sender

type Config struct {
	// WorkerID identifies this replica. It is the lease owner on claimed
	// deliveries and the ID of its Workers heartbeat row, so it must be stable
	// for the life of the process and unique in the cluster.
	WorkerID string

	// Lanes is the worker pool size per lane. Transactional is always served
	// before bulk. Default: 8 transactional, 32 bulk.
	Lanes map[store.Lane]int
	// ClaimBatch is the maximum number of deliveries claimed in one call.
	ClaimBatch int
	// LeaseFor is how long a claim holds a delivery (architecture 8.1).
	LeaseFor time.Duration
	// PollInterval is how long the loop sleeps after a pass that claimed
	// nothing.
	PollInterval time.Duration
	// CampaignRefresh is the TTL of the running-campaign set.
	CampaignRefresh time.Duration
	// TenantConcurrency caps the deliveries one tenant may occupy at once, so
	// one big campaign cannot starve the others.
	TenantConcurrency int
	// TenantCacheTTL is the TTL of cached tenant configuration rows.
	TenantCacheTTL time.Duration

	// HeartbeatInterval is how often the Workers row is refreshed, WorkerTTL
	// how far back ListActive looks. The active replica count divides the
	// cluster-wide transport rate (architecture 8.2).
	HeartbeatInterval time.Duration
	WorkerTTL         time.Duration
	// DefaultRatePerSecond applies to transports that configure no rate. Zero
	// means unlimited.
	DefaultRatePerSecond float64

	// ResultBatchSize and ResultFlushInterval drive the batched Complete.
	ResultBatchSize     int
	ResultFlushInterval time.Duration

	// Connection pool.
	MaxMsgsPerConn  int
	ConnIdleTimeout time.Duration
	DialTimeout     time.Duration
	SendTimeout     time.Duration
	EHLOName        string
	TLSConfig       *tls.Config
	Dialer          DialFunc

	// RenderTimeout bounds one recipient's Liquid render.
	RenderTimeout time.Duration

	// TransportFailThreshold is how many consecutive auth/TLS/connect failures
	// mark a transport unhealthy; TransportProbeInterval how often an unhealthy
	// one is probed (architecture 8.3).
	TransportFailThreshold int
	TransportProbeInterval time.Duration

	// RateLimitCap and AuthRetryAfter are the policy knobs of policy.go.
	RateLimitCap   time.Duration
	AuthRetryAfter time.Duration

	Hooks    host.Hooks
	Secrets  host.SecretCipher
	Renderer *render.Renderer
	// Platform resolves the shared senders of the operator's platform catalog:
	// their templated From addresses, the uses they are allowed for, and the
	// per-tenant rate share of the transport behind them (ADR-0017). Nil in a
	// deployment with no platform resources, which is every single-tenant one.
	Platform *platform.Resolver
	Metrics  host.Metrics
	Logger   *slog.Logger
	Clock    func() time.Time
	// Rand is the jitter source; nil uses math/rand/v2.
	Rand func() float64
}

type Conn struct {
	// contains filtered or unexported fields
}

type Decision struct {
	Status        store.DeliveryStatus
	NextAttemptAt time.Time
	// IncrementAttempt is true for transient and rate_limited only. Transport
	// faults (auth, TLS) are recorded but must not exhaust a delivery.
	IncrementAttempt bool
	// RecordAttempt is false when nothing was attempted over SMTP at all
	// (suppressed, skipped), so no DeliveryAttempt row is written.
	RecordAttempt bool
}

type DialFunc func(ctx context.Context, network, addr string) (net.Conn, error)

type Failure struct {
	Class store.ErrorClass
	// Code is the SMTP reply code, or 0 for a failure that never got one
	// (connection refused, timeout, TLS).
	Code int
	// Enhanced is the RFC 3463 status ("4.7.0"), when the reply carried one.
	Enhanced string
	// Message is the reply text, or the Go error text.
	Message string
	// Rule names the classification rule that matched, for logs and tests.
	Rule string
	Err  error
}

type Key struct {
	Name string
	Rate float64
}

type Limiter struct {
	// Workers reports the number of active sender replicas. It must return at
	// least 1; a nil func means "this replica is alone".
	Workers func() int
	// Now is the clock (tests inject one).
	Now func() time.Time
	// Sleep waits; tests replace it to avoid real time.
	Sleep func(ctx context.Context, d time.Duration) error
	// contains filtered or unexported fields
}

type Policy struct {
	Retry store.RetryPolicy
	// RateLimitCap shortens the backoff for rate_limited: architecture 4.2
	// asks for "a short retry plus a transport-level slowdown", and the
	// slowdown (ratelimit.go) is what actually spaces the traffic out, so the
	// delivery itself should come back soon.
	RateLimitCap time.Duration
	// AuthRetryAfter is how long an auth-class failure parks the delivery. It
	// stays queued and does not consume an attempt, so without a delay the
	// same delivery would be re-claimed in a tight loop while the transport is
	// being probed.
	AuthRetryAfter time.Duration
	// Jitter is the fraction the backoff is randomized by, ±Jitter.
	Jitter float64
	// Rand returns a value in [0,1). nil uses an internal source.
	Rand func() float64
}

type Pool struct {
	// contains filtered or unexported fields
}

type PoolConfig struct {
	// MaxMsgsPerConn reconnects after this many messages on one connection.
	// Long-lived connections accumulate per-connection limits on the far side
	// (architecture 8.1).
	MaxMsgsPerConn int
	// IdleTimeout closes a connection that has been idle this long.
	IdleTimeout time.Duration
	// DialTimeout bounds connect + greeting + EHLO + AUTH.
	DialTimeout time.Duration
	// SendTimeout bounds one MAIL/RCPT/DATA transaction.
	SendTimeout time.Duration
	// EHLOName is the name announced in EHLO.
	EHLOName string
	// TLSConfig is the base config for STARTTLS and implicit TLS; ServerName
	// is filled in from the transport host.
	TLSConfig *tls.Config
	// Dialer defaults to a net.Dialer.
	Dialer DialFunc
	Now    func() time.Time
	// Metrics is never nil after withDefaults.
	Metrics host.Metrics
}

type Sender struct {
	// contains filtered or unexported fields
}