu_locale_core",
+ "icu_locale_fallback_data",
+ "icu_provider",
+ "potential_utf",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_fallback_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "decf2a22ec8fa68f1a0c1129a3f8583f8f8bc24e8b9ccbe98ead99f62a4dc3a8"
+
+[[package]]
+name = "icu_normalizer"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
+
+[[package]]
+name = "icu_pattern"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b3db611446bd92c246b03e4aa0bafa71ddb194af431ddbb42b9d70e4bfce1a0"
+dependencies = [
+ "displaydoc",
+ "either",
+ "serde",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_plurals"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e475e6766ef87b1d3c1f97be6363995b0bfaeddbc789671615df598a97ff0593"
+dependencies = [
+ "fixed_decimal",
+ "icu_locale_fallback",
+ "icu_plurals_data",
+ "icu_provider",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_plurals_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1251aa39a95e1333888e499b1263e1c196447a28948acf5bdabd82c046f153bf"
+
+[[package]]
+name = "icu_properties"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
+
+[[package]]
+name = "icu_provider"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "serde",
+ "stable_deref_trait",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_time"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af37e1c3b9f3ab564b619fdf4b22de169f6381eb0f7048e3ca454290c438126b"
+dependencies = [
+ "calendrical_calculations",
+ "chrono",
+ "chrono-tz",
+ "displaydoc",
+ "icu_calendar",
+ "icu_locale_core",
+ "icu_provider",
+ "icu_time_data",
+ "ixdtf",
+ "serde",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_time_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "005ff86fa5851a77fc0a977b72d717f777bd9230415a247219d7898aefb1517a"
+
+[[package]]
+name = "idea"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "075557004419d7f2031b8bb7f44bb43e55a83ca7b63076a8fb8fe75753836477"
+dependencies = [
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "imagesize"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65b27460c2c92b037f3f94c538ed9a3342f3fdf923606781629ccb35f82d042a"
+
+[[package]]
+name = "imap"
+version = "0.16.22"
+dependencies = [
+ "ahash",
+ "common",
+ "compact_str",
+ "directory",
+ "email",
+ "imap_proto",
+ "mail-parser",
+ "md5",
+ "nlp",
+ "parking_lot",
+ "rand 0.10.2",
+ "registry",
+ "store",
+ "tokio",
+ "tokio-rustls",
+ "trc",
+ "types",
+ "utils",
+]
+
+[[package]]
+name = "imap_proto"
+version = "0.16.22"
+dependencies = [
+ "ahash",
+ "base64 0.23.1",
+ "chrono",
+ "compact_str",
+ "hashify",
+ "mail-parser",
+ "trc",
+ "types",
+ "utils",
+]
+
+[[package]]
+name = "include-flate"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48f173716febb1ad596c16ea5637b5f1790ea32de8e627493ff82bc73b0876ce"
+dependencies = [
+ "include-flate-codegen",
+ "include-flate-compress",
+]
+
+[[package]]
+name = "include-flate-codegen"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a7875b62a72ad3f3203cdd8950d4cf9947db036030b974b8b37ceae90c8d8c0"
+dependencies = [
+ "include-flate-compress",
+ "proc-macro-error3",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "include-flate-compress"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44fbb9c5ccb9a5b67b4afa2974c27e5507ea1bf6d22828cef418e4dfaeca51dd"
+dependencies = [
+ "libflate",
+ "zstd",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "infer"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64e9829a50b42bb782c1df523f78d332fe371b10c661e78b7a3c34b0198e9fac"
+
+[[package]]
+name = "infer"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4200d433cbd5178df7797c9c2e75b348b728e39631cf14520d1e2fc424201f4"
+dependencies = [
+ "cfb",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+dependencies = [
+ "block-padding 0.3.3",
+ "generic-array 0.14.7",
+]
+
+[[package]]
+name = "inout"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
+dependencies = [
+ "block-padding 0.4.2",
+ "hybrid-array 0.4.15",
+]
+
+[[package]]
+name = "instant"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "ipconfig"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d40460c0ce33d6ce4b0630ad68ff63d6661961c48b6dba35e5a4d81cfb48222"
+dependencies = [
+ "socket2 0.6.5",
+ "widestring",
+ "windows-registry",
+ "windows-result 0.4.1",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "ipnetwork"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf466541e9d546596ee94f9f69590f89473455f88372423e0008fc1a7daf100e"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "itertools"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "ixdtf"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d3667095d64c3ecffc96463a21157b04bf3e252f6e8d5750b20c02e33c194e3"
+
+[[package]]
+name = "jieba-macros"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34904340bc65749a9e9a02fcc7f3368e675427c18447b9bbe02df52c15c9a36a"
+dependencies = [
+ "phf_codegen",
+]
+
+[[package]]
+name = "jieba-rs"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb5bdea4dc241d589e179f39d2a778f31490f3370aa2f626223dbd930ebc5c9d"
+dependencies = [
+ "bytecount",
+ "cedarwood",
+ "include-flate",
+ "jieba-macros",
+ "phf 0.13.1",
+ "regex",
+ "rustc-hash",
+]
+
+[[package]]
+name = "jiff"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ab1baf72f08796de0260609515130699b890ac25f30e610ad894bc5856cafdb"
+dependencies = [
+ "defmt",
+ "jiff-core",
+ "jiff-static",
+ "jiff-tzdb-platform",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "jiff-core"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e52fe76043ccecc9005d2305ebaadf7d7fc0cc89ca6baa10a94d6bc68c7128c"
+dependencies = [
+ "defmt",
+ "log",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "378268a1116ad67ae6228701118ac9f491d78fda38a40a1f1a9e1348de6f7212"
+dependencies = [
+ "jiff-core",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jiff-tzdb"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "142bd39932ad231f10513df9ab62661fead8719872150b7ad02a2df79f4e141e"
+
+[[package]]
+name = "jiff-tzdb-platform"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "875a5a69ac2bab1a891711cf5eccbec1ce0341ea805560dcd90b7a2e925132e8"
+dependencies = [
+ "jiff-tzdb",
+]
+
+[[package]]
+name = "jmap"
+version = "0.16.22"
+dependencies = [
+ "async-stream",
+ "base64 0.23.1",
+ "calcard",
+ "chrono",
+ "common",
+ "directory",
+ "email",
+ "futures-util",
+ "groupware",
+ "hashify",
+ "http-body-util",
+ "http_proto",
+ "hyper",
+ "hyper-util",
+ "jmap-tools",
+ "jmap_proto",
+ "mail-auth",
+ "mail-builder 1.0.0",
+ "mail-parser",
+ "nlp",
+ "p256",
+ "rand 0.10.2",
+ "registry",
+ "reqwest 0.13.5",
+ "rkyv",
+ "serde",
+ "serde_json",
+ "services",
+ "sha1 0.11.0",
+ "sha2 0.11.0",
+ "sieve-rs",
+ "smtp",
+ "smtp-proto",
+ "spam-filter",
+ "store",
+ "tokio",
+ "tokio-tungstenite 0.30.0",
+ "trc",
+ "tungstenite 0.30.0",
+ "types",
+ "utils",
+]
+
+[[package]]
+name = "jmap-client"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4deab22e057d24e32122f0fc6e2d667a124fdd6a0d8ef3ed4f8a89923c11084f"
+dependencies = [
+ "ahash",
+ "async-stream",
+ "base64 0.22.1",
+ "chrono",
+ "futures-util",
+ "maybe-async",
+ "parking_lot",
+ "reqwest 0.13.5",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tokio-tungstenite 0.29.0",
+]
+
+[[package]]
+name = "jmap-tools"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5bdcd368dcd58a5efaac10c142fb8cddb4d2949af1297b624df3ff0db4cbff54"
+dependencies = [
+ "hashify",
+ "rkyv",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "jmap_proto"
+version = "0.16.22"
+dependencies = [
+ "ahash",
+ "calcard",
+ "compact_str",
+ "hashify",
+ "jmap-tools",
+ "mail-parser",
+ "registry",
+ "rkyv",
+ "serde",
+ "serde_json",
+ "trc",
+ "types",
+ "utils",
+]
+
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys",
+ "log",
+ "simd_cesu8",
+ "thiserror 2.0.20",
+ "walkdir",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom 0.4.3",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.105"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce57d20d1ea864ce2ac172ab472d409214f4fd359f0b2a2775abdf522e2af99e"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "json5"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96b0db21af676c1ce64250b5f40f3ce2cf27e4e47cb91ed91eb6fe9350b430c1"
+dependencies = [
+ "pest",
+ "pest_derive",
+ "serde",
+]
+
+[[package]]
+name = "jsonwebtoken"
+version = "11.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "881733cbc631fc9e472e24447ce32a64bedf2da498d6d8570b08edc87de71f65"
+dependencies = [
+ "aws-lc-rs",
+ "base64 0.22.1",
+ "getrandom 0.2.17",
+ "js-sys",
+ "pem 3.0.6",
+ "serde",
+ "serde_json",
+ "signature 2.2.0",
+ "simple_asn1",
+ "zeroize",
+]
+
+[[package]]
+name = "keccak"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
+dependencies = [
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "keccak"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8f198d1db720e4940b5a493201d199d9f24f568f8f746bd13706243a2f71598"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+]
+
+[[package]]
+name = "kem"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01737161ba802849cfd486b5bd209d38ba4943494c249a8126005170c7621edd"
+dependencies = [
+ "crypto-common 0.2.2",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "keyed-set"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89d255a6b6ecd77bb93ce91de984d7039bff7503f500eb4851a1269732f22baf"
+dependencies = [
+ "hashbrown 0.14.5",
+]
+
+[[package]]
+name = "keyed_priority_queue"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ee7893dab2e44ae5f9d0173f26ff4aa327c10b01b06a72b52dd9405b628640d"
+dependencies = [
+ "indexmap 2.14.2",
+]
+
+[[package]]
+name = "konst"
+version = "0.2.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "128133ed7824fcd73d6e7b17957c5eb7bacb885649bd8c69708b2331a10bcefb"
+dependencies = [
+ "konst_macro_rules",
+]
+
+[[package]]
+name = "konst_macro_rules"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4933f3f57a8e9d9da04db23fb153356ecaf00cbd14aee46279c33dc80925c37"
+
+[[package]]
+name = "lalrpop"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98a80a963123205c7157323c99611bc4abb65dcbd62ef46dc4bac74a3941bc75"
+dependencies = [
+ "ascii-canvas",
+ "bit-set 0.9.1",
+ "ena",
+ "itertools 0.14.0",
+ "lalrpop-util",
+ "petgraph",
+ "regex",
+ "regex-syntax",
+ "sha3 0.10.9",
+ "string_cache",
+ "term",
+ "unicode-xid",
+ "walkdir",
+]
+
+[[package]]
+name = "lalrpop-util"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "884f3e747ed2dcee867cda1b0c31a048f9e20de2d916a248949319921a2e666e"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin 0.9.9",
+]
+
+[[package]]
+name = "lber"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cbcf559624bfd9fe8d488329a8959766335a43a9b8b2cdd6a2c379fca02909a5"
+dependencies = [
+ "bytes",
+ "nom",
+]
+
+[[package]]
+name = "ldap3"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01fe89f5e7cfb7e4701e3a38ff9f00358e026a9aee940355d88ee9d81e5c7503"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "futures",
+ "futures-util",
+ "lber",
+ "log",
+ "nom",
+ "percent-encoding",
+ "rustls",
+ "rustls-native-certs",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-rustls",
+ "tokio-stream",
+ "tokio-util",
+ "url",
+ "x509-parser",
+]
+
+[[package]]
+name = "libbz2-rs-sys"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34b357333733e8260735ba5894eb928c02ecc69c78715f01a8019e7fa7f2db4c"
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "libflate"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "561a8da1a50e1428d3c51321dafeca849df992a5bb67720c386131234caba82e"
+dependencies = [
+ "adler32",
+ "crc32fast",
+ "dary_heap",
+ "libflate_lz77",
+ "no_std_io2",
+]
+
+[[package]]
+name = "libflate_lz77"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff7a10e427698aef6eef269482776debfef63384d30f13aad39a1a95e0e098fd"
+dependencies = [
+ "hashbrown 0.16.1",
+ "no_std_io2",
+ "rle-decode-fast",
+]
+
+[[package]]
+name = "libloading"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
+dependencies = [
+ "cfg-if",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
+[[package]]
+name = "libredox"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6480ccc157a1389bb2e4891b24751b0f798ba640d22386f23143fbcc89da195a"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "librocksdb-sys"
+version = "0.17.3+10.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cef2a00ee60fe526157c9023edab23943fae1ce2ab6f4abb2a807c1746835de9"
+dependencies = [
+ "bindgen",
+ "bzip2-sys",
+ "cc",
+ "libc",
+ "libz-sys",
+ "lz4-sys",
+ "zstd-sys",
+]
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.38.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1d20bef17f513b9b3004532233187769cd072d790971f4e4da0e346eb6401e8"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "libz-sys"
+version = "1.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85bc9657773828b90eeb625adff10eeac83cc21bbfd8e23a03eaa8a33c9e28d9"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "linked-hash-map"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "lru"
+version = "0.18.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff9840bcc50b71349309900da0ce7279aa336ae71d73250b07998932c7d97c25"
+dependencies = [
+ "hashbrown 0.17.1",
+]
+
+[[package]]
+name = "lru-cache"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31e24f1ad8321ca0e8a1e0ac13f23cb668e6f5466c2c57319f6a5cf1cc8e3b1c"
+dependencies = [
+ "linked-hash-map",
+]
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "lz4-sys"
+version = "1.11.1+lz4-1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bd8c0d6c6ed0cd30b3652886bb8711dc4bb01d637a68105a3d5158039b418e6"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "lz4_flex"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b8c72594ac26bfd34f2d99dfced2edfaddfe8a476e3ff2ca0eb293d925c4f83"
+dependencies = [
+ "twox-hash 1.6.3",
+]
+
+[[package]]
+name = "lz4_flex"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecbdfe44b1bd960b68170b417450a628c43f7cf56bb3c5317e61cb230ee7f226"
+dependencies = [
+ "twox-hash 2.1.4",
+]
+
+[[package]]
+name = "lzma-rust2"
+version = "0.16.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca93e534d1142d1d0dcca6d25fe302508a5dfb40b302802904577725ea0b695b"
+dependencies = [
+ "sha2 0.11.0",
+]
+
+[[package]]
+name = "mail-auth"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e11f19d98aac923fc5b7ee30c3509733a013ef546a226acb959b9202f5ca58f0"
+dependencies = [
+ "aws-lc-rs",
+ "flate2",
+ "getrandom 0.2.17",
+ "getrandom 0.4.3",
+ "hashify",
+ "hickory-resolver",
+ "idna",
+ "mail-builder 1.0.0",
+ "mail-parser",
+ "memchr",
+ "quick-xml 0.42.0",
+ "rand 0.10.2",
+ "rkyv",
+ "rsa",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "similar",
+ "zip",
+]
+
+[[package]]
+name = "mail-builder"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c942e8a4b83f9351236c1e531ea9fa0237913d63c7fc36818430e0128a1ddf3"
+dependencies = [
+ "gethostname",
+]
+
+[[package]]
+name = "mail-builder"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccbc27cb02a58a311a404769a22f5abf63fe3173b290d80be7c534f9c7023151"
+dependencies = [
+ "gethostname",
+]
+
+[[package]]
+name = "mail-parser"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ec00bda90c6e645a54506c630c2820cd6b1890cfd2b0a169b50f74b2b8c7c86"
+dependencies = [
+ "encoding_rs",
+ "hashify",
+ "memchr",
+ "rkyv",
+ "serde",
+]
+
+[[package]]
+name = "managesieve"
+version = "0.16.22"
+dependencies = [
+ "common",
+ "compact_str",
+ "directory",
+ "email",
+ "imap",
+ "imap_proto",
+ "jmap_proto",
+ "mail-parser",
+ "registry",
+ "sieve-rs",
+ "store",
+ "tokio",
+ "tokio-rustls",
+ "trc",
+ "types",
+]
+
+[[package]]
+name = "manyhow"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b33efb3ca6d3b07393750d4030418d594ab1139cee518f0dc88db70fec873587"
+dependencies = [
+ "manyhow-macros",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "manyhow-macros"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46fce34d199b78b6e6073abf984c9cf5fd3e9330145a93ee0738a7443e371495"
+dependencies = [
+ "proc-macro-utils",
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "maplit"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
+[[package]]
+name = "maybe-async"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "746873a384ad60adc5db74471dfaba74bd278afbdcfd81db93fafcdfc8b5ca0c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "md-5"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5a279bb9607f9f53c22d496eade00d138d1bdcccd07d74650387cf94942a15"
+dependencies = [
+ "block-buffer 0.9.0",
+ "digest 0.9.0",
+ "opaque-debug",
+]
+
+[[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "md-5"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98"
+dependencies = [
+ "cfg-if",
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "md5"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ebb8d8732c6a6df3d8f032a82911cfc747e00efb95cc46e8d0acd5b5b88570c"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "memory-stats"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c73f5c649995a115e1a0220b35e4df0a1294500477f97a91d0660fb5abeb574a"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "memsec"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c797b9d6bb23aab2fc369c65f871be49214f5c759af65bde26ffaaa2b646b492"
+
+[[package]]
+name = "migration"
+version = "0.16.22"
+dependencies = [
+ "common",
+ "email",
+ "registry",
+ "spam-filter",
+ "store",
+ "tokio",
+ "trc",
+ "types",
+]
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
+dependencies = [
+ "libc",
+ "wasi 0.11.1+wasi-snapshot-preview1",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "ml-dsa"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "add6b9d92e496f16f4526d68ff29da1483aba4b119baeab8bed3b9e3544a6f3d"
+dependencies = [
+ "crypto-common 0.2.2",
+ "ctutils",
+ "hybrid-array 0.4.15",
+ "module-lattice",
+ "shake",
+ "signature 3.0.0",
+ "zeroize",
+]
+
+[[package]]
+name = "ml-kem"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e15f3e5b957493873e396a66914e83e616b6afe335cdef7efe5c6e1216aba66"
+dependencies = [
+ "hybrid-array 0.4.15",
+ "kem",
+ "module-lattice",
+ "rand_core 0.10.1",
+ "sha3 0.11.0",
+ "zeroize",
+]
+
+[[package]]
+name = "module-lattice"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c61b87c9683ab7cb1c6871d261ad5479b6b10ceb52c4352aaca3b5d35a8febe"
+dependencies = [
+ "ctutils",
+ "hybrid-array 0.4.15",
+ "num-traits",
+ "zeroize",
+]
+
+[[package]]
+name = "moka"
+version = "0.12.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4293f18e7567a1caf3c584855554377025c65e0aa445344d04171f5ad63d19b9"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+ "equivalent",
+ "parking_lot",
+ "portable-atomic",
+ "smallvec",
+ "tagptr",
+ "uuid",
+]
+
+[[package]]
+name = "multiversion"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ca4bea16ffc3f443cf7d866912118196bfef4c6a1556ca00f9f9b00bb43f7c"
+dependencies = [
+ "multiversion-macros",
+]
+
+[[package]]
+name = "multiversion-macros"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d416831a7317ef4b08bee00b69cbbb9c8763da7959a7026244d6266869f9c83"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustversion",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "multiversion_no_op"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743fb55ba31b18fb1ecef6bdc9aa2743314978ac084044301a7eee33fb99a20d"
+
+[[package]]
+name = "munge"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e17401f259eba956ca16491461b6e8f72913a0a114e39736ce404410f915a0c"
+dependencies = [
+ "munge_macro",
+]
+
+[[package]]
+name = "munge_macro"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4568f25ccbd45ab5d5603dc34318c1ec56b117531781260002151b8530a9f931"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "mysql-common-derive"
+version = "0.32.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4db8a44120571277accfaa3f3d91e7d3989d601d817c2fc01a9391b86135666"
+dependencies = [
+ "darling 0.23.0",
+ "heck",
+ "manyhow",
+ "num-bigint 0.4.8",
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "termcolor",
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "mysql_async"
+version = "0.37.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40d11da0e2d9fad4640c9f9198ee431c6d68444568f83ef1f10f3367270071e4"
+dependencies = [
+ "arc-swap",
+ "bytes",
+ "crossbeam-queue",
+ "crossbeam-utils",
+ "flate2",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "keyed_priority_queue",
+ "lru",
+ "mysql_common",
+ "percent-encoding",
+ "rand 0.10.2",
+ "rustls",
+ "serde",
+ "socket2 0.6.5",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "twox-hash 2.1.4",
+ "url",
+ "webpki-roots 1.0.9",
+]
+
+[[package]]
+name = "mysql_common"
+version = "0.37.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f27695f286b461da077b8c2f72f47feaa04ce3c3f9c0976257410e90e21208a"
+dependencies = [
+ "base64 0.22.1",
+ "bitflags 2.13.2",
+ "btoi",
+ "byteorder",
+ "bytes",
+ "crc32fast",
+ "flate2",
+ "getrandom 0.3.4",
+ "mysql-common-derive",
+ "num-bigint 0.4.8",
+ "num-traits",
+ "regex",
+ "saturating",
+ "serde",
+ "serde_json",
+ "sha1 0.10.7",
+ "sha2 0.10.9",
+ "thiserror 2.0.20",
+ "uuid",
+]
+
+[[package]]
+name = "nanorand"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a51313c5820b0b02bd422f4b44776fbf47961755c74ce64afc73bfad10226c3"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "ndk-context"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
+
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
+[[package]]
+name = "nix"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
+[[package]]
+name = "nlp"
+version = "0.16.22"
+dependencies = [
+ "ahash",
+ "hashify",
+ "jieba-rs",
+ "maplit",
+ "psl",
+ "rand 0.10.2",
+ "rkyv",
+ "rust-stemmers",
+ "serde",
+ "whatlang",
+ "xxhash-rust",
+]
+
+[[package]]
+name = "no-std-net"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43794a0ace135be66a25d3ae77d41b91615fb68ae937f904090203e81f755b65"
+
+[[package]]
+name = "no_std_io2"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "418abd1b6d34fbf6cae440dc874771b0525a604428704c76e48b29a5e67b8003"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "nohash-hasher"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bf50223579dc7cdcfb3bfcacf7069ff68243f8c363f62ffa99cf000a6b9c451"
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "nonempty-collections"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e216d0e8cf9d54fa66e5780f6e1d5dc96d1c1b3c25aeba3b6758548bcbbd8b9d"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "ntapi"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3b335231dfd352ffb0f8017f3b6027a4917f7df785ea2143d8af2adc66980ae"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "num"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
+dependencies = [
+ "num-bigint 0.4.8",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93e7820bc0a80a0238e650327316f929ba18d5be054b647490a3a6a339f3e7c0"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
+dependencies = [
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.8",
+ "smallvec",
+ "zeroize",
+]
+
+[[package]]
+name = "num-complex"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
+[[package]]
+name = "num-integer"
+version = "0.1.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c92800bd69a1eac91786bcfe9da64a897eb72911b8dc3095decbd07429e8048b"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
+dependencies = [
+ "num-bigint 0.4.8",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+ "libm",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "num_enum"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0bca838442ec211fa11de3a8b0e0e8f3a4522575b5c4c06ed722e005036f26"
+dependencies = [
+ "num_enum_derive",
+ "rustversion",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "objc2-core-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
+dependencies = [
+ "bitflags 2.13.2",
+]
+
+[[package]]
+name = "objc2-io-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33fafba39597d6dc1fb709123dfa8289d39406734be322956a69f0931c73bb15"
+dependencies = [
+ "libc",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-system-configuration"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7216bd11cbda54ccabcab84d523dc93b858ec75ecfb3a7d89513fa22464da396"
+dependencies = [
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "ocb3"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c196e0276c471c843dd5777e7543a36a298a4be942a2a688d8111cd43390dedb"
+dependencies = [
+ "aead 0.5.2",
+ "cipher 0.4.4",
+ "ctr 0.9.2",
+ "subtle",
+]
+
+[[package]]
+name = "oid-registry"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f40cff3dde1b6087cc5d5f5d4d65712f34016a03ed60e9c08dcc392736b5b7"
+dependencies = [
+ "asn1-rs",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+dependencies = [
+ "critical-section",
+ "portable-atomic",
+]
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
+[[package]]
+name = "openssl"
+version = "0.10.81"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "opentelemetry"
+version = "0.31.0"
+source = "git+https://github.com/stalwartlabs/opentelemetry-rust#274b4d324794280ce6f4def095a3428197a9e6e3"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "js-sys",
+ "pin-project-lite",
+ "thiserror 2.0.20",
+ "tracing",
+]
+
+[[package]]
+name = "opentelemetry-http"
+version = "0.31.0"
+source = "git+https://github.com/stalwartlabs/opentelemetry-rust#274b4d324794280ce6f4def095a3428197a9e6e3"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "http 1.5.0",
+ "opentelemetry",
+ "reqwest 0.13.5",
+]
+
+[[package]]
+name = "opentelemetry-otlp"
+version = "0.31.0"
+source = "git+https://github.com/stalwartlabs/opentelemetry-rust#274b4d324794280ce6f4def095a3428197a9e6e3"
+dependencies = [
+ "http 1.5.0",
+ "opentelemetry",
+ "opentelemetry-http",
+ "opentelemetry-proto",
+ "opentelemetry_sdk",
+ "prost",
+ "reqwest 0.13.5",
+ "thiserror 2.0.20",
+ "tokio",
+ "tonic",
+ "tonic-types",
+]
+
+[[package]]
+name = "opentelemetry-proto"
+version = "0.31.0"
+source = "git+https://github.com/stalwartlabs/opentelemetry-rust#274b4d324794280ce6f4def095a3428197a9e6e3"
+dependencies = [
+ "opentelemetry",
+ "opentelemetry_sdk",
+ "prost",
+ "tonic",
+ "tonic-prost",
+]
+
+[[package]]
+name = "opentelemetry-semantic-conventions"
+version = "0.31.0"
+source = "git+https://github.com/stalwartlabs/opentelemetry-rust#274b4d324794280ce6f4def095a3428197a9e6e3"
+
+[[package]]
+name = "opentelemetry_sdk"
+version = "0.31.0"
+source = "git+https://github.com/stalwartlabs/opentelemetry-rust#274b4d324794280ce6f4def095a3428197a9e6e3"
+dependencies = [
+ "futures-channel",
+ "futures-executor",
+ "futures-util",
+ "opentelemetry",
+ "percent-encoding",
+ "portable-atomic",
+ "rand 0.9.5",
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "option-ext"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
+
+[[package]]
+name = "ordered-multimap"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49203cdcae0030493bad186b28da2fa25645fa276a51b6fec8010d281e02ef79"
+dependencies = [
+ "dlv-list",
+ "hashbrown 0.14.5",
+]
+
+[[package]]
+name = "p256"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2 0.10.9",
+]
+
+[[package]]
+name = "p384"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "sha2 0.10.9",
+]
+
+[[package]]
+name = "p521"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fc9e2161f1f215afdfce23677034ae137bbd45016a880c2eb3ba8eb95f085b2"
+dependencies = [
+ "base16ct",
+ "ecdsa",
+ "elliptic-curve",
+ "primeorder",
+ "rand_core 0.6.4",
+ "sha2 0.10.9",
+]
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "parse-display"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e78deb158fb1d73b29efb4b7e9b9860b78059c670de06bd28df8d0b458ded0eb"
+dependencies = [
+ "parse-display-derive",
+ "regex",
+ "regex-syntax",
+]
+
+[[package]]
+name = "parse-display-derive"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e95a50d1084dab562913062c4c34bb204b68fc6ec38a1395909ff5aaaf4f10a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "regex",
+ "regex-syntax",
+ "structmeta",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "password-hash"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aab41826031698d6ffcd9cff78ef56ef998e39dc7e5067cdfebe373842d4723b"
+dependencies = [
+ "getrandom 0.4.3",
+ "phc",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
+[[package]]
+name = "pbkdf2"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112d82ceb8c5bf524d9af484d4e4970c9fd5a0cc15ba14ad93dccd28873b0629"
+dependencies = [
+ "digest 0.11.3",
+ "hmac 0.13.0",
+ "password-hash 0.6.1",
+ "sha2 0.11.0",
+]
+
+[[package]]
+name = "pem"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+dependencies = [
+ "base64 0.22.1",
+ "serde_core",
+]
+
+[[package]]
+name = "pem"
+version = "4.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d354a98a3d1251555de99e8fdd8afda05573c31b82f59063a7b0a29b5527f120"
+dependencies = [
+ "base64 0.23.1",
+ "serde_core",
+]
+
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pest"
+version = "2.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d45aeb61b4bf818e12d4205f2466f8c4748f85f4fce0146d1c03d69d753f0ad"
+dependencies = [
+ "memchr",
+ "ucd-trie",
+]
+
+[[package]]
+name = "pest_derive"
+version = "2.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89cc5a242e25ed4e7704d0be240f2cfbe20a8c27e7e252d94835be93d92dc39f"
+dependencies = [
+ "pest",
+ "pest_generator",
+]
+
+[[package]]
+name = "pest_generator"
+version = "2.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7abf21475cc3820fe4b2ca2dc2142902f67a02189f3b5b3a229f4febc01a43e5"
+dependencies = [
+ "pest",
+ "pest_meta",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "pest_meta"
+version = "2.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adba4db388f687393c18c51348d44a41d870ca9df71a2c98172ea3035dc6936e"
+dependencies = [
+ "pest",
+]
+
+[[package]]
+name = "petgraph"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
+dependencies = [
+ "fixedbitset",
+ "hashbrown 0.15.5",
+ "indexmap 2.14.2",
+ "serde",
+]
+
+[[package]]
+name = "phc"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44dc769b75f93afdddd8c7fa12d685292ddeff1e66f7f0f3a234cf1818afe892"
+dependencies = [
+ "base64ct",
+ "ctutils",
+ "getrandom 0.4.3",
+]
+
+[[package]]
+name = "phf"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "913273894cec178f401a31ec4b656318d95473527be05c0752cc41cdc32be8b7"
+dependencies = [
+ "phf_shared 0.12.1",
+]
+
+[[package]]
+name = "phf"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+dependencies = [
+ "phf_macros",
+ "phf_shared 0.13.1",
+ "serde",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
+dependencies = [
+ "phf_generator",
+ "phf_shared 0.13.1",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+dependencies = [
+ "fastrand 2.5.0",
+ "phf_shared 0.13.1",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+dependencies = [
+ "phf_generator",
+ "phf_shared 0.13.1",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06005508882fb681fd97892ecff4b7fd0fee13ef1aa569f8695dae7ab9099981"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pin-project"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
+[[package]]
+name = "pnet_base"
+version = "0.35.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffc190d4067df16af3aba49b3b74c469e611cad6314676eaf1157f31aa0fb2f7"
+dependencies = [
+ "no-std-net",
+]
+
+[[package]]
+name = "pnet_datalink"
+version = "0.35.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e79e70ec0be163102a332e1d2d5586d362ad76b01cec86f830241f2b6452a7b7"
+dependencies = [
+ "ipnetwork",
+ "libc",
+ "pnet_base",
+ "pnet_sys",
+ "winapi",
+]
+
+[[package]]
+name = "pnet_sys"
+version = "0.35.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d4643d3d4db6b08741050c2f3afa9a892c4244c085a72fcda93c9c2c9a00f4b"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "poly1305"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2d0073b297041425c7c3df6eb4792d598a15323fe63346852b092eca02904c"
+dependencies = [
+ "cpufeatures 0.3.1",
+ "universal-hash 0.6.1",
+]
+
+[[package]]
+name = "polyval"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "opaque-debug",
+ "universal-hash 0.5.1",
+]
+
+[[package]]
+name = "polyval"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0fa31d631f2b2cb2a544d0aa321ce847a94764d701ca2becc411138b93d49cd"
+dependencies = [
+ "cpubits",
+ "cpufeatures 0.3.1",
+ "universal-hash 0.6.1",
+]
+
+[[package]]
+name = "pop3"
+version = "0.16.22"
+dependencies = [
+ "common",
+ "directory",
+ "email",
+ "imap",
+ "mail-parser",
+ "registry",
+ "store",
+ "tokio",
+ "tokio-rustls",
+ "trc",
+ "types",
+ "utils",
+]
+
+[[package]]
+name = "portable-atomic"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10ab3eb7f3becc3a1cbc4f2c6f20267996cfc1a6467a873763411b136a122715"
+dependencies = [
+ "portable-atomic",
+]
+
+[[package]]
+name = "postgres-protocol"
+version = "0.6.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08808e3c483c46e999108051c78334f473d5adb59d78bb80a1268c7e6aa6c514"
+dependencies = [
+ "base64 0.22.1",
+ "byteorder",
+ "bytes",
+ "fallible-iterator 0.2.0",
+ "hmac 0.13.0",
+ "md-5 0.11.0",
+ "memchr",
+ "rand 0.10.2",
+ "sha2 0.11.0",
+ "stringprep",
+]
+
+[[package]]
+name = "postgres-types"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "851ca9db4932932d69f3ea811b1abe63087a0f740a47692619dd40d4899b68be"
+dependencies = [
+ "bytes",
+ "fallible-iterator 0.2.0",
+ "postgres-protocol",
+ "serde_core",
+ "serde_json",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "serde_core",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppmd-rust"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e9219bcb9d7aca6b2f63c83cf100cf78bcd619ac46e6ecbd0dd90869a39345d"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy 0.8.57",
+]
+
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
+[[package]]
+name = "prefix-trie"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cf6e3177f0684016a5c209b00882e15f8bdd3f3bb48f0491df10cd102d0c6e7"
+dependencies = [
+ "either",
+ "ipnet",
+ "num-traits",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "primeorder"
+version = "0.13.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
+dependencies = [
+ "elliptic-curve",
+]
+
+[[package]]
+name = "privdrop"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70722a5a3728c9603c8d9469b64b8d1ee54dae6d74e24146da7f501b4c76540f"
+dependencies = [
+ "libc",
+ "nix",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
+dependencies = [
+ "toml_edit",
+]
+
+[[package]]
+name = "proc-macro-error-attr3"
+version = "3.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e564d14133360e1ae169ffde5da25881b5fa47261665b8e5713c212c27799da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "proc-macro-error3"
+version = "3.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f0d4471b3436c22106b21913b1dda531558918ae9b7ec55d58aa84b43552233"
+dependencies = [
+ "proc-macro-error-attr3",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "proc-macro-utils"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eeaf08a13de400bc215877b5bdc088f241b12eb42f0a548d3390dc1c56bb7071"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "smallvec",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "prometheus"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ca5326d8d0b950a9acd87e6a3f94745394f62e4dae1b1ee22b2bc0c394af43a"
+dependencies = [
+ "cfg-if",
+ "fnv",
+ "lazy_static",
+ "memchr",
+ "parking_lot",
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "prost"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
+dependencies = [
+ "bytes",
+ "prost-derive",
+]
+
+[[package]]
+name = "prost-derive"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
+dependencies = [
+ "anyhow",
+ "itertools 0.14.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "prost-types"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f94967dc7688f3054c7fac87473ffae4cc4c3904800e2d9f5b857246d8963b0a"
+dependencies = [
+ "prost",
+]
+
+[[package]]
+name = "proxy-header"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1493f63ddddfba840c3169e997c2905d09538ace72d64e84af6324c6e0e065"
+dependencies = [
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "psl"
+version = "2.1.232"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62834e308cc83aea5e30cd8c80b8aa82cdb104a3240c7f210d4f68d46e29f308"
+dependencies = [
+ "psl-types",
+]
+
+[[package]]
+name = "psl-types"
+version = "2.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33cb294fe86a74cbcf50d4445b37da762029549ebeea341421c7c70370f86cac"
+
+[[package]]
+name = "ptr_meta"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743da816b98c921cdbe8628ef7381b76f25ecf4da599fc80aca90eae7ef70cc0"
+dependencies = [
+ "ptr_meta_derive",
+]
+
+[[package]]
+name = "ptr_meta_derive"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c8d9ca532f185d5d4db7a7c9d51420b452168ea1c2b913953281bd6fe1fcbd0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "pwhash"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "419a3ad8fa9f9d445e69d9b185a24878ae6e6f55c96e4512f4a0e28cd3bc5c56"
+dependencies = [
+ "blowfish 0.7.0",
+ "byteorder",
+ "hmac 0.10.1",
+ "md-5 0.9.1",
+ "rand 0.8.8",
+ "sha-1",
+ "sha2 0.9.9",
+]
+
+[[package]]
+name = "quick-xml"
+version = "0.31.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1004a344b30a54e2ee58d66a71b32d2db2feb0a31f9a2d302bf0536f15de2a33"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "quick-xml"
+version = "0.38.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b66c2058c55a409d601666cffe35f04333cf1013010882cec174a7467cd4e21c"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "quick-xml"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "quick-xml"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41b1177fdf999d2321d3fb46ff47159d9c1fb9ad66a4879f8c50a0b504615e9b"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "quick_cache"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "403c1a912fec895cafb223201e368234842acb9220aaf08ab042ae89ba5f135c"
+dependencies = [
+ "equivalent",
+ "foldhash 0.2.0",
+ "hashbrown 0.17.1",
+ "parking_lot",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2 0.6.5",
+ "thiserror 2.0.20",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
+dependencies = [
+ "aws-lc-rs",
+ "bytes",
+ "fastbloom",
+ "getrandom 0.4.3",
+ "lru-slab",
+ "rand 0.10.2",
+ "rand_pcg",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "slab",
+ "thiserror 2.0.20",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2 0.6.5",
+ "tracing",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "r2d2"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51de85fb3fb6524929c8a2eb85e6b6d363de4e8c48f9e2c2eac4944abc181c93"
+dependencies = [
+ "log",
+ "parking_lot",
+ "scheduled-thread-pool",
+]
+
+[[package]]
+name = "radium"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
+
+[[package]]
+name = "radsort"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "019b4b213425016d7d84a153c4c73afb0946fbb4840e4eece7ba8848b9d6da22"
+
+[[package]]
+name = "rancor"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b534442d0fcdb55d66f373d9cac6d33b6293a2335bc2136dbd06ce0e87d2572"
+dependencies = [
+ "ptr_meta",
+]
+
+[[package]]
+name = "rand"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
+dependencies = [
+ "getrandom 0.1.16",
+ "libc",
+ "rand_chacha 0.2.2",
+ "rand_core 0.5.1",
+ "rand_hc",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.5.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
+dependencies = [
+ "getrandom 0.1.16",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "rand_hc"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
+dependencies = [
+ "rand_core 0.5.1",
+]
+
+[[package]]
+name = "rand_pcg"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
+dependencies = [
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "rasn"
+version = "0.28.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d1b71dd951343df0fe30b11bca09518f3aba8e5bd0ece4564adbc2dabd875fa"
+dependencies = [
+ "bitvec",
+ "bitvec-nom2",
+ "bytes",
+ "cfg-if",
+ "chrono",
+ "either",
+ "nom",
+ "num-bigint 0.4.8",
+ "num-integer",
+ "num-traits",
+ "once_cell",
+ "rasn-derive",
+ "serde_json",
+ "snafu",
+ "xml-no-std",
+]
+
+[[package]]
+name = "rasn-cms"
+version = "0.28.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4abf4c2fe5537b99e2bf3099a7ad26e40bd9cf51bc003600ed58dbbff69a1c"
+dependencies = [
+ "rasn",
+ "rasn-pkix",
+]
+
+[[package]]
+name = "rasn-derive"
+version = "0.28.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "979eafa601d351f7f6490f1d2f4decc168e8e51cb6517c6c6ff80111951129d5"
+dependencies = [
+ "proc-macro2",
+ "rasn-derive-impl",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "rasn-derive-impl"
+version = "0.28.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eee3136c97d6f2553c0d9f84d2c2555bb87ae9b365c5c9274e8bc5c366174431"
+dependencies = [
+ "either",
+ "itertools 0.13.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "uuid",
+]
+
+[[package]]
+name = "rasn-pkix"
+version = "0.28.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c029da7ed3b94dd93b75299431984081c1eaf88ce79771c21b056f0ebf6fb964"
+dependencies = [
+ "rasn",
+]
+
+[[package]]
+name = "rayon"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
+dependencies = [
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
+dependencies = [
+ "crossbeam-deque",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "rcgen"
+version = "0.14.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8774e05a7d0de114588e6a28fe7e71694b82614ed569d86d8b389dfbc98b8ad8"
+dependencies = [
+ "aws-lc-rs",
+ "pem 4.0.0",
+ "ring",
+ "rustls-pki-types",
+ "time",
+ "x509-parser",
+ "yasna",
+]
+
+[[package]]
+name = "rdkafka"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7956f9ac12b5712e50372d9749a3102f4810a8d42481c5eae3748d36d585bcf"
+dependencies = [
+ "futures-channel",
+ "futures-util",
+ "libc",
+ "log",
+ "rdkafka-sys",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "slab",
+ "tokio",
+]
+
+[[package]]
+name = "rdkafka-sys"
+version = "4.10.0+2.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e234cf318915c1059d4921ef7f75616b5219b10b46e9f3a511a15eb4b56a3f77"
+dependencies = [
+ "cmake",
+ "libc",
+ "libz-sys",
+ "num_enum",
+ "pkg-config",
+]
+
+[[package]]
+name = "redis"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2acbc41a996f7652b2ddd9dfd98cc4ff602cfd742ae35382f07f608405ab50ed"
+dependencies = [
+ "arcstr",
+ "async-lock",
+ "bytes",
+ "cfg-if",
+ "combine",
+ "crc16",
+ "futures-channel",
+ "futures-util",
+ "itoa",
+ "log",
+ "num-bigint 0.5.1",
+ "percent-encoding",
+ "pin-project-lite",
+ "rand 0.10.2",
+ "rustls",
+ "rustls-native-certs",
+ "ryu",
+ "sha1_smol",
+ "socket2 0.6.5",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "url",
+ "xxhash-rust",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags 2.13.2",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
+dependencies = [
+ "getrandom 0.2.17",
+ "libredox",
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "regex"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "registry"
+version = "0.16.22"
+dependencies = [
+ "ahash",
+ "hashify",
+ "jmap-tools",
+ "lz4_flex 0.14.0",
+ "mail-auth",
+ "serde",
+ "tokio",
+ "trc",
+ "types",
+ "utils",
+]
+
+[[package]]
+name = "rend"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "663ba70707f96e871406fe10d68128412e619b06d1d47cb91c3a4c6501176240"
+dependencies = [
+ "bytecheck",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http 1.5.0",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams 0.4.2",
+ "web-sys",
+ "webpki-roots 1.0.9",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.13.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16a1cfa75cc186dd73d5818e510e042e40927bccc9c236b061cea97e1eb08029"
+dependencies = [
+ "base64 0.23.1",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http 1.5.0",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "mime_guess",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams 0.5.0",
+ "web-sys",
+]
+
+[[package]]
+name = "resolv-conf"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e061d1b48cb8d38042de4ae0a7a6401009d6143dc80d2e2d6f31f0bdd6470c7"
+
+[[package]]
+name = "rfc6979"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
+dependencies = [
+ "hmac 0.12.1",
+ "subtle",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted 0.9.0",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "ringbuffer-spsc"
+version = "0.1.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d3e7aa0a681b232e7cd7f856a53b10603df88ca74b79a8d8088845185492e35"
+dependencies = [
+ "array-init",
+ "crossbeam",
+]
+
+[[package]]
+name = "ripemd"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd124222d17ad93a644ed9d011a40f4fb64aa54275c08cc216524a9ea82fb09f"
+dependencies = [
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "rkyv"
+version = "0.8.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9776093b7ca170454ab1406954f7b7d97a57c51dc6c0642957fb2ef25c2d399"
+dependencies = [
+ "bytecheck",
+ "bytes",
+ "hashbrown 0.17.1",
+ "indexmap 2.14.2",
+ "munge",
+ "ptr_meta",
+ "rancor",
+ "rend",
+ "rkyv_derive",
+ "tinyvec",
+ "uuid",
+]
+
+[[package]]
+name = "rkyv_derive"
+version = "0.8.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c25ef604ac7dd839d44d64648952ea23c97866f124ff671b0ed2cf3ad9bb06e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "rle-decode-fast"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3582f63211428f83597b51b2ddb88e2a91a9d52d12831f9d08f5e624e8977422"
+
+[[package]]
+name = "roaring"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18bd8a37d17a58532776dcdf6041ce64929adca78e8489d5cacbafe99229d3e1"
+dependencies = [
+ "bytemuck",
+ "byteorder",
+]
+
+[[package]]
+name = "rocksdb"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddb7af00d2b17dbd07d82c0063e25411959748ff03e8d4f96134c2ff41fce34f"
+dependencies = [
+ "libc",
+ "librocksdb-sys",
+]
+
+[[package]]
+name = "ron"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81116b9531d61eabc41aeb228e4b6b2435bcca3233b98cf3b3077d4e6e9debb3"
+dependencies = [
+ "bitflags 2.13.2",
+ "once_cell",
+ "serde",
+ "serde_derive",
+ "typeid",
+ "unicode-ident",
+]
+
+[[package]]
+name = "rsa"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
+dependencies = [
+ "const-oid 0.9.6",
+ "digest 0.10.7",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "sha2 0.10.9",
+ "signature 2.2.0",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rsqlite-vfs"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c51c9ae4df8a7fba42103df5c621fa3c37eccf3a3c650879e90fc48b11cc192c"
+dependencies = [
+ "hashbrown 0.16.1",
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "rtrb"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9278fb35b3e730abe136e9b395b5b81b96d06b9f5478a50f0c8430a2237b22de"
+
+[[package]]
+name = "rusqlite"
+version = "0.40.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23f2a97da3e3873c73cb2a2e71b35c40ff95e0b1eefa8d72d8499a6928c3b5b3"
+dependencies = [
+ "bitflags 2.13.2",
+ "fallible-iterator 0.3.0",
+ "fallible-streaming-iterator",
+ "hashlink",
+ "libsqlite3-sys",
+ "smallvec",
+ "sqlite-wasm-rs",
+]
+
+[[package]]
+name = "rust-ini"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "796e8d2b6696392a43bea58116b667fb4c29727dc5abd27d6acf338bb4f688c7"
+dependencies = [
+ "cfg-if",
+ "ordered-multimap",
+]
+
+[[package]]
+name = "rust-s3"
+version = "0.37.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aeedb13abdaa7e48d391de05b0569b37fa0a7a64a668dff6ffb2141ad0c2527e"
+dependencies = [
+ "async-trait",
+ "aws-creds",
+ "aws-region",
+ "base64 0.22.1",
+ "bytes",
+ "cfg-if",
+ "futures-util",
+ "hex",
+ "hmac 0.12.1",
+ "http 1.5.0",
+ "log",
+ "maybe-async",
+ "md5",
+ "percent-encoding",
+ "quick-xml 0.38.4",
+ "reqwest 0.12.28",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "sha2 0.10.9",
+ "sysinfo",
+ "thiserror 2.0.20",
+ "time",
+ "tokio",
+ "tokio-stream",
+ "url",
+]
+
+[[package]]
+name = "rust-stemmers"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e46a2036019fdb888131db7a4c847a1063a7493f971ed94ea82c67eada63ca54"
+dependencies = [
+ "serde",
+ "serde_derive",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags 2.13.2",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6725596c3f2c3a0aef021139e145d4eafe314a6623e4680ca83852b2c67ab2ba"
+dependencies = [
+ "aws-lc-rs",
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
+dependencies = [
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "untrusted 0.9.0",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "salsa20"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f874456e72520ff1375a06c588eaf074b0f01f9e9e1aada45bd9b7954a6e42c"
+dependencies = [
+ "cfg-if",
+ "cipher 0.5.2",
+]
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "saturating"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ece8e78b2f38ec51c51f5d475df0a7187ba5111b2a28bdc761ee05b075d40a71"
+
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "scheduled-thread-pool"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3cbc66816425a074528352f5789333ecff06ca41b36b0b0efdfbb29edc391a19"
+dependencies = [
+ "parking_lot",
+]
+
+[[package]]
+name = "schemars"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
+dependencies = [
+ "dyn-clone",
+ "either",
+ "ref-cast",
+ "schemars_derive",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars_derive"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98c67716b46af2f0b8cf752abc930f6f9aecfbf671ecfb531db8a31dbe4e2ba"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde_derive_internals",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "scim"
+version = "0.16.22"
+dependencies = [
+ "common",
+ "directory",
+ "http_proto",
+ "hyper",
+ "icu_locale",
+ "jmap",
+ "jmap_proto",
+ "registry",
+ "scim-proto",
+ "serde",
+ "serde_json",
+ "store",
+ "trc",
+ "types",
+ "utils",
+ "xxhash-rust",
+]
+
+[[package]]
+name = "scim-proto"
+version = "0.16.22"
+dependencies = [
+ "hashify",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "scrypt"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d87af57419b594aa23fa95f09f0e06d80d84ba01c26148c43844cad6ff4485f0"
+dependencies = [
+ "cfg-if",
+ "password-hash 0.6.1",
+ "pbkdf2",
+ "salsa20",
+ "sha2 0.11.0",
+]
+
+[[package]]
+name = "sec1"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
+dependencies = [
+ "base16ct",
+ "der",
+ "generic-array 0.14.7",
+ "pkcs8",
+ "serdect",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "secrecy"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bd1c54ea06cfd2f6b63219704de0b9b4f72dcc2b8fdef820be6cd799780e91e"
+dependencies = [
+ "serde",
+ "zeroize",
+]
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags 2.13.2",
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "sequoia-openpgp"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fbc8f9818a6fad141d85993777ba298ee52c80a09bd23d45dda461a6b7c83cb"
+dependencies = [
+ "aes 0.8.4",
+ "aes-gcm 0.10.3",
+ "anyhow",
+ "argon2 0.5.3",
+ "base64 0.22.1",
+ "block-padding 0.3.3",
+ "blowfish 0.9.1",
+ "buffered-reader",
+ "camellia",
+ "cast5",
+ "cbc 0.1.2",
+ "cfb-mode",
+ "chrono",
+ "cipher 0.4.4",
+ "cx448",
+ "des",
+ "digest 0.10.7",
+ "dsa",
+ "dyn-clone",
+ "eax",
+ "ecb",
+ "ecdsa",
+ "ed25519",
+ "ed25519-dalek",
+ "getrandom 0.2.17",
+ "hkdf 0.12.4",
+ "idea",
+ "idna",
+ "lalrpop",
+ "lalrpop-util",
+ "libc",
+ "md-5 0.10.6",
+ "memsec",
+ "ml-dsa",
+ "ml-kem",
+ "num-bigint-dig",
+ "num-integer",
+ "ocb3",
+ "p256",
+ "p384",
+ "p521",
+ "rand 0.9.5",
+ "rand_core 0.6.4",
+ "regex",
+ "regex-syntax",
+ "ripemd",
+ "rsa",
+ "sha1collisiondetection",
+ "sha2 0.10.9",
+ "sha3 0.10.9",
+ "slh-dsa",
+ "thiserror 2.0.20",
+ "twofish",
+ "typenum",
+ "x25519-dalek",
+ "xxhash-rust",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_bytes"
+version = "0.11.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "serde_derive_internals"
+version = "0.30.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f852137cce035d6a4df67ccce505ff6b3e9fd3a10e3e52b24dc71e650bb1a9bd"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "indexmap 2.14.2",
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_qs"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7715380eec75f029a4ef7de39a9200e0a63823176b759d055b613f5a87df6a6"
+dependencies = [
+ "percent-encoding",
+ "serde",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "serde_repr"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d3b1629de253c70a0508c3899572da79ca359fdab27c7920ff00406df418906"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_with"
+version = "3.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "935177bb8c0cd8ca1a4e6d1a2ac8988bea69cab4f9d3a31311e012ad27868ea4"
+dependencies = [
+ "base64 0.23.1",
+ "bs58",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.14.2",
+ "jiff",
+ "schemars 0.9.0",
+ "schemars 1.2.2",
+ "serde_core",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d607aa01a3cb0ad757d6fd216136910db3c97b102fe686585689615a02dbcdc"
+dependencies = [
+ "darling 0.24.1",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "serde_yaml"
+version = "0.9.34+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
+dependencies = [
+ "indexmap 2.14.2",
+ "itoa",
+ "ryu",
+ "serde",
+ "unsafe-libyaml",
+]
+
+[[package]]
+name = "serdect"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a84f14a19e9a014bb9f4512488d9829a68e04ecabffb0f9904cd1ace94598177"
+dependencies = [
+ "base16ct",
+ "serde",
+]
+
+[[package]]
+name = "serial_test"
+version = "4.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6df5ed973ad8d834e09f824f9e9f449af6b9a3745f78dec7cc752770bd3bf11"
+dependencies = [
+ "futures-executor",
+ "futures-util",
+ "log",
+ "once_cell",
+ "parking_lot",
+ "serial_test_derive",
+]
+
+[[package]]
+name = "serial_test_derive"
+version = "4.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a22144e767da4ddd8416dbf383700542ffd8a5dc493dfecedfe1fe3ad03c98ae"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "services"
+version = "0.16.22"
+dependencies = [
+ "aes-gcm 0.11.1",
+ "aho-corasick",
+ "base64 0.23.1",
+ "calcard",
+ "common",
+ "dns-update",
+ "email",
+ "groupware",
+ "hkdf 0.13.0",
+ "jmap-tools",
+ "jmap_proto",
+ "mail-builder 1.0.0",
+ "mail-parser",
+ "memory-stats",
+ "p256",
+ "psl",
+ "registry",
+ "reqwest 0.13.5",
+ "serde_json",
+ "sha2 0.11.0",
+ "smtp",
+ "smtp-proto",
+ "spam-filter",
+ "store",
+ "tokio",
+ "trc",
+ "types",
+ "utils",
+]
+
+[[package]]
+name = "sha-1"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99cd6713db3cf16b6c84e06321e049a9b9f699826e16096d23bbcc44d15d51a6"
+dependencies = [
+ "block-buffer 0.9.0",
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.9.0",
+ "opaque-debug",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha1"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "sha1_smol"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"
+
+[[package]]
+name = "sha1collisiondetection"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f606421e4a6012877e893c399822a4ed4b089164c5969424e1b9d1e66e6964b"
+dependencies = [
+ "const-oid 0.9.6",
+ "digest 0.10.7",
+ "generic-array 1.4.5",
+]
+
+[[package]]
+name = "sha2"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d58a1e1bf39749807d89cf2d98ac2dfa0ff1cb3faa38fbb64dd88ac8013d800"
+dependencies = [
+ "block-buffer 0.9.0",
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.9.0",
+ "opaque-debug",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.1",
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "sha2-const-stable"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f179d4e11094a893b82fff208f74d448a7512f99f5a0acbd5c679b705f83ed9"
+
+[[package]]
+name = "sha3"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
+dependencies = [
+ "digest 0.10.7",
+ "keccak 0.1.6",
+]
+
+[[package]]
+name = "sha3"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be176f1a57ce4e3d31c1a166222d9768de5954f811601fb7ca06fc8203905ce1"
+dependencies = [
+ "digest 0.11.3",
+ "keccak 0.2.2",
+]
+
+[[package]]
+name = "shake"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09057cb2149ad4cbd2da1e26b351f9a4c354219421229c69c3063e6f61947c4a"
+dependencies = [
+ "digest 0.11.3",
+ "keccak 0.2.2",
+ "sponge-cursor",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shellexpand"
+version = "3.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32824fab5e16e6c4d86dc1ba84489390419a39f97699852b66480bb87d297ed8"
+dependencies = [
+ "dirs",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "sieve-rs"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd00a548fde57bd0c8e7c13ae65fc5fe30bd923ff8655c81e010f3f02a90997b"
+dependencies = [
+ "ahash",
+ "arc-swap",
+ "fancy-regex 0.19.2",
+ "hashify",
+ "mail-builder 0.5.0",
+ "mail-parser",
+ "rkyv",
+ "serde",
+]
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest 0.10.7",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "signature"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
+dependencies = [
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
+
+[[package]]
+name = "simd_cesu8"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
+[[package]]
+name = "similar"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f66ca1f7aca2474dc10c942eb22feffc897735f54cd1db90138c2fddb490987"
+dependencies = [
+ "bstr",
+]
+
+[[package]]
+name = "simple_asn1"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d585997b0ac10be3c5ee635f1bab02d512760d14b7c468801ac8a01d9ae5f1d"
+dependencies = [
+ "num-bigint 0.4.8",
+ "num-traits",
+ "thiserror 2.0.20",
+ "time",
+]
+
+[[package]]
+name = "siphasher"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "slh-dsa"
+version = "0.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd2f20f4049197e03db1104a6452f4d9e96665d79f880198dce4a7026ba5f267"
+dependencies = [
+ "const-oid 0.9.6",
+ "digest 0.10.7",
+ "hmac 0.12.1",
+ "hybrid-array 0.3.1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "sha2 0.10.9",
+ "sha3 0.10.9",
+ "signature 2.2.0",
+ "typenum",
+ "zerocopy 0.7.35",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba467056f1b547ed52077911161fc86985becbc60e8e1857c8a144dab0def891"
+
+[[package]]
+name = "smtp"
+version = "0.16.22"
+dependencies = [
+ "ahash",
+ "base64 0.23.1",
+ "blake3",
+ "common",
+ "compact_str",
+ "directory",
+ "email",
+ "hashify",
+ "mail-auth",
+ "mail-builder 1.0.0",
+ "mail-parser",
+ "parking_lot",
+ "rand 0.10.2",
+ "registry",
+ "reqwest 0.13.5",
+ "rkyv",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "sieve-rs",
+ "smtp-proto",
+ "spam-filter",
+ "store",
+ "tokio",
+ "tokio-rustls",
+ "trc",
+ "types",
+ "utils",
+ "x509-parser",
+]
+
+[[package]]
+name = "smtp-proto"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "707104487221ff447b5b796b5049e5c09cf52ff9fc1c8abba4695b89ac4b0f37"
+dependencies = [
+ "memchr",
+ "rkyv",
+ "serde",
+]
+
+[[package]]
+name = "snafu"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e84b3f4eacbf3a1ce05eac6763b4d629d60cbc94d632e4092c54ade71f1e1a2"
+dependencies = [
+ "snafu-derive",
+]
+
+[[package]]
+name = "snafu-derive"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1c97747dbf44bb1ca44a561ece23508e99cb592e862f22222dcf42f51d1e451"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "socket2"
+version = "0.5.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "spam-filter"
+version = "0.16.22"
+dependencies = [
+ "common",
+ "compact_str",
+ "decancer",
+ "hashify",
+ "hyper",
+ "idna",
+ "infer 0.22.0",
+ "mail-auth",
+ "mail-parser",
+ "nlp",
+ "psl",
+ "registry",
+ "rkyv",
+ "serde",
+ "sha1 0.11.0",
+ "smtp-proto",
+ "store",
+ "tokio",
+ "trc",
+ "types",
+ "unicode-general-category",
+ "unicode-normalization",
+ "unicode-security",
+ "utils",
+]
+
+[[package]]
+name = "spin"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3763264f6b73151db08c50ff20d7d8a0b8796e021cdea7ceedad07b80155fa0e"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "spin"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "023a211cb3138dbc438680b32560ad89f699977624c9f8dbb95a47d5b4c07dd3"
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "sponge-cursor"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a0219bd7d979d58245a4f41f695e1ac9f8befdffadd7f61f1bae9e39abc6620"
+
+[[package]]
+name = "sqlite-wasm-rs"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc3efc0da82635d7e1ced0053bbbfa8c7ab9645d0bf36ceb4f7127bb85315d75"
+dependencies = [
+ "cc",
+ "js-sys",
+ "rsqlite-vfs",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "stabby"
+version = "72.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d53d2428934c46277fafd2d41e39357595aa1e47954c75db2b14ed90632f3cc"
+dependencies = [
+ "rustversion",
+ "stabby-abi",
+]
+
+[[package]]
+name = "stabby-abi"
+version = "72.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f375eae680bb54203ee5e47d4cd2ae7b79c0a79ed90919279f38f500ad53f190"
+dependencies = [
+ "rustc_version",
+ "rustversion",
+ "sha2-const-stable",
+ "stabby-macros",
+]
+
+[[package]]
+name = "stabby-macros"
+version = "72.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea664671a576c5f7e32fee291ac123d82af5e92b0689beb3555347c00c76eef1"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "stalwart"
+version = "0.16.22"
+dependencies = [
+ "common",
+ "coordinator",
+ "dav",
+ "directory",
+ "email",
+ "groupware",
+ "http 0.16.22",
+ "http_proto",
+ "imap",
+ "jmap",
+ "managesieve",
+ "migration",
+ "pop3",
+ "registry",
+ "rustls",
+ "scim",
+ "services",
+ "smtp",
+ "smtp-proto",
+ "spam-filter",
+ "store",
+ "tikv-jemallocator",
+ "tokio",
+ "trc",
+ "types",
+ "utils",
+]
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "store"
+version = "0.16.22"
+dependencies = [
+ "ahash",
+ "arc-swap",
+ "aws-lc-rs",
+ "azure_core",
+ "azure_storage",
+ "azure_storage_blobs",
+ "bitpacking",
+ "blake3",
+ "bytes",
+ "compact_str",
+ "deadpool",
+ "deadpool-postgres",
+ "flate2",
+ "foundationdb",
+ "futures",
+ "gethostname",
+ "lru-cache",
+ "lz4_flex 0.14.0",
+ "mysql_async",
+ "nlp",
+ "num_cpus",
+ "parking_lot",
+ "r2d2",
+ "radsort",
+ "rand 0.10.2",
+ "rayon",
+ "redis",
+ "registry",
+ "reqwest 0.12.28",
+ "reqwest 0.13.5",
+ "rkyv",
+ "roaring",
+ "rocksdb",
+ "rusqlite",
+ "rust-s3",
+ "rustls",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tokio-postgres",
+ "tokio-rustls",
+ "trc",
+ "types",
+ "utils",
+ "x509-parser",
+ "xxhash-rust",
+]
+
+[[package]]
+name = "string_cache"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a18596f8c785a729f2819c0f6a7eae6ebeebdfffbfe4214ae6b087f690e31901"
+dependencies = [
+ "new_debug_unreachable",
+ "parking_lot",
+ "phf_shared 0.13.1",
+ "precomputed-hash",
+]
+
+[[package]]
+name = "stringprep"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-properties",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "structmeta"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e1575d8d40908d70f6fd05537266b90ae71b15dbbe7a8b7dffa2b759306d329"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "structmeta-derive",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "structmeta-derive"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "152a0b65a590ff6c3da95cabe2353ee04e6167c896b28e3b14478c2636c922fc"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12df2e0110f65b775f769bb17ef989067a1d931b2eb822bd4346631eeada89f9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "sysinfo"
+version = "0.37.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16607d5caffd1c07ce073528f9ed972d88db15dd44023fa57142963be3feb11f"
+dependencies = [
+ "libc",
+ "memchr",
+ "ntapi",
+ "objc2-core-foundation",
+ "objc2-io-kit",
+ "windows",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+dependencies = [
+ "bitflags 2.13.2",
+ "core-foundation 0.9.4",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "tagptr"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
+
+[[package]]
+name = "tap"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
+
+[[package]]
+name = "term"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8c27177b12a6399ffc08b98f76f7c9a1f4fe9fc967c784c5a071fa8d93cf7e1"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "testcontainers"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2bbe381afaaa58ea610c5fc3ffb2184063a32b3e358a179f0b4865dd59934a"
+dependencies = [
+ "astral-tokio-tar",
+ "async-trait",
+ "bollard",
+ "bytes",
+ "docker_credential",
+ "either",
+ "etcetera",
+ "ferroid",
+ "futures",
+ "http 1.5.0",
+ "itertools 0.14.0",
+ "log",
+ "memchr",
+ "parse-display",
+ "pin-project-lite",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-stream",
+ "tokio-util",
+ "url",
+]
+
+[[package]]
+name = "tests"
+version = "0.16.22"
+dependencies = [
+ "ahash",
+ "aws-lc-rs",
+ "base64 0.23.1",
+ "biscuit",
+ "bytes",
+ "calcard",
+ "chrono",
+ "common",
+ "coordinator",
+ "csv",
+ "dav",
+ "dav-proto",
+ "directory",
+ "dns-update",
+ "ece",
+ "email",
+ "flate2",
+ "form_urlencoded",
+ "futures",
+ "groupware",
+ "http 0.16.22",
+ "http_proto",
+ "hyper",
+ "hyper-util",
+ "imap",
+ "imap_proto",
+ "jmap",
+ "jmap-client",
+ "jmap-tools",
+ "jmap_proto",
+ "mail-auth",
+ "mail-builder 1.0.0",
+ "mail-parser",
+ "managesieve",
+ "nlp",
+ "pop3",
+ "quick-xml 0.41.0",
+ "rayon",
+ "rcgen",
+ "registry",
+ "reqwest 0.13.5",
+ "rkyv",
+ "rust-s3",
+ "rustls",
+ "rustls-pki-types",
+ "scim",
+ "scim-proto",
+ "serde",
+ "serde_json",
+ "serial_test",
+ "services",
+ "sha2 0.11.0",
+ "sieve-rs",
+ "smtp",
+ "smtp-proto",
+ "spam-filter",
+ "store",
+ "testcontainers",
+ "tikv-jemallocator",
+ "time",
+ "tokio",
+ "tokio-rustls",
+ "trc",
+ "types",
+ "utils",
+ "x509-parser",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+dependencies = [
+ "thiserror-impl 2.0.20",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "tikv-jemalloc-sys"
+version = "0.7.1+5.3.1-0-g81034ce1f1373e37dc865038e1bc8eeecf559ce8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a2825c78386b4ae0314074867860ba9577875de945f05992c38815cbec327f0"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "tikv-jemallocator"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "249f09e49ab1609436f34c776e84231bead18d6a955f119f939bdc1d847561bd"
+dependencies = [
+ "libc",
+ "tikv-jemalloc-sys",
+]
+
+[[package]]
+name = "time"
+version = "0.3.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
+dependencies = [
+ "deranged",
+ "js-sys",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tiny-keccak"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c9d3793400a45f954c52e73d068316d76b6f4e36977e3fcebb13a2721e80237"
+dependencies = [
+ "crunchy",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
+dependencies = [
+ "displaydoc",
+ "serde_core",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cf0ded5c4e56918d8f8a339e1bb67d038d3bc6d144ac407904015ba2e4cde9b"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tls-listener"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1461056cc1ef47003f7ee16e4cef3741068d4c7f6b627bfce49b7c00c120a530"
+dependencies = [
+ "futures-util",
+ "pin-project-lite",
+ "thiserror 2.0.20",
+ "tokio",
+ "tokio-rustls",
+]
+
+[[package]]
+name = "token-cell"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb48920ae769b58126c8c93269805011c793201f95fde28b479b81a9a531bbde"
+dependencies = [
+ "paste",
+ "portable-atomic",
+ "rustversion",
+]
+
+[[package]]
+name = "tokio"
+version = "1.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2 0.6.5",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "tokio-postgres"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a528f7d280f6d5b9cd149635c8705b0dd049754bc67d81d31fa25169a93809d3"
+dependencies = [
+ "async-trait",
+ "byteorder",
+ "bytes",
+ "fallible-iterator 0.2.0",
+ "futures-channel",
+ "futures-util",
+ "log",
+ "parking_lot",
+ "percent-encoding",
+ "phf 0.13.1",
+ "pin-project-lite",
+ "postgres-protocol",
+ "postgres-types",
+ "rand 0.10.2",
+ "socket2 0.6.5",
+ "tokio",
+ "tokio-util",
+ "whoami",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0c85f2c3ef0b1cd58b36682f4b17aaa995f0e5db534d85692b4903abce21f67"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f72a05e828585856dacd553fba484c242c46e391fb0e58917c942ee9202915c"
+dependencies = [
+ "futures-util",
+ "log",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tungstenite 0.29.0",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.30.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17a073bfed563fa236697a068031408a93cd9522e08abf9933ead3e73411bd71"
+dependencies = [
+ "futures-util",
+ "log",
+ "tokio",
+ "tungstenite 0.30.0",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "libc",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-websockets"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f591660438b3038dd04d16c938271c79e7e06260ad2ea2885a4861bfb238605d"
+dependencies = [
+ "aws-lc-rs",
+ "base64 0.22.1",
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "http 1.5.0",
+ "httparse",
+ "rand 0.8.8",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "webpki-roots 0.26.11",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.25.15+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1340ea94a5856333492c9064b02c778b191dd2c853778d9609debdcdfea3a614"
+dependencies = [
+ "indexmap 2.14.2",
+ "toml_datetime",
+ "toml_parser",
+ "winnow",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.3+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "tonic"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
+dependencies = [
+ "async-trait",
+ "axum",
+ "base64 0.22.1",
+ "bytes",
+ "h2",
+ "http 1.5.0",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-timeout",
+ "hyper-util",
+ "percent-encoding",
+ "pin-project",
+ "rustls-native-certs",
+ "socket2 0.6.5",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tokio-stream",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tonic-prost"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50849f68853be452acf590cde0b146665b8d507b3b8af17261df47e02c209ea0"
+dependencies = [
+ "bytes",
+ "prost",
+ "tonic",
+]
+
+[[package]]
+name = "tonic-types"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73ab1b02061f83d519bba3caa167f88f261ef05720ab8ebc954ade70de3348e8"
+dependencies = [
+ "prost",
+ "prost-types",
+ "tonic",
+]
+
+[[package]]
+name = "totp-rs"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49d0f9b7aa5def86d3a8d8ba926fe8c1990924dd715d2b5fc54a4aa3788c11c1"
+dependencies = [
+ "base32",
+ "constant_time_eq",
+ "hmac 0.13.0",
+ "percent-encoding",
+ "rand 0.10.2",
+ "serde",
+ "sha1 0.11.0",
+ "sha2 0.11.0",
+ "url",
+ "zeroize",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "indexmap 2.14.2",
+ "pin-project-lite",
+ "slab",
+ "sync_wrapper",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "async-compression",
+ "bitflags 2.13.2",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http 1.5.0",
+ "http-body",
+ "http-body-util",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-serde"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "704b1aeb7be0d0a84fc9828cae51dab5970fee5088f83d1dd7ee6f6246fc6ff1"
+dependencies = [
+ "serde",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "serde",
+ "serde_json",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+ "tracing-serde",
+]
+
+[[package]]
+name = "trc"
+version = "0.16.22"
+dependencies = [
+ "ahash",
+ "base64 0.23.1",
+ "compact_str",
+ "event_macro",
+ "hashify",
+ "mail-auth",
+ "mail-parser",
+ "parking_lot",
+ "reqwest 0.13.5",
+ "rkyv",
+ "rtrb",
+ "serde",
+ "serde_json",
+ "tokio",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "try_map"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb1626d07cb5c1bb2cf17d94c0be4852e8a7c02b041acec9a8c5bdda99f9d580"
+
+[[package]]
+name = "tungstenite"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c01152af293afb9c7c2a57e4b559c5620b421f6d133261c60dd2d0cdb38e6b8"
+dependencies = [
+ "bytes",
+ "data-encoding",
+ "http 1.5.0",
+ "httparse",
+ "log",
+ "rand 0.9.5",
+ "rustls",
+ "rustls-pki-types",
+ "sha1 0.10.7",
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "tungstenite"
+version = "0.30.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e48ac77174b19c110a50ab2128b24215ac9cb40e0e12e093fb602d175c569d22"
+dependencies = [
+ "bytes",
+ "data-encoding",
+ "http 1.5.0",
+ "httparse",
+ "log",
+ "rand 0.10.2",
+ "sha1 0.11.0",
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "twofish"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a78e83a30223c757c3947cd144a31014ff04298d8719ae10d03c31c0448c8013"
+dependencies = [
+ "cipher 0.4.4",
+]
+
+[[package]]
+name = "twox-hash"
+version = "1.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fee6b57c6a41524a810daee9286c02d7752c4253064d0b05472833a438f675"
+dependencies = [
+ "cfg-if",
+ "static_assertions",
+]
+
+[[package]]
+name = "twox-hash"
+version = "2.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5283634e518fe9e82c7b20520bb4bc209009fd16c82077c802f8111ecbb0117a"
+
+[[package]]
+name = "typed-path"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
+
+[[package]]
+name = "typeid"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "types"
+version = "0.16.22"
+dependencies = [
+ "blake3",
+ "compact_str",
+ "hashify",
+ "jmap-tools",
+ "rkyv",
+ "serde",
+ "trc",
+ "utils",
+]
+
+[[package]]
+name = "ucd-trie"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
+
+[[package]]
+name = "uhlc"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b62a645e3e4e6c85b7abe49b086aa3204119431f42b6123b0070419fb6e9d24e"
+dependencies = [
+ "humantime",
+ "lazy_static",
+ "log",
+ "rand 0.8.8",
+ "serde",
+ "spin 0.10.1",
+]
+
+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
+[[package]]
+name = "unicode-general-category"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b993bddc193ae5bd0d623b49ec06ac3e9312875fdae725a975c51db1cc1677f"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+
+[[package]]
+name = "unicode-script"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "383ad40bb927465ec0ce7720e033cb4ca06912855fc35db31b5755d0de75b1ee"
+
+[[package]]
+name = "unicode-security"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e4ddba1535dd35ed8b61c52166b7155d7f4e4b8847cec6f48e71dc66d8b5e50"
+dependencies = [
+ "unicode-normalization",
+ "unicode-script",
+]
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common 0.1.7",
+ "subtle",
+]
+
+[[package]]
+name = "universal-hash"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4987bdc12753382e0bec4a65c50738ffaabc998b9cdd1f952fb5f39b0048a96"
+dependencies = [
+ "crypto-common 0.2.2",
+ "ctutils",
+]
+
+[[package]]
+name = "unsafe-libyaml"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "unty"
+version = "0.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d49784317cd0d1ee7ec5c716dd598ec5b4483ea832a2dced265471cc0f690ae"
+
+[[package]]
+name = "unzip-n"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b5bb2756c16fb66f80cfbf5fb0e0c09a7001e739f453c9ec241b9c8b1556fda"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+ "serde_derive",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utils"
+version = "0.16.22"
+dependencies = [
+ "ahash",
+ "arcstr",
+ "aws-lc-rs",
+ "base64 0.23.1",
+ "chrono",
+ "compact_str",
+ "farmhash",
+ "form_urlencoded",
+ "futures",
+ "idna",
+ "mail-auth",
+ "nohash-hasher",
+ "privdrop",
+ "psl",
+ "quick_cache",
+ "reqwest 0.13.5",
+ "rkyv",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "serde",
+ "tokio",
+ "tokio-rustls",
+ "trc",
+ "xxhash-rust",
+]
+
+[[package]]
+name = "uuid"
+version = "1.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce"
+dependencies = [
+ "getrandom 0.4.3",
+ "js-sys",
+ "serde_core",
+ "sha1_smol",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "validated_struct"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "869a93e8a7286e339e1128630051d82babbcd75d585975af07b9f3327220e60e"
+dependencies = [
+ "json5",
+ "serde",
+ "serde_json",
+ "validated_struct_macros",
+]
+
+[[package]]
+name = "validated_struct_macros"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c44ce98e7227a04eeb4cf9c784109a5c9710e54849ceb4f09f8597247897f1e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "unzip-n",
+]
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "vec_map"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "virtue"
+version = "0.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "051eb1abcf10076295e815102942cc58f9d5e3b4560e46e53c21e8ff6f3af7b1"
+
+[[package]]
+name = "waker-fn"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "317211a0dc0ceedd78fb2ca9a44aed3d7b9b26f81870d485c07122b4350673b7"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.9.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasi"
+version = "0.14.7+wasi-0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "883478de20367e224c0090af9cf5f9fa85bed63a95c1abf3afc5c083ebc06e8c"
+dependencies = [
+ "wasip2",
+]
+
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasite"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66fe902b4a6b8028a753d5424909b764ccf79b7a209eac9bf97e59cda9f71a42"
+dependencies = [
+ "wasi 0.14.7+wasi-0.2.4",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aecb87a33d3b0c5e3b7aa46336eaf486cffafbd281b195e4c8b80d50df2351bf"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.78"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ef4c5d3d2cdf5c54f4231181768f5510842e350db025faf1f7163b1030ed928"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a690d511e3c1a8b3a55e33511e3c2c00c78415cd23650f32b808627f5696b9ed"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "411e4887f0071ef2d2164a9d5fdf2d20efbef78fccd3a78b0c10a1dc5295e48a"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81941cd78d0c92026c33e5e01312845a4cb1e9af3407f9134b100dd03144103e"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.105"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fbddc4a036f00ec4f18c83445bd3115cb306a91da554919a099d9222fe4a7f8"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.26.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
+dependencies = [
+ "webpki-roots 1.0.9",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "whatlang"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f5e8f38b596e2a359b755342473520a99421e43658548c79489ee221b728c107"
+dependencies = [
+ "hashbrown 0.15.5",
+]
+
+[[package]]
+name = "whoami"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "626c4bac6755d76ffc12cb01b2eac751db1996b9e0041de9aa02c8c211ddc82c"
+dependencies = [
+ "libc",
+ "libredox",
+ "objc2-system-configuration",
+ "wasite",
+ "web-sys",
+]
+
+[[package]]
+name = "widestring"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72069c3113ab32ab29e5584db3c6ec55d416895e60715417b5b883a357c3e471"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows"
+version = "0.61.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9babd3a767a4c1aef6900409f85f5d53ce2544ccdfaa86dad48c91782c6d6893"
+dependencies = [
+ "windows-collections",
+ "windows-core 0.61.2",
+ "windows-future",
+ "windows-link 0.1.3",
+ "windows-numerics",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3beeceb5e5cfd9eb1d76b381630e82c4241ccd0d27f1a39ed41b2760b255c5e8"
+dependencies = [
+ "windows-core 0.61.2",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link 0.1.3",
+ "windows-result 0.3.4",
+ "windows-strings 0.4.2",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link 0.2.1",
+ "windows-result 0.4.1",
+ "windows-strings 0.5.1",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc6a41e98427b19fe4b73c550f060b59fa592d7d686537eebf9385621bfbad8e"
+dependencies = [
+ "windows-core 0.61.2",
+ "windows-link 0.1.3",
+ "windows-threading",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-numerics"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9150af68066c4c5c07ddc0ce30421554771e528bde427614c61038bc2c92c2b1"
+dependencies = [
+ "windows-core 0.61.2",
+ "windows-link 0.1.3",
+]
+
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link 0.2.1",
+ "windows-result 0.4.1",
+ "windows-strings 0.5.1",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
+dependencies = [
+ "windows-link 0.1.3",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
+dependencies = [
+ "windows-link 0.1.3",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows-threading"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b66463ad2e0ea3bbf808b7f1d371311c80e115c0b71d60efc142cafbcfb057a6"
+dependencies = [
+ "windows-link 0.1.3",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "winnow"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "wyz"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed"
+dependencies = [
+ "tap",
+]
+
+[[package]]
+name = "x25519-dalek"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
+dependencies = [
+ "curve25519-dalek",
+ "rand_core 0.6.4",
+ "zeroize",
+]
+
+[[package]]
+name = "x509-parser"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d43b0f71ce057da06bc0851b23ee24f3f86190b07203dd8f567d0b706a185202"
+dependencies = [
+ "asn1-rs",
+ "aws-lc-rs",
+ "data-encoding",
+ "der-parser",
+ "lazy_static",
+ "nom",
+ "oid-registry",
+ "ring",
+ "rusticata-macros",
+ "thiserror 2.0.20",
+ "time",
+]
+
+[[package]]
+name = "xattr"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
+dependencies = [
+ "libc",
+ "rustix",
+]
+
+[[package]]
+name = "xml"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f45bb2c13fec6a6cb4c0f76a7e94839e110a14ec803ec2940777a94c347bc52"
+
+[[package]]
+name = "xml-no-std"
+version = "0.8.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd223bc94c615fc02bf2f4bbc22a4a9bfe489c2add3ec10b1038df3aca44cac7"
+
+[[package]]
+name = "xml-rs"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3a56132a0d6ecbe77352edc10232f788fc4ceefefff4cab784a98e0e16b6b51"
+dependencies = [
+ "xml",
+]
+
+[[package]]
+name = "xxhash-rust"
+version = "0.8.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aee1b19627c7c60102ab80d3a9cbe18de90bfe03bfa6c3715447681f0e8c8af6"
+
+[[package]]
+name = "yasna"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5f6765e852b9b4dc8e2a76843e4d64d1cea8e79bcde0b6901aea8e7c7f08282"
+dependencies = [
+ "bit-vec 0.9.1",
+ "time",
+]
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zenoh"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "453ba5d28a1197653aae4bb024fd74a9d5c7051d5a19a77f3a43d83f40c22584"
+dependencies = [
+ "ahash",
+ "arc-swap",
+ "async-trait",
+ "bytes",
+ "const_format",
+ "flate2",
+ "flume",
+ "futures",
+ "git-version",
+ "itertools 0.14.0",
+ "json5",
+ "lazy_static",
+ "nonempty-collections",
+ "once_cell",
+ "petgraph",
+ "phf 0.13.1",
+ "rand 0.8.8",
+ "rustc_version",
+ "serde",
+ "serde_json",
+ "socket2 0.5.10",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "uhlc",
+ "vec_map",
+ "zenoh-buffers",
+ "zenoh-codec",
+ "zenoh-collections",
+ "zenoh-config",
+ "zenoh-core",
+ "zenoh-keyexpr",
+ "zenoh-link",
+ "zenoh-link-commons",
+ "zenoh-macros",
+ "zenoh-plugin-trait",
+ "zenoh-protocol",
+ "zenoh-result",
+ "zenoh-runtime",
+ "zenoh-sync",
+ "zenoh-task",
+ "zenoh-transport",
+ "zenoh-util",
+]
+
+[[package]]
+name = "zenoh-buffers"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "555a8169c9888fc5571f1b38d2843a63db786621e153abad1b075c40b20e83b4"
+dependencies = [
+ "zenoh-collections",
+]
+
+[[package]]
+name = "zenoh-codec"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc959f727893eab9b66ec051c8f4a2d6f66b4ee70bf23f2ed244aa754705e854"
+dependencies = [
+ "rand 0.8.8",
+ "tracing",
+ "uhlc",
+ "zenoh-buffers",
+ "zenoh-protocol",
+]
+
+[[package]]
+name = "zenoh-collections"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c05abd8dcfd2239a8dfb5b79bd4ed85094c6bb6d6b991d3529bff364cc48e29"
+dependencies = [
+ "ahash",
+]
+
+[[package]]
+name = "zenoh-config"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59799d556b4fac79886cb0a9c90f3bc48d0894816b99c8a90a3509b1809a02dd"
+dependencies = [
+ "json5",
+ "nonempty-collections",
+ "num_cpus",
+ "secrecy",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "serde_yaml",
+ "tracing",
+ "uhlc",
+ "validated_struct",
+ "zenoh-core",
+ "zenoh-keyexpr",
+ "zenoh-macros",
+ "zenoh-protocol",
+ "zenoh-result",
+ "zenoh-util",
+]
+
+[[package]]
+name = "zenoh-core"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "975073c51353c1c33e81a98370bf3560863540913e5f30091923f5a328fc46d4"
+dependencies = [
+ "lazy_static",
+ "tokio",
+ "zenoh-result",
+ "zenoh-runtime",
+]
+
+[[package]]
+name = "zenoh-crypto"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e281a36cfd351ba9232a24899d946a782d0ff3ac0c3d759f87f3e7cbe09a4553"
+dependencies = [
+ "aes 0.8.4",
+ "hmac 0.12.1",
+ "rand 0.8.8",
+ "rand_chacha 0.3.1",
+ "sha3 0.10.9",
+ "zenoh-result",
+]
+
+[[package]]
+name = "zenoh-keyexpr"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02c6fcb7f18846b4e9b097c61ed7c656ec8d7858ab54a12d5f5025fe1514caae"
+dependencies = [
+ "getrandom 0.2.17",
+ "hashbrown 0.16.1",
+ "keyed-set",
+ "rand 0.8.8",
+ "schemars 1.2.2",
+ "serde",
+ "token-cell",
+ "zenoh-result",
+]
+
+[[package]]
+name = "zenoh-link"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c55c4fbc923328f0b62b1b492723ff53b757a36421f70218e652f0aa899cde6c"
+dependencies = [
+ "zenoh-config",
+ "zenoh-link-commons",
+ "zenoh-link-quic",
+ "zenoh-link-tcp",
+ "zenoh-link-tls",
+ "zenoh-link-udp",
+ "zenoh-protocol",
+ "zenoh-result",
+]
+
+[[package]]
+name = "zenoh-link-commons"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d52520b4c22d05173c8621e3cbe18d838a17d74477891ed9c59a7aeedaa325d"
+dependencies = [
+ "async-trait",
+ "base64 0.22.1",
+ "bytes",
+ "flume",
+ "futures",
+ "quinn",
+ "quinn-proto",
+ "rcgen",
+ "rustls",
+ "rustls-pemfile",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "secrecy",
+ "serde",
+ "socket2 0.5.10",
+ "time",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "webpki-roots 1.0.9",
+ "x509-parser",
+ "zenoh-buffers",
+ "zenoh-codec",
+ "zenoh-config",
+ "zenoh-core",
+ "zenoh-protocol",
+ "zenoh-result",
+ "zenoh-runtime",
+ "zenoh-util",
+]
+
+[[package]]
+name = "zenoh-link-quic"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9fecc8832bb943631f75d7c4e4839a414d7bebbe80c0f695f14b2cd8c84759"
+dependencies = [
+ "async-trait",
+ "rustls-webpki",
+ "time",
+ "tracing",
+ "zenoh-core",
+ "zenoh-link-commons",
+ "zenoh-link-quic_datagram",
+ "zenoh-protocol",
+ "zenoh-result",
+]
+
+[[package]]
+name = "zenoh-link-quic_datagram"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1af3abf41c719c82ca356864b5ddeeb7c77cb29fe777776b40b31eb4d19de288"
+dependencies = [
+ "async-trait",
+ "rustls-webpki",
+ "time",
+ "tokio-util",
+ "tracing",
+ "zenoh-core",
+ "zenoh-link-commons",
+ "zenoh-protocol",
+ "zenoh-result",
+]
+
+[[package]]
+name = "zenoh-link-tcp"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d4702d55fe9f17cbd1d3b601901f8ba0a693a7ad1ce685a1ea4c60f775552b7"
+dependencies = [
+ "async-trait",
+ "socket2 0.5.10",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "zenoh-config",
+ "zenoh-core",
+ "zenoh-link-commons",
+ "zenoh-protocol",
+ "zenoh-result",
+]
+
+[[package]]
+name = "zenoh-link-tls"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cce65fd71b4631821a85058542e28faac0151af6c53cd61f2dfafc7e16c4d6c4"
+dependencies = [
+ "async-trait",
+ "base64 0.22.1",
+ "rustls",
+ "rustls-pemfile",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "secrecy",
+ "socket2 0.5.10",
+ "time",
+ "tls-listener",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tracing",
+ "webpki-roots 1.0.9",
+ "x509-parser",
+ "zenoh-config",
+ "zenoh-core",
+ "zenoh-link-commons",
+ "zenoh-protocol",
+ "zenoh-result",
+ "zenoh-runtime",
+]
+
+[[package]]
+name = "zenoh-link-udp"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b140e7b65715fe8b29b706b2b9fc3009fc6181346931c8926d290113fe38df4b"
+dependencies = [
+ "async-trait",
+ "libc",
+ "socket2 0.5.10",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "windows-sys 0.61.2",
+ "zenoh-buffers",
+ "zenoh-core",
+ "zenoh-link-commons",
+ "zenoh-link-quic_datagram",
+ "zenoh-protocol",
+ "zenoh-result",
+ "zenoh-sync",
+ "zenoh-util",
+]
+
+[[package]]
+name = "zenoh-macros"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f483b343fd79b6c1bd7d79f130b5c6c208e7fef243a4d7966a6bf9fdecbd70f8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "zenoh-keyexpr",
+]
+
+[[package]]
+name = "zenoh-plugin-trait"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d57f491f63afa7413d68ee68e4de2bc9ce361c4ac89a76d5a0a0e3ca0624e21"
+dependencies = [
+ "git-version",
+ "libloading",
+ "serde",
+ "stabby",
+ "tracing",
+ "zenoh-config",
+ "zenoh-keyexpr",
+ "zenoh-macros",
+ "zenoh-result",
+ "zenoh-util",
+]
+
+[[package]]
+name = "zenoh-protocol"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4492192986df044627f33c8eeb8aa237fb4d3bbd2d8cc68bc7eee16748c2fb61"
+dependencies = [
+ "const_format",
+ "rand 0.8.8",
+ "serde",
+ "uhlc",
+ "zenoh-buffers",
+ "zenoh-keyexpr",
+ "zenoh-macros",
+ "zenoh-result",
+]
+
+[[package]]
+name = "zenoh-result"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d6d0ca24186d9cfbf14f2d08b8b0a09afac690fe5cd68899d8f896f9247a3dd"
+dependencies = [
+ "anyhow",
+]
+
+[[package]]
+name = "zenoh-runtime"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e8ea6ed9fb3300d02bc303b3202a21a758aa5d7a1e7dcc38610428910af9f9"
+dependencies = [
+ "lazy_static",
+ "ron",
+ "serde",
+ "tokio",
+ "tracing",
+ "zenoh-macros",
+ "zenoh-result",
+]
+
+[[package]]
+name = "zenoh-sync"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d57ed2156b61df6e877b03fb13dd72227d3d286a7fa689120109bad289ddf12b"
+dependencies = [
+ "arc-swap",
+ "event-listener 5.4.2",
+ "futures",
+ "tokio",
+ "zenoh-buffers",
+ "zenoh-collections",
+ "zenoh-core",
+]
+
+[[package]]
+name = "zenoh-task"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "887115c0f81c72ff8c9b99e6fccd9e1c3829d83e16b8b063174786b9fba08810"
+dependencies = [
+ "futures",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "zenoh-core",
+ "zenoh-runtime",
+]
+
+[[package]]
+name = "zenoh-transport"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72bae2e0aca56ac6431bd6c37c6ac3fcc9367446cbb356bd44137cc01d1493ee"
+dependencies = [
+ "async-trait",
+ "crossbeam-utils",
+ "flume",
+ "futures",
+ "lazy_static",
+ "lz4_flex 0.10.0",
+ "rand 0.8.8",
+ "ringbuffer-spsc",
+ "rsa",
+ "serde",
+ "sha3 0.10.9",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "zenoh-buffers",
+ "zenoh-codec",
+ "zenoh-config",
+ "zenoh-core",
+ "zenoh-crypto",
+ "zenoh-link",
+ "zenoh-link-commons",
+ "zenoh-protocol",
+ "zenoh-result",
+ "zenoh-runtime",
+ "zenoh-sync",
+ "zenoh-task",
+ "zenoh-util",
+]
+
+[[package]]
+name = "zenoh-util"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43a473dcc62026b9d9589acc22c62b04cb7dab4070bba5543d2afac741ddf947"
+dependencies = [
+ "async-trait",
+ "const_format",
+ "flume",
+ "home",
+ "humantime",
+ "lazy_static",
+ "libc",
+ "libloading",
+ "pnet_datalink",
+ "schemars 1.2.2",
+ "serde",
+ "serde_json",
+ "shellexpand",
+ "tokio",
+ "tracing",
+ "tracing-subscriber",
+ "winapi",
+ "zenoh-core",
+ "zenoh-result",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
+dependencies = [
+ "byteorder",
+ "zerocopy-derive 0.7.35",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.57"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d35102a9f36d089ccae9e4c6802bc118be4487b80aaffc0ab4e0cf5ce92d2873"
+dependencies = [
+ "zerocopy-derive 0.8.57",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.57"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "146c01f5ab44258da43cf276c74a2763db2ff3969c9c652c3f2de07041d0b2bc"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
+dependencies = [
+ "serde",
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "zip"
+version = "8.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+dependencies = [
+ "aes 0.9.3",
+ "bzip2",
+ "constant_time_eq",
+ "crc32fast",
+ "deflate64",
+ "flate2",
+ "getrandom 0.4.3",
+ "hmac 0.13.0",
+ "indexmap 2.14.2",
+ "lzma-rust2",
+ "memchr",
+ "pbkdf2",
+ "ppmd-rust",
+ "sha1 0.11.0",
+ "time",
+ "typed-path",
+ "zeroize",
+ "zopfli",
+ "zstd",
+]
+
+[[package]]
+name = "zlib-rs"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34b31d188d9d685a4f9c7b46d6e36631b07058d2cfe190267adce54dc230bf12"
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
+
+[[package]]
+name = "zopfli"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "log",
+ "simd-adler32",
+]
+
+[[package]]
+name = "zstd"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
+dependencies = [
+ "zstd-safe",
+]
+
+[[package]]
+name = "zstd-safe"
+version = "7.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64d80649ab6db9d9f6f9c80a40becd948eda4714a0a5ac8c4d157a32231c7882"
+dependencies = [
+ "zstd-sys",
+]
+
+[[package]]
+name = "zstd-sys"
+version = "2.1.0+zstd.1.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ef0a8027ec3ee71300ab3bcbcd0393f434aa72b91ca6d635a39941deae8eea0"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
+
+[[package]]
+name = "zxcvbn"
+version = "3.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9eaee90f4a795d1eb4ba6c51e1c1721d4784d550e8efa7b2600f29c867365e0"
+dependencies = [
+ "chrono",
+ "derive_builder",
+ "fancy-regex 0.18.0",
+ "itertools 0.14.0",
+ "lazy_static",
+ "regex",
+ "time",
+ "wasm-bindgen",
+ "web-sys",
+]
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 0000000..20b326e
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,79 @@
+[workspace]
+resolver = "2"
+members = [
+ "crates/main",
+ "crates/types",
+ "crates/http",
+ "crates/http-proto",
+ "crates/jmap",
+ "crates/jmap-proto",
+ "crates/email",
+ "crates/imap",
+ "crates/imap-proto",
+ "crates/smtp",
+ "crates/managesieve",
+ "crates/pop3",
+ "crates/dav-proto",
+ "crates/scim-proto",
+ "crates/scim",
+ "crates/dav",
+ "crates/groupware",
+ "crates/spam-filter",
+ "crates/nlp",
+ "crates/store",
+ "crates/coordinator",
+ "crates/directory",
+ "crates/registry",
+ "crates/services",
+ "crates/utils",
+ "crates/common",
+ "crates/trc",
+ "crates/migration",
+ "tests",
+]
+
+[workspace.lints.clippy]
+result_unit_err = "allow"
+
+[profile.dev]
+opt-level = 0
+debug = 1
+#codegen-units = 4
+lto = false
+incremental = true
+panic = 'unwind'
+debug-assertions = true
+overflow-checks = false
+rpath = false
+
+[profile.release]
+opt-level = 3
+debug = false
+codegen-units = 1
+lto = true
+incremental = false
+panic = 'unwind'
+debug-assertions = false
+overflow-checks = false
+rpath = false
+strip = true
+
+[profile.test]
+opt-level = 0
+debug = 1
+#codegen-units = 16
+lto = false
+incremental = true
+debug-assertions = true
+overflow-checks = true
+rpath = false
+
+[profile.bench]
+opt-level = 3
+debug = false
+codegen-units = 1
+lto = true
+incremental = false
+debug-assertions = false
+overflow-checks = false
+rpath = false
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..c1f5475
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,46 @@
+FROM --platform=$BUILDPLATFORM docker.io/lukemathwalker/cargo-chef:latest-rust-slim-trixie AS chef
+WORKDIR /build
+
+FROM --platform=$BUILDPLATFORM chef AS planner
+COPY . .
+RUN cargo chef prepare --recipe-path /recipe.json
+
+FROM --platform=$BUILDPLATFORM chef AS builder
+ARG TARGETPLATFORM
+RUN case "${TARGETPLATFORM}" in \
+ "linux/arm64") echo "aarch64-unknown-linux-gnu" > /target.txt && echo "-C linker=aarch64-linux-gnu-gcc" > /flags.txt ;; \
+ "linux/amd64") echo "x86_64-unknown-linux-gnu" > /target.txt && echo "-C linker=x86_64-linux-gnu-gcc" > /flags.txt ;; \
+ *) exit 1 ;; \
+ esac
+RUN export DEBIAN_FRONTEND=noninteractive && \
+ apt-get update && \
+ apt-get install -yq --no-install-recommends build-essential libclang-19-dev \
+ g++-aarch64-linux-gnu binutils-aarch64-linux-gnu \
+ g++-x86-64-linux-gnu binutils-x86-64-linux-gnu
+RUN rustup target add "$(cat /target.txt)"
+COPY --from=planner /recipe.json /recipe.json
+RUN RUSTFLAGS="$(cat /flags.txt)" cargo chef cook --target "$(cat /target.txt)" --release --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise" --recipe-path /recipe.json
+COPY . .
+RUN RUSTFLAGS="$(cat /flags.txt)" cargo build --target "$(cat /target.txt)" --release -p stalwart --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise"
+RUN mv "/build/target/$(cat /target.txt)/release" "/output"
+
+FROM docker.io/debian:trixie-slim
+RUN export DEBIAN_FRONTEND=noninteractive && \
+ apt-get update && \
+ apt-get install -yq --no-install-recommends ca-certificates curl libcap2-bin && \
+ rm -rf /var/lib/apt/lists/* && \
+ groupadd -r -g 2000 stalwart && \
+ useradd -r -u 2000 -g 2000 -s /usr/sbin/nologin -M stalwart && \
+ mkdir -p /etc/stalwart /var/lib/stalwart && \
+ chown stalwart:stalwart /etc/stalwart /var/lib/stalwart
+COPY --from=builder --chmod=0755 /output/stalwart /usr/local/bin/stalwart
+RUN setcap 'cap_net_bind_service=+ep' /usr/local/bin/stalwart
+USER stalwart
+WORKDIR /var/lib/stalwart
+VOLUME ["/etc/stalwart", "/var/lib/stalwart"]
+EXPOSE 443 25 110 587 465 143 993 995 4190 8080
+ENV STALWART_HEALTHCHECK_URL=https://127.0.0.1:443/healthz/live
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+ CMD curl -fsSk -H "X-Forwarded-For: 127.0.0.1" "$STALWART_HEALTHCHECK_URL" || curl -fsS -H "X-Forwarded-For: 127.0.0.1" http://127.0.0.1:8080/healthz/live || exit 1
+ENTRYPOINT ["/usr/local/bin/stalwart"]
+CMD ["--config", "/etc/stalwart/config.json"]
diff --git a/Dockerfile.build b/Dockerfile.build
new file mode 100644
index 0000000..925a372
--- /dev/null
+++ b/Dockerfile.build
@@ -0,0 +1,195 @@
+# syntax=docker/dockerfile:1
+# check=skip=FromPlatformFlagConstDisallowed,RedundantTargetPlatform
+
+# *****************
+# Base image for planner & builder
+# *****************
+FROM --platform=$BUILDPLATFORM rust:slim-trixie AS base
+
+ENV DEBIAN_FRONTEND="noninteractive" \
+ BINSTALL_DISABLE_TELEMETRY=true \
+ CARGO_TERM_COLOR=always \
+ CARGO_NET_RETRY=10 \
+ CARGO_NET_GIT_FETCH_WITH_CLI=true \
+ LANG=C.UTF-8 \
+ TZ=UTC \
+ TERM=xterm-256color \
+ AWS_LC_SYS_PREBUILT_NASM=1
+# With zig, we only need libclang and make. ca-certificates is required for curl
+# to verify HTTPS downloads (zig tarballs, FoundationDB debs, crates.io, etc).
+RUN \
+ --mount=type=cache,target=/var/cache/apt,sharing=locked \
+ --mount=type=cache,target=/var/lib/apt,sharing=locked \
+ rm -f /etc/apt/apt.conf.d/docker-clean && \
+ echo 'Binary::apt::APT::Keep-Downloaded-Packages "true";' >/etc/apt/apt.conf.d/keep-cache && \
+ apt-get update && \
+ apt-get install -yq --no-install-recommends ca-certificates curl git jq xz-utils make libclang-19-dev
+# Zig is pinned to 0.13.0. Zig 0.14+ changed how its default target ABI is
+# resolved for `x86_64-linux-gnu`-style triples, and on Stalwart's dep tree
+# (rocksdb, jemalloc, aws-lc-sys, libfdb_c.so, rust-std 1.87+) this surfaces
+# as ld.lld undefined references to pthread_*/stat/pow@GLIBC_2.33+. An
+# explicit glibc suffix (`.2.17`) is NOT a workaround — C deps compiled via
+# zig cc against Zig 0.16 headers still emit @2.33+ symbols even when the
+# linker target is 2.17. Zig 0.13 produces binaries with a max glibc ref of
+# ~2.28 which stays compatible with Debian 11 / RHEL 8. Revisit this pin if
+# Zig upstream stabilizes a backwards-compatible default or if Stalwart drops
+# its hard C deps.
+RUN \
+ ZIG_VERSION=0.13.0 && \
+ curl --retry 5 -fsSL "https://ziglang.org/download/${ZIG_VERSION}/zig-linux-$(uname -m)-${ZIG_VERSION}.tar.xz" | tar -J -x -C /usr/local && \
+ ln -s "/usr/local/zig-linux-$(uname -m)-${ZIG_VERSION}/zig" /usr/local/bin/zig && \
+ zig version
+# Install cargo-binstall
+RUN curl --retry 5 -fL --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
+# Install cargo-chef & sccache & cargo-zigbuild
+RUN cargo binstall --no-confirm cargo-chef@0.1.78 sccache@0.17.0 cargo-zigbuild@0.23.2
+
+# *****************
+# Planner
+# *****************
+FROM base AS planner
+WORKDIR /app
+COPY . .
+# Generate recipe file
+RUN cargo chef prepare --recipe-path recipe.json
+
+# *****************
+# Builder
+# *****************
+FROM base AS builder
+WORKDIR /app
+COPY --from=planner /app/recipe.json recipe.json
+ARG TARGET
+ARG BUILD_ENV
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+# Install toolchain and specify some env variables
+RUN \
+ rustup set profile minimal && \
+ rustup target add ${TARGET} && \
+ mkdir -p artifact && \
+ touch /env-cargo && \
+ if [ ! -z "${BUILD_ENV}" ]; then \
+ echo "export ${BUILD_ENV}" >> /env-cargo; \
+ echo "Setting up ${BUILD_ENV}"; \
+ fi && \
+ if [[ "${TARGET}" == *gnu ]]; then \
+ base_arch="${TARGET%%-*}"; \
+ case "$base_arch" in \
+ x86_64) \
+ echo "export FDB_ARCH=amd64" >> /env-cargo; \
+ ;; \
+ aarch64) \
+ echo "export FDB_ARCH=aarch64" >> /env-cargo; \
+ ;; \
+ *) \
+ exit 1; \
+ ;; \
+ esac; \
+ fi
+# Install FoundationDB (pinned to latest 7.4.x; Apple publishes 7.4 as
+# prereleases on GitHub, so the release list is fetched without the
+# prerelease filter and narrowed by tag name).
+ARG FDB_VERSION_RANGE="7.4"
+RUN \
+ source /env-cargo && \
+ if [ ! -z "${FDB_ARCH}" ]; then \
+ curl --retry 5 -fLso fdb-client.deb "$(curl --retry 5 -fLs 'https://api.github.com/repos/apple/foundationdb/releases?per_page=100' | jq --arg FDB_ARCH "$FDB_ARCH" --arg RANGE "${FDB_VERSION_RANGE}" -r '[.[] | select(.tag_name | startswith($RANGE + "."))] | sort_by(.tag_name | split(".") | map(tonumber)) | reverse | .[0].assets[] | select(.name | test("foundationdb-clients.*" + $FDB_ARCH + ".deb$")) | .browser_download_url')" && \
+ mkdir -p /fdb && \
+ dpkg -x fdb-client.deb /fdb && \
+ mv /fdb/usr/include/foundationdb /usr/include && \
+ mv /fdb/usr/lib/libfdb_c.so /usr/lib && \
+ rm -rf fdb-client.deb /fdb; \
+ fi
+# Cargo-chef Cache layer
+RUN \
+ --mount=type=secret,id=ACTIONS_RESULTS_URL,env=ACTIONS_RESULTS_URL \
+ --mount=type=secret,id=ACTIONS_RUNTIME_TOKEN,env=ACTIONS_RUNTIME_TOKEN \
+ --mount=type=cache,target=/usr/local/cargo/registry \
+ --mount=type=cache,target=/usr/local/cargo/git \
+ source /env-cargo && \
+ if [ ! -z "${FDB_ARCH}" ]; then \
+ RUSTFLAGS="-L /usr/lib" cargo chef cook --recipe-path recipe.json --zigbuild --release --target ${TARGET} -p stalwart --no-default-features --features "foundationdb s3 redis nats enterprise"; \
+ fi
+RUN \
+ --mount=type=secret,id=ACTIONS_RESULTS_URL,env=ACTIONS_RESULTS_URL \
+ --mount=type=secret,id=ACTIONS_RUNTIME_TOKEN,env=ACTIONS_RUNTIME_TOKEN \
+ --mount=type=cache,target=/usr/local/cargo/registry \
+ --mount=type=cache,target=/usr/local/cargo/git \
+ source /env-cargo && \
+ cargo chef cook --recipe-path recipe.json --zigbuild --release --target ${TARGET} -p stalwart --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise"
+# Copy the source code
+COPY . .
+ENV RUSTC_WRAPPER="sccache" \
+ SCCACHE_GHA_ENABLED=true
+# Build FoundationDB version
+RUN \
+ --mount=type=secret,id=ACTIONS_RESULTS_URL,env=ACTIONS_RESULTS_URL \
+ --mount=type=secret,id=ACTIONS_RUNTIME_TOKEN,env=ACTIONS_RUNTIME_TOKEN \
+ --mount=type=cache,target=/usr/local/cargo/registry \
+ --mount=type=cache,target=/usr/local/cargo/git \
+ source /env-cargo && \
+ if [ ! -z "${FDB_ARCH}" ]; then \
+ RUSTFLAGS="-L /usr/lib" cargo zigbuild --release --target ${TARGET} -p stalwart --no-default-features --features "foundationdb s3 redis nats enterprise" && \
+ mv /app/target/${TARGET}/release/stalwart /app/artifact/stalwart-foundationdb; \
+ fi
+# Build generic version
+RUN \
+ --mount=type=secret,id=ACTIONS_RESULTS_URL,env=ACTIONS_RESULTS_URL \
+ --mount=type=secret,id=ACTIONS_RUNTIME_TOKEN,env=ACTIONS_RUNTIME_TOKEN \
+ --mount=type=cache,target=/usr/local/cargo/registry \
+ --mount=type=cache,target=/usr/local/cargo/git \
+ source /env-cargo && \
+ cargo zigbuild --release --target ${TARGET} -p stalwart --no-default-features --features "sqlite postgres mysql rocks s3 redis azure nats enterprise" && \
+ mv /app/target/${TARGET}/release/stalwart /app/artifact/stalwart
+
+# *****************
+# Binary stage
+# *****************
+FROM scratch AS binaries
+COPY --from=builder /app/artifact /
+
+# *****************
+# Runtime image for GNU targets
+# *****************
+FROM --platform=$TARGETPLATFORM docker.io/library/debian:trixie-slim AS gnu
+RUN export DEBIAN_FRONTEND=noninteractive && \
+ apt-get update && \
+ apt-get install -yq --no-install-recommends ca-certificates curl tzdata libcap2-bin && \
+ rm -rf /var/lib/apt/lists/* && \
+ groupadd -r -g 2000 stalwart && \
+ useradd -r -u 2000 -g 2000 -s /usr/sbin/nologin -M stalwart && \
+ mkdir -p /etc/stalwart /var/lib/stalwart && \
+ chown stalwart:stalwart /etc/stalwart /var/lib/stalwart
+COPY --from=builder --chmod=0755 /app/artifact/stalwart /usr/local/bin/stalwart
+RUN setcap 'cap_net_bind_service=+ep' /usr/local/bin/stalwart
+USER stalwart
+WORKDIR /var/lib/stalwart
+VOLUME ["/etc/stalwart", "/var/lib/stalwart"]
+EXPOSE 443 25 110 587 465 143 993 995 4190 8080
+ENV STALWART_HEALTHCHECK_URL=https://127.0.0.1:443/healthz/live
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+ CMD curl -fsSk -H "X-Forwarded-For: 127.0.0.1" "$STALWART_HEALTHCHECK_URL" || curl -fsS -H "X-Forwarded-For: 127.0.0.1" http://127.0.0.1:8080/healthz/live || exit 1
+ENTRYPOINT ["/usr/local/bin/stalwart"]
+CMD ["--config", "/etc/stalwart/config.json"]
+
+# *****************
+# Runtime image for musl targets
+# *****************
+FROM --platform=$TARGETPLATFORM alpine AS musl
+RUN apk add --update --no-cache ca-certificates curl tzdata libcap && \
+ rm -rf /var/cache/apk/* && \
+ addgroup -S -g 2000 stalwart && \
+ adduser -S -D -H -u 2000 -G stalwart -s /sbin/nologin stalwart && \
+ mkdir -p /etc/stalwart /var/lib/stalwart && \
+ chown stalwart:stalwart /etc/stalwart /var/lib/stalwart
+COPY --from=builder --chmod=0755 /app/artifact/stalwart /usr/local/bin/stalwart
+RUN setcap 'cap_net_bind_service=+ep' /usr/local/bin/stalwart
+USER stalwart
+WORKDIR /var/lib/stalwart
+VOLUME ["/etc/stalwart", "/var/lib/stalwart"]
+EXPOSE 443 25 110 587 465 143 993 995 4190 8080
+ENV STALWART_HEALTHCHECK_URL=https://127.0.0.1:443/healthz/live
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+ CMD curl -fsSk -H "X-Forwarded-For: 127.0.0.1" "$STALWART_HEALTHCHECK_URL" || curl -fsS -H "X-Forwarded-For: 127.0.0.1" http://127.0.0.1:8080/healthz/live || exit 1
+ENTRYPOINT ["/usr/local/bin/stalwart"]
+CMD ["--config", "/etc/stalwart/config.json"]
diff --git a/Dockerfile.fdb b/Dockerfile.fdb
new file mode 100644
index 0000000..fd732f8
--- /dev/null
+++ b/Dockerfile.fdb
@@ -0,0 +1,80 @@
+# syntax=docker/dockerfile:1
+
+FROM debian:trixie-slim AS chef
+ARG TARGETARCH
+ARG FDB_VERSION_RANGE="7.4"
+RUN apt-get update && \
+ export DEBIAN_FRONTEND=noninteractive && \
+ apt-get install -yq --no-install-recommends \
+ build-essential \
+ ca-certificates \
+ cmake \
+ clang \
+ curl \
+ jq \
+ protobuf-compiler
+ENV RUSTUP_HOME=/opt/rust/rustup \
+ PATH=/home/root/.cargo/bin:/opt/rust/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+RUN curl https://sh.rustup.rs -sSf | \
+ env CARGO_HOME=/opt/rust/cargo \
+ sh -s -- -y --default-toolchain stable --profile minimal --no-modify-path && \
+ env CARGO_HOME=/opt/rust/cargo \
+ rustup component add rustfmt
+RUN \
+ ARCH="${TARGETARCH:-$(dpkg --print-architecture)}" && \
+ case "$ARCH" in \
+ amd64) FDB_ARCH=amd64 ;; \
+ arm64) FDB_ARCH=aarch64 ;; \
+ *) echo "Unsupported architecture: $ARCH" >&2; exit 1 ;; \
+ esac && \
+ curl --retry 5 -fLso fdb-client.deb "$(curl --retry 5 -fLs 'https://api.github.com/repos/apple/foundationdb/releases?per_page=100' | jq --arg FDB_ARCH "$FDB_ARCH" --arg RANGE "${FDB_VERSION_RANGE}" -r '[.[] | select(.tag_name | startswith($RANGE + "."))] | sort_by(.tag_name | split(".") | map(tonumber)) | reverse | .[0].assets[] | select(.name | test("foundationdb-clients.*" + $FDB_ARCH + ".deb$")) | .browser_download_url')" && \
+ mkdir -p /fdb && \
+ dpkg -x fdb-client.deb /fdb && \
+ mv /fdb/usr/include/foundationdb /usr/include && \
+ mv /fdb/usr/lib/libfdb_c.so /usr/lib && \
+ rm -rf fdb-client.deb /fdb
+RUN env CARGO_HOME=/opt/rust/cargo cargo install cargo-chef && \
+ rm -rf /opt/rust/cargo/registry/
+WORKDIR /app
+
+FROM chef AS planner
+COPY Cargo.toml .
+COPY Cargo.lock .
+COPY crates/ crates/
+COPY resources/ resources/
+COPY tests/ tests/
+RUN cargo chef prepare --recipe-path recipe.json
+
+FROM chef AS builder
+COPY --from=planner /app/recipe.json recipe.json
+RUN cargo chef cook --release --recipe-path recipe.json
+COPY Cargo.toml .
+COPY Cargo.lock .
+COPY crates/ crates/
+COPY resources/ resources/
+COPY tests/ tests/
+RUN cargo build -p stalwart --no-default-features --features "foundationdb s3 redis azure nats enterprise" --release
+
+FROM debian:trixie-slim AS runtime
+
+COPY --from=builder --chmod=0755 /app/target/release/stalwart /usr/local/bin/stalwart
+COPY --from=builder /usr/lib/libfdb_c.so /usr/lib/libfdb_c.so
+RUN export DEBIAN_FRONTEND=noninteractive && \
+ apt-get update && \
+ apt-get install -yq --no-install-recommends ca-certificates curl libcap2-bin && \
+ rm -rf /var/lib/apt/lists/* && \
+ groupadd -r -g 2000 stalwart && \
+ useradd -r -u 2000 -g 2000 -s /usr/sbin/nologin -M stalwart && \
+ mkdir -p /etc/stalwart /var/lib/stalwart && \
+ chown stalwart:stalwart /etc/stalwart /var/lib/stalwart && \
+ setcap 'cap_net_bind_service=+ep' /usr/local/bin/stalwart
+
+USER stalwart
+WORKDIR /var/lib/stalwart
+VOLUME ["/etc/stalwart", "/var/lib/stalwart"]
+EXPOSE 443 25 110 587 465 143 993 995 4190 8080
+ENV STALWART_HEALTHCHECK_URL=https://127.0.0.1:443/healthz/live
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+ CMD curl -fsSk -H "X-Forwarded-For: 127.0.0.1" "$STALWART_HEALTHCHECK_URL" || curl -fsS -H "X-Forwarded-For: 127.0.0.1" http://127.0.0.1:8080/healthz/live || exit 1
+ENTRYPOINT ["/usr/local/bin/stalwart"]
+CMD ["--config", "/etc/stalwart/config.json"]
diff --git a/LICENSES/AGPL-3.0-only.txt b/LICENSES/AGPL-3.0-only.txt
new file mode 100644
index 0000000..0c97efd
--- /dev/null
+++ b/LICENSES/AGPL-3.0-only.txt
@@ -0,0 +1,235 @@
+GNU AFFERO GENERAL PUBLIC LICENSE
+Version 3, 19 November 2007
+
+Copyright (C) 2007 Free Software Foundation, Inc.
+
+Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
+
+ Preamble
+
+The GNU Affero General Public License is a free, copyleft license for software and other kinds of works, specifically designed to ensure cooperation with the community in the case of network server software.
+
+The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, our General Public Licenses are intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users.
+
+When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.
+
+Developers that use our General Public Licenses protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License which gives you legal permission to copy, distribute and/or modify the software.
+
+A secondary benefit of defending all users' freedom is that improvements made in alternate versions of the program, if they receive widespread use, become available for other developers to incorporate. Many developers of free software are heartened and encouraged by the resulting cooperation. However, in the case of software used on network servers, this result may fail to come about. The GNU General Public License permits making a modified version and letting the public access it on a server without ever releasing its source code to the public.
+
+The GNU Affero General Public License is designed specifically to ensure that, in such cases, the modified source code becomes available to the community. It requires the operator of a network server to provide the source code of the modified version running there to the users of that server. Therefore, public use of a modified version, on a publicly accessible server, gives the public access to the source code of the modified version.
+
+An older license, called the Affero General Public License and published by Affero, was designed to accomplish similar goals. This is a different license, not a version of the Affero GPL, but Affero has released a new version of the Affero GPL which permits relicensing under this license.
+
+The precise terms and conditions for copying, distribution and modification follow.
+
+ TERMS AND CONDITIONS
+
+0. Definitions.
+
+"This License" refers to version 3 of the GNU Affero General Public License.
+
+"Copyright" also means copyright-like laws that apply to other kinds of works, such as semiconductor masks.
+
+"The Program" refers to any copyrightable work licensed under this License. Each licensee is addressed as "you". "Licensees" and "recipients" may be individuals or organizations.
+
+To "modify" a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a "modified version" of the earlier work or a work "based on" the earlier work.
+
+A "covered work" means either the unmodified Program or a work based on the Program.
+
+To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
+
+To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
+
+An interactive user interface displays "Appropriate Legal Notices" to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion.
+
+1. Source Code.
+The "source code" for a work means the preferred form of the work for making modifications to it. "Object code" means any non-source form of a work.
+
+A "Standard Interface" means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language.
+
+The "System Libraries" of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A "Major Component", in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.
+
+The "Corresponding Source" for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source.
+
+The Corresponding Source for a work in source code form is that same work.
+
+2. Basic Permissions.
+All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law.
+
+You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.
+
+Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
+
+3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures.
+
+When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.
+
+4. Conveying Verbatim Copies.
+You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.
+
+You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.
+
+5. Conveying Modified Source Versions.
+You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
+
+ a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
+
+ b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to "keep intact all notices".
+
+ c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.
+
+ d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.
+
+A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an "aggregate" if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
+
+6. Conveying Non-Source Forms.
+You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:
+
+ a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.
+
+ b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.
+
+ c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b.
+
+ d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements.
+
+ e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d.
+
+A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work.
+
+A "User Product" is either (1) a "consumer product", which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, "normally used" refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.
+
+"Installation Information" for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.
+
+If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).
+
+The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network.
+
+Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying.
+
+7. Additional Terms.
+"Additional permissions" are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions.
+
+When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.
+
+Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms:
+
+ a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or
+
+ b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or
+
+ c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or
+
+ d) Limiting the use for publicity purposes of names of licensors or authors of the material; or
+
+ e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or
+
+ f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors.
+
+All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying.
+
+If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms.
+
+Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.
+
+8. Termination.
+
+You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).
+
+However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
+
+Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
+
+Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.
+
+9. Acceptance Not Required for Having Copies.
+
+You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.
+
+10. Automatic Licensing of Downstream Recipients.
+
+Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License.
+
+An "entity transaction" is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts.
+
+You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
+
+11. Patents.
+
+A "contributor" is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's "contributor version".
+
+A contributor's "essential patent claims" are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, "control" includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.
+
+Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.
+
+In the following three paragraphs, a "patent license" is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To "grant" such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party.
+
+If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent
+license to downstream recipients. "Knowingly relying" means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid.
+
+If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it.
+
+A patent license is "discriminatory" if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.
+
+Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law.
+
+12. No Surrender of Others' Freedom.
+
+If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may
+not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.
+
+13. Remote Network Interaction; Use with the GNU General Public License.
+
+Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph.
+
+Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the work with which it is combined will remain governed by version 3 of the GNU General Public License.
+
+14. Revised Versions of this License.
+
+The Free Software Foundation may publish revised and/or new versions of the GNU Affero General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU Affero General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU Affero General Public License, you may choose any version ever published by the Free Software Foundation.
+
+If the Program specifies that a proxy can decide which future versions of the GNU Affero General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program.
+
+Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version.
+
+15. Disclaimer of Warranty.
+
+THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+16. Limitation of Liability.
+
+IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+17. Interpretation of Sections 15 and 16.
+
+If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee.
+
+END OF TERMS AND CONDITIONS
+
+ How to Apply These Terms to Your New Programs
+
+If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.
+
+To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found.
+
+
+ Copyright (C)
+
+ This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License along with this program. If not, see .
+
+Also add information on how to contact you by electronic and paper mail.
+
+If your software can interact with users remotely through a computer network, you should also make sure that it provides a way for users to get its source. For example, if your program is a web application, its interface could display a "Source" link that leads users to an archive of the code. There are many ways you could offer source, and different solutions will be better for different programs; see section 13 for the specific requirements.
+
+You should also get your employer (if you work as a programmer) or school, if any, to sign a "copyright disclaimer" for the program, if necessary. For more information on this, and how to apply and follow the GNU AGPL, see .
diff --git a/LICENSES/LicenseRef-SEL.txt b/LICENSES/LicenseRef-SEL.txt
new file mode 100644
index 0000000..1345ee1
--- /dev/null
+++ b/LICENSES/LicenseRef-SEL.txt
@@ -0,0 +1,213 @@
+# Stalwart Enterprise License 2.0 (SELv2) Agreement
+
+*Last Update: March 29, 2026*
+
+PLEASE CAREFULLY READ THIS STALWART ENTERPRISE LICENSE AGREEMENT ("AGREEMENT"). THIS AGREEMENT CONSTITUTES A LEGALLY BINDING AGREEMENT BETWEEN YOU AND STALWART LABS LLC AND GOVERNS YOUR USE OF THE SOFTWARE (DEFINED BELOW). IF YOU DO NOT AGREE WITH THIS AGREEMENT, YOU MAY NOT USE THE SOFTWARE. IF YOU ARE USING THE SOFTWARE ON BEHALF OF A LEGAL ENTITY, YOU REPRESENT AND WARRANT THAT YOU HAVE AUTHORITY TO AGREE TO THIS AGREEMENT ON BEHALF OF SUCH ENTITY. IF YOU DO NOT HAVE SUCH AUTHORITY, DO NOT USE THE SOFTWARE IN ANY MANNER.
+
+This Agreement is entered into by and between Stalwart Labs LLC and you, or the legal entity on behalf of whom you are acting.
+
+---
+
+## 1. DEFINITIONS
+
+1.1. "Software" refers to the Stalwart Server Enterprise Edition software, including all its versions, updates, modifications, accompanying documentation, and related materials. The Software is self-hosted by Licensee on its own infrastructure.
+
+1.2. "Subscription" refers to the paid access to the Software provided by Licensor to Licensee, billed on a monthly or annual basis.
+
+1.3. "Licensor" refers to Stalwart Labs LLC, the entity providing the Software.
+
+1.4. "Licensee" refers to the individual or entity installing, accessing, or using the Software with a valid Subscription.
+
+1.5. "License Key" refers to the unique code provided by Licensor upon purchasing a Subscription which activates the full features of the Software. Each License Key is bound to the domain name (including all subdomains) designated by Licensee at the time of purchase.
+
+1.6. "Source Code" refers to the human-readable version of the Software's code, as opposed to the compiled machine-readable version.
+
+1.7. "Mailbox" refers to each individual user account or group account provisioned within the Software. The total number of Mailboxes across all domains and tenants hosted by Licensee determines the applicable Subscription tier.
+
+1.8. "Confidential Information" refers to any non-public information disclosed by either party to the other in connection with this Agreement, whether in written, oral, electronic, or other form, that is designated as confidential or that a reasonable person would understand to be confidential given the nature of the information and circumstances of disclosure.
+
+## 2. GRANT OF LICENSE
+
+2.1. Licensor grants Licensee a non-exclusive, non-transferable, non-sublicensable, limited license to download, install, and use the Software during the Subscription term, subject to the terms and conditions of this Agreement.
+
+2.2. The use of the Software is conditioned upon Licensee maintaining an active and valid paid Subscription with Licensor. The paid Subscription covers all versions of the Software and all updates and modifications released during the Subscription term.
+
+2.3. This license grants Licensee the right to use the Software for both personal and commercial purposes. Licensee may install and operate the Software on an unlimited number of servers within its organization, host an unlimited number of domains, and host data for an unlimited number of external organizations (tenants) using the Software's multi-tenancy features. The Subscription tier is determined solely by the total number of Mailboxes provisioned. However, Licensee is expressly prohibited from reselling, leasing, sublicensing, or otherwise redistributing the Software itself.
+
+2.4. This license is further governed by the terms and conditions set forth in any licensing agreements separately executed between Licensor and Licensee. In the event of any conflict between the terms of this Agreement and the terms of a signed licensing agreement, the terms of the signed licensing agreement shall control.
+
+2.5. You are not granted any other rights beyond what is expressly stated herein.
+
+## 3. LICENSE KEYS
+
+3.1. The Software shall not be used without a valid License Key issued by Licensor.
+
+3.2. Licensee is required to use valid License Keys issued by Licensor to run the Software, including any modified versions. Any attempts to bypass the License Key requirement is a violation of this Agreement.
+
+3.3. Distribution or sharing of License Keys to third parties, not associated with Licensee, is strictly prohibited.
+
+3.4. License Keys are bound to the Subscription period. Should your Subscription expire or be cancelled, all License Keys will become invalid after fifteen (15) days from the Subscription expiration or cancellation date.
+
+3.5. Any instance of the Software using such an expired key will revert to the Community Edition functionality after the aforementioned fifteen (15) day period.
+
+## 4. SOURCE CODE USAGE
+
+4.1. Licensee is permitted to view, copy, and modify the Software's Source Code, as made available by Licensor, solely for Licensee's internal business use and in compliance with this Agreement's terms.
+
+4.2. Any modifications to the Source Code do not grant Licensee any ownership rights to the original Software or any modifications. All rights, title, and interest to the Software and its Source Code remain exclusively with Licensor.
+
+4.3. Licensee is strictly prohibited from altering, removing, or in any way tampering with the License Key validation system within the Software. Any such unauthorized modifications will be considered a material breach of this Agreement and may result in legal action.
+
+4.4. Notwithstanding the availability of the Software's Source Code for review and limited modification, the Software and its Source Code are not open source and remain proprietary to Licensor. The provision of access to the Source Code does not confer any rights typically associated with open source software, including but not limited to the right to freely sublicense, or create derivative works for public distribution. All rights not expressly granted herein are reserved by Licensor.
+
+4.5. Notwithstanding the foregoing, you may copy the Source Code for development and testing purposes, without requiring a Subscription.
+
+## 5. INTELLECTUAL PROPERTY RIGHTS
+
+5.1. The Licensor retains all rights, title, and interest in and to the Software, including all intellectual property rights therein. This Agreement does not transfer any ownership rights to the Licensee.
+
+5.2. The Licensee must not remove, alter, or obscure any proprietary notices (including copyright and trademark notices) on the Software.
+
+## 6. SUBSCRIPTION TERMS, RENEWAL, AND CANCELLATION
+
+6.1. Subscriptions are available on a monthly or annual basis. The applicable fees, Mailbox tier, and billing cycle will be as set forth at the time of purchase or as subsequently agreed in writing between the parties.
+
+6.2. Where Licensee has provided a valid payment method (such as a credit card) on file, the Subscription will automatically renew at the end of each billing cycle at the then-current rate, unless Licensee removes the payment method or cancels the Subscription prior to the renewal date. No advance cancellation notice period is required; Licensee may cancel at any time by removing the payment method on file or by notifying Licensor.
+
+6.3. Where Licensee pays by invoice (bank transfer), the Subscription will not automatically renew. Licensor will issue an invoice notification prior to the end of the billing cycle, and the Subscription will renew only upon receipt of payment.
+
+6.4. Upon cancellation of a Subscription by Licensee prior to the end of a paid billing cycle, Licensee is entitled to a prorated refund for the unused portion of the then-current billing period. Refunds will be calculated from the effective date of cancellation through the end of the billing cycle and will be issued within thirty (30) days of the cancellation date.
+
+6.5. Licensor reserves the right to modify Subscription fees upon renewal. Any fee changes will be communicated to Licensee at least thirty (30) days prior to the start of the next billing cycle.
+
+## 7. SUPPORT AND SERVICE LEVELS
+
+7.1. All Licensees with an active Subscription have access to standard community support resources, including documentation and community forums, as made available by Licensor.
+
+7.2. Priority email support is available exclusively to Licensees whose Subscription covers one hundred fifty (150) or more Mailboxes. Priority email support inquiries will receive an initial response within forty-eight (48) hours of receipt during Licensor's standard business hours.
+
+7.3. The forty-eight (48) hour response time set forth in Section 7.2 constitutes a service level commitment. In the event Licensor consistently fails to meet this commitment over a period of thirty (30) consecutive days, the affected Licensee's sole remedy shall be the right to terminate the Subscription and receive a prorated refund for the unused portion of the billing cycle.
+
+7.4. The Software is self-hosted by Licensee on Licensee's own infrastructure. Licensor does not provide hosting services and makes no guarantees regarding uptime, availability, or performance of Licensee's self-hosted deployment.
+
+## 8. TERMINATION
+
+8.1. Licensor may terminate this Agreement immediately upon written notice if Licensee commits a material breach of any term of this Agreement and fails to cure such breach within thirty (30) days of receiving written notice specifying the breach.
+
+8.2. Licensor may terminate this Agreement for convenience upon thirty (30) days' written notice to Licensee. In such event, Licensee shall receive a prorated refund for the unused portion of any prepaid Subscription fees.
+
+8.3. In the event of a termination, Licensee will be provided with written notice, sent to the email address used during Subscription registration, outlining the reasons for the termination.
+
+8.4. Upon termination, all rights granted to Licensee under this Agreement will cease, and Licensee must promptly cease all use of the Software and destroy or delete all copies in its possession, except that Licensee may retain copies of the Source Code obtained prior to termination solely for archival purposes, subject to the continuing obligations of confidentiality and intellectual property protection set forth herein.
+
+## 9. CONFIDENTIALITY
+
+9.1. Each party agrees to hold the other party's Confidential Information in strict confidence and not to disclose such information to any third party, except to employees, contractors, or agents who have a need to know and are bound by confidentiality obligations no less protective than those contained herein.
+
+9.2. Confidential Information does not include information that: (a) is or becomes publicly available through no fault of the receiving party; (b) was rightfully in the receiving party's possession prior to disclosure; (c) is independently developed by the receiving party without use of the disclosing party's Confidential Information; or (d) is rightfully obtained from a third party without restriction on disclosure.
+
+9.3. A receiving party may disclose Confidential Information to the extent required by applicable law, regulation, or court order, provided that the receiving party gives the disclosing party prompt written notice (where legally permissible) and cooperates with the disclosing party's efforts to seek protective treatment of such information.
+
+9.4. The obligations of confidentiality set forth in this Section shall survive the termination or expiration of this Agreement for a period of three (3) years.
+
+## 10. LIMITATION OF LIABILITY
+
+10.1. In no event will the Licensor be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits or revenues, whether incurred directly or indirectly, or any loss of data, use, goodwill, or other intangible losses, resulting from (i) your use or inability to use the Software; (ii) any unauthorized access to or use of your servers and/or any personal information stored therein.
+
+10.2. Except for liability arising from death or personal injury caused by negligence, fraud, willful misconduct, or a party's indemnification obligations under this Agreement, Licensor's total aggregate liability for any and all claims under this Agreement shall be limited to the total Subscription fees paid by Licensee to Licensor in the twelve (12) months immediately preceding the event giving rise to the claim.
+
+## 11. INDEMNIFICATION
+
+11.1. Licensee agrees to indemnify, defend, and hold harmless Licensor, its officers, directors, employees, agents, licensors, suppliers, and any third-party information providers from and against all claims, losses, expenses, damages, and costs, including reasonable attorneys' fees, resulting from any violation of this Agreement or any activity related to Licensee's use or misuse of the Software (including negligent or wrongful conduct).
+
+11.2. Licensor agrees to indemnify, defend, and hold harmless Licensee from and against any third-party claim that the Software, as provided by Licensor, infringes or misappropriates any patent, copyright, trademark, or trade secret of a third party, provided that Licensee: (a) gives Licensor prompt written notice of such claim; (b) grants Licensor sole control of the defense and settlement of such claim; and (c) provides reasonable cooperation at Licensor's expense.
+
+11.3. If the Software becomes, or in Licensor's opinion is likely to become, the subject of an infringement claim, Licensor may at its option and expense: (a) procure for Licensee the right to continue using the Software; (b) modify or replace the Software to make it non-infringing while maintaining substantially equivalent functionality; or (c) if neither (a) nor (b) is commercially practicable, terminate this Agreement and provide Licensee with a prorated refund of any prepaid Subscription fees.
+
+11.4. Licensor shall have no obligation under this Section for any claim arising from: (a) modifications to the Software made by Licensee; (b) use of the Software in combination with products, services, or technologies not provided by Licensor, where the infringement would not have occurred but for such combination; or (c) Licensee's continued use of a version of the Software after being notified of the availability of a non-infringing update.
+
+## 12. DATA PROTECTION AND PRIVACY
+
+12.1. The Software is self-hosted by Licensee, and Licensee retains sole responsibility for all data stored and processed within its deployment of the Software, including any personal data of its users or tenants.
+
+12.2. To the extent that Licensor processes any personal data on behalf of Licensee (for example, in connection with support services or license management), such processing shall be conducted in accordance with applicable data protection laws, including but not limited to the General Data Protection Regulation (GDPR) where applicable, the California Consumer Privacy Act (CCPA) where applicable, and any other relevant data protection legislation.
+
+12.3. Where required by applicable data protection law, the parties shall enter into a separate Data Processing Agreement ("DPA") that sets forth the terms and conditions governing Licensor's processing of personal data on behalf of Licensee.
+
+12.4. In the event of a data breach affecting personal data processed by Licensor in connection with this Agreement, Licensor shall notify Licensee without undue delay and in any event within seventy-two (72) hours of becoming aware of the breach, and shall cooperate with Licensee in investigating and remediating the breach.
+
+12.5. Additional details regarding Licensor's data handling practices are outlined in Licensor's Privacy Policy, which can be accessed on Licensor's website.
+
+## 13. EXPORT COMPLIANCE
+
+13.1. The Software may be subject to export control and sanctions laws of the United States and other jurisdictions. Licensee agrees to comply with all applicable export control laws, including without limitation the U.S. Export Administration Regulations (EAR) and the regulations administered by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC).
+
+13.2. Licensee represents and warrants that: (a) Licensee is not located in, organized under the laws of, or a resident of any country or territory subject to comprehensive U.S. sanctions (currently including Cuba, Iran, North Korea, Syria, and the Crimea, Donetsk, and Luhansk regions of Ukraine); (b) Licensee is not listed on any U.S. government restricted party list; and (c) Licensee will not export, re-export, or transfer the Software to any prohibited destination, entity, or individual without the required governmental authorizations.
+
+## 14. ANTI-CORRUPTION
+
+14.1. Each party represents and warrants that it has not and will not, in connection with this Agreement, directly or indirectly offer, pay, promise to pay, or authorize the payment of any money or anything of value to any government official, political party, or candidate for political office for the purpose of influencing any act or decision, or securing any improper advantage.
+
+14.2. Each party shall comply with all applicable anti-corruption and anti-bribery laws, including without limitation the U.S. Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act 2010.
+
+## 15. GOVERNING LAW AND DISPUTE RESOLUTION
+
+15.1. This Agreement shall be governed by and construed under the laws of the State of Wyoming, United States of America, without regard to its conflict of laws principles.
+
+15.2. Any dispute, controversy, or claim arising out of or relating to this Agreement, or the breach, termination, or invalidity thereof, shall first be attempted to be resolved through good faith negotiation between the parties for a period of thirty (30) days following written notice of the dispute.
+
+15.3. If the dispute is not resolved through negotiation within the thirty (30) day period, it shall be finally resolved by binding arbitration administered by the American Arbitration Association ("AAA") in accordance with its Commercial Arbitration Rules. The arbitration shall be conducted in Sheridan, Wyoming, before a single arbitrator. The language of the arbitration shall be English.
+
+15.4. The arbitrator's award shall be final and binding and may be entered as a judgment in any court of competent jurisdiction. Each party shall bear its own costs and attorneys' fees in connection with the arbitration, unless the arbitrator determines otherwise.
+
+15.5. Notwithstanding the foregoing, either party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property rights or Confidential Information without first submitting to arbitration.
+
+## 16. NOTICES
+
+16.1. All notices required or permitted under this Agreement shall be in writing and shall be deemed effectively given: (a) upon personal delivery; (b) upon confirmed transmission by email; or (c) one (1) business day after deposit with a nationally recognized overnight courier service.
+
+16.2. Notices to Licensor shall be sent to the address and email set forth in Section 21 (Contact Information) of this Agreement. Notices to Licensee shall be sent to the email address provided during Subscription registration or as subsequently updated by Licensee in writing.
+
+## 17. ASSIGNMENT
+
+17.1. Licensee may not transfer or assign this Agreement or any rights or obligations hereunder without the prior written consent of Licensor, except that Licensee may assign this Agreement without consent in connection with a merger, acquisition, corporate reorganization, or sale of all or substantially all of its assets, provided that the assignee agrees in writing to be bound by the terms of this Agreement.
+
+17.2. Licensor may assign this Agreement without restriction. Any assignment in violation of this Section shall be null and void.
+
+## 18. DISCLAIMERS AND WARRANTIES
+
+18.1. The Software is provided "AS IS" and "AS AVAILABLE", without warranty of any kind, either express or implied, including, without limitation, warranties of merchantability, fitness for a particular purpose, and non-infringement.
+
+18.2. Licensor does not warrant that the Software will be error-free, that access thereto will be uninterrupted, or that defects will be corrected.
+
+18.3. Licensor warrants that, as of the date of delivery, the Software will perform substantially in accordance with the accompanying documentation for a period of ninety (90) days. Licensee's sole remedy for breach of this warranty shall be, at Licensor's option, repair or replacement of the non-conforming Software, or a refund of the Subscription fees paid for the period during which the Software was non-conforming.
+
+## 19. FORCE MAJEURE
+
+Neither party shall be in default or otherwise liable for any delay in or failure of its performance under this Agreement if such delay or failure arises by any reason of any event beyond the reasonable control of a party, including acts of God, the elements, earthquakes, floods, fires, epidemics, riots, failures or delays in transportation or communications, or any act or failure to act by the other party or such other party's officers, employees, agents, or contractors. The affected party shall give prompt notice to the other party and shall use commercially reasonable efforts to mitigate the effects of the force majeure event. If a force majeure event continues for more than ninety (90) days, either party may terminate this Agreement upon written notice, and Licensee shall receive a prorated refund of any prepaid Subscription fees.
+
+## 20. SURVIVAL
+
+The following Sections shall survive the termination or expiration of this Agreement: Section 1 (Definitions), Section 4.2 (Ownership of Modifications), Section 4.4 (Proprietary Nature of Software), Section 5 (Intellectual Property Rights), Section 9 (Confidentiality), Section 10 (Limitation of Liability), Section 11 (Indemnification), Section 12 (Data Protection and Privacy), Section 13 (Export Compliance), Section 15 (Governing Law and Dispute Resolution), and Section 20 (Survival).
+
+## 21. SEVERABILITY
+
+If any provision of this Agreement is held to be unenforceable or invalid for any reason, that provision shall be reformed to the extent necessary to make it enforceable and consistent with the intent of the parties, and the remaining provisions shall remain in full force and effect.
+
+## 22. ENTIRE AGREEMENT
+
+This Agreement constitutes the entire agreement between the Licensor and the Licensee with respect to the subject matter hereof and supersedes all prior or contemporaneous understandings regarding such subject matter. No amendment to or modification of this Agreement will be binding unless in writing and signed by the Licensor.
+
+## 23. ACCEPTANCE
+
+By downloading, installing, or using the Software, even without explicitly clicking on an "I Agree" button or a similar mechanism, you acknowledge that you have read, understood, and agreed to be bound by the terms and conditions of this Agreement.
+
+## 24. CONTACT INFORMATION
+
+If you have any questions about this Agreement, please contact Stalwart Labs LLC at:
+
+Stalwart Labs LLC
+1309 Coffeen Avenue STE 1200
+Sheridan, Wyoming 82801
+USA
+hello@stalw.art
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..1fe4842
--- /dev/null
+++ b/README.md
@@ -0,0 +1,186 @@
+
+
+ 
+
+
+
+
+ Secure, scalable mail & collaboration server with comprehensive protocol support 🛡️
(IMAP, JMAP, SMTP, CalDAV, CardDAV, WebDAV)
+
+
+
+
+
+ 
+
+ 
+
+ 
+
+ 
+
+ 
+
+ 
+ 
+
+ 
+
+
+## Features
+
+**Stalwart** is an open-source mail & collaboration server with JMAP, IMAP4, POP3, SMTP, CalDAV, CardDAV and WebDAV support and a wide range of modern features. It is written in Rust and designed to be secure, fast, robust and scalable.
+
+Key features:
+
+- **Email** server with complete protocol support:
+ - JMAP:
+ * [JMAP for Mail](https://datatracker.ietf.org/doc/html/rfc8621) server.
+ * [JMAP for Sieve Scripts](https://www.ietf.org/archive/id/draft-ietf-jmap-sieve-22.html).
+ * [WebSocket](https://datatracker.ietf.org/doc/html/rfc8887), [Blob Management](https://www.rfc-editor.org/rfc/rfc9404.html) and [Quotas](https://www.rfc-editor.org/rfc/rfc9425.html) extensions.
+ - IMAP:
+ * [IMAP4rev2](https://datatracker.ietf.org/doc/html/rfc9051) and [IMAP4rev1](https://datatracker.ietf.org/doc/html/rfc3501) server.
+ * [ManageSieve](https://datatracker.ietf.org/doc/html/rfc5804) server.
+ * Numerous [extensions](https://stalw.art/docs/development/rfcs#imap4-and-extensions) supported.
+ - POP3:
+ - [POP3](https://datatracker.ietf.org/doc/html/rfc1939) server.
+ - [STLS](https://datatracker.ietf.org/doc/html/rfc2595) and [SASL](https://datatracker.ietf.org/doc/html/rfc5034) support as well as other [extensions](https://datatracker.ietf.org/doc/html/rfc2449).
+ - SMTP:
+ * SMTP server with built-in [DMARC](https://datatracker.ietf.org/doc/html/rfc7489), [DKIMv2](https://datatracker.ietf.org/doc/draft-ietf-dkim-dkim2-spec/), [DKIMv1](https://datatracker.ietf.org/doc/html/rfc6376), [SPF](https://datatracker.ietf.org/doc/html/rfc7208) and [ARC](https://datatracker.ietf.org/doc/html/rfc8617) support for message authentication.
+ * Strong transport security through [DANE](https://datatracker.ietf.org/doc/html/rfc6698), [MTA-STS](https://datatracker.ietf.org/doc/html/rfc8461) and [SMTP TLS](https://datatracker.ietf.org/doc/html/rfc8460) reporting.
+ * Automated DKIM key rotation and management.
+ * Inbound throttling and filtering with granular configuration rules, sieve scripting, MTA hooks and milter integration.
+ * Distributed virtual queues with delayed delivery, priority delivery, quotas, routing rules and throttling support.
+ * Envelope rewriting and message modification.
+- **Collaboration** server:
+ - Calendaring and scheduling:
+ - [CalDAV](https://datatracker.ietf.org/doc/html/rfc4791) and [CalDAV Scheduling](https://datatracker.ietf.org/doc/html/rfc6638) support.
+ - [JMAP for Calendars](https://datatracker.ietf.org/doc/html/draft-ietf-jmap-calendars-24) support.
+ - Contact management:
+ - [CardDAV](https://datatracker.ietf.org/doc/html/rfc6352) support.
+ - [JMAP for Contacts](https://datatracker.ietf.org/doc/html/rfc9610) support.
+ - File storage:
+ - [WebDAV](https://datatracker.ietf.org/doc/html/rfc4918) support.
+ - [JMAP for File Storage](https://datatracker.ietf.org/doc/html/draft-ietf-jmap-filenode-03) support.
+ - Sharing with fine-grained access controls:
+ - [WebDAV ACL](https://datatracker.ietf.org/doc/html/rfc3744) support.
+ - [JMAP Sharing](https://datatracker.ietf.org/doc/html/rfc9670) support.
+- **Spam** and **Phishing** built-in filter:
+ - Comprehensive set of filtering **rules** on par with popular solutions.
+ - LLM-driven spam filtering and message analysis.
+ - Statistical **spam classifier** with collaborative filtering, automatic training capabilities and address book integration.
+ - DNS Blocklists (**DNSBLs**) checking of IP addresses, domains, and hashes.
+ - Collaborative digest-based spam filtering with **Pyzor**.
+ - **Phishing** protection against homographic URL attacks, sender spoofing and other techniques.
+ - Trusted **reply** tracking to recognize and prioritize genuine e-mail replies.
+ - Sender **reputation** monitoring by IP address, ASN, domain and email address.
+ - **Greylisting** to temporarily defer unknown senders.
+ - **Spam traps** to set up decoy email addresses that catch and analyze spam.
+- **Flexible**:
+ - Pluggable storage backends with **RocksDB**, **FoundationDB**, **PostgreSQL**, **mySQL**, **SQLite**, **S3-Compatible**, **Azure** and **Redis** support.
+ - Full-text search available in 17 languages using the built-in search engine or via **Meilisearch**, **ElasticSearch**, **OpenSearch**, **PostgreSQL** or **mySQL** backends.
+ - Sieve scripting language with support for all [registered extensions](https://www.iana.org/assignments/sieve-extensions/sieve-extensions.xhtml).
+ - Email aliases, mailing lists, subaddressing and catch-all addresses support.
+ - Automated DNS management.
+ - Automatic account configuration and discovery with [PACC](https://datatracker.ietf.org/doc/draft-ietf-mailmaint-pacc/), [autoconfig](https://datatracker.ietf.org/doc/draft-ietf-mailmaint-autoconfig/) and [autodiscover](https://learn.microsoft.com/en-us/exchange/architecture/client-access/autodiscover?view=exchserver-2019).
+ - Multi-tenancy support with domain and tenant isolation.
+ - Disk quotas per user and tenant.
+- **Secure and robust**:
+ - Encryption at rest with **S/MIME** or **OpenPGP**.
+ - Automatic TLS certificate provisioning with [ACME](https://datatracker.ietf.org/doc/html/rfc8555) using `TLS-ALPN-01`, `DNS-01`, `DNS-PERSIST-01` or `HTTP-01` challenges.
+ - Automated blocking of IP addresses that attack, abuse or scan the server for exploits.
+ - Rate limiting.
+ - Security audited (read the [report](https://stalw.art/blog/security-audit)).
+ - Memory safe (thanks to Rust).
+- **Scalable and fault-tolerant**:
+ - Designed to handle growth seamlessly, from small setups to large-scale deployments of thousands of nodes.
+ - Built with **fault tolerance** and **high availability** in mind, recovers from hardware or software failures with minimal operational impact.
+ - Peer-to-peer cluster coordination or with **Kafka**, **Redpanda**, **NATS** or **Redis**.
+ - **Kubernetes**, **Apache Mesos** and **Docker Swarm** support for automated scaling and container orchestration.
+ - Read replicas, sharded blob storage and in-memory data stores for high performance and low latency.
+- **Authentication and Authorization**:
+ - **OpenID Connect** authentication.
+ - OAuth 2.0 authorization with [authorization code](https://www.rfc-editor.org/rfc/rfc8628) and [device authorization](https://www.rfc-editor.org/rfc/rfc8628) flows.
+ - **LDAP**, **OIDC**, **SQL** or built-in authentication backend support.
+ - System for Cross-domain Identity Management ([SCIM](https://www.rfc-editor.org/info/rfc7643/)) v2 for automated provisioning.
+ - Two-factor authentication with Time-based One-Time Passwords (`2FA-TOTP`)
+ - Application passwords (App Passwords).
+ - Roles and permissions.
+ - Access Control Lists (ACLs).
+- **Observability**:
+ - Logging and tracing with **OpenTelemetry**, journald, log files and console support.
+ - Metrics with **OpenTelemetry** and **Prometheus** integration.
+ - Webhooks for event-driven automation.
+ - Alerts with email and webhook notifications.
+ - Live tracing and metrics.
+- **Web-based administration**:
+ - Dashboard with real-time statistics and monitoring.
+ - Account, domain, group and mailing list management.
+ - SMTP queue management for messages and outbound DMARC and TLS reports.
+ - Report visualization interface for received DMARC, TLS-RPT and Failure (ARF) reports.
+ - Configuration of every aspect of the mail server.
+ - Log viewer with search and filtering capabilities.
+ - Self-service portal for password reset and encryption-at-rest key management.
+
+## Screenshots
+
+
+
+## Presentation
+
+**Want a deeper dive?** Need to explain to your boss why Stalwart is the perfect fit? Whether you're evaluating options, making a case to your team, or simply curious about how it all works under the hood, these slides walk you through the key features, architecture, and benefits of Stalwart. Browse the [slides](https://stalw.art/slides) to see what makes it stand out.
+
+## Get Started
+
+Install Stalwart on your server by following the instructions for your platform:
+
+- [Linux / MacOS / FreeBSD](https://stalw.art/docs/install/platform/linux)
+- [Windows](https://stalw.art/docs/install/platform/windows)
+- [Docker](https://stalw.art/docs/install/platform/docker)
+
+All documentation is available at [stalw.art/docs](https://stalw.art/docs/install/get-started).
+
+## Support
+
+If you are having problems running Stalwart, found a bug, or just have a question, please head to the [Stalwart Support Portal](https://support.stalw.art) at [support.stalw.art](https://support.stalw.art).
+Additionally, you may purchase an [Enterprise License](https://stalw.art/enterprise) to obtain priority support from Stalwart Labs LLC, including response-time commitments and a private Priority Support area on the portal.
+
+## Contributing
+
+We welcome contributions, but to keep the project maintainable there are a few things to know before opening a pull request. Because of the high volume of low-quality, AI-generated submissions, pull requests are limited to a list of vouched contributors; to be added, post at [support.stalw.art](https://support.stalw.art) describing the change you would like to submit, together with a link to the proposed change. At this stage only bug fixes and translations are accepted, and new features are not, unless they involve just a few lines of code.
+For the full guidelines, please read [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## Roadmap
+
+Stalwart has reached an exciting point in its journey, it’s now **feature complete**. All the core functionality and open standard email and collaboration protocols that we set out to support are in place. In other words, Stalwart already does everything you’d expect from a modern, standards-compliant mail and collaboration platform.
+
+The next major milestone is all about refinement: finalizing the database schema and focusing on performance optimizations to ensure everything runs as efficiently and reliably as possible. Once that’s done, we’ll be ready to roll out version **1.0**.
+
+Of course, development doesn’t stop there. The community has contributed hundreds of great ideas for improvements and new features, everything from subtle usability tweaks to entirely new integrations. You can see the full list of proposals over on our [GitHub issues](https://github.com/stalwartlabs/stalwart/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc+label%3Aenhancement). If there’s something you’d like to see prioritized, just give it a thumbs up as we plan to implement enhancements based on the community’s votes.
+
+## Sponsorship
+
+Your support is crucial in helping us continue to improve the project, add new features, and maintain the highest level of quality. By [becoming a sponsor](https://opencollective.com/stalwart), you help fund the development and future of Stalwart. As a thank-you, sponsors who contribute $5 per month or more will automatically receive a [Enterprise edition](https://stalw.art/enterprise/) license. And, sponsors who contribute $30 per month or more, also have access to [Premium Support](https://stalw.art/support) from Stalwart Labs.
+
+## Funding
+
+Part of the development of this project was funded through:
+
+- [NGI0 Entrust Fund](https://nlnet.nl/entrust), a fund established by [NLnet](https://nlnet.nl/) with financial support from the European Commission's [Next Generation Internet](https://ngi.eu/) programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 101069594.
+- [NGI Zero Core](https://nlnet.nl/NGI0/), a fund established by [NLnet](https://nlnet.nl/) with financial support from the European Commission's programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 101092990.
+
+If you find the project useful you can help by [becoming a sponsor](https://opencollective.com/stalwart). Thank you!
+
+## License
+
+This project is dual-licensed under the **GNU Affero General Public License v3.0** (AGPL-3.0; as published by the Free Software Foundation) and the **Stalwart Enterprise License v2 (SELv2)**:
+
+- The [GNU Affero General Public License v3.0](./LICENSES/AGPL-3.0-only.txt) is a free software license that ensures your freedom to use, modify, and distribute the software, with the condition that any modified versions of the software must also be distributed under the same license.
+- The [Stalwart Enterprise License v2 (SELv2)](./LICENSES/LicenseRef-SEL.txt) is a proprietary license designed for commercial use. It offers additional features and greater flexibility for businesses that do not wish to comply with the AGPL-3.0 license requirements.
+
+Each file in this project contains a license notice at the top, indicating the applicable license(s). The license notice follows the [REUSE guidelines](https://reuse.software/) to ensure clarity and consistency. The full text of each license is available in the [LICENSES](./LICENSES/) directory.
+
+## Copyright
+
+Copyright (C) 2020, Stalwart Labs LLC
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..9d741d6
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,154 @@
+# Security Policy for Stalwart
+
+## Supported Versions
+
+We provide security updates for the following versions of Stalwart:
+
+| Version | Supported | End of Support |
+| ------- | ------------------ | -------------- |
+| 0.16.x | :white_check_mark: | TBD |
+| 0.15.x | :white_check_mark: | 2026-12-01 |
+| < 0.14 | :x: | Ended |
+
+**Note**: We typically support the current major version and one previous major version. Users are strongly encouraged to upgrade to the latest version for the best security posture.
+
+## Reporting a Vulnerability
+
+We take the security of Stalwart very seriously. If you believe you've found a security vulnerability, we encourage you to inform us responsibly through coordinated disclosure.
+
+### How to Report
+
+**Do not report security vulnerabilities through public GitHub issues, discussions, or social media.**
+
+Instead, please use one of these secure channels:
+
+1. **Email** (preferred): Send details to `security@stalw.art`
+2. **GitHub Security Advisories**: Use the "Report a vulnerability" button in the Security tab
+3. **Backup contact**: If no response within 48 hours, email `hello@stalw.art`
+
+### What to Include
+
+To help us understand and address the issue quickly, please include:
+
+**Required Information:**
+- Brief description of the vulnerability type
+- Affected version(s) and components
+- Steps to reproduce the issue
+- Impact assessment (what could an attacker achieve?)
+
+**Helpful Additional Details:**
+- Full paths of affected source files
+- Specific commit/branch where the issue exists
+- Required configuration to reproduce
+- Proof-of-concept code (if available)
+- Suggested mitigation or fix (if you have ideas)
+
+### Our Response Process
+
+**Timeline Commitments:**
+- **Initial acknowledgment**: Within 24 hours
+- **Detailed response**: Within 72 hours
+- **Status updates**: Every 7 days until resolved
+- **Resolution target**: 90 days for most issues
+
+**What We'll Do:**
+1. Acknowledge your report and assign a tracking ID
+2. Assess the vulnerability and determine severity
+3. Develop and test a fix
+4. Coordinate disclosure timeline with you
+5. Release security update and publish advisory
+6. Credit you in our security advisory (if desired)
+
+## Disclosure Policy
+
+We follow responsible disclosure principles:
+
+- **Coordinated disclosure**: We'll work with you to determine appropriate disclosure timing
+- **Typical timeline**: 90 days from report to public disclosure
+- **Early disclosure**: May occur if issue is being actively exploited
+- **Delayed disclosure**: May be necessary for complex issues requiring significant changes
+
+## Scope
+
+This security policy applies to:
+
+**In Scope:**
+- Stalwart (all supported versions)
+- Official Docker images
+- Documentation that could lead to insecure configurations
+- Dependencies with security implications
+
+**Out of Scope:**
+- Third-party integrations or plugins
+- Issues requiring physical access to the server
+- Social engineering attacks
+- Attacks requiring compromised credentials (unless the vulnerability enables credential compromise)
+- Theoretical vulnerabilities without practical exploitation
+
+## Security Measures
+
+**Our Commitments:**
+- Regular security audits of dependencies using `cargo audit`
+- Automated security scanning in CI/CD pipeline
+- Following Rust security best practices
+- Prompt security updates for critical dependencies
+- Security-focused code review process
+
+**User Responsibilities:**
+- Keep Stalwart updated to supported versions
+- Follow security configuration guidelines
+- Implement proper network security (firewalls, TLS, etc.)
+- Regular security monitoring and logging
+- Secure credential management
+
+## Legal Safe Harbor
+
+We support security research conducted in good faith. If you follow these guidelines:
+
+**We will NOT:**
+- Initiate legal action against you
+- Contact law enforcement about your research
+- Suspend or terminate your access to Stalwart services
+
+**You must:**
+- Only test against your own Stalwart installations
+- Not access, modify, or delete user data
+- Not perform testing that could degrade service availability
+- Not publicly disclose the issue before coordinated disclosure
+- Act in good faith and not for malicious purposes
+
+## Recognition
+
+We believe in recognizing security researchers who help keep Stalwart secure:
+
+- **Security Advisory Credits**: We'll credit you in our GitHub Security Advisories (unless you prefer to remain anonymous)
+- **Hall of Fame**: Significant contributors may be listed in our security acknowledgments
+- **Swag**: We may send Stalwart merchandise for notable contributions
+
+## Security Updates
+
+**Stay Informed:**
+- Subscribe to our [GitHub releases](https://github.com/stalwartlabs/stalwart/releases) for security updates
+- Join our community channels for security announcements
+- Enable GitHub notifications for security advisories
+
+**Update Process:**
+- Security updates are published as patch releases (e.g., 0.12.1 → 0.12.2)
+- Critical vulnerabilities may receive out-of-band releases
+- Docker images are updated simultaneously with releases
+- Security advisories are published through GitHub Security Advisories
+
+## Contact Information
+
+- **Security reports**: security@stalw.art
+- **General inquiries**: hello@stalw.art
+- **PGP Key**: Available upon request for sensitive communications
+
+## Additional Resources
+
+- [Stalwart Security Incident Response Process](SECURITY_PROCESS.md)
+- [Security Configuration Guide](https://stalw.art/docs/install/security)
+- [Rust Security Advisory Database](https://rustsec.org/)
+
+*This security policy is effective as of June 20, 2025 and may be updated periodically. Check back regularly for updates.*
+
diff --git a/SECURITY_PROCESS.md b/SECURITY_PROCESS.md
new file mode 100644
index 0000000..b32e96b
--- /dev/null
+++ b/SECURITY_PROCESS.md
@@ -0,0 +1,173 @@
+# Stalwart Security Incident Response Checklist
+
+## Phase 1 : Initial Assessment & Validation
+
+### Updates
+
+<< Use this section to detail the report received, initial assessment, and validation results >>
+
+Example:
+
+I've reviewed the security report and confirmed this vulnerability exists in Stalwart version X.Y.Z.
+
+Assessment of exploitability:
+
+- Attack complexity: [High/Medium/Low]
+- Prerequisites: [Authentication required/Network access/Specific configuration/etc.]
+- User interaction required: [Yes/No]
+
+Potential impact:
+- Email data confidentiality: [At risk/Not affected]
+- Server integrity: [At risk/Not affected]
+- Service availability: [At risk/Not affected]
+- Estimated affected installations: [Number/Percentage]
+
+### Resources
+
+- [Stalwart Security Policy](https://github.com/stalwartlabs/stalwart/blob/main/SECURITY.md)
+- [CVE Scoring Calculator](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator)
+- [Rust Security Advisory Database](https://rustsec.org/)
+
+### Tasks
+
+- [ ] Reproduce the vulnerability in test environment
+- [ ] Assess CVSS score and severity level
+- [ ] Check if vulnerability affects current stable version
+- [ ] Check if vulnerability affects LTS versions (if applicable)
+- [ ] Determine if this requires immediate action or can wait for next release cycle
+- [ ] Document technical details and root cause
+
+### Assessment Summary
+
+- **Severity Level**: `Critical|High|Medium|Low`
+- **CVSS Score**: `X.X`
+- **Affects versions**: `X.Y.Z to X.Y.Z`
+- **Root cause**: Brief technical explanation
+- **Introduced in commit/version**: `commit-hash` or `vX.Y.Z`
+- **Attack vector**: `Network|Local|Physical`
+- **Estimated timeline for fix**: `X days/weeks`
+
+## Phase 2: Immediate Response & Mitigation
+
+### Updates
+
+<< Document immediate actions taken and mitigation strategies >>
+
+Example:
+
+Working on hotfix for version X.Y.Z. Temporary workaround available by disabling [feature] in configuration.
+
+### Tasks
+
+- [ ] Implement immediate workaround if possible
+- [ ] Update security advisory draft
+- [ ] Prepare patch/hotfix
+- [ ] Test fix thoroughly in development environment
+- [ ] Prepare updated Docker images and binaries
+- [ ] Draft security advisory for GitHub Security Advisories
+- [ ] Consider if coordinated disclosure timeline needs adjustment
+
+### Mitigation Details
+
+- **Workaround available**: `Yes|No` - If yes, describe briefly
+- **Fix implemented on**: `YYYY-MM-DD`
+- **Patch/hotfix version**: `vX.Y.Z`
+- **GitHub Security Advisory ID**: `GHSA-XXXX-XXXX-XXXX`
+
+## Phase 3: Impact Assessment & User Analysis
+
+### Updates
+
+<< Analysis of potential impact on the Stalwart deployments >>
+
+Based on telemetry data and version statistics, approximately X installations may be affected.
+
+### Tasks
+
+- [ ] Analyze version adoption from update checks (if available)
+- [ ] Estimate number of vulnerable installations
+- [ ] Assess if default configurations are vulnerable
+- [ ] Review if vulnerability has been exploited (check logs, reports)
+- [ ] Determine if any user data may have been compromised
+- [ ] Check for indicators of active exploitation in the wild
+
+### Analysis Notes
+
+_Document your impact assessment process and findings_
+
+### Impact Summary
+
+- **Estimated vulnerable installations**: `~X out of Y`
+- **Default configuration vulnerable**: `Yes|No`
+- **Evidence of exploitation**: `Found|Not found|Unknown`
+- **User data potentially at risk**: `Email content|Credentials|Configuration|None`
+- **Confidence in assessment**: `High|Medium|Low`
+
+## Phase 4: Communication & Release
+
+### Updates
+
+<< Communication strategy and release timeline >>
+
+Security release vX.Y.Z will be published on YYYY-MM-DD with coordinated disclosure.
+
+### Tasks
+
+**Pre-release preparation:**
+
+- [ ] Finalize security patch
+- [ ] Prepare release notes with security details
+- [ ] Update documentation if needed
+- [ ] Test automated update mechanisms
+- [ ] Prepare GitHub Security Advisory
+
+**Communication channels:**
+
+- [ ] Draft announcement for Stalwart community forum/Discord
+- [ ] Prepare release announcement for GitHub
+- [ ] Draft security advisory content
+- [ ] Consider notification to major distributors/packagers
+
+**Release execution:**
+
+- [ ] Publish patched version to GitHub releases
+- [ ] Update Docker images on Docker Hub
+- [ ] Publish GitHub Security Advisory
+- [ ] Post to community channels (Discord/forum)
+- [ ] Update project website/documentation
+- [ ] Submit CVE request if warranted (CVSS ≥ 4.0)
+
+**Post-release:**
+
+- [ ] Monitor community channels for questions
+- [ ] Track adoption of security update
+- [ ] Follow up on any additional reports
+- [ ] Document lessons learned
+
+### Communication Record
+
+- **Security release published**: `YYYY-MM-DD HH:MM UTC`
+- **GitHub Security Advisory**: `GHSA-XXXX-XXXX-XXXX`
+- **CVE ID** (if applicable): `CVE-YYYY-XXXXX`
+- **Community announcement**: [Link to forum/Discord post]
+- **Estimated time to 50% adoption**: `X days/weeks`
+
+## Post-Incident Review
+
+### What went well?
+-
+
+### What could be improved?
+-
+
+### Action items for future incidents:
+- [ ]
+- [ ]
+- [ ]
+
+### Process improvements:
+- [ ]
+- [ ]
+
+## Emergency Contacts
+- **Primary maintainer**: hello@stalw.art
diff --git a/SECURITY_TEMPLATE.md b/SECURITY_TEMPLATE.md
new file mode 100644
index 0000000..059154a
--- /dev/null
+++ b/SECURITY_TEMPLATE.md
@@ -0,0 +1,135 @@
+# Stalwart Security Advisory
+
+**CVE ID:** CVE-YYYY-NNNNN
+**Publication Date:** YYYY-MM-DD
+**Last Updated:** YYYY-MM-DD
+
+## Summary
+
+[Provide a brief, non-technical summary of the vulnerability in 1-2 sentences]
+
+## Affected Products and Versions
+
+**Product:** Stalwart Mail and Collaboration Server
+
+**Affected Versions:**
+- Version X.X.X through Y.Y.Y
+- [List specific affected version ranges]
+
+**Fixed Versions:**
+- Version Z.Z.Z and later
+- [List all versions that include the fix]
+
+## Vulnerability Details
+
+### Description
+
+[Detailed technical description of the vulnerability, including how it can be exploited]
+
+### Impact
+
+[Describe the potential impact if this vulnerability is exploited]
+
+### CVSS Score
+
+**CVSS v3.1 Base Score:** X.X ([SEVERITY])
+**Vector String:** CVSS:3.1/AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X
+
+**Severity Breakdown:**
+- **Attack Vector:** [Network/Adjacent/Local/Physical]
+- **Attack Complexity:** [Low/High]
+- **Privileges Required:** [None/Low/High]
+- **User Interaction:** [None/Required]
+- **Scope:** [Unchanged/Changed]
+- **Confidentiality Impact:** [None/Low/High]
+- **Integrity Impact:** [None/Low/High]
+- **Availability Impact:** [None/Low/High]
+
+### CWE Classification
+
+**CWE-XXX:** [Weakness Name]
+
+## Technical Details
+
+### Root Cause
+
+[Explain the underlying cause of the vulnerability]
+
+### Attack Scenario
+
+[Describe a realistic attack scenario or proof of concept, without providing exploit code]
+
+### Prerequisites
+
+[List any conditions that must be met for successful exploitation]
+
+## Remediation
+
+### Recommended Actions
+
+1. **Immediate:** Upgrade to version Z.Z.Z or later
+2. **Short-term:** [Any temporary mitigation measures]
+3. **Long-term:** [Any additional security hardening recommendations]
+
+### Upgrade Instructions
+
+```bash
+# Example upgrade commands
+[Provide specific upgrade instructions for Stalwart]
+```
+
+### Workarounds
+
+[If applicable, describe any temporary workarounds for systems that cannot be immediately upgraded]
+
+**Note:** Workarounds are temporary measures and do not fully resolve the vulnerability. Upgrading is strongly recommended.
+
+## Detection
+
+### Indicators of Compromise
+
+[List any logs, patterns, or indicators that may suggest exploitation attempts]
+
+### Log Entries
+
+```
+[Example log entries that administrators should look for]
+```
+
+## Timeline
+
+- **YYYY-MM-DD:** Vulnerability discovered [by researcher/team name]
+- **YYYY-MM-DD:** Vendor notified
+- **YYYY-MM-DD:** Vendor acknowledged issue
+- **YYYY-MM-DD:** Fix developed and tested
+- **YYYY-MM-DD:** Fixed version released
+- **YYYY-MM-DD:** Public disclosure
+
+## Credits
+
+This vulnerability was discovered by [Researcher Name / Organization].
+
+## References
+
+- Stalwart Mail Server: https://stalw.art/
+- CVE Entry: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-YYYY-NNNNN
+- GitHub Advisory: [Link to GitHub Security Advisory if applicable]
+- Release Notes: [Link to release notes with fix]
+
+## Contact Information
+
+For questions or concerns regarding this advisory, please contact:
+
+**Security Team:** hello@stalw.art
+**Website:** https://stalw.art
+
+To report security vulnerabilities in Stalwart, please follow our [responsible disclosure policy](https://github.com/stalwartlabs/stalwart/security/policy).
+
+## Disclaimer
+
+This advisory is provided "as is" without warranty of any kind. The information contained in this advisory is subject to change without notice.
+
+---
+
+**Document Version:** 1.0
+**Classification:** Public
diff --git a/UPGRADING/v0_04.md b/UPGRADING/v0_04.md
new file mode 100644
index 0000000..e316dcb
--- /dev/null
+++ b/UPGRADING/v0_04.md
@@ -0,0 +1,49 @@
+# Upgrading from `v0.4.0` to `v0.4.x`
+
+- Replace the binary with the new version.
+- Restart the service.
+
+# Upgrading from `v0.3.x` to `v0.4.0`
+
+## What's changed
+
+- **Configuration File Split:** While the `config.toml` configuration file format hasn't changed much, the new version has divided it into multiple sub-files. These sub-files are now included from the new `config.toml`. This division was implemented because the config file had grown significantly, and splitting it improves organization.
+
+- **Changes in the Sieve Interpreter Attribute Names:**
+ - The configuration key prefix `jmap.sieve` (JMAP Sieve Interpreter) has been renamed to `sieve.untrusted`.
+ - The configuration key prefix `sieve` (SMTP Sieve Interpreter) has been renamed to `sieve.trusted`.
+
+## What's been added
+
+- **SPAM Filter Module:** The most notable addition in this version is the SPAM filter module. It comprises:
+ - A TOML configuration file located at `etc/smtp/spamfilter.toml`.
+ - A set of Sieve scripts in `etc/spamfilter/scripts`.
+ - Lookup maps in `etc/spamfilter/maps`.
+
+- **New Configuration Key:** A new key `resolver.public-suffix` has been added. This specifies the URL of the list of public suffixes.
+
+## Migration Steps
+
+1. **Backup:** Ensure you have a backup of your current `config.toml` file.
+2. **Download Configuration Bundle:** Fetch the new configuration bundle from [this link](https://get.stalw.art/resources/config.zip). Unpack it under `BASE_DIR/etc` (for example `/opt/stalwart-mail/etc`).
+3. **Update Configuration Files:** Modify the following files with your domain name, host name, certificate paths, DKIM signatures, and so on:
+ - `etc/config.toml`
+ - `etc/jmap/store.toml`
+ - `etc/jmap/oauth.toml`
+ - `etc/smtp/signature.toml`
+ - `etc/common/tls.toml`
+4. **Adjust included files:** If you are using an LDAP directory for authentication, edit `etc/config.toml` and replace the `etc/directory/sql.toml` include with `etc/directory/ldap.toml`.
+5. **Configure the SPAM Filter Database:** Set up and configure the SPAM filter database. More details can be found [here](https://stalw.art/docs/spamfilter/settings/database).
+6. **Review All TOML Files:** Navigate to every TOML file under the `etc/` directory and make necessary changes.
+7. **Update Binary:** Download and substitute the v0.4.0 binary suitable for your platform from [here](https://github.com/stalwartlabs/mail-server/releases/tag/v0.4.0).
+8. **Restart Service:** Conclude by restarting the Stalwart service.
+
+### Alternative Method:
+
+1. **Separate Installation:** Install v0.4.0 in a distinct directory. This will auto-update all configuration files and establish the spam filter database in SQLite format.
+2. **Move Configuration Files:** Transfer the configuration files from `etc/` and the SQLite spam filter database from `data/` to your current installation's directory.
+3. **Replace Binary:** Move the binary from the `bin/` directory to your current installation's `data/` directory.
+4. **Restart Service:** Finally, restart the Stalwart service.
+
+
+We apologize for the lack of an automated migration tool for this upgrade. However, we are planning on introducing an automated migration tool in the near future. Thank you for your understanding and patience.
diff --git a/UPGRADING/v0_05.md b/UPGRADING/v0_05.md
new file mode 100644
index 0000000..ef4ca39
--- /dev/null
+++ b/UPGRADING/v0_05.md
@@ -0,0 +1,63 @@
+# Upgrading from `v0.5.2` to `v0.5.3`
+
+- The following configuration attributes have been renamed, see [store.toml](https://github.com/stalwartlabs/mail-server/blob/main/resources/config/common/store.toml) for an example:
+ - `jmap.store.data` -> `storage.data`
+ - `jmap.store.fts` -> `storage.fts`
+ - `jmap.store.blob` -> `storage.blob`
+ - `jmap.encryption.*` -> `storage.encryption.*`
+ - `jmap.spam.header` -> `storage.spam.header`
+ - `jmap.fts.default-language` -> `storage.fts.default-language`
+ - `jmap.cluster.node-id` -> `storage.cluster.node-id`
+ - `management.directory` and `sieve.trusted.default.directory` -> `storage.directory`
+ - `sieve.trusted.default.store` -> `storage.lookup`
+- Proxy networks are now configured under `server.proxy.trusted-networks` rather than `server.proxy-trusted-networks`. IP addresses/masks have to be defined within a set (`{}`) rather than a list (`[]`), see [server.toml](https://github.com/stalwartlabs/mail-server/blob/main/resources/config/common/server.toml) for an example.
+
+
+# Upgrading from `v0.5.1` to `v0.5.2`
+
+- Make sure that implicit TLS is enabled for the JMAP [listener](https://stalw.art/docs/server/listener) configured under `ets/jmap/listener.toml`:
+ ```toml
+ [server.listener."jmap".tls]
+ implicit = true
+ ```
+- Optional: Enable automatic TLS with [ACME](https://stalw.art/docs/server/tls/acme).
+- Replace the binary with the new version.
+- Restart the service.
+
+# Upgrading from `v0.5.0` to `v0.5.1`
+
+- Replace the binary with the new version.
+- Restart the service.
+
+# Upgrading from `v0.4.x` to `v0.5.0`
+
+## What's changed
+
+- **Database Layout**: Version 0.5.0 utilizes a different database layout which is more efficient and allows multiple backends to be supported. For this reason, the database must be migrated to the new layout.
+- **Configuration file changes**: The configuration file has been updated to support multiple stores, most configuration attributes starting with `store.*` and `directory.*` need to be reviewed.
+- **SPAM filter**: Sieve scripts that interact with databases need to be updated. The functions `lookup` and `lookup_map` has been renamed to `key_exists` and `key_get`. It is recommended to replace all scripts with the new versions rather than updating them manually. Additionally, the SPAM database no longer requires an SQL server, it can now be stored in Redis or any of the supported databases.
+- **Directory superusers**: Due to problems and confusion with the `superuser-group` attribute, the concept of a superuser group has been removed. Instead, a new attribute `type` has been added to external directories. The value of this attribute can be `individual`, `group` or `admin`. The `admin` type is equivalent to the old superuser group. The `type` attribute is required for all principals in the directory, it defaults to `individual` if not specified.
+- **Purge schedules**: The attributes `jmap.purge.schedule.db` and `jmap.purge.schedule.blobs` have been removed. Instead, the purge frequency is now specified per store in `store..purge.frequency`. The attribute `jmap.purge.schedule.sessions` has been renamed to `jmap.purge.sessions.frequency`.
+
+## What's been added
+
+- **Multiple stores**: The server now supports multiple stores to be defined in the configuration file under `store.`. Which store to use is defined in the `jmap.store.data`, `jmap.store.fts` and `jmap.store.blob` settings.
+- **More backend options**: It is now possible to use `RocksDB`, `PostgreSQL` and `MySQL` as data stores. It is also now possible to store blobs in any of the supported databases instead of being limited to the filesystem or an S3-compatible storage. Full-text indexing can now be done using `Elasticsearch` and the Spam database stored in `Redis`.
+- **Internal Directory**: The server now has an internal directory that can be used to store user accounts, passwords and group membership. This directory can be used instead of an external directory such as LDAP or SQL.
+- **New settings**: When running Stalwart in a cluster, `jmap.cluster.node-id` allows to specify a unique identifier for each node. Messages containing the SPAM headers defined in `jmap.spam.header` are moved automatically to the user's Junk Mail folder.
+- **Default Sieve stores**: For Sieve scripts such as the Spam filter that require access to a directory and a lookup store, it is now possible to configure the default lookup store and directory using the `sieve.trusted.default.directory` and `sieve.trusted.default.store` settings.
+
+## Migration Steps
+
+Rather than manually updating the configuration file, it is recommended to start with a fresh configuration file and update it with the necessary settings:
+
+- Install `v0.5.0` in a distinct directory. You now have the option to use an [internal directory](https://stalw.art/docs/directory/types/internal), which will allow you to manage users and groups directly from Stalwart server. Alternatively, you can continue to use an external directory such as LDAP or SQL.
+- Update the configuration files with your previous settings. All configuration attributes are backward compatible, except those starting with `store.*`, `directory.*` and `jmap.purge.*`.
+- Export each account following the procedure described in the [migration guide](https://stalw.art/docs/management/database/migrate).
+- Stop the old `v0.4.x` server.
+- If there are messages pending to be delivered in the SMTP queue, move the `queue` directory to the new installation.
+- Start the new `v0.5.0` server.
+- Import each account following the procedure described in the [migration guide](https://stalw.art/docs/management/database/migrate).
+
+
+Once again, we apologize for the lack of an automated migration tool for this upgrade. However, we are planning on introducing an automated migration tool once the web-admin is released in Q1 2024. Thank you for your understanding and patience.
diff --git a/UPGRADING/v0_06.md b/UPGRADING/v0_06.md
new file mode 100644
index 0000000..d7c137f
--- /dev/null
+++ b/UPGRADING/v0_06.md
@@ -0,0 +1,7 @@
+# Upgrading from `v0.5.3` to `v0.6.0`
+
+- In order to support [expressions](https://stalw.art/docs/configuration/expressions/overview), version `0.6.0` introduces multiple breaking changes in the SMTP server configuration file. It is recommended to download the new SMTP configuration files from the [repository](https://github.com/stalwartlabs/mail-server/tree/main/resources/config/smtp), make any necessary changes and replace the old files under `INSTALL_DIR/etc/smtp` with the new ones.
+- If you are using custom subaddressing of catch-all rules, you'll need to replace these rules with expressions. Check out the updated [syntax](https://stalw.art/docs/directory/addresses).
+- Message queues are now distributed and stored in the backend specified by the `storage.data` and `storage.blob` settings. Make sure to flush your SMTP message queue before upgrading to `0.6.0` to avoid losing any outgoing messages pending delivery.
+- Replace the binary with the new version.
+- Restart the service.
diff --git a/UPGRADING/v0_07.md b/UPGRADING/v0_07.md
new file mode 100644
index 0000000..3ebef59
--- /dev/null
+++ b/UPGRADING/v0_07.md
@@ -0,0 +1,33 @@
+# Upgrading from `v0.6.0` to `v0.7.0`
+
+Version `0.7.0` of Stalwart introduces significant improvements and features that enhance performance and functionality. However, it also comes with multiple breaking changes in the configuration files and a revamped database layout optimized for accessing large mailboxes. Additionally, Stalwart now supports compression for binaries stored in the blob store, further increasing efficiency.
+Due to these extensive changes, the recommended approach for upgrading is to perform a clean reinstallation of Stalwart and manually migrate your accounts to the new version.
+
+## Pre-Upgrade Steps
+- Download the `v0.7.0` mail-server and CLI binaries for your platform from the [releases page](https://github.com/stalwartlabs/mail-server/releases/latest/).
+- Initialize the setup on a distinct directory using the command `sudo ./stalwart-mail --init /path/to/new-install`. This command will print the administrator password required to access the web-admin.
+- Create the `bin` directory using `mkdir /path/to/new-install/bin`.
+- Move the downloaded binaries to the `bin` directory using the command `mv stalwart-mail stalwart-cli /path/to/new-install/bin`.
+- Open `/path/to/new-install/etc/config.toml` in a text editor and comment out all listeners except the HTTP listener for port `8080`.
+- Start the new installation from the terminal using the command `sudo /path/to/new-install/bin/stalwart-mail --config /path/to/new-install/etc/config.toml`.
+- Point your browser to the web-admin at `http://yourserver.org:8080` and login using the auto-generated administrator password.
+- Configure the new installation with your domain, hostname, certificates, and other settings following the instructions at [stalw.art/docs/get-started](https://stalw.art/docs/get-started). Ignore the part about using the installation script, we are performing a manual installation.
+- Add your user accounts.
+- Configure Stalwart to run as the `stalwart-mail` user and `stalwart-mail` group from `Settings` > `Server` > `System`. This is not necessary if you are using Docker.
+- Stop the new installation by pressing `Ctrl+C` in the terminal.
+
+## Upgrade Steps
+- On your `v0.6.0` installation, open in a text editor the `smtp/listener.toml`, `imap/listener.toml` files and comment out all listeners except the JMAP/HTTP listener (we are going to need it to export the user accounts) and then restart the service.
+- If you are using an external store, backup the database using the appropriate method for your database system.
+- Create the `~/exports` directory, here we will store the exported accounts.
+- Using the existing CLI tool (not the one you just downloaded as it is not compatible), export each user account using the command `./stalwart-cli -u https://your-old-server.org -c export account ~/exports`.
+- Stop the `v0.6.0` installation using the command `sudo systemctl stop stalwart-mail`.
+- Move the old `v0.6.0` installation to a backup directory, for example `mv /opt/stalwart-mail /opt/stalwart-mail-backup`.
+- Move the new `v0.7.0` installation to the old installation directory, for example `mv /path/to/new-install /opt/stalwart-mail`.
+- Set the right permissions for the new installation using the command `sudo chown -R stalwart-mail:stalwart-mail /opt/stalwart-mail`.
+- Start the new installation using the command `sudo systemctl start stalwart-mail`.
+- Import the accounts using the new CLI tool with the command `./stalwart-cli -u http://yourserver.org:8080 -c import account ~/exports/`.
+- Using the admin tool, reactivate all the necessary listener (SMTP, IMAP, etc.)
+- Restart the service using the command `sudo systemctl restart stalwart-mail`.
+
+We apologize for the complexity of the upgrade process associated with this version of Stalwart. We understand the challenges and inconveniences that the requirement for a clean reinstallation and manual account migration poses. Moving forward, an automated migration tool will be included in any future releases that necessitate changes to the database layout, aiming to streamline the upgrade process for you. Furthermore, as we approach the milestone of version 1.0.0, we anticipate that such foundational changes will become increasingly infrequent, leading to more straightforward updates. We appreciate your patience and commitment to Stalwart during this upgrade.
diff --git a/UPGRADING/v0_08.md b/UPGRADING/v0_08.md
new file mode 100644
index 0000000..e240bbf
--- /dev/null
+++ b/UPGRADING/v0_08.md
@@ -0,0 +1,86 @@
+# Upgrading from `v0.7.3` to `v0.8.0`
+
+Version `0.8.0` includes both performance and security enhancements that require your data to be migrated to a new database layout. Luckily version `0.7.3` includes a migration tool which should make this process much easier than previous upgrades. In addition to the new layout, you will have to change the systemd service file to use the `CAP_NET_BIND_SERVICE` capability.
+
+## Preparation
+- Upgrade to version `0.7.3` if you haven't already. If you are on a version previous to `0.7.0`, you will have to do a manual migration of your data using the Command-line Interface.
+- Create a directory where your data will be exported to, for example `/opt/stalwart-mail/export`.
+
+## Systemd service upgrade (Linux only)
+- Stop the `v0.7.3` installation:
+ ```bash
+ $ sudo systemctl stop stalwart-mail
+ ```
+- Update your systemd file to include the `CAP_NET_BIND_SERVICE` capability. Open the file `/etc/systemd/system/stalwart-mail.service` in a text editor and add the following lines under the `[Service]` section:
+ ```
+ User=stalwart-mail
+ Group=stalwart-mail
+ AmbientCapabilities=CAP_NET_BIND_SERVICE
+ ```
+- Reload the daemon:
+ ```bash
+ $ systemctl daemon-reload
+ ```
+- Do not start the service yet.
+
+## Data migration
+- Stop Stalwart and export your data:
+
+ ```bash
+ $ sudo systemctl stop stalwart-mail
+ $ sudo /opt/stalwart-mail/bin/stalwart-mail --config /opt/stalwart-mail/etc/config.toml --export /opt/stalwart-mail/export
+ $ sudo chown -R stalwart-mail:stalwart-mail /opt/stalwart-mail/export
+ ```
+
+ or, if you are using the Docker image:
+
+ ```bash
+ $ docker stop stalwart-mail
+ $ docker run --rm -v :/opt/stalwart-mail -it stalwart-mail /opt/stalwart-mail/bin/stalwart-mail --config /opt/stalwart-mail/etc/config.toml --export /opt/stalwart-mail/export
+ ```
+- Backup your `v0.7.3` installation:
+ - If you are using RocksDB or SQLite, simply rename the `data` directory to `data-backup`, for example:
+ ```bash
+ $ mv /opt/stalwart-mail/data /opt/stalwart-mail/data-backup
+ $ mkdir /opt/stalwart-mail/data
+ $ chown stalwart-mail:stalwart-mail /opt/stalwart-mail/data
+ ```
+ - If you are using PostgreSQL, rename the database and create a blank database with the same name, for example:
+ ```sql
+ ALTER DATABASE stalwart RENAME TO stalwart_old;
+ CREATE database stalwart;
+ ```
+ - If you are using MySQL, rename the database and create a blank database with the same name, for example:
+ ```sql
+ CREATE DATABASE stalwart_old;
+ RENAME TABLE stalwart.b TO stalwart_old.b;
+ RENAME TABLE stalwart.v TO stalwart_old.v;
+ RENAME TABLE stalwart.l TO stalwart_old.l;
+ RENAME TABLE stalwart.i TO stalwart_old.i;
+ RENAME TABLE stalwart.t TO stalwart_old.t;
+ RENAME TABLE stalwart.c TO stalwart_old.c;
+ DROP DATABASE stalwart;
+ CREATE database stalwart;
+ ```
+ - If you are using FoundationDB, backup your database and clean the entire key range.
+- Download the `v0.8.0` mail-server for your platform from the [releases page](https://github.com/stalwartlabs/mail-server/releases/latest/) and replace the binary in `/opt/stalwart-mail/bin`. If you are using the Docker image, pull the latest image.
+- Import your data:
+
+ ```bash
+ $ sudo -u stalwart-mail /opt/stalwart-mail/bin/stalwart-mail --config /opt/stalwart-mail/etc/config.toml --import /opt/stalwart-mail/export
+ ```
+
+ or, if you are using the Docker image:
+
+ ```bash
+ $ docker run --rm -v :/opt/stalwart-mail -it stalwart-mail /opt/stalwart-mail/bin/stalwart-mail --config /opt/stalwart-mail/etc/config.toml --import /opt/stalwart-mail/export
+ ```
+- Start the service:
+ ```bash
+ $ sudo systemctl start stalwart-mail
+ ```
+
+ Or, if you are using the Docker image:
+ ```bash
+ $ docker start stalwart-mail
+ ```
\ No newline at end of file
diff --git a/UPGRADING/v0_09.md b/UPGRADING/v0_09.md
new file mode 100644
index 0000000..8c92fd4
--- /dev/null
+++ b/UPGRADING/v0_09.md
@@ -0,0 +1,9 @@
+# Upgrading from `v0.8.x` to `v0.9.0`
+
+Version `0.9.0` introduces significant internal improvements while maintaining compatibility with existing database layouts and configuration file formats from version `0.8.0`. As a result, no data or configuration migration is necessary. This release focuses on enhancing performance and functionality, particularly in logging and tracing capabilities.
+
+To upgrade to Stalwart version `0.9.0` from `0.8.x`, begin by downloading the latest version of the `stalwart-mail` binary. Once downloaded, replace the existing binary with the new version. Additionally, it's important to update the WebAdmin interface to the latest version to ensure compatibility and to access new features introduced in this release.
+
+In terms of breaking changes, this release brings significant updates to webhooks. All webhook event names have been modified, requiring a thorough review and adjustment of existing webhook configurations. Furthermore, the update introduces hundreds of new event types, enhancing the granularity and specificity of event handling capabilities. Users should familiarize themselves with these changes to effectively integrate them into their systems.
+
+The reason for this release being classified as a major version, despite the absence of changes to the database or configuration formats, is the complete rewrite of the logging and tracing layer. This overhaul substantially improves the efficiency and speed of generating detailed tracing and logging events, making the system more robust and facilitating easier debugging and monitoring.
diff --git a/UPGRADING/v0_10.md b/UPGRADING/v0_10.md
new file mode 100644
index 0000000..d0f32a6
--- /dev/null
+++ b/UPGRADING/v0_10.md
@@ -0,0 +1,37 @@
+
+# Upgrading from `v0.9.x` to `v0.10.0`
+
+## Important Notes
+
+- In version `0.10.0` accounts are associated with roles and permissions, which define what resources they can access. The concept of administrator or super user accounts no longer exists, now there is a single account type (the `individual` principal) which can be assigned the `admin` role or custom permissions to have administrator access.
+- Due to the changes in the database layout in order to support roles and permissions, the database must be migrated to the new layout. The migration is automatic and should not require any manual intervention.
+- While the database migration is automatic, it's recommended to **back up your data** before upgrading.
+- The webadmin must be upgraded **before** the mail server to maintain access post-upgrade. This is true even if you run Stalwart in Docker.
+
+## Step-by-Step Upgrade Process
+
+- Upgrade the webadmin by clicking on `Manage` > `Maintenance` > `Update Webadmin`.
+- Stop Stalwart and backup your data:
+
+ ```bash
+ $ sudo systemctl stop stalwart-mail
+ $ sudo /opt/stalwart-mail/bin/stalwart-mail --config /opt/stalwart-mail/etc/config.toml --export /opt/stalwart-mail/export
+ $ sudo chown -R stalwart-mail:stalwart-mail /opt/stalwart-mail/export
+ ```
+
+ or, if you are using the Docker image:
+
+ ```bash
+ $ docker stop stalwart-mail
+ $ docker run --rm -v :/opt/stalwart-mail -it stalwart-mail /usr/local/bin/stalwart-mail --config /opt/stalwart-mail/etc/config.toml --export /opt/stalwart-mail/export
+ ```
+- Download the `v0.10.0` mail-server for your platform from the [releases page](https://github.com/stalwartlabs/mail-server/releases/latest/) and replace the binary in `/opt/stalwart-mail/bin`. If you are using the Docker image, pull the latest image.
+- Start the service:
+ ```bash
+ $ sudo systemctl start stalwart-mail
+ ```
+
+ Or, if you are using the Docker image:
+ ```bash
+ $ docker start stalwart-mail
+ ```
diff --git a/UPGRADING/v0_11.md b/UPGRADING/v0_11.md
new file mode 100644
index 0000000..9a30390
--- /dev/null
+++ b/UPGRADING/v0_11.md
@@ -0,0 +1,13 @@
+
+# Upgrading from `v0.10.x` to `v0.11.0`
+
+Version `0.11.0` introduces breaking changes to the spam filter configuration. Although no data migration is required, if changes were made to the previous spam filter, the configuration of the new spam filter should be reviewed. In particular:
+
+- `lookup.spam-*` settings are no longer used, these have been replaced by `spam-filter.*` settings. Review the [updated documentation](http://stalw.art/docs/spamfilter/overview).
+- Previous `spam-filter` and `track-replies` Sieve scripts cannot be used with the new version. They have been replaced by a built-in spam filter written in Rust.
+- Cache settings have changed, see the [documentation](https://stalw.art/docs/server/cache) for details.
+- Support for Pipes was removed in favor of MTA hooks and Milter.
+- `config.resource.spam-filter` is now `spam-filter.resource`.
+- `config.resource.webadmin` is now `webadmin.resource`.
+- `authentication.rate-limit` was removed as security is handled by fail2ban.
+
diff --git a/UPGRADING/v0_12.md b/UPGRADING/v0_12.md
new file mode 100644
index 0000000..46d3a54
--- /dev/null
+++ b/UPGRADING/v0_12.md
@@ -0,0 +1,68 @@
+
+# Upgrading from `v0.11.x` to `v0.12.x`
+
+## Important Notes
+
+Version `0.12.x` introduces significant improvements such as zero-copy deserialization which make the new database layout incompatible with the previous version. As a result, the database must be migrated to the new layout. The migration is done automatically on startup and should not require any manual intervention. However, it is highly recommended to **back up your data** before upgrading since it is not possible to downgrade the database once it has been migrated. You may also want to run a mock migration before upgrading to ensure that everything works as expected.
+
+In addition to the database layout changes, multiple settings were renamed:
+
+- `server.http.*` to `http.*`.
+- `jmap.folders.*` to `email.folders.*`.
+- `jmap.account.purge.frequency` to `account.purge.frequency`.
+- `jmap.email.auto-expunge` to `email.auto-expunge`.
+- `jmap.protocol.changes.max-history` to `changes.max-history`.
+- `storage.encryption.*` to `email.encryption.*`.
+
+## Step-by-Step Upgrade Process
+
+- Stop Stalwart in **every single node of your cluster**. If you are using the systemd service, you can do this with the following command:
+
+ ```bash
+ $ sudo systemctl stop stalwart-mail
+ ```
+
+- Backup your data following your database system's instructions. For example, if you are using RocksDB or SQLite, you can simply copy the `data` directory to a backup location. If you are using PostgreSQL or MySQL, you can use the `pg_dump` or `mysqldump` commands to create a backup of your database. If your database does not support backups, you can use the [built-in migration utility](https://stalw.art/docs/management/migration) to export your data to a file. For example:
+
+ ```bash
+ $ sudo /opt/stalwart-mail/bin/stalwart-mail --config /opt/stalwart-mail/etc/config.toml --export /opt/stalwart-mail/export
+ $ sudo chown -R stalwart-mail:stalwart-mail /opt/stalwart-mail/export
+ ```
+
+- Download the `v0.12.x` binary for your platform (which is now called `stalwart` rather than `mail-server`) from the [releases page](https://github.com/stalwartlabs/stalwart/releases/latest/) and replace the binary in `/opt/stalwart-mail/bin`. If you rename the binary from `stalwart` to `stalwart-mail`, you can keep the same systemd service file, otherwise you will need to update the service file to point to the new binary name.
+
+- Start the service. In a cluster, you can speed up the migration process by starting all nodes at once.
+ ```bash
+ $ sudo systemctl start stalwart-mail
+ ```
+
+- Upgrade the webadmin by clicking on `Manage` > `Maintenance` > `Update Webadmin`.
+
+## Step-by-Step Upgrade Process (Docker)
+
+- Stop the Stalwart container in **every single node of your cluster**. If you are using Docker, you can do this with the following command:
+
+ ```bash
+ $ docker stop stalwart-mail
+ ```
+
+- Backup your data following your database system's instructions. For example, if you are using RocksDB or SQLite, you can simply copy the `data` directory to a backup location. If you are using PostgreSQL or MySQL, you can use the `pg_dump` or `mysqldump` commands to create a backup of your database. If your database does not support backups, you can use the `--export` command to export your data to a file. For example:
+
+ ```bash
+ $ docker run --rm -v :/opt/stalwart-mail -it stalwart-mail /usr/local/bin/stalwart-mail --config /opt/stalwart-mail/etc/config.toml --export /opt/stalwart-mail/export
+ ```
+
+- The Docker image location has now changed to `stalwartlabs/stalwart` instead of `stalwartlabs/mail-server`. Pull the latest image and configure it to use your existing data directory:
+
+ ```bash
+ $ docker run -d -ti -p 443:443 -p 8080:8080 \
+ -p 25:25 -p 587:587 -p 465:465 \
+ -p 143:143 -p 993:993 -p 4190:4190 \
+ -p 110:110 -p 995:995 \
+ -v :/opt/stalwart \
+ --name stalwart stalwartlabs/stalwart:latest
+ ```
+
+- Since the mount point has changed from `/opt/stalwart-mail` to `/opt/stalwart`, you will need to update your Stalwart's configuration file to reflect this change. Open the file `/opt/stalwart/etc/config.toml` and update the paths accordingly.
+
+- Upgrade the webadmin by clicking on `Manage` > `Maintenance` > `Update Webadmin`.
diff --git a/UPGRADING/v0_13.md b/UPGRADING/v0_13.md
new file mode 100644
index 0000000..ef5a039
--- /dev/null
+++ b/UPGRADING/v0_13.md
@@ -0,0 +1,59 @@
+# Upgrading from `v0.12.x` (and `v0.11.x`) to `v0.13.x`
+
+## Important Notes
+
+Version `0.13.x` introduces a significant redesign of the MTA’s delivery and queueing subsystem. This includes a transition to a new message queue serialization format and a move to a strategy-based configuration model for routing, scheduling, and delivery control. Upon first launch of version `0.13.0`, any messages currently in the outbound queue will be automatically migrated to the new format. This migration is handled internally and does not require manual intervention.
+
+However, if your deployment includes custom routing rules or queueing logic, it is important to manually reconfigure those settings using the new strategy framework. The previous configuration format for routing is no longer compatible and will need to be updated. For systems that rely solely on the default configuration, no changes are required and the upgrade should proceed without issue.
+
+Even if your system uses the default settings, it is strongly recommended to read the accompanying [blog announcement](https://stalw.art/blog/virtual-queues) and consult the [updated documentation](https://stalw.art/docs/mta/outbound/overview). These resources provide a full overview of the new delivery architecture and can help you determine whether any adjustments are needed for your environment.
+
+Before applying the upgrade to a production system, take time to familiarize yourself with the new configuration structure and validate that your delivery behavior aligns with the new model.
+
+## Step-by-Step Upgrade Process
+
+- Stop Stalwart in **every single node of your cluster**. If you are using the systemd service, you can do this with the following command:
+
+ ```bash
+ $ sudo systemctl stop stalwart
+ ```
+
+- Backup your data following your database system's instructions. For example, if you are using RocksDB or SQLite, you can simply copy the `data` directory to a backup location. If you are using PostgreSQL or MySQL, you can use the `pg_dump` or `mysqldump` commands to create a backup of your database. If your database does not support backups, you can use the [built-in migration utility](https://stalw.art/docs/management/migration) to export your data to a file. For example:
+
+ ```bash
+ $ sudo /opt/stalwart/bin/stalwart --config /opt/stalwart/etc/config.toml --export /opt/stalwart/export
+ $ sudo chown -R stalwart:stalwart /opt/stalwart/export
+ ```
+
+- Download the `v0.13.x` binary for your platform from the [releases page](https://github.com/stalwartlabs/stalwart/releases/latest/) and replace the binary in `/opt/stalwart/bin`.
+
+- Start the service. In a cluster, you can speed up the migration process by starting all nodes at once.
+ ```bash
+ $ sudo systemctl start stalwart
+ ```
+
+- Upgrade the webadmin by clicking on `Manage` > `Maintenance` > `Update Webadmin`.
+
+## Step-by-Step Upgrade Process (Docker)
+
+- Stop the Stalwart container in **every single node of your cluster**. If you are using Docker, you can do this with the following command:
+
+ ```bash
+ $ docker stop stalwart
+ ```
+
+- Backup your data following your database system's instructions. For example, if you are using RocksDB or SQLite, you can simply copy the `data` directory to a backup location. If you are using PostgreSQL or MySQL, you can use the `pg_dump` or `mysqldump` commands to create a backup of your database. If your database does not support backups, you can use the `--export` command to export your data to a file. For example:
+
+ ```bash
+ $ docker run --rm -v :/opt/stalwart -it stalwart /usr/local/bin/stalwart --config /opt/stalwart/etc/config.toml --export /opt/stalwart/export
+ ```
+
+- Pull the latest image and restart the container:
+
+ ```bash
+ $ docker pull stalwartlabs/stalwart:latest
+ $ docker start stalwart
+ ```
+
+- Upgrade the webadmin by clicking on `Manage` > `Maintenance` > `Update Webadmin`.
+
diff --git a/UPGRADING/v0_14.md b/UPGRADING/v0_14.md
new file mode 100644
index 0000000..0b3c9b7
--- /dev/null
+++ b/UPGRADING/v0_14.md
@@ -0,0 +1,48 @@
+# Upgrading from `v0.13.x` to `v0.14.x`
+
+## Binary installation
+
+- Stop Stalwart in **every single node of your cluster**. If you are using the systemd service, you can do this with the following command:
+
+ ```bash
+ $ sudo systemctl stop stalwart
+ ```
+
+- Backup your data following your database system's instructions. For example, if you are using RocksDB or SQLite, you can simply copy the `data` directory to a backup location. If you are using PostgreSQL or MySQL, you can use the `pg_dump` or `mysqldump` commands to create a backup of your database. If your database does not support backups, you can use the [built-in migration utility](https://stalw.art/docs/management/migration) to export your data to a file. For example:
+
+ ```bash
+ $ sudo /opt/stalwart/bin/stalwart --config /opt/stalwart/etc/config.toml --export /opt/stalwart/export
+ $ sudo chown -R stalwart:stalwart /opt/stalwart/export
+ ```
+
+- Download the latest binary for your platform from the [releases page](https://github.com/stalwartlabs/stalwart/releases/latest/) and replace the binary in `/opt/stalwart/bin`.
+
+- Start the service. In a cluster, you can speed up the migration process by starting all nodes at once.
+ ```bash
+ $ sudo systemctl start stalwart
+ ```
+
+- Upgrade the webadmin by clicking on `Manage` > `Maintenance` > `Update Webadmin`.
+
+## Containerized
+
+- Stop the Stalwart container in **every single node of your cluster**. If you are using Docker, you can do this with the following command:
+
+ ```bash
+ $ docker stop stalwart
+ ```
+
+- Backup your data following your database system's instructions. For example, if you are using RocksDB or SQLite, you can simply copy the `data` directory to a backup location. If you are using PostgreSQL or MySQL, you can use the `pg_dump` or `mysqldump` commands to create a backup of your database. If your database does not support backups, you can use the `--export` command to export your data to a file. For example:
+
+ ```bash
+ $ docker run --rm -v :/opt/stalwart -it stalwart /usr/local/bin/stalwart --config /opt/stalwart/etc/config.toml --export /opt/stalwart/export
+ ```
+
+- Pull the latest image and restart the container:
+
+ ```bash
+ $ docker pull stalwartlabs/stalwart:latest
+ $ docker start stalwart
+ ```
+
+- Upgrade the webadmin by clicking on `Manage` > `Maintenance` > `Update Webadmin`.
diff --git a/UPGRADING/v0_15.md b/UPGRADING/v0_15.md
new file mode 100644
index 0000000..f24a48f
--- /dev/null
+++ b/UPGRADING/v0_15.md
@@ -0,0 +1,156 @@
+# Upgrading from `v0.14.x` to `v0.15.x`
+
+Stalwart `v0.15.x` introduces **breaking changes** to both the **database schema** and some **configuration options**.
+Upgrading to this version **requires a schema migration**, which is performed **automatically when Stalwart starts** for the first time on `v0.15.x`.
+
+Because this migration modifies how data is stored and indexed, it is important to understand what will change, what will be migrated, and how the upgrade may impact your deployment—especially for larger installations.
+
+## What's changed
+
+Version `0.15.x` introduces significant internal improvements focused on performance, storage efficiency, and accuracy:
+
+- **Optimized database schema**: The database schema has been redesigned to use less storage space and significantly reduce the number of read and write operations required for common tasks.
+- **Rewritten search layer**: The search subsystem has been completely rewritten to use a more efficient and scalable indexing strategy.
+- **Native full-text search for SQL backends**: When using **PostgreSQL** or **MySQL** as the backend, Stalwart now leverages the database’s **native full-text search capabilities**, replacing the previous custom full-text search implementation.
+- **New spam classifier engine** : The spam classifier has been rewritten to use the **FTRL-Proximal** algorithm instead of the previous **Naive Bayes** implementation. This change improves classification accuracy, reduces memory usage, and reduces storage requirements for training data.
+
+
+## What will be migrated
+
+The migration process runs automatically at startup and will migrate the following data:
+
+- **E-mail metadata**, including flags, folders, and parsed message representations. *(The raw e-mail content stored in the blob store is not migrated.)*
+- **Encryption-at-rest settings**, which now also include a **spam training privacy option**
+- **MTA message queue metadata** *(The actual message contents are not migrated.)*
+- **Maintenance tasks**
+- **Blob links** *(The underlying blobs themselves are not migrated.)*
+- **Search indexes**, which will be **rebuilt** using the new indexing strategy
+
+## Important considerations
+
+- For deployments with **1,000 or more mailboxes**, the migration may take a **considerable amount of time**, depending on the volume of stored data.
+- During migration, **Stalwart runs in read-only mode**:
+ - No new e-mail can be received
+ - No outbound e-mail can be sent
+- It is **strongly recommended** to perform this upgrade during a **maintenance window**.
+- By default, the migration process is **multithreaded** and uses two threads for each available CPUs. You can control the number of threads by setting the following environment variable ``NUM_THREADS=``
+
+> **Note:** If you do **not** require any of the features introduced in `v0.15.x`, consider **waiting for the next major release**, which will introduce a proxy-based architecture allowing **zero-downtime upgrades**.
+
+## Upgrading steps
+
+### Binary installation
+
+- Stop Stalwart in **every single node of your cluster**. If you are using the systemd service, you can do this with the following command:
+
+ ```bash
+ $ sudo systemctl stop stalwart
+ ```
+
+- Backup your data following your database system's instructions. For example, if you are using RocksDB or SQLite, you can simply copy the `data` directory to a backup location. If you are using PostgreSQL or MySQL, you can use the `pg_dump` or `mysqldump` commands to create a backup of your database.
+
+- Download the latest binary for your platform from the [releases page](https://github.com/stalwartlabs/stalwart/releases/latest/) and replace the binary in `/opt/stalwart/bin`.
+
+- Start the service. In a cluster, you can speed up the migration process by starting all nodes at once.
+ ```bash
+ $ sudo systemctl start stalwart
+ ```
+
+### Containerized
+
+- Stop the Stalwart container in **every single node of your cluster**. If you are using Docker, you can do this with the following command:
+
+ ```bash
+ $ docker stop stalwart
+ ```
+
+- Backup your data following your database system's instructions. For example, if you are using RocksDB or SQLite, you can simply copy the `data` directory to a backup location. If you are using PostgreSQL or MySQL, you can use the `pg_dump` or `mysqldump` commands to create a backup of your database.
+
+- Pull the latest image and restart the container:
+
+ ```bash
+ $ docker pull stalwartlabs/stalwart:latest
+ $ docker start stalwart
+ ```
+
+## Post-upgrade steps
+
+After the upgrade and migration complete, several follow-up steps are required or recommended:
+
+- **Upgrade the webadmin**: Upgrade the webadmin interface by navigating to ``Manage → Maintenance → Update Webadmin``
+
+- **Update the spam rules**: Download and apply the latest spam rules from the webadmin ``Manage → Maintenance → Update Spam rules``
+
+- **Update search settings**: Review the updated documentation for search settings, as some configuration options have changed. In particular, the Elasticsearch backend now uses **different authentication settings** than previous versions.
+
+- **Rebuild search indexes**: All search indexes must be rebuilt to take advantage of the new indexing strategy. This can be done from the webadmin interface ``Manage → Maintenance``.
+
+- **Recalculate disk quotas for all accounts**: This step is **not required immediately**, but it is recommended to perform it at some point after the upgrade. The new version includes additional metadata in quota calculations, so recalculating ensures accurate disk usage reporting.
+ ```bash
+ $ curl -X DELETE https://myserver.org/api/store/quota/ -u : -k
+ ```
+
+- **Delete deprecated spam classifier keys**: Remove deprecated spam classifier keys from the memory store. These are the keys starting with the integer prefixes `12` to `16` and `17` to `18`:
+ - If you are using Redis:
+
+ ```bash
+ $ for code in {12..18}; do
+ char=$(printf "\\x$(printf '%02x' $code)")
+ redis-cli --scan --pattern "${char}*" | xargs -r redis-cli DEL
+ done
+ ```
+ - If you are using your database as the in-memory store:
+
+ ```bash
+ $ /opt/stalwart/bin/stalwart --config /opt/stalwart/etc/config.toml --console
+ Stalwart Server v0.15.2 Data Store CLI
+
+ > delete y\x0c\x00 y\x12\xff
+ > delete m\x0c\x00 m\x12\xff
+ > exit
+ ```
+ - If you are using your database as the in-memory store with Docker:
+
+ ```bash
+ $ docker stop stalwart
+ $ docker run -it --rm \
+ -v :/opt/stalwart \
+ --entrypoint /usr/local/bin/stalwart \
+ stalwartlabs/stalwart:latest \
+ --config /opt/stalwart/etc/config.toml --console
+ Stalwart Server v0.15.2 Data Store CLI
+
+ > delete y\x0c\x00 y\x12\xff
+ > delete m\x0c\x00 m\x12\xff
+ > exit
+
+ $ docker start stalwart
+ ```
+
+
+## Troubleshooting
+
+### Interrupted or stopped migration
+
+If the migration process is interrupted or stopped, it can be **resumed automatically** by simply restarting Stalwart.
+
+### `Data corruption detected` error
+
+If you see an error message similar to: ``Data corruption detected``. This indicates that **another node wrote data using the old format while the migration was in progress**. This usually happens when the cluster was **not fully stopped** before starting the upgrade.
+
+In order to resolve this issue, follow these steps:
+
+1. Stop **all** Stalwart nodes.
+2. Ensure **all nodes are upgraded** to `v0.15.x`.
+3. Start the nodes again.
+
+### Forcing a migration
+
+If the migration does not resume because the node responsible for it already marked it as completed, you can force migration using environment variables:
+
+- **Force re-migration of MTA queue metadata**: ``FORCE_MIGRATE_QUEUE=4``
+- **Force re-migration of blob links**: ``FORCE_MIGRATE_BLOBS=4``
+- **Force re-migration of a specific account**: ``FORCE_MIGRATE_ACCOUNT=``
+- **Force re-migration of all data**: ``FORCE_MIGRATE=4``
+
+Use these options with care and only when necessary.
diff --git a/UPGRADING/v0_16.md b/UPGRADING/v0_16.md
new file mode 100644
index 0000000..9f17156
--- /dev/null
+++ b/UPGRADING/v0_16.md
@@ -0,0 +1,605 @@
+# Upgrading from `v0.15.x` to `v0.16.x`
+
+Stalwart `v0.16.x` introduces **significant breaking changes** that make its configuration and management layer **completely incompatible** with every previous release. The database layout used to store user data (emails, calendars, contacts, files, blobs, search indexes) is **not** affected by this change, so message bodies, mailboxes, calendar events, and shared files remain on disk unchanged. What does change is **how the server is configured and managed**, and because those records live inside the same database, a multi-step migration is required.
+
+Before continuing, please read this document in full. Skipping steps will leave the server in an unrecoverable state and will require restoring from a backup.
+
+If any step below raises questions, a dedicated discussion thread for the `v0.16` upgrade is open at https://support.stalw.art. The earlier design discussion that led to these changes is also public at https://github.com/stalwartlabs/stalwart/discussions/2892 and describes the user-reported problems that motivated each breaking change.
+
+## A note on downtime
+
+Email is a critical service, and we understand that a forced maintenance window is disruptive: in some environments it is simply not an option. The breaking changes in `v0.16` are not cosmetic. Stalwart has been under continuous development for close to five years; in that time the feature set and the user base have both grown well beyond what the original configuration and management layer was designed for. The gap between what users need and what the old architecture can cleanly support has widened to the point where a redesign was unavoidable: and the redesign itself unlocks a long list of frequently-requested features that were simply not implementable under the previous model. The storage layer is untouched by all of this: emails, calendars, contacts, files, and every other piece of user data stay exactly where they are. The migration is about configuration, not about data.
+
+Operators who cannot accept downtime should **wait**. In the next two to three weeks we plan to release two tools that work together:
+
+- A **zero-downtime migration utility** that moves data (accounts, mailboxes, calendars, contacts, files) from an existing (`v0.15.x` or below) deployment to a freshly-installed `v0.16.x` deployment one account at a time, while both servers are running.
+- A **proxy** that sits in front of both deployments and routes each incoming connection to the server that currently owns that account. As accounts are migrated one by one, the proxy transparently shifts their traffic from the old deployment to the new one, so end users never notice a cutover.
+
+Together, these let operators migrate a live production deployment on an account-by-account basis with no scheduled maintenance window. When those tools are available, the instructions in this document will be superseded for most deployments. Everyone else can follow the manual steps below during a scheduled maintenance window.
+
+## What has changed
+
+### No more TOML configuration files
+
+The previous server used one or more TOML files, with some settings living on local disk and others living in the database. In `v0.16` there is a single small `config.json` on disk that describes **only** the datastore (the database Stalwart uses to keep everything else). Every other configuration and management setting: domains, accounts, mail routing, DKIM signatures, storage backends, rate limits, spam rules, and so on: is now stored inside that datastore as a **JMAP object**. JMAP ("JSON Meta Application Protocol") is the JSON-based API Stalwart uses to expose its data; treating configuration as JMAP objects means the same API that serves email metadata also serves server configuration.
+
+This change is driven by two real problems with the old model. First, in a **clustered deployment** every node had to carry its own copy of the configuration file and stay in lockstep with every other node. Divergence was easy to introduce and hard to debug, and it made distributed deployments unnecessarily fragile. Centralising everything in the database means configuration is consistent across the cluster by definition. Second, the **split between "settings in the file" and "settings in the database"** was a persistent source of user confusion: the same conceptual setting had to be documented in two places depending on where it happened to live, and administrators routinely edited the wrong one. A single unified model removes that entire category of mistake, and it gives management tooling (the WebUI and the CLI) a complete view of the system.
+
+**For Ansible, NixOS, Terraform, and other declarative tooling:** the small `config.json` is still a plain file and can be managed with existing tooling exactly as before. Everything that used to live in TOML is now managed through [`stalwart-cli apply`](https://stalw.art/docs/management/cli/apply), which accepts a declarative plan file and idempotently reconciles the live server state to match it, creating what is missing, updating what has changed, and removing what the plan no longer declares. This is the same pattern used by CockroachDB (cluster settings via SQL/CLI), Consul (KV store), Elasticsearch (`PUT /_cluster/settings`), and HashiCorp Vault (CLI/API for policies and secrets); infrastructure-as-code tooling targets the API rather than a file. The workflow becomes: commit the declarative plan to version control, deploy `config.json` through existing tooling, and invoke `stalwart-cli apply` as an idempotent step in a playbook or activation script.
+
+### REST API replaced by JMAP
+
+The `/api/...` endpoints from previous releases no longer exist. All management operations happen through **JMAP objects** reachable at `/jmap`. JMAP (RFC 8620) is a well-specified, transport-efficient protocol with first-class support for batch operations, push notifications, and fine-grained change tracking. Stalwart already speaks JMAP for email: extending it to administration gives operators and integrators a single consistent protocol for interacting with the entire server. In practice this means dozens of configuration changes can be applied in a single round-trip (the `apply` command uses this), any JMAP client library works against the management surface, and the same authentication flow covers both mail access and administration. Existing scripts and integrations that called the old REST endpoints must be updated; the new CLI is the straightforward replacement for most of them.
+
+### Account names must be email addresses
+
+Every user and group principal now has a **local part** (the name) and an associated **domain**. In previous releases an account could be a bare string such as `alice`; in `v0.16` it must be `alice@example.com`. The migration script handles this automatically: accounts without a domain are assigned the default domain of the deployment (chosen by scanning existing principals for the most common domain), so no users are lost during conversion.
+
+To avoid locking existing users out of their mail clients on the first login after the upgrade, `v0.16` **automatically appends the default domain** when a client authenticates with a bare username. Administrators running an **external directory** (LDAP, SQL, etc.), however, do need to update their directory filters to query by full email address rather than by bare account name; the old filters will no longer match.
+
+**CalDAV, CardDAV, and WebDAV clients need one manual adjustment.** These protocols use the account name as part of the URL path (for example `/dav/cal/alice`), and because the account name is now a full email address, that path changes. The `@` character is reserved in URLs and must be encoded as `%40`, so the equivalent path in `v0.16` becomes `/dav/cal/alice%40example.com`. Authentication itself still works (the server accepts the bare username and appends the default domain, as described above), but calendar, contact, and file sync will stop working until each client is reconfigured to point at the new path. It is a good idea to notify users before the upgrade so that they can update their calendar and contacts accounts in Apple Calendar, Thunderbird, DAVx⁵, and similar clients.
+
+Two reasons drove this requirement. The first is **support for multiple external directories simultaneously**: when account names are bare strings there is no reliable way to tell which directory owns a given username, whereas email addresses are naturally namespaced by domain and make that mapping unambiguous. The second, and more consequential, reason is the **PACC specification** ([draft-ietf-mailmaint-pacc](https://datatracker.ietf.org/doc/draft-ietf-mailmaint-pacc/)): the IETF's replacement for the fragmented collection of autoconfig / autodiscover / SRV-record mechanisms that mail clients use today to discover server settings. PACC expects login names shaped like email addresses; when they are not, the server has to reveal whether a given account exists just to disambiguate the login, which is exactly the privacy leak the spec is designed to prevent. Aligning account names with email addresses is what lets Stalwart implement PACC correctly.
+
+PACC also brings OAuth into the autodiscovery flow, and because the draft originates from Apple, a correct PACC implementation is the path to supporting Apple Mail clients with OIDC and MFA: a long-standing user request that only becomes possible once this groundwork is in place.
+
+## What has been added
+
+- **A brand-new WebUI**, rewritten from scratch on top of the new JMAP-based management API.
+- **A brand-new CLI** (`stalwart-cli`) that also uses the JMAP API and can be used for day-to-day administration, scripted deployments, and infrastructure-as-code workflows. Full documentation is available at https://stalw.art/docs/management/cli.
+- **[Over one hundred feature requests and bug fixes](https://github.com/stalwartlabs/stalwart/blob/main/CHANGELOG.md#0160---2026-xx-xx)** across every subsystem.
+
+## Evaluate `v0.16` before migrating
+
+Because so much has changed, `v0.16` will feel like a different product at first contact. Concepts have been renamed, some have been removed, and several new ones have been introduced.
+
+It is **strongly recommended** that operators first install a fresh `v0.16` instance in a Docker container or a throwaway virtual machine, log into the new WebUI, and spend time becoming familiar with how configuration works in the new release. This avoids the situation where a critical production upgrade is the first time an operator sees the new interface.
+
+A second, equally important benefit: any settings created in the test deployment (directory integrations, SMTP listeners, spam rules, rate limits, TLS providers, etc.) can be exported using the [`snapshot`](https://stalw.art/docs/management/cli/overview/snapshot) command. The resulting JSON file is an `apply` plan that can be fed directly into the production instance after the migration completes. Time spent on a test deployment is not thrown away.
+
+## How the migration works
+
+The migration is a **multi-step, offline** process. At a high level:
+
+1. If the server is still on a version older than `v0.15.x`, it must first be upgraded to `v0.15.x`. The `v0.16` migration tooling does not support anything older. Operators who cannot upgrade to `v0.15.x` now should wait for the zero-downtime proxy described above, which will perform a direct migration from older releases.
+2. A Python helper script is run against the live `v0.15.x` server. It downloads the current settings and principals, converts them to the new format, and produces two files: `config.json` (the new on-disk datastore configuration) and `export.json` (a snapshot of everything else, in a format that the new CLI can replay).
+3. The `v0.15.x` server is stopped and its database is backed up.
+4. The `v0.16` binary (or Docker image) is started in **recovery mode**. On first start it detects the old data, wipes the pieces that are no longer compatible, migrates the spam classifier model, and comes up listening on a single HTTP port (`8080`) exposing the management API.
+5. `stalwart-cli apply` replays `export.json` (and, optionally, any snapshots from the test deployment) against the recovery-mode server.
+6. Recovery mode is disabled, the service manager (systemd / init.d / Docker) is reconfigured to use the new `config.json`, and the server is restarted normally.
+7. Post-migration tasks are triggered from the WebUI to recalculate disk quotas.
+
+The following sections describe each step in detail.
+
+> **Note for clustered deployments.** Before starting the migration, **every node in the cluster must be stopped**. If even one node is left running on `v0.15.x` while another is being upgraded, it will write records in the old format and cause data corruption that can only be repaired by manually deleting the offending keys. This requirement is repeated in the binary and Docker sections below, but it applies globally.
+
+## Step 1: Convert existing settings into a configuration snapshot
+
+This step is **independent of how Stalwart is deployed** and **does not require stopping the server**. The migration script talks to the running `v0.15.x` server over its management API and produces two JSON files on the machine where it is run. Running this step early is encouraged: it gives the operator a chance to review the generated files before touching the server, and to rerun the conversion with different options if needed.
+
+### Download the migration script
+
+Download the script from the Stalwart repository:
+
+```bash
+$ curl -fLO https://raw.githubusercontent.com/stalwartlabs/stalwart/refs/heads/main/resources/scripts/migrate_v016.py
+```
+
+Review the script before running it. It is a single self-contained Python file and makes no changes to the running server: it only reads configuration and principal data.
+
+### Create a Python virtual environment
+
+A virtual environment (`venv`) is a self-contained Python setup that keeps installed libraries out of the system-wide Python install. This avoids polluting the host Python and lets the script run on systems where `pip` installs are restricted.
+
+```bash
+$ python3 -m venv .venv
+$ source .venv/bin/activate
+(.venv) $ pip install requests urllib3
+```
+
+The first command creates the environment in a `.venv/` directory. The second activates it (the shell prompt usually gains a `(.venv)` prefix). The third installs the only two libraries the script needs.
+
+### Dump the live `v0.15.x` settings
+
+The script has two subcommands. The first, `dump`, connects to the running server and downloads its settings and principals into two files on disk:
+
+```bash
+(.venv) $ python migrate_v016.py dump \
+ --url https://mail.example.com \
+ --username admin \
+ --password adminPassword \
+ --settings settings.json \
+ --principals principals.json
+```
+
+Replace the URL and credentials with those of the `v0.15.x` server. The admin account must have permission to read all settings and principals. Output files default to `settings.json` and `principals.json` in the current directory. These files are plain JSON: opening them in a text editor to inspect their contents is encouraged.
+
+### Convert the dump to the new format
+
+The second subcommand, `convert`, reads the two dump files and produces the two files that the new server will consume:
+
+```bash
+(.venv) $ python migrate_v016.py convert \
+ --settings settings.json \
+ --principals principals.json \
+ --config config.json \
+ --output export.json
+```
+
+This produces:
+
+- `config.json`: the new on-disk datastore configuration. This is the file the `v0.16` server will be pointed at on startup. It is small, because it describes only the datastore (data store, blob store, search store, in-memory store).
+- `export.json`: a snapshot of every other piece of state the script could convert, in the format consumed by `stalwart-cli apply`. This file will be replayed against the `v0.16` server once it is running in recovery mode.
+
+### What the script converts: and what it does not
+
+The conversion is intentionally conservative. Only the following settings are migrated, because the rest have changed enough that automatic mapping would do more harm than good:
+
+- **User accounts, groups, and mailing lists** (with their aliases and memberships)
+- **Tenants** (in multi-tenant deployments)
+- **Domain names** (including those discovered by scanning the addresses of existing accounts)
+- **Data store, blob store, full-text search store, and in-memory store** settings
+- **DKIM signatures** (except `rsa-sha1`, which is obsolete and not supported in `v0.16`)
+- **TLS certificates** (including those issued by the built-in ACME client)
+
+**Everything else**: SMTP listeners, mail routing rules, rate limits, connection limits, spam filter settings, logging and telemetry configuration, authentication backends other than the ones listed above, session scripts, Sieve preludes, milter/MTA hook configuration, etc.: must be recreated on the new server.
+
+This is the reason the test deployment recommended above is so useful: recreating the remaining settings on a test `v0.16` instance, then using [`stalwart-cli snapshot`](https://stalw.art/docs/management/cli/snapshot) to export them, turns what would otherwise be manual post-migration work into a second `apply` run. If the production deployment is close to the defaults, this is straightforward. If it has extensive customisation, plan for the time this takes.
+
+## Step 2: Back up the database
+
+When the `v0.16` server starts for the first time, it will **wipe** the parts of the database that are no longer compatible with the new schema. No user mail is touched, but everything below is **deleted unconditionally**:
+
+- **Directory records.** Every user, group, tenant, OAuth client, domain, and mailing list record is removed. The mail itself stays in place on disk: it is the *directory entries* describing who owns it that are deleted. After the first `apply`, the new directory entries produced from `export.json` recreate these records with the same identities.
+- **All settings.** Every stored setting is deleted. `export.json` replays what the script was able to convert; anything the script could not convert needs to be recreated manually (or via a snapshot from the test deployment).
+- **DMARC, TLS, and ARF reports** (both incoming and outgoing). Report records are incompatible with the new schema.
+- **Pending tasks.** Maintenance tasks queued for background execution are discarded. `v0.16` exposes a task panel in the WebUI, and the equivalent tasks can be triggered manually from there.
+- **Telemetry data.** Metrics and trace spans are deleted.
+- **Spam training samples** (but **not** the spam classifier model itself: the model is preserved and migrated).
+- **Disk quotas.** All per-account disk-usage counters are reset to zero and must be recalculated after the migration (see Step 4).
+
+Because the wipe is irreversible, a full backup of the existing data must exist **before** the new server is started.
+
+### Embedded databases (RocksDB, SQLite)
+
+These store everything in a single directory on disk (typically `/var/lib/stalwart/data` or `/opt/stalwart/data`). A file-level copy while the server is stopped is sufficient:
+
+```bash
+$ sudo systemctl stop stalwart # or the equivalent for the service manager in use
+$ sudo cp -a /var/lib/stalwart /var/lib/stalwart.v015-backup
+```
+
+Record the path of the backup somewhere safe. If the migration fails, restoring this directory and starting the old binary returns the system to its previous state.
+
+### PostgreSQL / MySQL backends
+
+The database holds many tables, but only a subset needs to be captured to be able to undo the migration. Each table is a single ASCII character that corresponds to an internal Stalwart subspace. The destructive part of the migration touches the following tables:
+
+| Table | Purpose | Priority |
+|:---:|---|---|
+| `s` | Settings | **Critical**: contains all server configuration |
+| `d` | Directory | **Critical**: users, groups, domains, tenants, mailing lists, OAuth clients |
+| `r` | Incoming reports (DMARC, TLS, ARF) | Recommended |
+| `h` | Outgoing reports | Recommended |
+| `b` | Legacy bitmap index | Recommended |
+| `g` | Legacy full-text-search index | Recommended |
+| `j` | Legacy blob-extra metadata | Recommended |
+| `f` | Pending task queue | Recommended |
+| `u` | Quotas (partially reset) | Recommended |
+| `o` | Telemetry spans (traces) | Optional: can be very large |
+| `x` | Telemetry metrics | Optional: can be very large |
+| `w` | Legacy telemetry/spam-sample index | Optional: can be very large |
+
+The telemetry tables (`o`, `x`, `w`) can grow into tens of gigabytes on busy servers. Skipping them from the backup is reasonable unless there is a specific need to preserve historical metrics or traces.
+
+For PostgreSQL, a per-table dump looks like this:
+
+```bash
+$ pg_dump -U stalwart -d stalwart \
+ -t s -t d -t r -t h -t b -t g -t j -t f -t u \
+ -f /var/backups/stalwart-v015-critical.sql
+```
+
+The equivalent with `mysqldump`:
+
+```bash
+$ mysqldump -u stalwart -p stalwart \
+ s d r h b g j f u \
+ > /var/backups/stalwart-v015-critical.sql
+```
+
+A full database dump (`pg_dump` / `mysqldump` without the `-t` flags, or `pg_dumpall`) is the safest option if disk space allows.
+
+## Step 3: Perform the migration
+
+This step is the only one that requires downtime. The sequence has moving parts, and each moving part must complete before the next begins. Reading this entire section before starting is strongly encouraged.
+
+> **Clustered deployments:** stop **every** node before beginning. Leaving a single `v0.15.x` node running while the migration is in progress will corrupt the database.
+
+### Option A: Binary deployments (systemd / init.d)
+
+The following instructions assume the standard FHS layout (`/usr/local/bin/stalwart`, `/etc/stalwart/config.toml`, `/var/lib/stalwart`). Operators using a custom prefix (for example `/opt/stalwart`) should substitute their paths accordingly.
+
+**1. Download the `v0.16` binary.** Grab the release matching the target platform from https://github.com/stalwartlabs/stalwart/releases/latest. Do **not** replace the running binary yet.
+
+**2. Stop the old service.**
+
+- On systems with systemd:
+ ```bash
+ $ sudo systemctl stop stalwart
+ ```
+- On SysV-style systems with init.d:
+ ```bash
+ $ sudo service stalwart stop
+ ```
+
+Verify the process is gone with `ps` before continuing. In a cluster, repeat this on every node.
+
+**3. Back up the old binary and install the new one.**
+
+```bash
+$ sudo mv /usr/local/bin/stalwart /usr/local/bin/stalwart.v015
+$ sudo mv /path/to/downloaded/stalwart /usr/local/bin/stalwart
+$ sudo chmod 0755 /usr/local/bin/stalwart
+$ sudo chown root:root /usr/local/bin/stalwart
+```
+
+**4. Install the new `config.json`.** The file produced by the migration script in Step 1 goes where the old TOML configuration used to live:
+
+```bash
+$ sudo mv /path/to/config.json /etc/stalwart/config.json
+$ sudo chown stalwart:stalwart /etc/stalwart/config.json
+$ sudo chmod 0640 /etc/stalwart/config.json
+```
+
+The old `config.toml` can be kept as a reference but is no longer read by the server.
+
+**5. Start the new binary in recovery mode from the foreground.** Running the initial migration under the service manager is discouraged: if something goes wrong, the output scrolls past in `journalctl` and the restart loop masks the cause. Instead, run it directly as the `stalwart` user so that stdout and stderr are visible in the current terminal:
+
+```bash
+$ sudo -u stalwart env \
+ STALWART_RECOVERY_MODE=1 \
+ STALWART_RECOVERY_ADMIN=admin:someTemporaryPassword \
+ /usr/local/bin/stalwart --config=/etc/stalwart/config.json
+```
+
+`STALWART_RECOVERY_MODE=1` tells the server to enter the one-shot migration path: wipe the incompatible subspaces listed above, migrate the spam classifier model, and then bring up **only** the management HTTP endpoint on port `8080`. Mail ports stay closed. `STALWART_RECOVERY_ADMIN=admin:someTemporaryPassword` provisions a temporary admin credential that the CLI can authenticate against: this is needed because the converted `export.json` does not grant admin rights to any user (that is deliberate; admin assignment is a deployment decision). Replace `someTemporaryPassword` with a strong value; this account exists only until a real admin is created.
+
+The migration output will scroll past. When it finishes, the process stays in the foreground, listening on port `8080`. Leave this terminal open.
+
+**6. Apply the exported snapshot.** From a **second terminal** (on the same host or any machine that can reach the server on port `8080`), install the new CLI (*make sure to install v1.0.2 or later*): instructions at https://stalw.art/docs/management/cli/overview: and run:
+
+```bash
+$ export STALWART_URL=http://127.0.0.1:8080
+$ export STALWART_USER=admin
+$ export STALWART_PASSWORD=someTemporaryPassword
+$ stalwart-cli apply --file /path/to/export.json
+```
+
+A summary similar to the following should appear:
+
+```
+Plan: 0 destroy, 5 update, 6 create (…)
+✓ created Tenant (…)
+✓ created Domain (…)
+✓ created Account (…)
+…
+Done: 0 destroyed, 5 updated, … created (0 failed)
+```
+
+If any operation fails, the CLI stops immediately and prints the error. Fix the root cause (usually a conflict with an object created in an earlier attempt) and rerun. `apply` is re-entrant with `--continue-on-error` when needed.
+
+At this point, snapshots exported from the test deployment with `stalwart-cli snapshot` can also be applied, in order:
+
+```bash
+$ stalwart-cli apply --file /path/to/test-deployment-snapshot.json
+```
+
+**7. Shut down recovery mode.** Return to the terminal running the foreground server and press `Ctrl+C`. The process will exit cleanly.
+
+**8. Reconfigure the service manager.** The systemd unit or init.d script still references the old TOML path. Update it to point at the new JSON file:
+
+- For systemd (typically `/etc/systemd/system/stalwart.service`), locate the `ExecStart=` line and change the `--config=` argument:
+ ```ini
+ ExecStart=/usr/local/bin/stalwart --config=/etc/stalwart/config.json
+ ```
+ Then reload the unit:
+ ```bash
+ $ sudo systemctl daemon-reload
+ ```
+- For init.d (typically `/etc/init.d/stalwart`), update the `DAEMON_ARGS` line similarly.
+
+**9. Decide how to handle the recovery admin.** The recovery admin credential must be available the first time a real administrator logs in to create a proper admin account. Two options:
+
+- **Preferred, if a test deployment was used:** the test-deployment snapshot applied in step 6 can already include an administrator account, in which case no further action is needed. Start the service normally.
+- **Otherwise:** leave `STALWART_RECOVERY_ADMIN` in place until a real admin is created through the WebUI, then remove it. For systemd, set it via the environment file referenced by `EnvironmentFile=` in the service unit (the default Stalwart install creates `/etc/stalwart/stalwart.env` for exactly this purpose: uncomment the `STALWART_RECOVERY_ADMIN` line and set the value). For init.d, export the variable in `/etc/default/stalwart` or the distribution's equivalent. Do **not** set `STALWART_RECOVERY_MODE=1`: that is for the migration only and would put the server back into recovery mode at every restart.
+
+**10. Start the service.**
+
+```bash
+$ sudo systemctl start stalwart # or: sudo service stalwart start
+```
+
+Verify it comes up cleanly and is listening on its normal ports. The deployment is now on `v0.16`. For reference on how a fresh `v0.16` Linux install is expected to look, see https://stalw.art/docs/install/platform/linux.
+
+### Option B: Docker deployments
+
+The new Docker image uses **different mount points** than the old one. Where the previous image mounted a single `/opt/stalwart` volume, the new image mounts two:
+
+| Volume | Purpose |
+|:---|---|
+| `/etc/stalwart` | Configuration directory (contains `config.json`) |
+| `/var/lib/stalwart` | Persistent application data (RocksDB, local blobs, bootstrap registry) |
+
+The Docker migration uses the same recovery-mode pattern as the binary case: stop the old container, run a throwaway container in recovery mode, apply the snapshot, stop the throwaway, then start the real container.
+
+> **Clustered deployments:** stop every container running `v0.15.x` before starting the migration on any node.
+
+**1. Stop the old container.**
+
+```bash
+$ docker stop stalwart
+```
+
+**2. Prepare the new volumes.** Two named volumes (or two host directories, if bind-mounting) are required:
+
+```bash
+$ docker volume create stalwart-etc
+$ docker volume create stalwart-data
+```
+
+For deployments where the embedded database holds user mail (RocksDB / SQLite), the contents of the old `/opt/stalwart/data` directory must be placed in the new `stalwart-data` volume before starting the recovery-mode container. The simplest way is a helper container:
+
+```bash
+$ docker run --rm \
+ -v :/old \
+ -v stalwart-data:/new \
+ alpine sh -c 'cp -a /old/data/. /new/ && chown -R 2000:2000 /new'
+```
+
+Replace `` with the host path that the previous container had mounted at `/opt/stalwart`. The `chown` step is required because the new image runs as UID `2000`. For deployments that use external databases (PostgreSQL, MySQL, FoundationDB, S3, Azure, Redis, NATS), skip the copy: the data already lives outside the container.
+
+**3. Install `config.json` in the new config volume.**
+
+```bash
+$ docker run --rm \
+ -v /path/to/local/config.json:/src/config.json:ro \
+ -v stalwart-etc:/dst \
+ alpine sh -c 'cp /src/config.json /dst/config.json && chown 2000:2000 /dst/config.json'
+```
+
+> **Update embedded paths inside `config.json` and `export.json` for the new mount points.** The migration script writes the on-disk paths it found in the v0.15 deployment, which on the previous Docker image typically pointed at `/opt/stalwart/data` (and `/opt/stalwart/data/blobs` for the filesystem [BlobStore](https://stalw.art/docs/ref/object/blob-store)). The new image mounts persistent data at `/var/lib/stalwart` instead, so any path referencing the old location must be rewritten before the recovery container is started; otherwise the container exits with `Permission denied: /opt/stalwart/data` because UID `2000` cannot create that directory inside the container's filesystem.
+>
+> The migration script ships with a `--patch-paths` flag that handles the rewrite during `convert`:
+>
+> ```bash
+> $ python migrate_v016.py convert \
+> --settings settings.json --principals principals.json \
+> --config config.json --output export.json \
+> --patch-paths /opt/stalwart=/var/lib/stalwart
+> ```
+>
+> `--patch-paths SOURCE=DEST` walks both emitted files and rewrites any string value beginning with the source prefix. The flag may be supplied multiple times for deployments that mount data under several legacy paths. When the script detects `/opt/stalwart` in the source settings and the flag was not passed, it prints a notice with the exact command to rerun.
+>
+> For deployments that already produced `config.json` and `export.json` without the flag, the equivalent in-place edit is:
+>
+> ```bash
+> $ sed -i.bak \
+> -e 's|/opt/stalwart/data/blobs|/var/lib/stalwart/blobs|g' \
+> -e 's|/opt/stalwart/data|/var/lib/stalwart|g' \
+> config.json export.json
+> $ grep -n /opt/stalwart config.json export.json # verify clean
+> ```
+>
+> The blob-path substitution runs first so the more general data-path rewrite does not double-rewrite it. The `.bak` files left behind by `-i.bak` are the rollback if the substitution went wrong.
+>
+> Skip this paragraph entirely on deployments that use external databases (PostgreSQL, MySQL, FoundationDB) and external blob backends; those deployments have no on-disk paths to rewrite.
+
+**4. Start a temporary container in recovery mode.** This container exists only for the duration of the migration:
+
+```bash
+$ docker run -d --name stalwart-recovery \
+ -e STALWART_RECOVERY_MODE=1 \
+ -e STALWART_RECOVERY_ADMIN=admin:someTemporaryPassword \
+ -p 8080:8080 \
+ -v stalwart-etc:/etc/stalwart \
+ -v stalwart-data:/var/lib/stalwart \
+ stalwartlabs/stalwart:v0.16
+```
+
+Only port `8080` (management API) is published: mail ports stay closed in recovery mode. Watch the logs to confirm the migration completes successfully:
+
+```bash
+$ docker logs -f stalwart-recovery
+```
+
+Wait until the logs stop scrolling and settle on the message indicating the HTTP endpoint is listening.
+
+**5. Apply the exported snapshot.** From the host (or any machine that can reach `http://:8080`):
+
+```bash
+$ export STALWART_URL=http://127.0.0.1:8080
+$ export STALWART_USER=admin
+$ export STALWART_PASSWORD=someTemporaryPassword
+$ stalwart-cli apply --file /path/to/export.json
+```
+
+Follow with any snapshots captured from the test deployment:
+
+```bash
+$ stalwart-cli apply --file /path/to/test-deployment-snapshot.json
+```
+
+**6. Stop and remove the temporary container.**
+
+```bash
+$ docker stop stalwart-recovery
+$ docker rm stalwart-recovery
+```
+
+**7. Start the production container.** Same image, without `STALWART_RECOVERY_MODE`, with all mail ports published:
+
+```bash
+$ docker run -d --name stalwart \
+ --restart unless-stopped \
+ -e STALWART_RECOVERY_ADMIN=admin:someTemporaryPassword \
+ -p 443:443 -p 8080:8080 \
+ -p 25:25 -p 587:587 -p 465:465 \
+ -p 143:143 -p 993:993 \
+ -p 110:110 -p 995:995 \
+ -p 4190:4190 \
+ -v stalwart-etc:/etc/stalwart \
+ -v stalwart-data:/var/lib/stalwart \
+ stalwartlabs/stalwart:v0.16
+```
+
+The `STALWART_RECOVERY_ADMIN` variable is retained deliberately so that a real administrator account can still be created through the WebUI after the first login. Once a permanent admin exists, restart the container without that environment variable to remove the back-door credential. If the test deployment snapshot applied in step 5 already includes an administrator account, the variable can be omitted from this step entirely.
+
+For reference on the standard Docker deployment, see https://stalw.art/docs/install/platform/docker.
+
+## Step 4: Post-migration tasks
+
+With the server running on `v0.16`, a few follow-up actions are required to complete the upgrade.
+
+### Log in to the admin panel
+
+Open a browser and navigate to:
+
+```
+https://mail.example.org/admin
+```
+
+Replace `mail.example.org` with the server's hostname. Log in either with the recovery admin credential (if it is still active) or with the administrator account created via the test-deployment snapshot.
+
+A few behavioural changes from `v0.15.x` are worth flagging before the first sign-in:
+
+- **The WebUI is reached over HTTPS on the configured hostname only.** The OAuth, OIDC, and JMAP discovery documents `v0.16` publishes use `https:///...` exclusively in normal mode. Loading the WebUI by IP address, by container name, or over plain HTTP (for example `http://192.168.1.10:8080/admin`) will appear to load the sign-in page but will fail at the OAuth callback. Use the same hostname that was entered in Step 1 of the wizard, or that already lives on `defaultHostname` from the migrated settings.
+- **`http://...:8080` is no longer the right URL for day-to-day administration.** Port `8080` carries the recovery / bootstrap HTTP listener and is intended for the migration window; once the server is running normally it stops being a valid sign-in entry point.
+- **When the public HTTPS port is not `443`** (for example a reverse proxy on `:8443`, or a Docker host port mapping that diverges from the container's `443`), set the [`STALWART_HTTPS_PORT`](https://stalw.art/docs/configuration/environment-variables#public-urls) environment variable to that port and restart the server. Without it, the discovery documents will publish `https:///...` (port `443` implied) and clients will be sent to a port the proxy is not listening on.
+- **Plain-text mail listeners (port `587` submission, port `143` IMAP) are no longer added by default.** This is required for compliance with the PACC autoconfig draft, which only advertises implicit-TLS ports. Mail clients that were configured to connect over `587` STARTTLS will silently stop working until either the listener is recreated through the WebUI / CLI or the clients are pointed at the implicit-TLS ports (`465` for submission, `993` for IMAPS).
+
+#### Reverse-proxy deployments
+
+If the deployment sits behind a reverse proxy (NGINX, Traefik, Caddy, HAProxy, or similar), this is the part of the migration where proxy-related issues most often surface. The migrated `defaultHostname`, the proxy's public hostname, the proxy's listening port, and the proxy's TLS configuration all have to line up before the first sign-in completes; if any of them is off, the OAuth flow fails partway through with errors that are hard to relate back to the proxy.
+
+The most reliable way through this step is to **bypass the proxy temporarily** for the duration of the recovery-mode `apply`, the first sign-in, and the creation of a permanent administrator. Concretely:
+
+1. While running `stalwart-cli apply` and creating the permanent admin, point the CLI and the browser at Stalwart directly: `http://:8080` for the recovery-mode CLI session, then `https:///admin` (accepting any self-signed certificate warning) for the first WebUI sign-in.
+2. Once a permanent administrator account exists and the WebUI is confirmed working, restore the reverse-proxy configuration. From this point forward, end users reach Stalwart through the proxy and the discovery documents already point at the public hostname over HTTPS.
+
+A full description of how `v0.16` composes the published URLs, how the proxy can talk to Stalwart on either HTTP or HTTPS, and where to set `STALWART_HTTPS_PORT` for non-standard public ports lives at https://stalw.art/docs/server/reverse-proxy/overview.
+
+### Recalculate disk quotas
+
+Disk quotas were reset to zero during the wipe and need to be rebuilt from the actual mailbox contents. Navigate to the **Tasks** section of the admin panel and trigger the **"Recalculate disk quotas"** task. This spawns one subtask per user account, each of which scans that user's storage and updates the counter. On large deployments this may take a while to complete: progress is visible in the Tasks panel.
+
+### Recalculate tenant quotas (multi-tenant deployments)
+
+Only applicable when per-tenant disk quotas are in use. After the per-account recalculation has finished for every user, trigger a second task from the Tasks panel: **"Recalculate tenant quotas"**. This rolls the per-account totals up into the tenant-level counters.
+
+### Create a permanent administrator
+
+If the migration was performed without a snapshot from a test deployment, the only administrative credential at this point is the recovery admin defined by `STALWART_RECOVERY_ADMIN`. This credential is a back door: as long as the environment variable is set, the username and password it specifies can log in regardless of directory state. Create a real administrator account through **Management → Accounts**, verify the new account can log in, and then remove `STALWART_RECOVERY_ADMIN` from:
+
+- the systemd environment file (for example `/etc/stalwart/stalwart.env`) and restart the service, or
+- the init.d defaults file, and restart the service, or
+- the Docker container's `-e` flag (redeploy the container without it).
+
+### Review the rest of the configuration
+
+The migration script converts directory, domain, storage, DKIM, and certificate state. Everything else: SMTP listeners, mail routing, spam rules, rate limits, retention policies, ACME, authentication backends other than those listed above: must be reviewed in the WebUI and either recreated by hand, applied from a test-deployment snapshot, or validated against the defaults that `v0.16` ships with.
+
+## Troubleshooting
+
+### The server fails to start after installing `config.json`
+
+Confirm the file is valid JSON (`python -m json.tool config.json` or `jq . config.json`) and that the datastore described in it is reachable with the provided credentials. The daemon's logs will name the offending field when a field is missing or malformed.
+
+### `stalwart-cli apply` fails partway through
+
+Most failures come from trying to create an object whose parent does not exist yet (for example, a `DkimSignature` referencing a `Domain` that is missing from the plan). The error message names the object and the missing reference. Either edit the plan to include the missing parent, or split the `apply` into two runs using the individual snapshot files produced by the script and the test deployment.
+
+### Recovering from a partial `apply`
+
+`apply` runs operations in plan order and stops on the first error. When a `create` fails halfway through, every prior `create` in the same run has already been committed to the database. Re-running the same plan now fails with `primaryKeyViolation` (the objects exist) or `invalidForeignKey` (a parent that did not get created the first time is still missing).
+
+> **Do not bulk-delete `Account` objects to recover.** The migration plan creates each account with its original v0.15 account id (the `restore-` mechanism), so a migrated `Account` points at the existing v0.15 mailbox data in the data store. Deleting that `Account` schedules account destruction, which unlinks and erases all mail, calendars, and contacts stored under that id. On the community edition this runs immediately, with no retention window. Never run `delete Account` against a data store that already contains v0.15 mail.
+
+Recovery does not require deleting accounts. An account that a partial `apply` already created is correct and is reused as-is on the next run; the only objects that need clearing are the registry-only ones that carry no mailbox data and whose re-creation would otherwise raise `primaryKeyViolation`. While the server is still in recovery mode:
+
+```bash
+$ stalwart-cli query DkimSignature --json | jq -r '.[].id' \
+ | stalwart-cli delete DkimSignature --stdin
+$ stalwart-cli query Certificate --json | jq -r '.[].id' \
+ | stalwart-cli delete Certificate --stdin
+$ stalwart-cli query Domain --json | jq -r '.[].id' \
+ | stalwart-cli delete Domain --stdin
+$ stalwart-cli query Tenant --json | jq -r '.[].id' \
+ | stalwart-cli delete Tenant --stdin
+```
+
+`Domain` and `Tenant` hold only directory metadata and are safe to delete and recreate; `Account` is deliberately omitted. Then fix the underlying cause in `export.json` (most often a domain that fails the v0.16 hostname check, an account whose local-part contains `@`, or a stale `/opt/stalwart` path embedded by the migration script), remove from `export.json` the `create` operation for `Account` (and any other object that already committed before the failure, so re-applying it does not raise `primaryKeyViolation`), and rerun:
+
+```bash
+$ stalwart-cli apply --file export.json
+```
+
+If you must start over with the accounts as well, do not delete them: point the new deployment at an empty data store (or restore the v0.15 data-store backup) before re-running `apply`, so that destroying and recreating accounts cannot reach live mail.
+
+If the failure was caused by data that the migration script itself produced incorrectly, also rerun the script with the latest version from `main` before applying. Fixes during the v0.16.0 / v0.16.1 window addressed several edge cases (group names containing `@`, ACME base64 padding, single-URL Redis stores, paths embedded in custom storage backends, and `%{file:...}%` / `%{env:...}%` macros in DKIM private keys and certificates, which are now expanded by the script instead of being passed through verbatim and aborting the `apply`).
+
+For deployments where individual objects are easier to identify than to wipe wholesale, use `stalwart-cli query ` to list ids and `stalwart-cli delete --ids ` to remove a specific one. The same warning applies: deleting an `Account` destroys the mail stored under it. Only `Domain`, `Tenant`, `DkimSignature`, and `Certificate` are safe to delete and recreate during recovery.
+
+### Bootstrapping a real administrator from the CLI
+
+When the WebUI is unreachable for any reason (TLS not yet in place, reverse proxy misconfigured, OAuth callback failing), the CLI is the supported escape hatch for promoting the first real administrator. Authenticate as the recovery admin and run:
+
+```bash
+$ export STALWART_URL='http://127.0.0.1:8080'
+$ export STALWART_USER='admin'
+$ export STALWART_PASSWORD='someTemporaryPassword'
+
+$ stalwart-cli query Domain --fields id,name
+$ stalwart-cli create account/user \
+ --field name=admin \
+ --field domainId=
+$ stalwart-cli query Account --where name=admin --fields id
+$ stalwart-cli update Account \
+ --field 'credentials={"0":{"@type":"Password","secret":""}}'
+$ stalwart-cli update Account \
+ --field 'roles={"@type":"Admin"}'
+```
+
+Once the new account can sign in to the WebUI, remove `STALWART_RECOVERY_ADMIN` from the service environment and restart the service.
+
+### Common questions
+
+- **`primaryKeyViolation` on a rerun of `apply`**: see *Recovering from a partial `apply`* above.
+- **`Domain: create failed for create-N: invalidPatch | Invalid domain name`**: the domain in `export.json` does not pass the v0.16 hostname check (typically a missing or non-public TLD). Either correct the domain in v0.15 before redumping, or hand-edit the offending block in `export.json`.
+- **`/admin` redirects to `http://:8080/`**: fixed in v0.16.x; upgrade to the latest patch release.
+- **"Recalculate disk quotas" not visible in the WebUI**: open *Tasks → Scheduled → Create task*, choose the *Quota recalculation* maintenance type at the per-account scope, and pick a near-future timestamp.
+
+### `Data corruption detected` after migration
+
+This error means one node in a cluster was left running on `v0.15.x` while another was being migrated, and the old node wrote records in the obsolete format into the shared database. Stop every node in the cluster, ensure every binary is on `v0.16`, and restart. If corruption persists, the logs name the offending keys and they can be removed with the `stalwart-cli delete` command.
+
+### `/admin` (or `/account`) returns `404 Not Found`
+
+The WebUI is delivered as a downloadable [Application](https://stalw.art/docs/applications/overview) bundle that the server fetches from `https://github.com/stalwartlabs/webui/releases/latest/` on first start, and then refreshes on a schedule. When the very first download fails, no bundle has been unpacked locally and every request to a WebUI mount path returns `404 Not Found`. This is the most common cause of "the server is running, port `8080` answers, but `/admin` returns 404" reports during the migration.
+
+The fix is to make sure outbound HTTPS from the Stalwart host can reach GitHub's release storage (`github.com` and `objects.githubusercontent.com`). On a host that genuinely cannot reach the public internet, stage the WebUI bundle on an internal HTTPS server and update the [`resourceUrl`](https://stalw.art/docs/ref/object/application#resourceurl) field on the WebUI's [Application](https://stalw.art/docs/ref/object/application) record to point at the internal location. After the first successful download, subsequent failures are non-fatal: the previously installed bundle stays in service and `/admin` keeps working until the next successful refresh. The full description, including the precise hosts involved, is at https://stalw.art/docs/management/webui/overview#outbound-network-requirement.
+
+### Rolling back
+
+If the migration cannot be completed within the available maintenance window, the database backup captured in Step 2 can be restored and the old binary (preserved as `/usr/local/bin/stalwart.v015` in the example) started again. The `v0.16` binary will refuse to start a second time against a database that has already been migrated, so restoring the pre-migration backup is the only path back to `v0.15.x`.
+
+## Questions
+
+If any part of this migration is unclear, or if something does not behave as documented, please post in the dedicated upgrade discussion at https://support.stalw.art. Include:
+
+- The deployment type (binary / Docker / clustered)
+- The datastore backend (RocksDB / SQLite / PostgreSQL / MySQL / FoundationDB)
+- The exact version being upgraded from (`stalwart --version`)
+- Any error messages from the server log or the CLI, verbatim
+
+We would rather answer a question than watch a deployment break. There is no such thing as an obvious question for a migration of this size.
diff --git a/api/v1/openapi.yml b/api/v1/openapi.yml
new file mode 100644
index 0000000..7de8b44
--- /dev/null
+++ b/api/v1/openapi.yml
@@ -0,0 +1,586 @@
+openapi: 3.0.3
+info:
+ title: Stalwart Management API
+ description: |
+ REST Management API for Stalwart server. These endpoints are helpers
+ that complement the JMAP API — most of the server's configuration and data
+ is managed via JMAP (see `POST /jmap/`). The endpoints documented here cover
+ interactive login, account introspection, configuration schema retrieval and
+ live (Server-Sent Events) telemetry streams.
+ version: "1.0"
+ license:
+ name: AGPL-3.0-only OR LicenseRef-SEL
+servers:
+ - url: https://{host}
+ description: Stalwart server
+ variables:
+ host:
+ default: mail.example.com
+ description: The hostname of Stalwart server
+security:
+ - bearerAuth: []
+ - basicAuth: []
+paths:
+ /api/auth:
+ post:
+ operationId: login
+ summary: Authenticate a user and obtain an authorization code
+ description: |
+ Anonymous endpoint used by the web UI and device-flow clients to exchange
+ user credentials (plus optional MFA token and PKCE challenge) for an
+ OAuth authorization `client_code` that can then be exchanged for an
+ access token via `POST /auth/token`. Rate-limited as an anonymous request.
+ security: []
+ tags: [Authentication]
+ requestBody:
+ required: true
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/LoginRequest'
+ examples:
+ authCode:
+ summary: Authorization-code flow (web UI)
+ value:
+ type: authCode
+ accountName: jane@example.com
+ accountSecret: s3cret
+ clientId: webadmin
+ redirectUri: https://mail.example.com/login
+ codeChallenge: E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
+ codeChallengeMethod: S256
+ authDevice:
+ summary: Device-flow completion
+ value:
+ type: authDevice
+ accountName: jane@example.com
+ accountSecret: s3cret
+ code: BDWP-HQPK
+ responses:
+ '200':
+ description: Result of the authentication attempt
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/LoginResponse'
+ examples:
+ authenticated:
+ value:
+ type: authenticated
+ clientCode: 3F7A9C1E4B2D8E6F
+ mfaRequired:
+ value:
+ type: mfaRequired
+ failure:
+ value:
+ type: failure
+ '400':
+ $ref: '#/components/responses/BadRequest'
+ '429':
+ $ref: '#/components/responses/TooManyRequests'
+
+ /api/discover/{email}:
+ get:
+ operationId: discoverOidc
+ summary: Discover the OpenID Connect provider for an email address
+ description: |
+ Returns the OpenID Connect discovery document for the directory that
+ owns the domain part of `email`. If the domain is not bound to an
+ external OIDC directory, the server's own OIDC discovery document
+ (equivalent to `/.well-known/openid-configuration`) is returned.
+ Anonymous endpoint, rate-limited.
+ security: []
+ tags: [Authentication]
+ parameters:
+ - name: email
+ in: path
+ required: true
+ description: Email address or account name
+ schema:
+ type: string
+ format: email
+ responses:
+ '200':
+ description: OpenID Connect discovery document
+ content:
+ application/json:
+ schema:
+ type: object
+ description: OIDC discovery metadata (RFC 8414)
+ additionalProperties: true
+ '404':
+ $ref: '#/components/responses/NotFound'
+ '429':
+ $ref: '#/components/responses/TooManyRequests'
+
+ /api/account:
+ get:
+ operationId: getAccount
+ summary: Return the authenticated account's permissions, edition and locale
+ tags: [Account]
+ responses:
+ '200':
+ description: Account descriptor
+ content:
+ application/json:
+ schema:
+ $ref: '#/components/schemas/Account'
+ '401':
+ $ref: '#/components/responses/Unauthorized'
+
+ /api/schema:
+ get:
+ operationId: getSchemaRedirect
+ summary: Redirect to the versioned configuration schema URL
+ description: |
+ Redirects (302) to `/api/schema/{hash}` where `{hash}` is the SHA-256
+ of the current configuration schema. Use this when you do not yet know
+ the hash; once you have cached a schema at a given hash the immutable
+ cache will never require re-download.
+ tags: [Schema]
+ responses:
+ '302':
+ description: Redirect to the hashed schema URL
+ headers:
+ Location:
+ schema:
+ type: string
+ example: /api/schema/a1b2c3d4e5f6...
+ '401':
+ $ref: '#/components/responses/Unauthorized'
+
+ /api/schema/{hash}:
+ get:
+ operationId: getSchema
+ summary: Return the configuration schema at a specific hash
+ description: |
+ Returns the JSON Schema describing the full Stalwart configuration tree.
+ The response is always gzip-encoded (`Content-Encoding: gzip`) and served
+ with an immutable cache policy — the schema for a given hash never
+ changes. If the hash does not match the server's current schema, the
+ server redirects to the correct URL.
+ tags: [Schema]
+ parameters:
+ - name: hash
+ in: path
+ required: true
+ description: SHA-256 hex digest of the configuration schema
+ schema:
+ type: string
+ responses:
+ '200':
+ description: Gzipped JSON Schema document
+ headers:
+ Content-Encoding:
+ schema:
+ type: string
+ example: gzip
+ Cache-Control:
+ schema:
+ type: string
+ example: public, max-age=31536000, immutable
+ content:
+ application/json:
+ schema:
+ type: object
+ description: JSON Schema document describing Stalwart config
+ additionalProperties: true
+ '302':
+ description: Redirect to the current schema URL when the hash is stale
+ '401':
+ $ref: '#/components/responses/Unauthorized'
+
+ /api/token/delivery:
+ get:
+ operationId: issueDeliveryToken
+ summary: Issue a short-lived token for live delivery diagnostics
+ description: |
+ Returns a plain-text bearer token, valid for 60 seconds, that authorises
+ connecting to `/api/live/delivery/{target}` as a query parameter
+ (`?token=...`). Useful for EventSource clients that cannot send
+ `Authorization` headers. Requires `LiveDeliveryTest` permission.
+ tags: [Live Telemetry]
+ responses:
+ '200':
+ description: Short-lived delivery token
+ content:
+ text/plain:
+ schema:
+ type: string
+ example: eyJhbGciOi...
+ '401':
+ $ref: '#/components/responses/Unauthorized'
+ '403':
+ $ref: '#/components/responses/Forbidden'
+
+ /api/token/tracing:
+ get:
+ operationId: issueTracingToken
+ summary: Issue a short-lived token for live tracing (Enterprise)
+ description: |
+ Returns a plain-text bearer token, valid for 60 seconds, that authorises
+ connecting to `/api/live/tracing` as a query parameter. Requires the
+ `LiveTracing` permission. Available only in the Enterprise edition.
+ tags: [Live Telemetry]
+ responses:
+ '200':
+ description: Short-lived tracing token
+ content:
+ text/plain:
+ schema:
+ type: string
+ '401':
+ $ref: '#/components/responses/Unauthorized'
+ '403':
+ $ref: '#/components/responses/Forbidden'
+ '404':
+ description: Enterprise feature not available in this edition
+
+ /api/token/metrics:
+ get:
+ operationId: issueMetricsToken
+ summary: Issue a short-lived token for live metrics (Enterprise)
+ description: |
+ Returns a plain-text bearer token, valid for 60 seconds, that authorises
+ connecting to `/api/live/metrics` as a query parameter. Requires the
+ `LiveMetrics` permission. Available only in the Enterprise edition.
+ tags: [Live Telemetry]
+ responses:
+ '200':
+ description: Short-lived metrics token
+ content:
+ text/plain:
+ schema:
+ type: string
+ '401':
+ $ref: '#/components/responses/Unauthorized'
+ '403':
+ $ref: '#/components/responses/Forbidden'
+ '404':
+ description: Enterprise feature not available in this edition
+
+ /api/live/delivery/{target}:
+ get:
+ operationId: liveDelivery
+ summary: Stream outbound-delivery diagnostics as Server-Sent Events
+ description: |
+ Opens a `text/event-stream` connection that streams each stage of an
+ outbound delivery attempt to `target` (a domain or email address): MX
+ lookup, MTA-STS fetch, TLSA/DANE validation, SMTP conversation, and so
+ on. Each SSE frame carries a JSON-encoded `DeliveryStage` wrapped in a
+ single-element array (`data: [{...}]`). The stream ends with a final
+ `completed` event. Requires `LiveDeliveryTest` permission; may also be
+ authenticated via the `?token=` query parameter obtained from
+ `/api/token/delivery`.
+ tags: [Live Telemetry]
+ security:
+ - bearerAuth: []
+ - basicAuth: []
+ - liveToken: []
+ parameters:
+ - name: target
+ in: path
+ required: true
+ description: Target domain or email address to diagnose
+ schema:
+ type: string
+ - name: timeout
+ in: query
+ required: false
+ description: Maximum stream lifetime in seconds (minimum 1, default 30)
+ schema:
+ type: integer
+ minimum: 1
+ default: 30
+ responses:
+ '200':
+ description: Server-Sent Events stream of delivery-diagnose stages
+ content:
+ text/event-stream:
+ schema:
+ type: string
+ description: |
+ Series of SSE frames. Each `event: event` frame carries
+ `data: []`; the final frame's stage is
+ `{"type":"completed"}`.
+ '401':
+ $ref: '#/components/responses/Unauthorized'
+ '403':
+ $ref: '#/components/responses/Forbidden'
+
+ /api/live/tracing:
+ get:
+ operationId: liveTracing
+ summary: Stream live tracing events (Enterprise)
+ description: |
+ Opens a `text/event-stream` connection streaming server trace events in
+ real time. Requires `LiveTracing` permission; may be authenticated via
+ the `?token=` query parameter from `/api/token/tracing`. Enterprise only.
+ tags: [Live Telemetry]
+ security:
+ - bearerAuth: []
+ - basicAuth: []
+ - liveToken: []
+ responses:
+ '200':
+ description: Server-Sent Events stream of tracing events
+ content:
+ text/event-stream:
+ schema:
+ type: string
+ '401':
+ $ref: '#/components/responses/Unauthorized'
+ '403':
+ $ref: '#/components/responses/Forbidden'
+ '404':
+ description: Enterprise feature not available in this edition
+
+ /api/live/metrics:
+ get:
+ operationId: liveMetrics
+ summary: Stream live metrics events (Enterprise)
+ description: |
+ Opens a `text/event-stream` connection streaming server metrics in real
+ time. Requires `LiveMetrics` permission; may be authenticated via the
+ `?token=` query parameter from `/api/token/metrics`. Enterprise only.
+ tags: [Live Telemetry]
+ security:
+ - bearerAuth: []
+ - basicAuth: []
+ - liveToken: []
+ responses:
+ '200':
+ description: Server-Sent Events stream of metric events
+ content:
+ text/event-stream:
+ schema:
+ type: string
+ '401':
+ $ref: '#/components/responses/Unauthorized'
+ '403':
+ $ref: '#/components/responses/Forbidden'
+ '404':
+ description: Enterprise feature not available in this edition
+
+components:
+ securitySchemes:
+ bearerAuth:
+ type: http
+ scheme: bearer
+ bearerFormat: JWT
+ description: OAuth2 access token issued by `POST /auth/token`.
+ basicAuth:
+ type: http
+ scheme: basic
+ description: HTTP Basic authentication using account name and secret.
+ liveToken:
+ type: apiKey
+ in: query
+ name: token
+ description: |
+ Short-lived token (60s lifetime) issued by `/api/token/{kind}` and used
+ to authorise Server-Sent Events streams where an `Authorization` header
+ cannot be set (e.g. browser `EventSource`).
+
+ responses:
+ BadRequest:
+ description: Request payload is malformed or fails validation
+ content:
+ application/problem+json:
+ schema:
+ $ref: '#/components/schemas/ProblemDetails'
+ Unauthorized:
+ description: Missing or invalid credentials
+ headers:
+ WWW-Authenticate:
+ schema:
+ type: string
+ example: Bearer realm="Stalwart Server"
+ content:
+ application/problem+json:
+ schema:
+ $ref: '#/components/schemas/ProblemDetails'
+ Forbidden:
+ description: Authenticated principal lacks the required permission
+ content:
+ application/problem+json:
+ schema:
+ $ref: '#/components/schemas/ProblemDetails'
+ NotFound:
+ description: Resource not found
+ content:
+ application/problem+json:
+ schema:
+ $ref: '#/components/schemas/ProblemDetails'
+ TooManyRequests:
+ description: Anonymous-request rate limit exceeded
+ content:
+ application/problem+json:
+ schema:
+ $ref: '#/components/schemas/ProblemDetails'
+
+ schemas:
+ LoginRequest:
+ type: object
+ description: |
+ Tagged union discriminated by `type`. Use `authCode` for the standard
+ OAuth authorization-code flow (optionally with PKCE) and `authDevice`
+ to complete an OAuth device-authorization flow.
+ oneOf:
+ - $ref: '#/components/schemas/LoginRequestAuthCode'
+ - $ref: '#/components/schemas/LoginRequestAuthDevice'
+ discriminator:
+ propertyName: type
+ mapping:
+ authCode: '#/components/schemas/LoginRequestAuthCode'
+ authDevice: '#/components/schemas/LoginRequestAuthDevice'
+
+ LoginRequestAuthCode:
+ type: object
+ required: [type, accountName, accountSecret, clientId]
+ properties:
+ type:
+ type: string
+ enum: [authCode]
+ accountName:
+ type: string
+ accountSecret:
+ type: string
+ format: password
+ mfaToken:
+ type: string
+ nullable: true
+ description: MFA token returned by a previous `mfaRequired` response
+ clientId:
+ type: string
+ description: OAuth client identifier
+ redirectUri:
+ type: string
+ format: uri
+ nullable: true
+ description: Must use `https://` unless the server is in recovery or dev mode
+ nonce:
+ type: string
+ nullable: true
+ scope:
+ type: string
+ nullable: true
+ codeChallenge:
+ type: string
+ nullable: true
+ description: PKCE code challenge (RFC 7636)
+ codeChallengeMethod:
+ type: string
+ enum: [plain, S256]
+ nullable: true
+ description: Defaults to `plain` when a `codeChallenge` is present
+ state:
+ type: string
+ nullable: true
+
+ LoginRequestAuthDevice:
+ type: object
+ required: [type, accountName, accountSecret, code]
+ properties:
+ type:
+ type: string
+ enum: [authDevice]
+ accountName:
+ type: string
+ accountSecret:
+ type: string
+ format: password
+ mfaToken:
+ type: string
+ nullable: true
+ code:
+ type: string
+ description: User-facing device code issued by `POST /auth/device`
+
+ LoginResponse:
+ type: object
+ description: Tagged union discriminated by `type`.
+ oneOf:
+ - $ref: '#/components/schemas/LoginResponseAuthenticated'
+ - $ref: '#/components/schemas/LoginResponseVerified'
+ - $ref: '#/components/schemas/LoginResponseMfaRequired'
+ - $ref: '#/components/schemas/LoginResponseFailure'
+ discriminator:
+ propertyName: type
+ mapping:
+ authenticated: '#/components/schemas/LoginResponseAuthenticated'
+ verified: '#/components/schemas/LoginResponseVerified'
+ mfaRequired: '#/components/schemas/LoginResponseMfaRequired'
+ failure: '#/components/schemas/LoginResponseFailure'
+
+ LoginResponseAuthenticated:
+ type: object
+ required: [type, clientCode]
+ properties:
+ type:
+ type: string
+ enum: [authenticated]
+ clientCode:
+ type: string
+ description: Authorization code to exchange at `POST /auth/token`
+
+ LoginResponseVerified:
+ type: object
+ required: [type]
+ properties:
+ type:
+ type: string
+ enum: [verified]
+
+ LoginResponseMfaRequired:
+ type: object
+ required: [type]
+ properties:
+ type:
+ type: string
+ enum: [mfaRequired]
+
+ LoginResponseFailure:
+ type: object
+ required: [type]
+ properties:
+ type:
+ type: string
+ enum: [failure]
+
+ Account:
+ type: object
+ required: [permissions, edition, locale]
+ properties:
+ permissions:
+ type: array
+ description: |
+ Effective permissions for the authenticated principal, filtered to
+ exclude internal/system-only permissions. Values are from the
+ `Permission` enum (e.g. `authenticate`, `jmap-email-get`,
+ `sys-account-settings-get`).
+ items:
+ type: string
+ edition:
+ type: string
+ enum: [oss, community, enterprise]
+ description: Server edition
+ locale:
+ type: string
+ description: Preferred locale for the account (IETF BCP 47-style tag)
+
+ ProblemDetails:
+ type: object
+ description: RFC 7807 problem details document
+ properties:
+ type:
+ type: string
+ format: uri
+ title:
+ type: string
+ status:
+ type: integer
+ detail:
+ type: string
+ instance:
+ type: string
diff --git a/crates/common/Cargo.toml b/crates/common/Cargo.toml
new file mode 100644
index 0000000..c584f85
--- /dev/null
+++ b/crates/common/Cargo.toml
@@ -0,0 +1,101 @@
+[package]
+name = "common"
+version = "0.16.22"
+edition = "2024"
+build = "build.rs"
+
+[dependencies]
+utils = { path = "../utils" }
+nlp = { path = "../nlp" }
+store = { path = "../store" }
+trc = { path = "../trc" }
+directory = { path = "../directory" }
+coordinator = { path = "../coordinator" }
+types = { path = "../types" }
+registry = { path = "../registry" }
+jmap_proto = { path = "../jmap-proto" }
+sieve-rs = { version = "0.7", features = ["rkyv", "serde"] }
+mail-parser = { version = "0.11", features = ["full_encoding"] }
+mail-builder = { version = "1.0" }
+mail-auth = { version = "0.13", features = ["generate", "arc"] }
+smtp-proto = { version = "0.2.3", features = ["rkyv"] }
+dns-update = { version = "0.5" }
+calcard = { version = "0.3", features = ["rkyv"] }
+ahash = { version = "0.8.12", features = ["serde"] }
+parking_lot = "0.12.5"
+regex = "1.13.1"
+proxy-header = { version = "0.1.2", features = ["tokio"] }
+arc-swap = "1.9.2"
+rustls = { version = "0.23.43", default-features = false, features = ["std", "aws_lc_rs", "tls12"] }
+rustls-pemfile = "2.2"
+rustls-pki-types = { version = "1" }
+aws-lc-rs = { version = "1" }
+tokio = { version = "1.53", features = ["net", "macros"] }
+tokio-rustls = { version = "0.26", default-features = false, features = ["aws_lc_rs", "tls12"] }
+futures = "0.3"
+rcgen = { version = "0.14", default-features = false, features = ["crypto", "pem", "aws_lc_rs"] }
+reqwest = { version = "0.13", default-features = false, features = ["rustls", "http2", "stream"]}
+serde = { version = "1.0", features = ["derive"]}
+serde_json = "1.0"
+base64 = "0.23"
+x509-parser = "0.18"
+pem = "4.0"
+chrono = { version = "0.4", features = ["serde"] }
+hyper = { version = "1.11.1", features = ["server", "http1", "http2"] }
+opentelemetry = { git = "https://github.com/stalwartlabs/opentelemetry-rust" }
+opentelemetry_sdk = { git = "https://github.com/stalwartlabs/opentelemetry-rust" }
+opentelemetry-otlp = { git = "https://github.com/stalwartlabs/opentelemetry-rust", default-features = false, features = ["reqwest-client", "http-proto", "trace", "metrics", "logs", "internal-logs", "grpc-tonic", "tls-aws-lc", "tls-roots", "reqwest-rustls"] }
+opentelemetry-semantic-conventions = { git = "https://github.com/stalwartlabs/opentelemetry-rust" }
+prometheus = { version = "0.14", default-features = false }
+imagesize = "0.15"
+sha1 = "0.11"
+sha2 = "0.11"
+md5 = "0.8.1"
+whatlang = "0.18"
+idna = "1.1"
+decancer = "3.3.3"
+unicode-security = "0.1.2"
+infer = "0.22"
+bincode = { version = "2.0.1", features = ["serde"] }
+hostname = "0.4.2"
+zip = "8.6"
+xxhash-rust = { version = "0.8.18", features = ["xxh3"] }
+psl = "2"
+aes-gcm-siv = "0.12.1"
+jsonwebtoken = { version = "11.0.0", features = ["aws_lc_rs"] }
+rsa = "0.9.10"
+p256 = { version = "0.13", features = ["ecdh", "ecdsa", "pkcs8", "pem"] }
+p384 = { version = "0.13", features = ["ecdh"] }
+hashify = "0.2"
+rkyv = { version = "0.8.18", features = ["little_endian"] }
+tinyvec = { version = "1.12.0", features = ["alloc"] }
+compact_str = { version = "0.10.0", features = ["rkyv", "serde"] }
+lz4_flex = { version = "0.14", features = ["frame"], default-features = false }
+hickory-proto = "0.26.3"
+nohash-hasher = "0.2.0"
+quick_cache = "0.7"
+rasn = "0.28"
+rasn-pkix = "0.28"
+sequoia-openpgp = { version = "2.4", default-features = false, features = ["crypto-rust", "allow-experimental-crypto", "allow-variable-time-crypto"] }
+zxcvbn = "3.1.1"
+pkcs8 = { version = "0.10.2", features = ["alloc", "std"] }
+quick-xml = "0.41"
+
+[target.'cfg(unix)'.dependencies]
+privdrop = "0.5.6"
+libc = "0.2.189"
+
+[target.'cfg(windows)'.dependencies]
+socket2 = "0.6"
+
+[features]
+test_mode = []
+dev_mode = []
+enterprise = []
+foundation = []
+
+[dev-dependencies]
+tokio = { version = "1.53", features = ["full"] }
+
+[lints]
+workspace = true
diff --git a/crates/common/build.rs b/crates/common/build.rs
new file mode 100644
index 0000000..c62f67d
--- /dev/null
+++ b/crates/common/build.rs
@@ -0,0 +1,234 @@
+use std::collections::{HashMap, HashSet};
+use std::env;
+use std::fs;
+use std::path::Path;
+
+fn main() {
+ let out_dir = env::var("OUT_DIR").unwrap();
+ let dest_path = Path::new(&out_dir).join("locales.rs");
+
+ // Read the YAML file
+ let manifest_dir = env::var("CARGO_MANIFEST_DIR").unwrap();
+ let repo_root = Path::new(&manifest_dir).parent().unwrap().parent().unwrap();
+ let yaml_path = repo_root.join("resources/locales/i18n.yml");
+ let yaml_content =
+ fs::read_to_string(&yaml_path).unwrap_or_else(|_| panic!("Failed to read {yaml_path:?}"));
+
+ let locales = parse_yaml(&yaml_content);
+
+ let generated_code = generate_locale_code(&locales);
+
+ fs::write(&dest_path, generated_code).expect("Failed to write generated locales.");
+
+ println!("cargo:rerun-if-changed={}", yaml_path.display());
+}
+
+fn parse_yaml(content: &str) -> HashMap> {
+ let mut result: HashMap> = HashMap::new();
+ let mut current_key = None;
+
+ for line in content.lines() {
+ if let Some((key, value)) = line.split_once(':') {
+ let is_translation = key
+ .as_bytes()
+ .first()
+ .is_some_and(|&b| b.is_ascii_whitespace());
+ let key = key.trim();
+ if !key.starts_with('#') && !key.is_empty() {
+ if !is_translation {
+ current_key = result.entry(key.replace('.', "_")).or_default().into();
+ } else {
+ current_key
+ .as_mut()
+ .unwrap()
+ .insert(key.to_string(), value.trim().trim_matches('"').to_string());
+ }
+ }
+ }
+ }
+
+ result
+}
+
+fn const_name(language: &str) -> String {
+ language.to_uppercase().replace('-', "_")
+}
+
+const PLURAL_CATEGORIES: [&str; 6] = ["zero", "one", "two", "few", "many", "other"];
+
+const RTL_LANGUAGES: [&str; 10] = ["ar", "ckb", "dv", "fa", "he", "ps", "sd", "ug", "ur", "yi"];
+
+fn direction(language: &str) -> &'static str {
+ let tag = language.split(['-', '_']).next().unwrap_or(language);
+ if RTL_LANGUAGES.contains(&tag) {
+ "rtl"
+ } else {
+ "ltr"
+ }
+}
+
+fn split_plural_forms(value: &str) -> Option> {
+ value
+ .split(';')
+ .map(|segment| {
+ segment
+ .split_once('=')
+ .filter(|(name, _)| PLURAL_CATEGORIES.contains(name))
+ })
+ .collect()
+}
+
+fn plural_keys(locales: &HashMap>) -> HashSet {
+ let mut keys = HashSet::new();
+
+ for (key, translations) in locales {
+ if !translations
+ .values()
+ .any(|value| split_plural_forms(value).is_some())
+ {
+ continue;
+ }
+
+ for (language, value) in translations {
+ let Some(forms) = split_plural_forms(value) else {
+ panic!(
+ "{key}: {language} has no plural categories while other languages do: {value:?}"
+ );
+ };
+ let mut seen = HashSet::new();
+ for (name, _) in &forms {
+ if !seen.insert(*name) {
+ panic!("{key}: {language} repeats the plural category {name:?}");
+ }
+ }
+ if !seen.contains("other") {
+ panic!("{key}: {language} is missing the required \"other\" plural category");
+ }
+ }
+
+ keys.insert(key.clone());
+ }
+
+ keys
+}
+
+fn plural_forms_literal(value: &str) -> String {
+ let forms = split_plural_forms(value).expect("validated above");
+ let other = forms
+ .iter()
+ .find(|(name, _)| *name == "other")
+ .map(|(_, text)| *text)
+ .expect("validated above");
+
+ let mut literal = String::from("PluralForms {");
+ for category in PLURAL_CATEGORIES {
+ let text = forms
+ .iter()
+ .find(|(name, _)| *name == category)
+ .map_or(other, |(_, text)| *text);
+ literal.push_str(&format!(" {category}: {text:?},"));
+ }
+ literal.push_str(" }");
+ literal
+}
+
+fn generate_locale_code(locales: &HashMap>) -> String {
+ let mut code = String::new();
+ let plural = plural_keys(locales);
+
+ code.push_str("#[derive(Debug, Clone, Copy)]\n");
+ code.push_str("pub struct PluralForms {\n");
+ for category in PLURAL_CATEGORIES {
+ code.push_str(&format!(" pub {category}: &'static str,\n"));
+ }
+ code.push_str("}\n\n");
+
+ code.push_str("#[derive(Debug, Clone)]\n");
+ code.push_str("pub struct Locale {\n");
+ code.push_str(" pub name: &'static str,\n");
+ code.push_str(" pub direction: &'static str,\n");
+
+ for key in locales.keys() {
+ let field_type = if plural.contains(key) {
+ "PluralForms"
+ } else {
+ "&'static str"
+ };
+ code.push_str(&format!(" pub {key}: {field_type},\n"));
+ }
+
+ code.push_str("}\n\n");
+
+ let mut languages = std::collections::HashSet::new();
+ for translations in locales.values() {
+ for lang in translations.keys() {
+ languages.insert(lang.clone());
+ }
+ }
+
+ for lang in &languages {
+ code.push_str(&format!(
+ "pub static {}_LOCALES: Locale = Locale {{\n",
+ const_name(lang)
+ ));
+ code.push_str(&format!(" name: {lang:?},\n"));
+ code.push_str(&format!(" direction: {:?},\n", direction(lang)));
+
+ for (key, translations) in locales {
+ let value = translations
+ .get(lang)
+ .unwrap_or_else(|| panic!("Missing: {}", key));
+ if plural.contains(key) {
+ code.push_str(&format!(" {key}: {},\n", plural_forms_literal(value)));
+ } else {
+ code.push_str(&format!(" {key}: {value:?},\n"));
+ }
+ }
+
+ code.push_str("};\n\n");
+ }
+
+ let mut sorted: Vec<&String> = languages.iter().collect();
+ sorted.sort_unstable();
+ code.push_str(&format!(
+ "pub static ALL_LOCALES: [&Locale; {}] = [\n",
+ sorted.len()
+ ));
+ for lang in &sorted {
+ code.push_str(&format!(" &{}_LOCALES,\n", const_name(lang)));
+ }
+ code.push_str("];\n\n");
+
+ code.push_str("pub fn locale(name: &str) -> Option<&'static Locale> {\n");
+ code.push_str(" hashify::tiny_map_ignore_case!(name.as_bytes(),\n");
+ for lang in &languages {
+ code.push_str(&format!(
+ " \"{}\" => &{}_LOCALES,\n",
+ lang,
+ const_name(lang)
+ ));
+ }
+ code.push_str(" )\n");
+ code.push_str("}\n\n");
+
+ // Maps a bare language tag onto the regional locale shipped for it
+ let mut by_language: Vec<(&str, &str)> = languages
+ .iter()
+ .map(|lang| (lang.split('-').next().unwrap_or(lang), lang.as_str()))
+ .collect();
+ by_language.sort_unstable();
+ by_language.dedup_by_key(|(language, _)| *language);
+
+ code.push_str("pub fn locale_by_language(language: &str) -> Option<&'static Locale> {\n");
+ code.push_str(" hashify::tiny_map_ignore_case!(language.as_bytes(),\n");
+ for (language, lang) in by_language {
+ code.push_str(&format!(
+ " \"{}\" => &{}_LOCALES,\n",
+ language,
+ const_name(lang)
+ ));
+ }
+ code.push_str(" )\n");
+ code.push_str("}\n");
+ code
+}
diff --git a/crates/common/src/auth/access_token.rs b/crates/common/src/auth/access_token.rs
new file mode 100644
index 0000000..4c6ce2d
--- /dev/null
+++ b/crates/common/src/auth/access_token.rs
@@ -0,0 +1,940 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use super::AccessToken;
+use crate::{
+ Server,
+ auth::{
+ AccessScope, AccessTo, AccessTokenInner, AccountTenantIds, Permissions, RECOVERY_ADMIN_ID,
+ permissions::{BuildPermissions, PermissionsListBuilder},
+ },
+ network::limiter::{ConcurrencyLimiter, LimiterResult},
+};
+use ahash::AHasher;
+use registry::{
+ schema::{
+ enums::Permission,
+ structs::{self, Account, Roles, UserRoles},
+ },
+ types::EnumImpl,
+};
+use std::{
+ hash::{Hash, Hasher},
+ net::IpAddr,
+ sync::Arc,
+};
+use store::{query::acl::AclQuery, rand, write::now};
+use tinyvec::TinyVec;
+use trc::{AddContext, StoreEvent};
+use types::{acl::Acl, collection::Collection};
+use utils::map::bitmap::{Bitmap, BitmapItem};
+use xxhash_rust::xxh3;
+
+impl Server {
+ async fn build_access_token(
+ &self,
+ account: Account,
+ account_id: u32,
+ revision: u64,
+ revision_account: u64,
+ ) -> trc::Result {
+ match account {
+ Account::User(account) => {
+ let tenant_id = account.member_tenant_id.map(|t| t.id() as u32);
+ let permissions = self
+ .effective_permissions(
+ &account.permissions,
+ match &account.roles {
+ UserRoles::User => {
+ self.core.network.security.default_role_ids_user.as_slice()
+ }
+ UserRoles::Admin => {
+ if tenant_id.is_none() {
+ self.core.network.security.default_role_ids_admin.as_slice()
+ } else {
+ self.core
+ .network
+ .security
+ .default_role_ids_tenant
+ .as_slice()
+ }
+ }
+ UserRoles::Custom(custom_roles) => custom_roles.role_ids.as_slice(),
+ },
+ tenant_id,
+ )
+ .await?;
+
+ let member_of = account
+ .member_group_ids
+ .iter()
+ .map(|m| m.id() as u32)
+ .collect::>();
+ let mut access_to: Vec = Vec::new();
+ for grant_account_id in [account_id].into_iter().chain(member_of.iter().copied()) {
+ for acl_item in self
+ .store()
+ .acl_query(AclQuery::HasAccess { grant_account_id })
+ .await
+ .caused_by(trc::location!())?
+ {
+ if acl_item.to_account_id != account_id
+ && !member_of.contains(&acl_item.to_account_id)
+ {
+ let acl = Bitmap::::from(acl_item.permissions);
+ let collection = acl_item.to_collection;
+ if !collection.is_valid() {
+ return Err(trc::StoreEvent::DataCorruption
+ .ctx(trc::Key::Reason, "Corrupted collection found in ACL key.")
+ .details(format!("{acl_item:?}"))
+ .account_id(grant_account_id)
+ .caused_by(trc::location!()));
+ }
+
+ let mut collections: Bitmap = Bitmap::new();
+ if acl.contains(Acl::Read) {
+ collections.insert(collection);
+ }
+ if acl.contains(Acl::ReadItems)
+ && let Some(child_col) = collection.child_collection()
+ {
+ collections.insert(child_col);
+ }
+
+ if !collections.is_empty() {
+ if let Some(idx) = access_to
+ .iter()
+ .position(|a| a.account_id == acl_item.to_account_id)
+ {
+ access_to[idx].collections.union(&collections);
+ } else {
+ access_to.push(AccessTo {
+ account_id: acl_item.to_account_id,
+ collections,
+ });
+ }
+ }
+ }
+ }
+ }
+
+ let now = now();
+ let mut credential_version = 0;
+ let mut credential_scopes = Vec::with_capacity(account.credentials.len());
+
+ credential_scopes.push(AccessScope::new(permissions.finalize(), u32::MAX));
+
+ for credential in account.credentials {
+ match credential {
+ structs::Credential::Password(credential) => {
+ credential_version = xxh3::xxh3_64(credential.secret.as_bytes()).max(1);
+
+ if credential.expires_at.is_some() || !credential.allowed_ips.is_empty()
+ {
+ let credential_scope = &mut credential_scopes[0];
+ credential_scope.expires_at = credential
+ .expires_at
+ .map(|v| v.timestamp() as u64)
+ .unwrap_or(u64::MAX);
+ credential_scope.allowed_ips =
+ credential.allowed_ips.into_inner().into_boxed_slice();
+ }
+ }
+ structs::Credential::ApiKey(credential)
+ | structs::Credential::AppPassword(credential) => {
+ let credential_id = credential.credential_id.document_id();
+ let expires_at = credential
+ .expires_at
+ .map(|v| v.timestamp() as u64)
+ .unwrap_or(u64::MAX);
+ if expires_at > now {
+ let permissions = &credential_scopes[0].permissions;
+ let permissions = match credential.permissions {
+ structs::CredentialPermissions::Inherit => permissions.clone(),
+ structs::CredentialPermissions::Disable(list) => {
+ let mut permissions = permissions.clone();
+ permissions.clear_many(&Permissions::from_permission(
+ list.permissions.as_slice(),
+ ));
+ permissions
+ }
+ structs::CredentialPermissions::Replace(list) => {
+ let mut replace_permissions = Permissions::from_permission(
+ list.permissions.as_slice(),
+ );
+ replace_permissions.intersection(permissions);
+ replace_permissions
+ }
+ };
+ credential_scopes.push(AccessScope {
+ credential_id,
+ permissions,
+ expires_at,
+ allowed_ips: credential
+ .allowed_ips
+ .into_inner()
+ .into_boxed_slice(),
+ })
+ }
+ }
+ }
+ }
+
+ Ok(AccessTokenInner {
+ concurrent_imap_requests: self
+ .core
+ .imap
+ .rate_concurrent
+ .map(ConcurrencyLimiter::new),
+ concurrent_http_requests: self
+ .core
+ .jmap
+ .request_max_concurrent
+ .map(ConcurrencyLimiter::new),
+ concurrent_uploads: self
+ .core
+ .jmap
+ .upload_max_concurrent
+ .map(ConcurrencyLimiter::new),
+ obj_size: 0,
+ revision,
+ revision_account,
+ credential_version,
+ account_id,
+ tenant_id,
+ member_of,
+ access_to: access_to.into_boxed_slice(),
+ scopes: []
+ .into_iter()
+ .chain(credential_scopes)
+ .collect::>(),
+ }
+ .update_size())
+ }
+ Account::Group(account) => {
+ let tenant_id = account.member_tenant_id.map(|t| t.id() as u32);
+ let permissions = self
+ .effective_permissions(
+ &account.permissions,
+ account.roles.role_ids().unwrap_or(
+ self.core.network.security.default_role_ids_group.as_slice(),
+ ),
+ tenant_id,
+ )
+ .await?;
+
+ Ok(AccessTokenInner {
+ concurrent_imap_requests: self
+ .core
+ .imap
+ .rate_concurrent
+ .map(ConcurrencyLimiter::new),
+ concurrent_http_requests: self
+ .core
+ .jmap
+ .request_max_concurrent
+ .map(ConcurrencyLimiter::new),
+ concurrent_uploads: self
+ .core
+ .jmap
+ .upload_max_concurrent
+ .map(ConcurrencyLimiter::new),
+ obj_size: 0,
+ revision,
+ revision_account,
+ credential_version: 0,
+ account_id,
+ tenant_id,
+ member_of: Default::default(),
+ access_to: Default::default(),
+ scopes: Box::new([AccessScope::new(permissions.finalize(), u32::MAX)]),
+ }
+ .update_size())
+ }
+ }
+ }
+
+ pub async fn access_token(&self, account_id: u32) -> trc::Result> {
+ match self
+ .inner
+ .cache
+ .access_tokens
+ .get_value_or_guard_async(&account_id)
+ .await
+ {
+ Ok(token) => {
+ trc::event!(
+ Store(StoreEvent::CacheHit),
+ Key = account_id,
+ Collection = "accessToken",
+ );
+
+ Ok(token)
+ }
+ Err(guard) => {
+ trc::event!(
+ Store(StoreEvent::CacheMiss),
+ Key = account_id,
+ Collection = "accessToken",
+ );
+
+ let token: Arc = if let Some(account) =
+ self.registry().object::(account_id.into()).await?
+ {
+ let revision = rand::random::();
+ let revision_account = hash_account(&account);
+ self.build_access_token(account, account_id, revision, revision_account)
+ .await?
+ .into()
+ } else if account_id == RECOVERY_ADMIN_ID {
+ AccessTokenInner::new_admin().into()
+ } else {
+ return Err(trc::SecurityEvent::Unauthorized
+ .into_err()
+ .details("Account not found")
+ .account_id(account_id)
+ .caused_by(trc::location!()));
+ };
+
+ let _ = guard.insert(token.clone());
+ Ok(token)
+ }
+ }
+ }
+
+ pub(crate) async fn access_token_from_account(
+ &self,
+ account_id: u32,
+ account: Account,
+ ) -> trc::Result> {
+ let revision_account = hash_account(&account);
+ match self
+ .inner
+ .cache
+ .access_tokens
+ .get_value_or_guard_async(&account_id)
+ .await
+ {
+ Ok(token) => {
+ if token.revision_account == revision_account {
+ trc::event!(
+ Store(StoreEvent::CacheHit),
+ Key = account_id,
+ Collection = "accessToken",
+ );
+
+ Ok(token)
+ } else {
+ // Token is stale, rebuild it
+ trc::event!(
+ Store(StoreEvent::CacheStale),
+ Key = account_id,
+ Collection = "accessToken",
+ );
+
+ debug_assert!(
+ false,
+ "Token is stale, invalidation should have been triggered"
+ );
+ let revision = rand::random::();
+ let token: Arc = self
+ .build_access_token(account, account_id, revision, revision_account)
+ .await?
+ .into();
+ self.inner
+ .cache
+ .access_tokens
+ .update(account_id, token.clone());
+ Ok(token)
+ }
+ }
+ Err(guard) => {
+ trc::event!(
+ Store(StoreEvent::CacheMiss),
+ Key = account_id,
+ Collection = "accessToken",
+ );
+
+ let revision = rand::random::();
+ let token: Arc = self
+ .build_access_token(account, account_id, revision, revision_account)
+ .await?
+ .into();
+ let _ = guard.insert(token.clone());
+ Ok(token)
+ }
+ }
+ }
+}
+
+impl AccessToken {
+ pub fn new(inner: Arc, remote_ip: IpAddr) -> trc::Result {
+ AccessToken {
+ scope_idx: 0,
+ inner,
+ }
+ .assert_is_valid(remote_ip)
+ }
+
+ pub fn new_maybe_invalid(inner: Arc) -> Self {
+ AccessToken {
+ scope_idx: 0,
+ inner,
+ }
+ }
+
+ pub fn new_scoped(
+ inner: Arc,
+ credential_id: u32,
+ remote_ip: IpAddr,
+ ) -> trc::Result {
+ inner
+ .scopes
+ .iter()
+ .position(|scope| scope.credential_id == credential_id)
+ .ok_or_else(|| {
+ trc::SecurityEvent::Unauthorized
+ .into_err()
+ .ctx(trc::Key::AccountId, inner.account_id)
+ .ctx(trc::Key::Id, credential_id)
+ .reason("Credential expired or removed.")
+ })
+ .map(|scope_idx| AccessToken { scope_idx, inner })
+ .and_then(|token| token.assert_is_valid(remote_ip))
+ }
+
+ pub fn renew(
+ inner: Arc,
+ credential_id: Option,
+ remote_ip: IpAddr,
+ ) -> trc::Result {
+ if let Some(credential_id) = credential_id {
+ Self::new_scoped(inner, credential_id, remote_ip)
+ } else {
+ AccessToken {
+ scope_idx: 0,
+ inner,
+ }
+ .assert_is_valid(remote_ip)
+ }
+ }
+
+ pub fn state(&self) -> u32 {
+ // Hash state
+ let mut s = AHasher::default();
+ self.inner.member_of.hash(&mut s);
+ self.inner.access_to.hash(&mut s);
+ s.finish() as u32
+ }
+
+ #[inline(always)]
+ pub fn account_id(&self) -> u32 {
+ self.inner.account_id
+ }
+
+ #[inline(always)]
+ pub fn tenant_id(&self) -> Option {
+ self.inner.tenant_id
+ }
+
+ pub fn secondary_ids(&self) -> impl Iterator- {
+ self.inner
+ .member_of
+ .iter()
+ .chain(self.inner.access_to.iter().map(|a| &a.account_id))
+ }
+
+ pub fn member_ids(&self) -> impl Iterator
- {
+ [self.inner.account_id]
+ .into_iter()
+ .chain(self.inner.member_of.iter().copied())
+ }
+
+ pub fn all_ids(&self) -> impl Iterator
- {
+ [self.inner.account_id]
+ .into_iter()
+ .chain(self.inner.member_of.iter().copied())
+ .chain(self.inner.access_to.iter().map(|a| a.account_id))
+ }
+
+ pub fn all_ids_by_collection(&self, collection: Collection) -> impl Iterator
- {
+ [self.inner.account_id]
+ .into_iter()
+ .chain(self.inner.member_of.iter().copied())
+ .chain(self.inner.access_to.iter().filter_map(move |a| {
+ if a.collections.contains(collection) {
+ Some(a.account_id)
+ } else {
+ None
+ }
+ }))
+ }
+
+ pub fn is_member(&self, account_id: u32) -> bool {
+ self.inner.account_id == account_id
+ || self.inner.member_of.contains(&account_id)
+ || self.has_permission(Permission::Impersonate)
+ }
+
+ pub fn is_account_id(&self, account_id: u32) -> bool {
+ self.inner.account_id == account_id
+ }
+
+ pub fn personal_id(&self, account_id: u32, collection: Collection) -> u32 {
+ let child_collection = collection.child_collection();
+ if self.is_account_id(account_id)
+ || self.inner.member_of.contains(&account_id)
+ || self.inner.access_to.iter().any(|a| {
+ a.account_id == account_id
+ && (a.collections.contains(collection)
+ || child_collection.is_some_and(|child| a.collections.contains(child)))
+ })
+ {
+ self.inner.account_id
+ } else {
+ account_id
+ }
+ }
+
+ #[inline(always)]
+ pub fn has_permission(&self, permission: Permission) -> bool {
+ self.inner
+ .scopes
+ .get(self.scope_idx)
+ .is_some_and(|scope| scope.permissions.get(permission as usize))
+ }
+
+ pub fn assert_is_valid(self, remote_ip: IpAddr) -> trc::Result {
+ if let Some(scope) = self.inner.scopes.get(self.scope_idx) {
+ let has_expired = scope.expires_at <= now();
+ let is_valid_ip = scope.allowed_ips.is_empty()
+ || scope
+ .allowed_ips
+ .iter()
+ .any(|ip_mask| ip_mask.matches(&remote_ip));
+
+ let mut access_token = self;
+ if has_expired {
+ if access_token.scope_idx > 0 {
+ return Err(trc::AuthEvent::CredentialExpired
+ .into_err()
+ .ctx(trc::Key::AccountId, access_token.inner.account_id)
+ .reason("Credential expired."));
+ } else {
+ trc::event!(
+ Auth(trc::AuthEvent::CredentialExpired),
+ AccountId = access_token.inner.account_id,
+ Reason = "Main credential expired, downgrading permissions.",
+ );
+ }
+
+ // Downgrade permissions to allow password change
+ let mut scopes = Vec::with_capacity(access_token.inner.scopes.len());
+ for (idx, scope) in access_token.inner.scopes.iter().enumerate() {
+ if idx == 0 {
+ let mut permissions = Permissions::new();
+
+ for permission in [
+ Permission::Authenticate,
+ Permission::AuthenticateWithAlias,
+ Permission::SysAccountPasswordGet,
+ Permission::SysAccountPasswordUpdate,
+ Permission::EmailReceive,
+ ] {
+ if scope.permissions.get(permission as usize) {
+ permissions.set(permission as usize);
+ }
+ }
+
+ scopes.push(AccessScope {
+ permissions,
+ credential_id: scope.credential_id,
+ expires_at: u64::MAX,
+ allowed_ips: scope.allowed_ips.clone(),
+ });
+ } else {
+ scopes.push(scope.clone());
+ }
+ }
+ let old_inner = &access_token.inner;
+ let inner = AccessTokenInner {
+ scopes: scopes.into_boxed_slice(),
+ account_id: old_inner.account_id,
+ tenant_id: old_inner.tenant_id,
+ member_of: old_inner.member_of.clone(),
+ access_to: old_inner.access_to.clone(),
+ concurrent_http_requests: old_inner.concurrent_http_requests.clone(),
+ concurrent_imap_requests: old_inner.concurrent_imap_requests.clone(),
+ concurrent_uploads: old_inner.concurrent_uploads.clone(),
+ revision_account: old_inner.revision_account,
+ revision: old_inner.revision,
+ credential_version: old_inner.credential_version,
+ obj_size: old_inner.obj_size,
+ };
+
+ access_token = AccessToken {
+ scope_idx: access_token.scope_idx,
+ inner: Arc::new(inner),
+ };
+ }
+
+ if is_valid_ip {
+ Ok(access_token)
+ } else {
+ Err(trc::SecurityEvent::IpUnauthorized
+ .into_err()
+ .ctx(trc::Key::AccountId, access_token.inner.account_id)
+ .reason("IP address not allowed."))
+ }
+ } else {
+ Err(trc::SecurityEvent::Unauthorized
+ .into_err()
+ .ctx(trc::Key::AccountId, self.inner.account_id)
+ .reason("Credential not valid."))
+ }
+ }
+
+ #[inline(always)]
+ pub fn credential_id(&self) -> Option {
+ self.inner
+ .scopes
+ .get(self.scope_idx)
+ .map(|scope| scope.credential_id)
+ }
+
+ #[inline(always)]
+ pub fn revision(&self) -> u64 {
+ self.inner.revision
+ }
+
+ pub fn assert_has_permissions(self, permissions: &[Permission]) -> trc::Result {
+ for permission in permissions {
+ if !self.has_permission(*permission) {
+ return Err(trc::SecurityEvent::Unauthorized
+ .into_err()
+ .details(permission.as_str())
+ .account_id(self.account_id()));
+ }
+ }
+
+ Ok(self)
+ }
+
+ pub fn assert_has_permission(self, permission: Permission) -> trc::Result {
+ if self.has_permission(permission) {
+ Ok(self)
+ } else {
+ Err(trc::SecurityEvent::Unauthorized
+ .into_err()
+ .details(permission.as_str())
+ .account_id(self.account_id()))
+ }
+ }
+
+ pub fn enforce_permission(&self, permission: Permission) -> trc::Result<()> {
+ if self.has_permission(permission) {
+ Ok(())
+ } else {
+ Err(trc::SecurityEvent::Unauthorized
+ .into_err()
+ .details(permission.as_str())
+ .account_id(self.account_id()))
+ }
+ }
+
+ pub fn permissions(&self) -> Vec {
+ if let Some(scope) = self.inner.scopes.get(self.scope_idx) {
+ scope.permissions.build_permissions_list()
+ } else {
+ vec![]
+ }
+ }
+
+ #[inline(always)]
+ pub fn access_scope(&self) -> Option<&AccessScope> {
+ self.inner.scopes.get(self.scope_idx)
+ }
+
+ pub(crate) fn permissions_bits(&self) -> &Permissions {
+ &self
+ .inner
+ .scopes
+ .get(self.scope_idx)
+ .unwrap_or(&self.inner.scopes[0])
+ .permissions
+ }
+
+ pub fn account_permissions(&self) -> &Permissions {
+ &self.inner.scopes[0].permissions
+ }
+
+ pub fn is_shared(&self, account_id: u32) -> bool {
+ !self.is_member(account_id)
+ && self
+ .inner
+ .access_to
+ .iter()
+ .any(|a| a.account_id == account_id)
+ }
+
+ pub fn shared_accounts(&self, collection: Collection) -> impl Iterator
- {
+ self.inner
+ .member_of
+ .iter()
+ .chain(self.inner.access_to.iter().filter_map(move |a| {
+ if a.collections.contains(collection) {
+ Some(&a.account_id)
+ } else {
+ None
+ }
+ }))
+ }
+
+ pub fn has_access(&self, to_account_id: u32, to_collection: impl Into) -> bool {
+ let to_collection = to_collection.into();
+ self.is_member(to_account_id)
+ || self
+ .inner
+ .access_to
+ .iter()
+ .any(|a| a.account_id == to_account_id && a.collections.contains(to_collection))
+ }
+
+ pub fn has_account_access(&self, to_account_id: u32) -> bool {
+ self.is_member(to_account_id)
+ || self
+ .inner
+ .access_to
+ .iter()
+ .any(|a| a.account_id == to_account_id)
+ }
+
+ pub fn is_http_request_allowed(&self) -> LimiterResult {
+ self.inner
+ .concurrent_http_requests
+ .as_ref()
+ .map_or(LimiterResult::Disabled, |limiter| limiter.is_allowed())
+ }
+
+ pub fn concurrent_http_requests(&self) -> u64 {
+ self.inner
+ .concurrent_http_requests
+ .as_ref()
+ .map(|limiter| limiter.max_concurrent())
+ .unwrap_or(0)
+ }
+
+ pub fn is_imap_request_allowed(&self) -> LimiterResult {
+ self.inner
+ .concurrent_imap_requests
+ .as_ref()
+ .map_or(LimiterResult::Disabled, |limiter| limiter.is_allowed())
+ }
+
+ pub fn is_upload_allowed(&self) -> LimiterResult {
+ self.inner
+ .concurrent_uploads
+ .as_ref()
+ .map_or(LimiterResult::Disabled, |limiter| limiter.is_allowed())
+ }
+
+ pub fn concurrent_uploads(&self) -> u64 {
+ self.inner
+ .concurrent_uploads
+ .as_ref()
+ .map(|limiter| limiter.max_concurrent())
+ .unwrap_or(0)
+ }
+
+ pub fn account_tenant_ids(&self) -> AccountTenantIds {
+ AccountTenantIds {
+ account_id: self.account_id(),
+ tenant_id: self.tenant_id(),
+ }
+ }
+
+ pub fn new_admin() -> AccessToken {
+ AccessToken {
+ scope_idx: 0,
+ inner: Arc::new(AccessTokenInner::new_admin()),
+ }
+ }
+
+ pub fn from_permissions(
+ account_id: u32,
+ set_permissions: impl IntoIterator
- ,
+ ) -> AccessToken {
+ let mut permissions = Permissions::new();
+ for permission in set_permissions {
+ permissions.set(permission as usize);
+ }
+ AccessToken {
+ scope_idx: 0,
+ inner: Arc::new(AccessTokenInner {
+ account_id,
+ tenant_id: Default::default(),
+ member_of: Default::default(),
+ access_to: Default::default(),
+ scopes: Box::new([AccessScope::new(permissions, u32::MAX)]),
+ concurrent_http_requests: Default::default(),
+ concurrent_imap_requests: Default::default(),
+ concurrent_uploads: Default::default(),
+ revision: Default::default(),
+ revision_account: Default::default(),
+ credential_version: Default::default(),
+ obj_size: Default::default(),
+ }),
+ }
+ }
+
+ pub fn from_id_maybe_invalid(account_id: u32) -> Self {
+ AccessToken::new_maybe_invalid(Arc::new(AccessTokenInner::from_id(account_id)))
+ }
+}
+
+impl AccessTokenInner {
+ pub fn from_id(account_id: u32) -> Self {
+ Self {
+ account_id,
+ ..Default::default()
+ }
+ }
+
+ pub fn with_tenant_id(mut self, tenant_id: Option) -> Self {
+ self.tenant_id = tenant_id;
+ self
+ }
+
+ pub fn update_size(mut self) -> Self {
+ self.obj_size = (std::mem::size_of::()
+ + (self.member_of.len() * std::mem::size_of::())
+ + (self.access_to.len() * (std::mem::size_of::() + std::mem::size_of::()))
+ + (self.scopes.len() * std::mem::size_of::()))
+ as u64;
+ self
+ }
+
+ pub fn new_admin() -> Self {
+ AccessTokenInner {
+ account_id: RECOVERY_ADMIN_ID,
+ tenant_id: Default::default(),
+ member_of: Default::default(),
+ access_to: Default::default(),
+ scopes: Box::new([AccessScope::new(Permissions::all(), u32::MAX)]),
+ concurrent_http_requests: Default::default(),
+ concurrent_imap_requests: Default::default(),
+ concurrent_uploads: Default::default(),
+ revision: Default::default(),
+ revision_account: Default::default(),
+ credential_version: Default::default(),
+ obj_size: Default::default(),
+ }
+ }
+
+ pub fn revision(&self) -> u64 {
+ self.revision
+ }
+
+ pub fn revision_account(&self) -> u64 {
+ self.revision_account
+ }
+
+ pub fn credential_version(&self) -> u64 {
+ self.credential_version
+ }
+}
+
+impl AccessScope {
+ pub fn new(permissions: Permissions, credential_id: u32) -> Self {
+ Self {
+ permissions,
+ credential_id,
+ expires_at: u64::MAX,
+ allowed_ips: Default::default(),
+ }
+ }
+}
+
+fn hash_account(account: &Account) -> u64 {
+ let mut s = AHasher::default();
+
+ match account {
+ Account::User(account) => {
+ account.member_tenant_id.hash(&mut s);
+ match &account.roles {
+ UserRoles::User => {
+ 0u8.hash(&mut s);
+ }
+ UserRoles::Admin => {
+ 1u8.hash(&mut s);
+ }
+ UserRoles::Custom(custom_roles) => {
+ 2u8.hash(&mut s);
+ custom_roles.role_ids.as_slice().hash(&mut s);
+ }
+ }
+ hash_permissions(&mut s, &account.permissions);
+ for credential in account
+ .credentials
+ .iter()
+ .filter_map(|credential| credential.as_secondary_credential())
+ {
+ credential.credential_id.hash(&mut s);
+ credential.expires_at.hash(&mut s);
+ hash_credential_permissions(&mut s, &credential.permissions);
+ }
+ for group_id in account.member_group_ids.iter() {
+ group_id.hash(&mut s);
+ }
+ }
+ Account::Group(account) => {
+ account.member_tenant_id.hash(&mut s);
+ match &account.roles {
+ Roles::Default => {}
+ Roles::Custom(custom_roles) => {
+ custom_roles.role_ids.as_slice().hash(&mut s);
+ }
+ }
+ hash_permissions(&mut s, &account.permissions);
+ }
+ }
+
+ s.finish()
+}
+
+fn hash_permissions(hasher: &mut AHasher, permissions: &structs::Permissions) {
+ match permissions {
+ structs::Permissions::Inherit => {
+ 0u8.hash(hasher);
+ }
+ structs::Permissions::Merge(permissions) => {
+ 2u8.hash(hasher);
+ permissions.enabled_permissions.as_slice().hash(hasher);
+ permissions.disabled_permissions.as_slice().hash(hasher);
+ }
+ structs::Permissions::Replace(permissions) => {
+ 3u8.hash(hasher);
+ permissions.enabled_permissions.as_slice().hash(hasher);
+ permissions.disabled_permissions.as_slice().hash(hasher);
+ }
+ }
+}
+
+fn hash_credential_permissions(hasher: &mut AHasher, permissions: &structs::CredentialPermissions) {
+ match permissions {
+ structs::CredentialPermissions::Inherit => {
+ 0u8.hash(hasher);
+ }
+ structs::CredentialPermissions::Disable(permissions) => {
+ 2u8.hash(hasher);
+ permissions.permissions.as_slice().hash(hasher);
+ }
+ structs::CredentialPermissions::Replace(permissions) => {
+ 3u8.hash(hasher);
+ permissions.permissions.as_slice().hash(hasher);
+ }
+ }
+}
diff --git a/crates/common/src/auth/authentication.rs b/crates/common/src/auth/authentication.rs
new file mode 100644
index 0000000..d24568c
--- /dev/null
+++ b/crates/common/src/auth/authentication.rs
@@ -0,0 +1,644 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use crate::{
+ Server,
+ auth::{
+ AccessToken, AuthRequest, DomainCache,
+ credential::{ApiKey, AppPassword},
+ oauth::GrantType,
+ },
+};
+use base64::{Engine, engine::general_purpose};
+use directory::{
+ Credentials, Directory, Recipient,
+ core::secret::{SecretVerificationResult, verify_mfa_secret_hash, verify_secret_hash},
+};
+use registry::schema::{
+ enums::Permission,
+ structs::{self, Credential},
+};
+use std::{net::IpAddr, sync::Arc};
+use store::write::now;
+use trc::AddContext;
+
+pub struct UsernameParts {
+ pub account: Username,
+ pub master_user: Option,
+}
+
+#[derive(PartialEq, Eq)]
+pub struct Username {
+ pub name: String,
+ pub domain_start: usize,
+}
+
+impl Server {
+ pub async fn authenticate(&self, req: &AuthRequest) -> trc::Result {
+ match Box::pin(self.route_auth_request(req))
+ .await
+ .and_then(|token| token.assert_has_permission(Permission::Authenticate))
+ {
+ Ok(token) => Ok(token),
+ Err(err) => {
+ // Random delay to mitigate user enumeration attacks
+ #[cfg(not(feature = "test_mode"))]
+ {
+ use store::rand::{self, RngExt};
+
+ let delay = rand::rng().random_range(50..500);
+ tokio::time::sleep(std::time::Duration::from_millis(delay)).await;
+ }
+
+ if matches!(
+ err.as_ref(),
+ trc::EventType::Auth(trc::AuthEvent::Failed)
+ | trc::EventType::Security(trc::SecurityEvent::IpUnauthorized)
+ ) && self.has_auth_fail2ban()
+ && self
+ .is_auth_fail2banned(req.remote_ip, req.username())
+ .await?
+ {
+ Err(trc::SecurityEvent::AuthenticationBan
+ .into_err()
+ .ctx(trc::Key::RemoteIp, req.remote_ip)
+ .ctx_opt(trc::Key::AccountName, req.username().map(|s| s.to_string())))
+ } else {
+ Err(err.ctx(trc::Key::RemoteIp, req.remote_ip))
+ }
+ }
+ }
+ }
+
+ async fn route_auth_request(&self, req: &AuthRequest) -> trc::Result {
+ match &req.credentials {
+ Credentials::Basic {
+ username,
+ secret,
+ mfa_token,
+ } => {
+ let mut username = UsernameParts::new(username);
+
+ // Try to authenticate as fallback admin if configured
+ if let Some((fallback_user, fallback_hash)) = &self.registry().recovery_admin()
+ && username.auth_as().address() == fallback_user
+ {
+ return if verify_secret_hash(fallback_hash, secret.as_bytes()).await? {
+ if username.is_master() {
+ let address = username.account().address();
+ if let Some(account_id) =
+ self.impersonated_account_id(username.account()).await?
+ {
+ trc::event!(
+ Auth(trc::AuthEvent::Success),
+ AccountName = address.to_string(),
+ AccountId = account_id,
+ SpanId = req.session_id,
+ Details = fallback_user.to_string(),
+ );
+
+ self.access_token(account_id)
+ .await
+ .and_then(|token| AccessToken::new(token, req.remote_ip))
+ } else {
+ Err(trc::AuthEvent::Failed
+ .into_err()
+ .ctx(trc::Key::AccountName, address.to_string())
+ .reason("Master user account not found for fallback admin authentication"))
+ }
+ } else {
+ trc::event!(
+ Auth(trc::AuthEvent::Success),
+ AccountName = fallback_user.to_string(),
+ SpanId = req.session_id,
+ );
+
+ Ok(AccessToken::new_admin())
+ }
+ } else {
+ Err(trc::AuthEvent::Failed
+ .into_err()
+ .ctx(trc::Key::AccountName, fallback_user.to_string())
+ .ctx(trc::Key::SpanId, req.session_id)
+ .reason("Fallback admin authentication failed"))
+ };
+ }
+
+ // Add domain if missing, use the default domain
+ self.add_missing_domain(&mut username.account);
+ if let Some(master_user) = &mut username.master_user {
+ self.add_missing_domain(master_user);
+ }
+
+ // Obtain domain
+ let auth_as = username.auth_as();
+ let auth_as_address = auth_as.address();
+ let auth_as_local = auth_as.local();
+ let auth_as_domain = auth_as.domain().unwrap();
+ let domain = self.resolve_domain(auth_as_domain).await?;
+
+ // Authenticate app passwords
+ if let Some(app_pass) = AppPassword::parse(secret) {
+ if username.is_master() {
+ return Err(trc::AuthEvent::Failed
+ .into_err()
+ .ctx(trc::Key::AccountName, auth_as_address.to_string())
+ .ctx(trc::Key::SpanId, req.session_id)
+ .reason("App passwords cannot be used for impersonation"));
+ }
+ return if let Some(account_id) =
+ self.account_id_from_parts(auth_as_local, domain.id).await?
+ {
+ self.validate_credential(
+ account_id,
+ app_pass.credential_id,
+ app_pass.secret.as_ref(),
+ req.remote_ip,
+ req.session_id,
+ )
+ .await
+ } else {
+ Err(trc::AuthEvent::Failed
+ .into_err()
+ .ctx(trc::Key::AccountName, auth_as_address.to_string())
+ .reason("App password authentication failed: account not found"))
+ };
+ }
+
+ // Obtain external directory, if any
+ let mut is_alias_login = false;
+ let token = if let Some(directory) = self.get_directory_for_cached_domain(&domain) {
+ let directory_account = if username.is_master() {
+ directory
+ .authenticate(&Credentials::Basic {
+ username: auth_as_address.to_string(),
+ secret: secret.clone(),
+ mfa_token: mfa_token.clone(),
+ })
+ .await?
+ } else {
+ directory.authenticate(&req.credentials).await?
+ };
+
+ is_alias_login = directory_account.email != auth_as_address;
+ self.build_directory_token(directory_account, req.remote_ip)
+ .await
+ } else if let Some(account_id) =
+ self.account_id_from_parts(auth_as_local, domain.id).await?
+ {
+ if let Some(account) = self
+ .registry()
+ .object::(account_id.into())
+ .await?
+ .and_then(|account| account.into_user())
+ {
+ let Some(credential) = account.password_credential() else {
+ return Err(trc::AuthEvent::Failed
+ .into_err()
+ .ctx(trc::Key::AccountName, auth_as_address.to_string())
+ .ctx(trc::Key::AccountId, account_id)
+ .ctx(trc::Key::SpanId, req.session_id)
+ .reason("Password credential not found for account"));
+ };
+
+ match verify_mfa_secret_hash(
+ credential.otp_auth.as_deref(),
+ mfa_token.as_deref(),
+ credential.secret.as_str(),
+ secret,
+ )
+ .await?
+ {
+ SecretVerificationResult::Valid => {
+ is_alias_login = account.name != auth_as_local;
+ self.access_token(account_id)
+ .await
+ .and_then(|token| AccessToken::new(token, req.remote_ip))
+ }
+ SecretVerificationResult::Invalid => Err(trc::AuthEvent::Failed
+ .into_err()
+ .ctx(trc::Key::AccountName, auth_as_address.to_string())
+ .ctx(trc::Key::AccountId, account_id)
+ .ctx(trc::Key::SpanId, req.session_id)
+ .reason("Authentication failed")),
+ SecretVerificationResult::MissingMfaToken => {
+ Err(trc::AuthEvent::MfaRequired
+ .into_err()
+ .ctx(trc::Key::AccountName, auth_as_address.to_string())
+ .ctx(trc::Key::AccountId, account_id)
+ .ctx(trc::Key::SpanId, req.session_id)
+ .reason("MFA token required"))
+ }
+ }
+ } else {
+ Err(trc::AuthEvent::Error
+ .into_err()
+ .ctx(trc::Key::AccountName, auth_as_address.to_string())
+ .ctx(trc::Key::AccountId, account_id)
+ .reason("Account not found in registry"))
+ }
+ } else {
+ Err(trc::AuthEvent::Failed
+ .into_err()
+ .ctx(trc::Key::AccountName, auth_as_address.to_string())
+ .reason("Account not found"))
+ }?;
+
+ // Enforce alias login restrictions
+ if is_alias_login && !token.has_permission(Permission::AuthenticateWithAlias) {
+ return Err(trc::AuthEvent::Failed
+ .into_err()
+ .ctx(trc::Key::AccountName, auth_as_address.to_string())
+ .ctx(trc::Key::AccountId, token.account_id())
+ .ctx(trc::Key::SpanId, req.session_id)
+ .reason("Authenticated using an email alias but account does not have AuthenticateAlias permission"));
+ }
+
+ // Validate master user access
+ if username.is_master() {
+ token.assert_has_permissions(&[
+ Permission::Impersonate,
+ Permission::Authenticate,
+ ])?;
+ let address = username.account().address();
+ let master_address = auth_as_address;
+ if let Some(account_id) =
+ self.impersonated_account_id(username.account()).await?
+ {
+ trc::event!(
+ Auth(trc::AuthEvent::Success),
+ AccountName = address.to_string(),
+ AccountId = account_id,
+ SpanId = req.session_id,
+ Details = master_address.to_string(),
+ );
+
+ self.access_token(account_id)
+ .await
+ .map(AccessToken::new_maybe_invalid)
+ } else {
+ Err(trc::AuthEvent::Failed
+ .into_err()
+ .ctx(trc::Key::AccountName, address.to_string())
+ .details(master_address.to_string())
+ .reason("Master user account not found"))
+ }
+ } else {
+ trc::event!(
+ Auth(trc::AuthEvent::Success),
+ AccountName = auth_as_address.to_string(),
+ AccountId = token.account_id(),
+ SpanId = req.session_id,
+ );
+
+ Ok(token)
+ }
+ }
+ Credentials::Bearer { username, token } => {
+ // Handle API key authentication
+ if let Some(key) = ApiKey::parse(token) {
+ return self
+ .validate_credential(
+ key.account_id,
+ key.credential_id,
+ key.secret.as_ref(),
+ req.remote_ip,
+ req.session_id,
+ )
+ .await;
+ }
+
+ #[cfg(feature = "dev_mode")]
+ if std::env::var("API_TOKEN_ADMIN").is_ok_and(|admin_token| &admin_token == token) {
+ return Ok(AccessToken::new_admin());
+ }
+
+ // Obtain external directory, if any. When no username is supplied
+ // (e.g. HTTP bearer auth), peek at the JWT claims to find the
+ // user's domain so per-domain OIDC directories are reachable.
+ let directory = if let Some(username) = username.as_deref().map(UsernameParts::new)
+ {
+ if let Some(domain_name) = username.auth_as().domain() {
+ self.get_directory_for_domain(domain_name).await?
+ } else if let Some(domain_name) = extract_jwt_domain(token) {
+ self.get_directory_for_domain(&domain_name).await?
+ } else {
+ self.get_default_directory()
+ }
+ } else if let Some(domain_name) = extract_jwt_domain(token) {
+ self.get_directory_for_domain(&domain_name).await?
+ } else {
+ self.get_default_directory()
+ };
+
+ // Try external directory authentication first if supported, then fallback to internal OAuth.
+ let mut external_error = None;
+ if let Some(directory) = directory
+ && directory.has_bearer_token_support()
+ {
+ match directory.authenticate(&req.credentials).await {
+ Ok(result) => {
+ return self.build_directory_token(result, req.remote_ip).await;
+ }
+ Err(err) => {
+ external_error = Some(err);
+ }
+ }
+ }
+
+ // Internal OAuth
+ match self
+ .validate_access_token(GrantType::AccessToken.into(), token)
+ .await
+ {
+ Ok(token_info) => self
+ .access_token(token_info.account_id)
+ .await
+ .and_then(|token| AccessToken::new(token, req.remote_ip)),
+ Err(err) => {
+ if let Some(external_error) = external_error {
+ Err(external_error)
+ } else {
+ Err(err)
+ }
+ }
+ }
+ }
+ }
+ }
+
+ async fn impersonated_account_id(&self, username: &Username) -> trc::Result> {
+ let address = username.address();
+
+ if let Some(account_id) = self.account_id_from_email(address, false).await? {
+ return Ok(Some(account_id));
+ }
+
+ if let Some(domain) = username.domain()
+ && let Some(domain_cache) = self.domain(domain).await?
+ && let Some(directory) = self.get_directory_for_cached_domain(&domain_cache)
+ && let Recipient::Account(account) = directory.recipient(address).await?
+ {
+ return Ok(Some(Box::pin(self.synchronize_account(account)).await?.id));
+ }
+
+ Ok(None)
+ }
+
+ async fn validate_credential(
+ &self,
+ account_id: u32,
+ credential_id: u32,
+ secret: &[u8],
+ remote_ip: IpAddr,
+ span_id: u64,
+ ) -> trc::Result {
+ if let Some(account) = self
+ .registry()
+ .object::(account_id.into())
+ .await?
+ .and_then(|account| account.into_user())
+ {
+ // Find credential by credential_id
+ let mut authenticated = false;
+ for (credential, credential_type) in
+ account.credentials.iter().filter_map(|credential| {
+ credential
+ .as_secondary_credential()
+ .map(|secondary_credential| (secondary_credential, credential))
+ })
+ {
+ if credential.credential_id.document_id() == credential_id {
+ if !verify_secret_hash(&credential.secret, secret).await? {
+ return Err(trc::AuthEvent::Failed
+ .into_err()
+ .ctx(trc::Key::AccountName, account.name)
+ .ctx(trc::Key::AccountId, account_id)
+ .ctx(trc::Key::Id, credential_id)
+ .ctx(trc::Key::SpanId, span_id)
+ .reason("Invalid credential secret"));
+ }
+
+ if credential
+ .expires_at
+ .as_ref()
+ .is_some_and(|exp| exp.timestamp() < now() as i64)
+ {
+ return Err(trc::AuthEvent::CredentialExpired
+ .into_err()
+ .ctx(trc::Key::AccountName, account.name)
+ .ctx(trc::Key::AccountId, account_id)
+ .ctx(trc::Key::Id, credential_id)
+ .ctx(trc::Key::SpanId, span_id)
+ .reason("Credential has expired"));
+ }
+
+ trc::event!(
+ Auth(trc::AuthEvent::Success),
+ AccountName = account.name.clone(),
+ AccountId = account_id,
+ Id = credential_id,
+ SpanId = span_id,
+ Details = match credential_type {
+ Credential::AppPassword(_) => "Authenticated with app password",
+ Credential::ApiKey(_) => "Authenticated with API key",
+ _ => "Authenticated with credential",
+ }
+ );
+
+ authenticated = true;
+ break;
+ }
+ }
+
+ if authenticated {
+ let token = self
+ .access_token_from_account(account_id, structs::Account::User(account))
+ .await?;
+
+ AccessToken::new_scoped(token, credential_id, remote_ip)
+ .add_context(|ctx| ctx.span_id(span_id))
+ } else {
+ Err(trc::AuthEvent::Failed
+ .into_err()
+ .ctx(trc::Key::AccountId, account_id)
+ .ctx(trc::Key::Id, credential_id)
+ .ctx(trc::Key::SpanId, span_id)
+ .reason("Credential not found for account"))
+ }
+ } else {
+ Err(trc::AuthEvent::Failed
+ .into_err()
+ .ctx(trc::Key::AccountId, account_id)
+ .ctx(trc::Key::SpanId, span_id)
+ .reason("Account not found for credential"))
+ }
+ }
+
+ async fn resolve_domain(&self, domain_name: &str) -> trc::Result> {
+ if let Some(domain) = self.domain(domain_name).await? {
+ Ok(domain)
+ } else {
+ Err(trc::AuthEvent::Failed
+ .into_err()
+ .ctx(trc::Key::Details, domain_name.to_string())
+ .reason("Domain not found"))
+ }
+ }
+
+ fn add_missing_domain(&self, address: &mut Username) {
+ if address.domain().is_none() {
+ trc::event!(
+ Auth(trc::AuthEvent::Warning),
+ AccountName = address.address().to_string(),
+ Reason = "No domain in username",
+ );
+ address.domain_start = address.name.len() + 1;
+ address.name = format!("{}@{}", address.name, self.core.email.default_domain_name);
+ }
+ }
+
+ async fn build_directory_token(
+ &self,
+ account: directory::Account,
+ remote_ip: IpAddr,
+ ) -> trc::Result {
+ let account = Box::pin(self.synchronize_account(account)).await?;
+ self.access_token_from_account(account.id, account.account)
+ .await
+ .and_then(|token| AccessToken::new(token, remote_ip))
+ }
+
+ pub async fn get_directory_for_domain(
+ &self,
+ domain_name: &str,
+ ) -> trc::Result>> {
+
+ Ok(self.get_default_directory())
+ }
+
+ pub fn get_directory_for_cached_domain(&self, domain: &DomainCache) -> Option<&Arc> {
+
+ self.get_default_directory()
+ }
+}
+
+fn extract_jwt_domain(token: &str) -> Option {
+ let mut parts = token.split('.');
+ let _header = parts.next()?;
+ let payload = parts.next()?;
+ let _signature = parts.next()?;
+ if parts.next().is_some() {
+ return None;
+ }
+ let payload_bytes = general_purpose::URL_SAFE_NO_PAD.decode(payload).ok()?;
+ let claims: serde_json::Value = serde_json::from_slice(&payload_bytes).ok()?;
+ for claim in ["email", "preferred_username", "upn"] {
+ if let Some(val) = claims.get(claim).and_then(|v| v.as_str())
+ && let Some((_, domain)) = val.rsplit_once('@')
+ && !domain.is_empty()
+ {
+ return Some(domain.to_ascii_lowercase());
+ }
+ }
+ None
+}
+
+impl UsernameParts {
+ pub fn new(address: &str) -> Self {
+ let mut account = Username {
+ name: String::with_capacity(address.len()),
+ domain_start: usize::MAX,
+ };
+ let mut master_user = None;
+
+ for ch in address.chars() {
+ if ch == '%' {
+ master_user = Some(Username {
+ name: String::with_capacity(address.len()),
+ domain_start: usize::MAX,
+ });
+ } else {
+ let target = master_user.as_mut().unwrap_or(&mut account);
+ if ch != '@' {
+ for lower in ch.to_lowercase() {
+ target.name.push(lower);
+ }
+ } else {
+ target.name.push(ch);
+ target.domain_start = target.name.len();
+ }
+ }
+ }
+
+ UsernameParts {
+ master_user: master_user.filter(|u| u != &account),
+ account,
+ }
+ }
+
+ pub fn auth_as(&self) -> &Username {
+ self.master_user.as_ref().unwrap_or(&self.account)
+ }
+
+ pub fn account(&self) -> &Username {
+ &self.account
+ }
+
+ pub fn is_master(&self) -> bool {
+ self.master_user.is_some()
+ }
+}
+
+impl Username {
+ pub fn address(&self) -> &str {
+ self.name.as_str()
+ }
+
+ pub fn local(&self) -> &str {
+ self.name
+ .get(..self.domain_start.saturating_sub(1))
+ .unwrap_or_default()
+ }
+
+ pub fn domain(&self) -> Option<&str> {
+ self.name.get(self.domain_start..)
+ }
+}
+
+impl AuthRequest {
+ pub fn from_credentials(credentials: Credentials, session_id: u64, remote_ip: IpAddr) -> Self {
+ Self {
+ credentials,
+ session_id,
+ remote_ip,
+ }
+ }
+
+ pub fn from_plain(
+ user: impl Into,
+ pass: impl Into,
+ session_id: u64,
+ remote_ip: IpAddr,
+ ) -> Self {
+ Self::from_credentials(
+ Credentials::Basic {
+ username: user.into(),
+ secret: pass.into(),
+ mfa_token: None,
+ },
+ session_id,
+ remote_ip,
+ )
+ }
+
+ pub fn username(&self) -> Option<&str> {
+ match &self.credentials {
+ Credentials::Basic { username, .. } => Some(username.as_str()),
+ Credentials::Bearer { username, .. } => username.as_deref(),
+ }
+ }
+}
diff --git a/crates/common/src/auth/credential.rs b/crates/common/src/auth/credential.rs
new file mode 100644
index 0000000..33123f4
--- /dev/null
+++ b/crates/common/src/auth/credential.rs
@@ -0,0 +1,93 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
+use std::io::Write;
+use store::{
+ U32_LEN,
+ rand::{self},
+};
+use utils::codec::base32_custom::{Base32Reader, Base32Writer};
+
+pub struct ApiKey {
+ pub account_id: u32,
+ pub credential_id: u32,
+ pub secret: [u8; 20],
+}
+
+pub struct AppPassword {
+ pub credential_id: u32,
+ pub secret: [u8; 18],
+}
+
+impl ApiKey {
+ pub fn new(account_id: u32, credential_id: u32) -> Self {
+ ApiKey {
+ account_id,
+ credential_id,
+ secret: rand::random::<[u8; 20]>(),
+ }
+ }
+
+ pub fn parse(token: &str) -> Option {
+ let decoded = URL_SAFE_NO_PAD.decode(token.strip_prefix("API_")?).ok()?;
+
+ Some(ApiKey {
+ account_id: u32::from_be_bytes(decoded.get(0..U32_LEN)?.try_into().ok()?),
+ credential_id: u32::from_be_bytes(decoded.get(U32_LEN..U32_LEN * 2)?.try_into().ok()?),
+ secret: decoded.get(U32_LEN * 2..)?.try_into().ok()?,
+ })
+ }
+
+ pub fn build(&self) -> String {
+ let mut bytes = Vec::with_capacity(U32_LEN * 2 + self.secret.len());
+ bytes.extend_from_slice(&self.account_id.to_be_bytes());
+ bytes.extend_from_slice(&self.credential_id.to_be_bytes());
+ bytes.extend_from_slice(&self.secret);
+ format!("API_{}", URL_SAFE_NO_PAD.encode(bytes))
+ }
+}
+
+impl AppPassword {
+ pub fn new(credential_id: u32) -> Self {
+ AppPassword {
+ credential_id,
+ secret: rand::random::<[u8; 18]>(),
+ }
+ }
+
+ pub fn parse(token: &str) -> Option {
+ let token = token.strip_prefix("app")?;
+ let mut reader = Base32Reader::new(token.as_bytes().get(1..)?);
+ let mut credential_id = [0u8; 4];
+ let mut secret = [0u8; 18];
+
+ for byte in credential_id.iter_mut() {
+ *byte = reader.next()?;
+ }
+
+ for byte in secret.iter_mut() {
+ *byte = reader.next()?;
+ }
+
+ if reader.next().is_none() {
+ Some(AppPassword {
+ credential_id: u32::from_be_bytes(credential_id),
+ secret,
+ })
+ } else {
+ None
+ }
+ }
+
+ pub fn build(&self) -> String {
+ let mut writer = Base32Writer::with_capacity(std::mem::size_of::().div_ceil(5) * 8);
+ writer.push_string("app_");
+ let _ = writer.write(&self.credential_id.to_be_bytes());
+ let _ = writer.write_all(&self.secret);
+ writer.finalize()
+ }
+}
diff --git a/crates/common/src/auth/mod.rs b/crates/common/src/auth/mod.rs
new file mode 100644
index 0000000..c4e9870
--- /dev/null
+++ b/crates/common/src/auth/mod.rs
@@ -0,0 +1,332 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use crate::{
+ expr::if_block::IfBlock,
+ network::limiter::ConcurrencyLimiter,
+ storage::{ObjectQuota, TenantQuota},
+};
+use directory::Credentials;
+use quick_cache::Equivalent;
+use registry::{
+ schema::enums::{Locale, Permission},
+ types::{EnumImpl, ipmask::IpAddrOrMask},
+};
+use std::{
+ hash::{Hash, Hasher},
+ net::IpAddr,
+ sync::Arc,
+};
+use tinyvec::TinyVec;
+use trc::ipc::bitset::Bitset;
+use types::collection::Collection;
+use utils::{cache::CacheItemWeight, map::bitmap::Bitmap};
+
+pub mod access_token;
+pub mod authentication;
+pub mod credential;
+pub mod oauth;
+pub mod permissions;
+pub mod rate_limit;
+
+pub const RECOVERY_ADMIN_ID: u32 = u32::MAX;
+const PERMISSIONS_BITSET_SIZE: usize = Permission::COUNT.div_ceil(std::mem::size_of::());
+pub type Permissions = Bitset;
+
+#[derive(Debug, PartialEq, Eq, Clone)]
+pub struct EmailAddress {
+ pub local_part: Box,
+ pub domain_id: u32,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct EmailAddressRef<'x> {
+ local_part: &'x str,
+ domain_id: u32,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum EmailCache {
+ Account(u32),
+ MailingList(u32),
+ DisabledAccountAddress(u32),
+ DisabledListAddress(u32),
+}
+
+#[derive(Debug, Clone)]
+pub struct DomainCache {
+ pub names: Box<[Box]>,
+ pub id: u32,
+ pub id_directory: Option,
+ pub id_tenant: Option,
+ pub catch_all: Option>,
+ pub sub_addressing_custom: Option>,
+ pub flags: u8,
+}
+
+pub const DOMAIN_FLAG_RELAY: u8 = 1;
+pub const DOMAIN_FLAG_SUB_ADDRESSING: u8 = 1 << 1;
+
+
+#[derive(Debug, Clone, Default)]
+pub struct AccountCache {
+ pub name: Box,
+ pub id: u32,
+ pub addresses: Box<[EmailAddress]>,
+ pub id_tenant: Option,
+ pub id_member_of: TinyVec<[u32; 3]>,
+ pub quota_disk: u64,
+ pub quota_objects: Option>,
+ pub description: Option>,
+ pub encryption_key: Option,
+ pub locale: Locale,
+ pub flags: u64,
+}
+
+pub type EncryptionKeys = Box<[Box<[u8]>]>;
+
+pub const ACCOUNT_IS_USER: u64 = 1;
+pub const ACCOUNT_FLAG_ENCRYPT_TRAIN_SPAM_FILTER: u64 = 1 << 1;
+pub const ACCOUNT_FLAG_ENCRYPT_METHOD_SMIME: u64 = 1 << 2;
+pub const ACCOUNT_FLAG_ENCRYPT_METHOD_PGP: u64 = 1 << 3;
+pub const ACCOUNT_FLAG_ENCRYPT_ALGO_AES256: u64 = 1 << 4;
+pub const ACCOUNT_FLAG_ENCRYPT_ALGO_AES128: u64 = 1 << 5;
+pub const ACCOUNT_FLAG_ENCRYPT_APPEND: u64 = 1 << 6;
+pub const ACCOUNT_FLAG_ENCRYPT_ALGO_AES256_GCM: u64 = 1 << 7;
+pub const ACCOUNT_FLAG_ENCRYPT_ALGO_CHACHA20_POLY1305: u64 = 1 << 8;
+
+#[derive(Debug, Clone)]
+pub struct RoleCache {
+ pub id_roles: TinyVec<[u32; 3]>,
+ pub permissions: PermissionsGroup,
+}
+
+#[derive(Debug, Clone)]
+pub struct MailingListCache {
+ pub addresses: Box<[EmailAddress]>,
+ pub recipients: Arc<[Box]>,
+}
+
+#[derive(Debug, Clone)]
+pub struct TenantCache {
+ pub id_roles: TinyVec<[u32; 3]>,
+ pub quota_disk: u64,
+ pub quota_objects: Option>,
+ pub permissions: Option>,
+}
+
+#[derive(Debug, Clone, Default)]
+pub struct PermissionsGroup {
+ pub enabled: Permissions,
+ pub disabled: Permissions,
+ pub merge: bool,
+}
+
+#[derive(Debug, Default, Clone)]
+pub struct AccessToken {
+ scope_idx: usize,
+ inner: Arc,
+}
+
+#[derive(Debug, Default, Clone)]
+pub struct AccessTokenInner {
+ pub(crate) account_id: u32,
+ pub(crate) tenant_id: Option,
+ pub(crate) member_of: TinyVec<[u32; 3]>,
+ pub(crate) access_to: Box<[AccessTo]>,
+ pub(crate) scopes: Box<[AccessScope]>,
+ pub(crate) concurrent_http_requests: Option,
+ pub(crate) concurrent_imap_requests: Option,
+ pub(crate) concurrent_uploads: Option,
+ pub(crate) revision_account: u64,
+ pub(crate) revision: u64,
+ pub(crate) credential_version: u64,
+ pub(crate) obj_size: u64,
+}
+
+#[derive(Debug, Default, Hash, Clone)]
+pub struct AccessScope {
+ pub permissions: Permissions,
+ pub credential_id: u32,
+ pub expires_at: u64,
+ pub allowed_ips: Box<[IpAddrOrMask]>,
+}
+
+#[derive(Debug, Default, Hash, PartialEq, Eq, Clone)]
+pub(crate) struct AccessTo {
+ pub account_id: u32,
+ pub collections: Bitmap,
+}
+
+#[derive(Clone)]
+pub struct AccountInfo {
+ pub account_id: u32,
+ pub account: Arc,
+ pub addresses: Vec,
+}
+
+#[derive(Clone, Copy)]
+pub struct AccountTenantIds {
+ pub account_id: u32,
+ pub tenant_id: Option,
+}
+
+pub struct AuthRequest {
+ pub credentials: Credentials,
+ pub session_id: u64,
+ pub remote_ip: IpAddr,
+}
+
+impl CacheItemWeight for AccessTokenInner {
+ fn weight(&self) -> u64 {
+ self.obj_size
+ }
+}
+
+impl CacheItemWeight for EmailAddress {
+ fn weight(&self) -> u64 {
+ std::mem::size_of::() as u64 + self.local_part.len() as u64
+ }
+}
+
+impl CacheItemWeight for EmailCache {
+ fn weight(&self) -> u64 {
+ std::mem::size_of::() as u64
+ }
+}
+
+impl CacheItemWeight for DomainCache {
+ fn weight(&self) -> u64 {
+ std::mem::size_of::() as u64
+ + self
+ .names
+ .iter()
+ .map(|s| s.len() as u64 + std::mem::size_of::>() as u64)
+ .sum::()
+ + self.catch_all.as_ref().map_or(0, |s| s.len() as u64)
+ + self
+ .sub_addressing_custom
+ .as_ref()
+ .map_or(0, |s| s.weight())
+ }
+}
+
+impl Equivalent for EmailAddressRef<'_> {
+ fn equivalent(&self, key: &EmailAddress) -> bool {
+ self.local_part == &*key.local_part && self.domain_id == key.domain_id
+ }
+}
+
+impl Hash for EmailAddress {
+ fn hash(&self, state: &mut H) {
+ self.local_part.as_ref().hash(state);
+ self.domain_id.hash(state);
+ }
+}
+
+impl Hash for EmailAddressRef<'_> {
+ fn hash(&self, state: &mut H) {
+ self.local_part.hash(state);
+ self.domain_id.hash(state);
+ }
+}
+
+impl CacheItemWeight for AccountCache {
+ fn weight(&self) -> u64 {
+ std::mem::size_of::() as u64
+ + self.name.len() as u64
+ + self
+ .addresses
+ .iter()
+ .map(|s| s.local_part.len() as u64 + std::mem::size_of::() as u64)
+ .sum::()
+ + self.description.as_ref().map_or(0, |s| s.len() as u64)
+ + self.encryption_key.as_ref().map_or(0, |keys| {
+ keys.iter()
+ .map(|k| k.len() as u64 + std::mem::size_of::>() as u64)
+ .sum::()
+ })
+ }
+}
+
+impl CacheItemWeight for RoleCache {
+ fn weight(&self) -> u64 {
+ std::mem::size_of::() as u64
+ }
+}
+
+impl CacheItemWeight for MailingListCache {
+ fn weight(&self) -> u64 {
+ std::mem::size_of::() as u64
+ + self
+ .addresses
+ .iter()
+ .map(|s| s.local_part.len() as u64 + std::mem::size_of::() as u64)
+ .sum::()
+ + self
+ .recipients
+ .iter()
+ .map(|s| s.len() as u64 + std::mem::size_of::>() as u64)
+ .sum::()
+ }
+}
+
+impl CacheItemWeight for TenantCache {
+ fn weight(&self) -> u64 {
+ std::mem::size_of::() as u64
+ + self.permissions.as_ref().map_or(0, |p| p.weight())
+ }
+}
+
+impl CacheItemWeight for PermissionsGroup {
+ fn weight(&self) -> u64 {
+ std::mem::size_of::() as u64
+ }
+}
+
+pub trait BuildAccessToken {
+ fn build(self) -> AccessToken;
+}
+
+impl BuildAccessToken for Arc {
+ fn build(self) -> AccessToken {
+ AccessToken {
+ scope_idx: 0,
+ inner: self,
+ }
+ }
+}
+
+impl EmailAddress {
+ pub fn new(local_part: impl Into>, domain_id: u32) -> Self {
+ Self {
+ local_part: local_part.into(),
+ domain_id,
+ }
+ }
+}
+
+impl<'x> EmailAddressRef<'x> {
+ pub fn new(local_part: &'x str, domain_id: u32) -> Self {
+ Self {
+ local_part,
+ domain_id,
+ }
+ }
+}
+
+impl AccountCache {
+ pub fn domain_id(&self) -> Option {
+ self.addresses.first().map(|address| address.domain_id)
+ }
+}
+
+impl DomainCache {
+ pub fn name(&self) -> &str {
+ self.names.first().map(|s| s.as_ref()).unwrap_or_default()
+ }
+
+}
diff --git a/crates/common/src/auth/oauth/client_id.rs b/crates/common/src/auth/oauth/client_id.rs
new file mode 100644
index 0000000..525fab3
--- /dev/null
+++ b/crates/common/src/auth/oauth/client_id.rs
@@ -0,0 +1,225 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use super::{
+ SCOPE_CALENDARS, SCOPE_CONTACTS, SCOPE_MAIL, SCOPE_OFFLINE_ACCESS, SCOPE_OPENID,
+ crypto::SymmetricEncrypt,
+};
+use base64::{Engine, engine::general_purpose};
+use store::blake3;
+use utils::codec::leb128::{Leb128Iterator, Leb128Vec};
+
+const CLIENT_ID_HEADER: &str = "swc1.";
+const CLIENT_ID_KEY_CONTEXT: &str = "stalwart-oauth-client-id-sw1";
+const CLIENT_ID_VERSION: u8 = 1;
+
+const SCOPE_BITS: &[&str] = &[
+ SCOPE_OPENID,
+ SCOPE_OFFLINE_ACCESS,
+ SCOPE_MAIL,
+ SCOPE_CONTACTS,
+ SCOPE_CALENDARS,
+];
+
+pub fn scopes_to_mask(scope: &str) -> u64 {
+ let mut mask = 0u64;
+ for scope in scope.split_ascii_whitespace() {
+ if let Some(bit) = SCOPE_BITS.iter().position(|known| *known == scope) {
+ mask |= 1 << bit;
+ }
+ }
+ mask
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct ClientMeta {
+ pub redirect_uris: Vec,
+ pub scope_mask: u64,
+ pub client_name: Option,
+}
+
+pub fn encode_client_id(key: &[u8], meta: &ClientMeta) -> Result {
+ let client_name = meta.client_name.as_deref().unwrap_or_default();
+
+ let mut payload = Vec::with_capacity(
+ 24 + meta
+ .redirect_uris
+ .iter()
+ .map(|u| u.len() + 2)
+ .sum::()
+ + client_name.len(),
+ );
+ payload.push(CLIENT_ID_VERSION);
+ payload.push_leb128(meta.redirect_uris.len());
+ for uri in &meta.redirect_uris {
+ payload.push_leb128(uri.len());
+ payload.extend_from_slice(uri.as_bytes());
+ }
+ payload.push_leb128(meta.scope_mask);
+ payload.push_leb128(client_name.len());
+ payload.extend_from_slice(client_name.as_bytes());
+
+ let digest = blake3::hash(&payload);
+ let nonce = &digest.as_bytes()[..SymmetricEncrypt::NONCE_LEN];
+ let ciphertext =
+ SymmetricEncrypt::new(key, CLIENT_ID_KEY_CONTEXT).encrypt_with_aad(&payload, nonce, &[])?;
+
+ let mut body = Vec::with_capacity(nonce.len() + ciphertext.len());
+ body.extend_from_slice(nonce);
+ body.extend_from_slice(&ciphertext);
+
+ let mut out = String::with_capacity(CLIENT_ID_HEADER.len() + body.len().div_ceil(3) * 4);
+ out.push_str(CLIENT_ID_HEADER);
+ general_purpose::URL_SAFE_NO_PAD.encode_string(&body, &mut out);
+
+ Ok(out)
+}
+
+pub fn decode_client_id(key: &[u8], client_id: &str) -> Option {
+ let body = general_purpose::URL_SAFE_NO_PAD
+ .decode(client_id.strip_prefix(CLIENT_ID_HEADER)?.as_bytes())
+ .ok()?;
+ if body.len() < SymmetricEncrypt::NONCE_LEN + SymmetricEncrypt::ENCRYPT_TAG_LEN {
+ return None;
+ }
+ let (nonce, ciphertext) = body.split_at(SymmetricEncrypt::NONCE_LEN);
+ let payload = SymmetricEncrypt::new(key, CLIENT_ID_KEY_CONTEXT)
+ .decrypt_with_aad(ciphertext, nonce, &[])
+ .ok()?;
+
+ let mut bytes = payload.iter();
+ if bytes.next().copied()? != CLIENT_ID_VERSION {
+ return None;
+ }
+
+ let uri_count: usize = bytes.next_leb128()?;
+ if uri_count > u8::MAX as usize {
+ return None;
+ }
+ let mut redirect_uris = Vec::with_capacity(uri_count);
+ for _ in 0..uri_count {
+ redirect_uris.push(take_string(&mut bytes)?);
+ }
+ let scope_mask: u64 = bytes.next_leb128()?;
+ let client_name = take_string(&mut bytes)?;
+
+ Some(ClientMeta {
+ redirect_uris,
+ scope_mask,
+ client_name: (!client_name.is_empty()).then_some(client_name),
+ })
+}
+
+fn take_string(bytes: &mut std::slice::Iter<'_, u8>) -> Option {
+ let len: usize = bytes.next_leb128()?;
+ let slice = bytes.as_slice();
+ if slice.len() < len {
+ return None;
+ }
+ let value = String::from_utf8(slice[..len].to_vec()).ok()?;
+ if len > 0 {
+ bytes.nth(len - 1)?;
+ }
+ Some(value)
+}
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+
+ const KEY: &[u8] = b"a-test-encryption-key-of-some-length";
+
+ fn sample() -> ClientMeta {
+ ClientMeta {
+ redirect_uris: vec![
+ "http://127.0.0.1/cb".to_string(),
+ "com.example.app:/oauth".to_string(),
+ ],
+ scope_mask: scopes_to_mask(&format!("{SCOPE_OFFLINE_ACCESS} {SCOPE_MAIL}")),
+ client_name: Some("Example Client".to_string()),
+ }
+ }
+
+ #[test]
+ fn round_trip_preserves_all_fields() {
+ for meta in [
+ sample(),
+ ClientMeta {
+ redirect_uris: vec!["http://[::1]/".to_string()],
+ scope_mask: 0,
+ client_name: None,
+ },
+ ClientMeta::default(),
+ ] {
+ let client_id = encode_client_id(KEY, &meta).unwrap();
+ assert!(client_id.starts_with(CLIENT_ID_HEADER));
+ assert_eq!(decode_client_id(KEY, &client_id), Some(meta));
+ }
+ }
+
+ #[test]
+ fn scope_mask_is_order_independent_and_drops_unknown() {
+ assert_eq!(
+ scopes_to_mask(&format!("{SCOPE_MAIL} {SCOPE_OFFLINE_ACCESS}")),
+ scopes_to_mask(&format!("{SCOPE_OFFLINE_ACCESS} {SCOPE_MAIL}"))
+ );
+ assert_eq!(
+ scopes_to_mask(&format!("{SCOPE_MAIL} custom:unknown")),
+ scopes_to_mask(SCOPE_MAIL)
+ );
+ assert_eq!(scopes_to_mask("totally unknown"), 0);
+ }
+
+ #[test]
+ fn identical_input_is_deterministic() {
+ let meta = sample();
+ assert_eq!(
+ encode_client_id(KEY, &meta).unwrap(),
+ encode_client_id(KEY, &meta).unwrap()
+ );
+ }
+
+ #[test]
+ fn wrong_key_is_rejected() {
+ let client_id = encode_client_id(KEY, &sample()).unwrap();
+ assert_eq!(
+ decode_client_id(b"a-completely-different-key-value!", &client_id),
+ None
+ );
+ }
+
+ #[test]
+ fn tampering_is_rejected() {
+ let client_id = encode_client_id(KEY, &sample()).unwrap();
+ let (header, body_b64) = client_id.split_at(CLIENT_ID_HEADER.len());
+ let mut body = general_purpose::URL_SAFE_NO_PAD.decode(body_b64).unwrap();
+ for idx in 0..body.len() {
+ let mut tampered = body.clone();
+ tampered[idx] ^= 0x01;
+ let forged = format!(
+ "{header}{}",
+ general_purpose::URL_SAFE_NO_PAD.encode(&tampered)
+ );
+ assert_eq!(decode_client_id(KEY, &forged), None, "byte {idx}");
+ }
+ body[0] ^= 0x00;
+ assert!(decode_client_id(KEY, &client_id).is_some());
+ }
+
+ #[test]
+ fn malformed_input_never_panics() {
+ for case in [
+ "",
+ "swc1.",
+ "swc1.!!!",
+ "swc1.AAAA",
+ "wrong.AAAA",
+ "swc1.AAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+ ] {
+ assert_eq!(decode_client_id(KEY, case), None, "{case:?}");
+ }
+ }
+}
diff --git a/crates/common/src/auth/oauth/config.rs b/crates/common/src/auth/oauth/config.rs
new file mode 100644
index 0000000..598d4c9
--- /dev/null
+++ b/crates/common/src/auth/oauth/config.rs
@@ -0,0 +1,203 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use crate::{
+ config::{EcKeyCurve, build_ecdsa_pem, build_rsa_keypair},
+ manager::application::Resource,
+};
+use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
+use jsonwebtoken::{
+ Algorithm, EncodingKey,
+ jwk::{
+ AlgorithmParameters, CommonParameters, EllipticCurve, EllipticCurveKeyParameters,
+ EllipticCurveKeyType, Jwk, JwkSet, KeyAlgorithm, OctetKeyParameters, OctetKeyType,
+ PublicKeyUse, RSAKeyParameters, RSAKeyType,
+ },
+};
+use registry::schema::{enums::JwtSignatureAlgorithm, prelude::ObjectType, structs::OidcProvider};
+use std::borrow::Cow;
+use store::{
+ rand::{RngExt, distr::Alphanumeric, rng},
+ registry::bootstrap::Bootstrap,
+};
+
+#[derive(Clone)]
+pub struct OAuthConfig {
+ pub oauth_key: String,
+ pub oauth_expiry_user_code: u64,
+ pub oauth_expiry_auth_code: u64,
+ pub oauth_expiry_token: u64,
+ pub oauth_expiry_refresh_token: u64,
+ pub oauth_expiry_refresh_token_renew: u64,
+ pub oauth_max_auth_attempts: u32,
+
+ pub allow_anonymous_client_registration: bool,
+ pub require_client_authentication: bool,
+
+ pub oidc_expiry_id_token: u64,
+ pub oidc_signing_secret: EncodingKey,
+ pub oidc_signature_algorithm: Algorithm,
+ pub oidc_jwks: Resource>,
+}
+
+impl OAuthConfig {
+ pub async fn parse(bp: &mut Bootstrap) -> Self {
+ let auth = bp.setting_infallible::().await;
+
+ let oidc_signature_algorithm = match auth.signature_algorithm {
+ JwtSignatureAlgorithm::Es256 => Algorithm::ES256,
+ JwtSignatureAlgorithm::Es384 => Algorithm::ES384,
+ JwtSignatureAlgorithm::Ps256 => Algorithm::PS256,
+ JwtSignatureAlgorithm::Ps384 => Algorithm::PS384,
+ JwtSignatureAlgorithm::Ps512 => Algorithm::PS512,
+ JwtSignatureAlgorithm::Rs256 => Algorithm::RS256,
+ JwtSignatureAlgorithm::Rs384 => Algorithm::RS384,
+ JwtSignatureAlgorithm::Rs512 => Algorithm::RS512,
+ JwtSignatureAlgorithm::Hs256 => Algorithm::HS256,
+ JwtSignatureAlgorithm::Hs384 => Algorithm::HS384,
+ JwtSignatureAlgorithm::Hs512 => Algorithm::HS512,
+ };
+
+ let rand_key = rng()
+ .sample_iter(Alphanumeric)
+ .take(64)
+ .map(char::from)
+ .collect::();
+
+ let signature_key = auth
+ .signature_key
+ .secret()
+ .await
+ .map_err(|err| {
+ bp.build_error(ObjectType::OidcProvider.singleton(), err);
+ })
+ .unwrap_or(Cow::Borrowed(rand_key.as_str()));
+
+ let fallback_key = || {
+ (
+ EncodingKey::from_secret(rand_key.as_bytes()),
+ AlgorithmParameters::OctetKey(OctetKeyParameters {
+ key_type: OctetKeyType::Octet,
+ value: URL_SAFE_NO_PAD.encode(&rand_key),
+ })
+ .into(),
+ )
+ };
+
+ let (oidc_signing_secret, algorithm) = match oidc_signature_algorithm {
+ Algorithm::HS256 | Algorithm::HS384 | Algorithm::HS512 => {
+ (EncodingKey::from_secret(signature_key.as_bytes()), None)
+ }
+ Algorithm::RS256
+ | Algorithm::RS384
+ | Algorithm::RS512
+ | Algorithm::PS256
+ | Algorithm::PS384
+ | Algorithm::PS512 => parse_rsa_key(&auth)
+ .await
+ .map_err(|err| {
+ bp.build_error(ObjectType::OidcProvider.singleton(), err);
+ })
+ .map(|(secret, alg)| (secret, Some(alg)))
+ .unwrap_or_else(|_| fallback_key()),
+ Algorithm::ES256 | Algorithm::ES384 => parse_ecdsa_key(&auth, oidc_signature_algorithm)
+ .await
+ .map_err(|err| {
+ bp.build_error(ObjectType::OidcProvider.singleton(), err);
+ })
+ .map(|(secret, alg)| (secret, Some(alg)))
+ .unwrap_or_else(|_| fallback_key()),
+ _ => {
+ bp.build_error(
+ ObjectType::OidcProvider.singleton(),
+ format!("Unsupported OIDC signature algorithm {oidc_signature_algorithm:?}"),
+ );
+ fallback_key()
+ }
+ };
+
+ let oidc_jwks = Resource {
+ content_type: "application/json".into(),
+ contents: serde_json::to_string(&JwkSet {
+ keys: algorithm
+ .into_iter()
+ .map(|algorithm| Jwk {
+ common: CommonParameters {
+ public_key_use: PublicKeyUse::Signature.into(),
+ key_algorithm: KeyAlgorithm::from(oidc_signature_algorithm).into(),
+ key_id: "default".to_string().into(),
+ ..Default::default()
+ },
+ algorithm,
+ })
+ .collect(),
+ })
+ .unwrap_or_default()
+ .into_bytes(),
+ };
+
+ OAuthConfig {
+ oauth_key: auth
+ .encryption_key
+ .secret()
+ .await
+ .map_err(|err| bp.build_error(ObjectType::OidcProvider.singleton(), err))
+ .map_or_else(|_| rand_key.clone(), Cow::into_owned),
+ oauth_expiry_user_code: auth.user_code_expiry.as_secs(),
+ oauth_expiry_auth_code: auth.auth_code_expiry.as_secs(),
+ oauth_expiry_token: auth.access_token_expiry.as_secs(),
+ oauth_expiry_refresh_token: auth.refresh_token_expiry.as_secs(),
+ oauth_expiry_refresh_token_renew: auth.refresh_token_renewal.as_secs(),
+ oauth_max_auth_attempts: auth.auth_code_max_attempts as u32,
+ oidc_expiry_id_token: auth.id_token_expiry.as_secs(),
+ allow_anonymous_client_registration: auth.anonymous_client_registration,
+ require_client_authentication: auth.require_client_registration,
+ oidc_signing_secret,
+ oidc_signature_algorithm,
+ oidc_jwks,
+ }
+ }
+}
+
+async fn parse_rsa_key(auth: &OidcProvider) -> Result<(EncodingKey, AlgorithmParameters), String> {
+ let rsa_key = build_rsa_keypair(auth.signature_key.secret().await?.as_ref())?;
+
+ let rsa_key_params = RSAKeyParameters {
+ key_type: RSAKeyType::RSA,
+ n: URL_SAFE_NO_PAD.encode(&rsa_key.modulus),
+ e: URL_SAFE_NO_PAD.encode(&rsa_key.exponent),
+ };
+
+ Ok((
+ EncodingKey::from_rsa_der(&rsa_key.pkcs1_der),
+ AlgorithmParameters::RSA(rsa_key_params),
+ ))
+}
+
+async fn parse_ecdsa_key(
+ auth: &OidcProvider,
+ oidc_signature_algorithm: Algorithm,
+) -> Result<(EncodingKey, AlgorithmParameters), String> {
+ let (curve, ec_curve) = match oidc_signature_algorithm {
+ Algorithm::ES256 => (EllipticCurve::P256, EcKeyCurve::P256),
+ Algorithm::ES384 => (EllipticCurve::P384, EcKeyCurve::P384),
+ _ => unreachable!(),
+ };
+
+ let ecdsa_key = build_ecdsa_pem(ec_curve, auth.signature_key.secret().await?.as_ref())?;
+
+ let ecdsa_key_params = EllipticCurveKeyParameters {
+ key_type: EllipticCurveKeyType::EC,
+ curve,
+ x: URL_SAFE_NO_PAD.encode(&ecdsa_key.x),
+ y: URL_SAFE_NO_PAD.encode(&ecdsa_key.y),
+ };
+
+ Ok((
+ EncodingKey::from_ec_der(&ecdsa_key.pkcs8_der),
+ AlgorithmParameters::EllipticCurve(ecdsa_key_params),
+ ))
+}
diff --git a/crates/common/src/auth/oauth/crypto.rs b/crates/common/src/auth/oauth/crypto.rs
new file mode 100644
index 0000000..dd8927e
--- /dev/null
+++ b/crates/common/src/auth/oauth/crypto.rs
@@ -0,0 +1,54 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use aes_gcm_siv::{
+ Aes256GcmSiv, Key, KeyInit, Nonce,
+ aead::{Aead, Payload},
+};
+use store::blake3;
+
+pub struct SymmetricEncrypt {
+ aes: Aes256GcmSiv,
+}
+
+impl SymmetricEncrypt {
+ pub const ENCRYPT_TAG_LEN: usize = 16;
+ pub const NONCE_LEN: usize = 12;
+
+ pub fn new(key: &[u8], context: &str) -> Self {
+ SymmetricEncrypt {
+ aes: Aes256GcmSiv::new(&Key::::from(blake3::derive_key(context, key))),
+ }
+ }
+
+ pub fn encrypt_with_aad(
+ &self,
+ bytes: &[u8],
+ nonce: &[u8],
+ aad: &[u8],
+ ) -> Result, String> {
+ self.aes
+ .encrypt(
+ <&Nonce>::try_from(nonce).map_err(|e| e.to_string())?,
+ Payload { msg: bytes, aad },
+ )
+ .map_err(|e| e.to_string())
+ }
+
+ pub fn decrypt_with_aad(
+ &self,
+ bytes: &[u8],
+ nonce: &[u8],
+ aad: &[u8],
+ ) -> Result, String> {
+ self.aes
+ .decrypt(
+ <&Nonce>::try_from(nonce).map_err(|e| e.to_string())?,
+ Payload { msg: bytes, aad },
+ )
+ .map_err(|e| e.to_string())
+ }
+}
diff --git a/crates/common/src/auth/oauth/introspect.rs b/crates/common/src/auth/oauth/introspect.rs
new file mode 100644
index 0000000..39a4c3b
--- /dev/null
+++ b/crates/common/src/auth/oauth/introspect.rs
@@ -0,0 +1,81 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use crate::{Server, auth::AccessToken};
+use serde::{Deserialize, Serialize};
+use trc::{AddContext, AuthEvent, EventType};
+
+#[derive(Debug, Default, Clone, Eq, PartialEq, Deserialize, Serialize)]
+pub struct OAuthIntrospect {
+ #[serde(default)]
+ pub active: bool,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub scope: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub client_id: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub username: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub token_type: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub exp: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub iat: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub nbf: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub sub: Option,
+}
+
+impl Server {
+ pub async fn introspect_access_token(
+ &self,
+ token: &str,
+ access_token: &AccessToken,
+ ) -> trc::Result {
+ match self.validate_access_token(None, token).await {
+ Ok(token_info) => Ok(OAuthIntrospect {
+ active: true,
+ username: self
+ .account(access_token.account_id())
+ .await
+ .caused_by(trc::location!())?
+ .name()
+ .to_string()
+ .into(),
+ token_type: Some("bearer".into()),
+ exp: Some(token_info.expiry as i64),
+ iat: Some(token_info.issued_at as i64),
+ ..Default::default()
+ }),
+ Err(err)
+ if matches!(
+ err.event_type(),
+ EventType::Auth(AuthEvent::Error) | EventType::Auth(AuthEvent::TokenExpired)
+ ) =>
+ {
+ Ok(OAuthIntrospect::default())
+ }
+ Err(err) => Err(err),
+ }
+ }
+}
diff --git a/crates/common/src/auth/oauth/mod.rs b/crates/common/src/auth/oauth/mod.rs
new file mode 100644
index 0000000..2beb819
--- /dev/null
+++ b/crates/common/src/auth/oauth/mod.rs
@@ -0,0 +1,80 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+pub mod client_id;
+pub mod config;
+pub mod crypto;
+pub mod introspect;
+pub mod oidc;
+pub mod registration;
+pub mod token;
+
+pub const DEVICE_CODE_LEN: usize = 40;
+pub const USER_CODE_LEN: usize = 8;
+pub const RANDOM_CODE_LEN: usize = 32;
+pub const CLIENT_ID_MAX_LEN: usize = 2048;
+
+pub const USER_CODE_ALPHABET: &[u8] = b"ABCDEFGHJKLMNPQRSTUVWXYZ23456789"; // No 0, O, I, 1
+
+pub const SCOPE_OPENID: &str = "openid";
+pub const SCOPE_OFFLINE_ACCESS: &str = "offline_access";
+pub const SCOPE_MAIL: &str = "urn:ietf:params:oauth:scope:mail";
+pub const SCOPE_CONTACTS: &str = "urn:ietf:params:oauth:scope:contacts";
+pub const SCOPE_CALENDARS: &str = "urn:ietf:params:oauth:scope:calendars";
+
+pub const SUPPORTED_SCOPES: &[&str] = &[
+ SCOPE_OPENID,
+ SCOPE_OFFLINE_ACCESS,
+ SCOPE_MAIL,
+ SCOPE_CONTACTS,
+ SCOPE_CALENDARS,
+];
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq)]
+pub enum GrantType {
+ AccessToken,
+ RefreshToken,
+ LiveTracing,
+ LiveMetrics,
+ LiveDelivery,
+ Rsvp,
+}
+
+impl GrantType {
+ pub fn as_str(&self) -> &'static str {
+ match self {
+ GrantType::AccessToken => "access_token",
+ GrantType::RefreshToken => "refresh_token",
+ GrantType::LiveTracing => "live_tracing",
+ GrantType::LiveMetrics => "live_metrics",
+ GrantType::LiveDelivery => "live_delivery",
+ GrantType::Rsvp => "rsvp",
+ }
+ }
+
+ pub fn id(&self) -> u8 {
+ match self {
+ GrantType::AccessToken => 0,
+ GrantType::RefreshToken => 1,
+ GrantType::LiveTracing => 2,
+ GrantType::LiveMetrics => 3,
+ GrantType::LiveDelivery => 4,
+ GrantType::Rsvp => 5,
+ }
+ }
+
+ pub fn from_id(id: u8) -> Option {
+ match id {
+ 0 => Some(GrantType::AccessToken),
+ 1 => Some(GrantType::RefreshToken),
+ 2 => Some(GrantType::LiveTracing),
+ 3 => Some(GrantType::LiveMetrics),
+ 4 => Some(GrantType::LiveDelivery),
+ 5 => Some(GrantType::Rsvp),
+ _ => None,
+ }
+ }
+}
diff --git a/crates/common/src/auth/oauth/oidc.rs b/crates/common/src/auth/oauth/oidc.rs
new file mode 100644
index 0000000..48b97db
--- /dev/null
+++ b/crates/common/src/auth/oauth/oidc.rs
@@ -0,0 +1,182 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use std::fmt;
+
+use jsonwebtoken::Header;
+
+use serde::{
+ Deserialize, Deserializer, Serialize,
+ de::{self, Visitor},
+};
+use store::write::now;
+
+use crate::Server;
+
+#[derive(Debug, Default, Clone, Eq, PartialEq, Deserialize, Serialize)]
+pub struct Userinfo {
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub sub: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub name: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub given_name: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub family_name: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub middle_name: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub nickname: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub preferred_username: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub profile: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub picture: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub website: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub email: Option,
+
+ #[serde(default, deserialize_with = "any_bool")]
+ #[serde(skip_serializing_if = "std::ops::Not::not")]
+ pub email_verified: bool,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub zoneinfo: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub locale: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub updated_at: Option,
+}
+
+#[derive(Debug, Default, Eq, PartialEq, Deserialize, Serialize)]
+pub struct StandardClaims {
+ #[serde(skip_serializing_if = "Option::is_none")]
+ #[serde(default)]
+ pub nonce: Option,
+
+ #[serde(skip_serializing_if = "Option::is_none")]
+ #[serde(default)]
+ pub preferred_username: Option,
+
+ #[serde(skip_serializing_if = "Option::is_none")]
+ #[serde(default)]
+ pub email: Option,
+
+ #[serde(skip_serializing_if = "Option::is_none")]
+ #[serde(default)]
+ pub description: Option,
+}
+
+#[derive(Serialize)]
+struct IdTokenClaims {
+ iss: String,
+ sub: String,
+ aud: String,
+ nbf: i64,
+ iat: i64,
+ exp: i64,
+
+ #[serde(flatten)]
+ private: StandardClaims,
+}
+
+impl Server {
+ pub fn issue_id_token(
+ &self,
+ subject: impl Into,
+ issuer: impl Into,
+ audience: impl Into,
+ claims: StandardClaims,
+ ) -> trc::Result {
+ let now = now() as i64;
+
+ jsonwebtoken::encode(
+ &Header {
+ kid: Some("default".into()),
+ ..Header::new(self.core.oauth.oidc_signature_algorithm)
+ },
+ &IdTokenClaims {
+ iss: issuer.into(),
+ sub: subject.into(),
+ aud: audience.into(),
+ nbf: now,
+ iat: now,
+ exp: now + self.core.oauth.oidc_expiry_id_token as i64,
+ private: claims,
+ },
+ &self.core.oauth.oidc_signing_secret,
+ )
+ .map_err(|err| {
+ trc::AuthEvent::Error
+ .into_err()
+ .reason(err)
+ .details("Failed to encode ID token")
+ })
+ }
+}
+
+fn any_bool<'de, D>(deserializer: D) -> Result
+where
+ D: Deserializer<'de>,
+{
+ struct AnyBoolVisitor;
+
+ impl Visitor<'_> for AnyBoolVisitor {
+ type Value = bool;
+
+ fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
+ formatter.write_str("a boolean value")
+ }
+
+ fn visit_str(self, value: &str) -> Result
+ where
+ E: de::Error,
+ {
+ match value {
+ "true" => Ok(true),
+ "false" => Ok(false),
+ _ => Err(E::custom(format!("Unknown boolean: {value}"))),
+ }
+ }
+
+ fn visit_bool(self, value: bool) -> Result
+ where
+ E: de::Error,
+ {
+ Ok(value)
+ }
+ }
+
+ deserializer.deserialize_any(AnyBoolVisitor)
+}
diff --git a/crates/common/src/auth/oauth/registration.rs b/crates/common/src/auth/oauth/registration.rs
new file mode 100644
index 0000000..56d7711
--- /dev/null
+++ b/crates/common/src/auth/oauth/registration.rs
@@ -0,0 +1,295 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+#[derive(Serialize, Deserialize, Debug, Default)]
+#[serde(rename_all = "snake_case")]
+pub struct ClientRegistrationRequest {
+ pub redirect_uris: Vec,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub scope: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Vec::is_empty")]
+ pub response_types: Vec,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Vec::is_empty")]
+ pub grant_types: Vec,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub application_type: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Vec::is_empty")]
+ pub contacts: Vec,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub client_name: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub logo_uri: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub client_uri: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub policy_uri: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub tos_uri: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub jwks_uri: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub jwks: Option, // Using serde_json::Value for flexibility
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub sector_identifier_uri: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub subject_type: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub id_token_signed_response_alg: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub id_token_encrypted_response_alg: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub id_token_encrypted_response_enc: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub userinfo_signed_response_alg: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub userinfo_encrypted_response_alg: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub userinfo_encrypted_response_enc: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub request_object_signing_alg: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub request_object_encryption_alg: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub request_object_encryption_enc: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub token_endpoint_auth_method: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub token_endpoint_auth_signing_alg: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub default_max_age: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub require_auth_time: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Vec::is_empty")]
+ pub default_acr_values: Vec,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub initiate_login_uri: Option,
+
+ #[serde(default)]
+ #[serde(skip_serializing_if = "Vec::is_empty")]
+ pub request_uris: Vec,
+
+ #[serde(flatten)]
+ #[serde(skip_serializing_if = "HashMap::is_empty")]
+ pub additional_fields: HashMap,
+}
+
+#[derive(Serialize, Deserialize, Debug, Default)]
+#[serde(rename_all = "snake_case")]
+pub struct ClientRegistrationResponse {
+ // Required fields
+ pub client_id: String,
+
+ // Optional fields specific to the response
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub client_secret: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub registration_access_token: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub registration_client_uri: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub client_id_issued_at: Option,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub client_secret_expires_at: Option,
+
+ // Echo back the request
+ #[serde(flatten)]
+ pub request: ClientRegistrationRequest,
+}
+
+#[derive(Serialize, Deserialize, Debug)]
+#[serde(rename_all = "lowercase")]
+pub enum ApplicationType {
+ Web,
+ Native,
+}
+
+#[derive(Serialize, Deserialize, Debug)]
+#[serde(rename_all = "lowercase")]
+pub enum SubjectType {
+ Pairwise,
+ Public,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum TokenEndpointAuthMethod {
+ ClientSecretPost,
+ ClientSecretBasic,
+ ClientSecretJwt,
+ PrivateKeyJwt,
+ None,
+}
+
+#[derive(Serialize, Debug)]
+pub struct ClientRegistrationError {
+ pub error: &'static str,
+ #[serde(skip_serializing_if = "Option::is_none")]
+ pub error_description: Option<&'static str>,
+}
+
+impl ClientRegistrationError {
+ pub fn invalid_redirect_uri(description: &'static str) -> Self {
+ ClientRegistrationError {
+ error: "invalid_redirect_uri",
+ error_description: Some(description),
+ }
+ }
+
+ pub fn invalid_client_metadata(description: &'static str) -> Self {
+ ClientRegistrationError {
+ error: "invalid_client_metadata",
+ error_description: Some(description),
+ }
+ }
+}
+
+pub fn loopback_redirect_parts(uri: &str) -> Option<(&str, &str)> {
+ let uri = uri.strip_prefix("http://")?;
+
+ for host in ["127.0.0.1", "[::1]"] {
+ if let Some(rest) = uri.strip_prefix(host) {
+ if let Some(path) = rest.strip_prefix('/') {
+ return Some((host, path));
+ } else if let Some(after_colon) = rest.strip_prefix(':')
+ && let Some((port, path)) = after_colon.split_once('/')
+ && !port.is_empty()
+ && port.bytes().all(|b| b.is_ascii_digit())
+ {
+ return Some((host, path));
+ }
+ }
+ }
+ None
+}
+
+pub fn redirect_uri_matches(registered: &str, presented: &str) -> bool {
+ registered == presented
+ || matches!(
+ (
+ loopback_redirect_parts(registered),
+ loopback_redirect_parts(presented),
+ ),
+ (Some(reg), Some(pres)) if reg == pres
+ )
+}
+
+pub fn validate_redirect_uri(uri: &str) -> Result<(), ClientRegistrationError> {
+ if uri.contains('#') {
+ return Err(ClientRegistrationError::invalid_redirect_uri(
+ "Redirect URI must not contain a fragment.",
+ ));
+ } else if uri.contains("..") {
+ return Err(ClientRegistrationError::invalid_redirect_uri(
+ "Redirect URI must not contain consecutive dots.",
+ ));
+ } else if uri.starts_with("https://") || loopback_redirect_parts(uri).is_some() {
+ return Ok(());
+ } else if let Some((scheme, _)) = uri.split_once(':')
+ && scheme.contains('.')
+ && scheme
+ .as_bytes()
+ .first()
+ .is_some_and(u8::is_ascii_alphabetic)
+ && scheme
+ .bytes()
+ .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'-' | b'+'))
+ {
+ return Ok(());
+ }
+
+ Err(ClientRegistrationError::invalid_redirect_uri(
+ "Redirect URI must be an https URL, a loopback (http://127.0.0.1/, http://[::1]/) or a private-use scheme URI.",
+ ))
+}
+
+pub fn validate_grant_metadata(
+ request: &ClientRegistrationRequest,
+) -> Result<(), ClientRegistrationError> {
+ if !request.response_types.is_empty() && !request.response_types.iter().any(|t| t == "code") {
+ return Err(ClientRegistrationError::invalid_client_metadata(
+ "response_types must include \"code\".",
+ ));
+ }
+ if !request.grant_types.is_empty() {
+ if !request
+ .grant_types
+ .iter()
+ .any(|t| t == "authorization_code")
+ {
+ return Err(ClientRegistrationError::invalid_client_metadata(
+ "grant_types must include \"authorization_code\".",
+ ));
+ }
+ if !request.grant_types.iter().any(|t| t == "refresh_token") {
+ return Err(ClientRegistrationError::invalid_client_metadata(
+ "grant_types must include \"refresh_token\".",
+ ));
+ }
+ }
+
+ Ok(())
+}
diff --git a/crates/common/src/auth/oauth/token.rs b/crates/common/src/auth/oauth/token.rs
new file mode 100644
index 0000000..cc4ef4f
--- /dev/null
+++ b/crates/common/src/auth/oauth/token.rs
@@ -0,0 +1,418 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC