@12-apps/notifications 4.7.1 → 4.9.0

package/dist/manifest/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/manifest/index.ts"],"sourcesContent":["/**\n * `@12-apps/notifications/manifest` — the SHARED wiring manifest.\n *\n * Identity, the Prisma contribution (the four owned models) and the runtime\n * inventory: `http` on the server. Three narrowings are deliberate:\n *\n * - **No `notifications` blueprints.** This package is the notification\n *   MECHANISM — the inbox, the preference matrix, the transports, the retry\n *   sweep — not an author of alerts. The blueprints belong to whichever\n *   package raises the alert (`@12-apps/product-research`'s budget warning\n *   ships as a factory over host copy for exactly this reason), and this one\n *   takes them through the `generators` seam at mount.\n * - **No `email` capability.** The transports are host-supplied config\n *   (`config.transports`, `config.drivers`), so what would be declared here\n *   is a seam the host already fills — and declaring it would oblige an\n *   adopter to bind a mailer this package never owns.\n *\n * ON THE `jobs` DECLARATION. The dispatch fast path and the retry sweep are\n * this package's own cadence decisions — attempts, backoff, the five-minute\n * tick, the single-flight lease — and they were host code in every adopting\n * host, restated by hand from this package's docstrings. That is the\n * `paymentsJobBlueprints()` incident's shape exactly: a mechanism a host must\n * remember to schedule is a mechanism most hosts silently do not have, and the\n * one host that DID write them wrote them correctly only because someone read\n * the source. `./server`'s `NOTIFICATIONS_JOBS` declares both; a host with no\n * worker declines the capability in writing and the report says so.\n *\n * ON THE `web` INVENTORY, which this manifest used to narrow away. The reason\n * given — that listing it would oblige every SERVER host to answer for a React\n * surface it never mounts — is not how the consumer behaves: a capability\n * declared for the OTHER runtime is reported `out-of-scope`, and only an\n * applicable, unanswered one is `unbound`. So the narrowing protected nothing\n * and hid Bell, Panel and Preferences from every adopting host, which is why\n * the origin host hand-duplicated two of the three.\n *\n * ON THE `db` DECLARATION. The origin host already composes\n * `prisma/notifications.prisma` into its schema — but by STRUCTURAL\n * DISCOVERY, the assembler's fallback for a package that declares nothing.\n * That fallback is why the gap was invisible: four tables reached a host's\n * database with no declaration behind them, and the contract's whole claim\n * is that a package's models arrive because it said so. Declaring changes no\n * host behaviour (the assembler reads the declaration where it used to scan)\n * and closes the one case where composition was happening by accident.\n *\n * `@12-apps/wiring` is a TYPE-ONLY devDependency (the report-builder move):\n * the manifest is a plain `satisfies`-checked value, and the producer\n * factories' runtime assertions run in this package's own test suite.\n */\n\nimport type { PackageManifest } from '@12-apps/wiring';\n\nexport const notificationsManifest = {\n  name: '@12-apps/notifications',\n  contract: 1,\n  db: { partial: 'prisma/notifications.prisma', migrations: 'prisma/migrations' },\n  /**\n   * Mandatory for runtime manifests since wiring 1.3.0: a delivery that\n   * exhausts its attempts files under `notifications`, not nowhere.\n   */\n  observability: { namespace: 'notifications' },\n  server: ['http', 'jobs'],\n  web: ['surface'],\n} as const satisfies PackageManifest;\n"],"mappings":";;;AAmDO,IAAM,wBAAwB;AAAA,EACnC,MAAM;AAAA,EACN,UAAU;AAAA,EACV,IAAI,EAAE,SAAS,+BAA+B,YAAY,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9E,eAAe,EAAE,WAAW,gBAAgB;AAAA,EAC5C,QAAQ,CAAC,QAAQ,MAAM;AAAA,EACvB,KAAK,CAAC,SAAS;AACjB;","names":[]}
+{"version":3,"sources":["../../src/manifest/index.ts"],"sourcesContent":["/**\n * `@12-apps/notifications/manifest` — the SHARED wiring manifest.\n *\n * Identity, the Prisma contribution (the four owned models) and the runtime\n * inventory: `http` on the server. Three narrowings are deliberate:\n *\n * - **No `notifications` blueprints.** This package is the notification\n *   MECHANISM — the inbox, the preference matrix, the transports, the retry\n *   sweep — not an author of alerts. The blueprints belong to whichever\n *   package raises the alert (`@12-apps/product-research`'s budget warning\n *   ships as a factory over host copy for exactly this reason), and this one\n *   takes them through the `generators` seam at mount.\n * - **No `email` capability.** The transports are host-supplied config\n *   (`config.transports`, `config.drivers`), so what would be declared here\n *   is a seam the host already fills — and declaring it would oblige an\n *   adopter to bind a mailer this package never owns.\n *\n * ON THE `jobs` DECLARATION. The dispatch fast path and the retry sweep are\n * this package's own cadence decisions — attempts, backoff, the five-minute\n * tick, the single-flight lease — and they were host code in every adopting\n * host, restated by hand from this package's docstrings. That is the\n * `paymentsJobBlueprints()` incident's shape exactly: a mechanism a host must\n * remember to schedule is a mechanism most hosts silently do not have, and the\n * one host that DID write them wrote them correctly only because someone read\n * the source. `./server`'s `NOTIFICATIONS_JOBS` declares both; a host with no\n * worker declines the capability in writing and the report says so.\n *\n * ON THE `web` INVENTORY, which this manifest used to narrow away. The reason\n * given — that listing it would oblige every SERVER host to answer for a React\n * surface it never mounts — is not how the consumer behaves: a capability\n * declared for the OTHER runtime is reported `out-of-scope`, and only an\n * applicable, unanswered one is `unbound`. So the narrowing protected nothing\n * and hid Bell, Panel and Preferences from every adopting host, which is why\n * the origin host hand-duplicated two of the three.\n *\n * ON THE `db` DECLARATION. The origin host already composes\n * `prisma/notifications.prisma` into its schema — but by STRUCTURAL\n * DISCOVERY, the assembler's fallback for a package that declares nothing.\n * That fallback is why the gap was invisible: four tables reached a host's\n * database with no declaration behind them, and the contract's whole claim\n * is that a package's models arrive because it said so. Declaring changes no\n * host behaviour (the assembler reads the declaration where it used to scan)\n * and closes the one case where composition was happening by accident.\n *\n * `@12-apps/wiring` is a TYPE-ONLY devDependency (the report-builder move):\n * the manifest is a plain `satisfies`-checked value, and the producer\n * factories' runtime assertions run in this package's own test suite.\n */\n\nimport type { PackageManifest } from '@12-apps/wiring';\n\nexport const notificationsManifest = {\n  name: '@12-apps/notifications',\n  contract: 1,\n  db: { partial: 'prisma/notifications.prisma', migrations: 'prisma/migrations' },\n  /**\n   * Mandatory for runtime manifests since wiring 1.3.0: a delivery that\n   * exhausts its attempts files under `notifications`, not nowhere.\n   */\n  observability: { namespace: 'notifications' },\n  server: ['http', 'jobs'],\n  web: ['surface'],\n} as const satisfies PackageManifest;\n\n/**\n * The e-mail PREVIEW console — a second manifest, from the same package.\n *\n * ## Why a second manifest and not two more keys on the first\n *\n * `notificationsManifest` has already spent both slots this surface needs:\n * `http` is the account inbox at `/api/account`, `surface` is the bell and the\n * preference matrix. A capability is singular by the contract's shape, so a\n * package with two genuinely different surfaces declares two manifests — which\n * is exactly what `@12-apps/auth` does with `@12-apps/auth-platform`, and for\n * the same reason it gives: those two switches turn a sign-in method off for\n * EVERYBODY, so they do not belong behind the same gate as \"reset my password\".\n *\n * The split here is the same one. The inbox ships to every signed-in user; this\n * console publishes the product's whole transactional-mail inventory and the\n * exact wording and link shape of its verification and reset mails, which is\n * the reference someone writing a convincing phishing mail would want. Two\n * manifests keep that expressible: a host mounts the inbox and DECLINES the\n * console, in writing, rather than silently getting both behind one gate.\n *\n * ## What it deliberately does not declare\n *\n * No `db` — a catalogue is DERIVED from what a host already sends, so an\n * adopter mounts it without touching its schema. No `notifications`, because\n * this surface authors no alert. And no `email`: that capability is a DELIVERY\n * port, and this manifest renders and never sends. The delivery port is the\n * OTHER half of this package, and it stays where it is.\n */\nexport const notificationEmailPreviewsManifest = {\n  name: '@12-apps/notifications-email-previews',\n  contract: 1,\n  /** A refusal to render a preview files under its own namespace, not nowhere. */\n  observability: { namespace: 'email-previews' },\n  server: ['http'],\n  web: ['surface'],\n} as const satisfies PackageManifest;\n"],"mappings":";;;AAmDO,IAAM,wBAAwB;AAAA,EACnC,MAAM;AAAA,EACN,UAAU;AAAA,EACV,IAAI,EAAE,SAAS,+BAA+B,YAAY,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9E,eAAe,EAAE,WAAW,gBAAgB;AAAA,EAC5C,QAAQ,CAAC,QAAQ,MAAM;AAAA,EACvB,KAAK,CAAC,SAAS;AACjB;AA8BO,IAAM,oCAAoC;AAAA,EAC/C,MAAM;AAAA,EACN,UAAU;AAAA;AAAA,EAEV,eAAe,EAAE,WAAW,iBAAiB;AAAA,EAC7C,QAAQ,CAAC,MAAM;AAAA,EACf,KAAK,CAAC,SAAS;AACjB;","names":[]}

package/dist/manifest/server.d.ts

@@ -1,11 +1,14 @@
+import { EmailPreviewRoute } from '../email/previews/index.js';
 import * as _12_apps_wiring from '@12-apps/wiring';
 import { WireRequest } from '@12-apps/wiring';
-import { N as NotificationsServerConfig, A as ApiNotifications, b as NotificationsRoute } from '../create-api-notifications-B3u6Kx3x.js';
-import { N as NotificationsJobDeps } from '../jobs-BDZ7aGHV.js';
-import '../generators-B9xt3sRh.js';
-import '../types-CXLAG3UU.js';
-import '../wire-6dzyfDE7.js';
-import '../web-push-Cs14Wp9u.js';
+import { N as NotificationsServerConfig, A as ApiNotifications, b as NotificationsRoute } from '../create-api-notifications-B-VMezVB.js';
+import { N as NotificationsJobDeps } from '../jobs-D64B_bg7.js';
+import { E as EmailPreviewsConfig } from '../catalog-BOVZ2b-b.js';
+import '../generators-BsuXe8Mp.js';
+import '../types-BFmAY0P5.js';
+import '../wire-_coV3tJk.js';
+import '../web-push-D-ysQd5h.js';
+import '../template-Dlt5S54z.js';
 
 /** One `NotificationsRoute` as the wiring contract reads it. */
 declare function asWireRoute(route: NotificationsRoute): {
@@ -41,5 +44,27 @@ declare const notificationsServerManifest: {
         };
     };
 };
+/**
+ * The preview console's server half — the two endpoints over the catalogue.
+ *
+ * A CONSTANT, not a factory. `http.create(config)` receives whatever the host
+ * bound at adoption, and "which messages exist" is precisely a host's binding:
+ * a package cannot know that a product sends a "your quota is exhausted"
+ * notice, let alone what data it renders from. Writing `EmailPreviewsConfig`
+ * as a factory argument instead would move that decision out of
+ * `bindings.http`, where `assemble()` can report on it, into a call the report
+ * never sees.
+ *
+ * The routes carry `kind: 'authenticated'` — see `../email/previews/routes`
+ * for why the descriptor states a posture it cannot itself enforce.
+ */
+declare const notificationEmailPreviewsServerManifest: {
+    readonly name: "@12-apps/notifications-email-previews";
+    readonly http: {
+        readonly create: (config: EmailPreviewsConfig) => {
+            routes: EmailPreviewRoute[];
+        };
+    };
+};
 
-export { createWireApiNotifications, notificationsServerManifest };
+export { createWireApiNotifications, notificationEmailPreviewsServerManifest, notificationsServerManifest };

package/dist/manifest/server.js

@@ -1,12 +1,16 @@
+import {
+  emailPreviewRoutes
+} from "../chunk-FTFLU6KH.js";
 import {
   NOTIFICATIONS_JOBS
-} from "../chunk-CUZW62JS.js";
+} from "../chunk-KU4FVOFA.js";
 import {
   createApiNotifications
-} from "../chunk-WHBMPHQE.js";
-import "../chunk-HHMRCMQU.js";
-import "../chunk-XE7HZVMH.js";
+} from "../chunk-KZG7QGFA.js";
+import "../chunk-GGAZOLNN.js";
 import "../chunk-M2TVBVH2.js";
+import "../chunk-BGI4BQ66.js";
+import "../chunk-EKUSNUBT.js";
 import {
   __name
 } from "../chunk-7QVYU63E.js";
@@ -51,8 +55,15 @@ var notificationsServerManifest = {
    */
   jobs: NOTIFICATIONS_JOBS
 };
+var notificationEmailPreviewsServerManifest = {
+  name: "@12-apps/notifications-email-previews",
+  http: {
+    create: /* @__PURE__ */ __name((config) => ({ routes: emailPreviewRoutes(config) }), "create")
+  }
+};
 export {
   createWireApiNotifications,
+  notificationEmailPreviewsServerManifest,
   notificationsServerManifest
 };
 //# sourceMappingURL=server.js.map

package/dist/manifest/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/manifest/server.ts"],"sourcesContent":["/**\n * `@12-apps/notifications/manifest/server` — the server capabilities.\n *\n * `http.create` wraps `createApiNotifications` in a WIRE VIEW, and the reason\n * is one field. `NotificationsRequest` carries `headers` — the contract's\n * `WireRequest` does not, because headers are the adapter's business\n * everywhere else — and exactly one descriptor reads it: push-subscribe takes\n * `user-agent` as the DEVICE HINT it labels a subscription with. Without the\n * view the field would simply be absent at runtime while still type-checking,\n * and every saved device would come back unnamed: a silent quality loss, the\n * failure mode the wiring contract exists to convert into a loud one.\n *\n * So the view derives `headers` from the raw request the contract already\n * carries for the handlers `params`/`query`/`body` cannot serve. A host whose\n * adapter leaves `request` unset still gets a working surface — every route\n * answers, the subscription saves — with an unnamed device, which is the\n * honest degradation for a hint. `@12-apps/notifications/hono` populates it.\n *\n * Everything else rides beside the mapped routes on the aggregate unchanged:\n * `notify`, `notifyByPermission`, `dispatchDeliveries`, `drainPending`, the\n * three stores, `registerGenerator` and the transports registry. A host still\n * calls those directly — being mounted does not make the emit front door stop\n * being a library.\n */\n\nimport type { AnyServerManifest, WireRequest } from '@12-apps/wiring';\n\nimport {\n  createApiNotifications,\n  NOTIFICATIONS_JOBS,\n  type ApiNotifications,\n  type NotificationsRoute,\n  type NotificationsServerConfig,\n} from '../server';\n\n/** The header names this surface reads — the device hint, and nothing else. */\nconst READ_HEADERS = ['user-agent'] as const;\n\n/** The headers the package expects, taken off the raw request when there is one. */\nfunction headersOf(request: WireRequest<never>): Record<string, string | undefined> {\n  const raw = request.request;\n  if (!raw) return {};\n  return Object.fromEntries(\n    READ_HEADERS.map((name) => [name, raw.headers.get(name) ?? undefined]),\n  );\n}\n\n/** One `NotificationsRoute` as the wiring contract reads it. */\nfunction asWireRoute(route: NotificationsRoute): {\n  method: NotificationsRoute['method'];\n  path: string;\n  handle(request: WireRequest<never>): Promise<{ status: number; body: unknown }>;\n} {\n  return {\n    method: route.method,\n    path: route.path,\n    handle: (request) =>\n      route.handle({\n        actor: request.actor,\n        params: request.params,\n        query: request.query,\n        body: request.body,\n        headers: headersOf(request),\n      }),\n  };\n}\n\n/** `createApiNotifications`, its routes re-shaped for the aggregate. */\nexport function createWireApiNotifications(\n  config: NotificationsServerConfig,\n): Omit<ApiNotifications, 'routes'> & { routes: ReturnType<typeof asWireRoute>[] } {\n  const api = createApiNotifications(config);\n  return { ...api, routes: api.routes.map(asWireRoute) };\n}\n\nexport const notificationsServerManifest = {\n  name: '@12-apps/notifications',\n  http: { create: createWireApiNotifications },\n  /**\n   * The dispatch fast path and the retry sweep, with their cadence. The host\n   * binds `{ dispatchDeliveries, drainPending }` off its own mount — the two\n   * methods the aggregate already hands it — and deletes the hand-rolled\n   * copies. See `../server/jobs` for why the numbers are the package's.\n   */\n  jobs: NOTIFICATIONS_JOBS,\n} as const satisfies AnyServerManifest;\n"],"mappings":";;;;;;;;;;;;;;AAoCA,IAAM,eAAe,CAAC,YAAY;AAGlC,SAAS,UAAU,SAAiE;AAClF,QAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,SAAO,OAAO;AAAA,IACZ,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,QAAQ,IAAI,IAAI,KAAK,MAAS,CAAC;AAAA,EACvE;AACF;AANS;AAST,SAAS,YAAY,OAInB;AACA,SAAO;AAAA,IACL,QAAQ,MAAM;AAAA,IACd,MAAM,MAAM;AAAA,IACZ,QAAQ,wBAAC,YACP,MAAM,OAAO;AAAA,MACX,OAAO,QAAQ;AAAA,MACf,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ;AAAA,MACd,SAAS,UAAU,OAAO;AAAA,IAC5B,CAAC,GAPK;AAAA,EAQV;AACF;AAjBS;AAoBF,SAAS,2BACd,QACiF;AACjF,QAAM,MAAM,uBAAuB,MAAM;AACzC,SAAO,EAAE,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,WAAW,EAAE;AACvD;AALgB;AAOT,IAAM,8BAA8B;AAAA,EACzC,MAAM;AAAA,EACN,MAAM,EAAE,QAAQ,2BAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO3C,MAAM;AACR;","names":[]}
+{"version":3,"sources":["../../src/manifest/server.ts"],"sourcesContent":["/**\n * `@12-apps/notifications/manifest/server` — the server capabilities.\n *\n * `http.create` wraps `createApiNotifications` in a WIRE VIEW, and the reason\n * is one field. `NotificationsRequest` carries `headers` — the contract's\n * `WireRequest` does not, because headers are the adapter's business\n * everywhere else — and exactly one descriptor reads it: push-subscribe takes\n * `user-agent` as the DEVICE HINT it labels a subscription with. Without the\n * view the field would simply be absent at runtime while still type-checking,\n * and every saved device would come back unnamed: a silent quality loss, the\n * failure mode the wiring contract exists to convert into a loud one.\n *\n * So the view derives `headers` from the raw request the contract already\n * carries for the handlers `params`/`query`/`body` cannot serve. A host whose\n * adapter leaves `request` unset still gets a working surface — every route\n * answers, the subscription saves — with an unnamed device, which is the\n * honest degradation for a hint. `@12-apps/notifications/hono` populates it.\n *\n * Everything else rides beside the mapped routes on the aggregate unchanged:\n * `notify`, `notifyByPermission`, `dispatchDeliveries`, `drainPending`, the\n * three stores, `registerGenerator` and the transports registry. A host still\n * calls those directly — being mounted does not make the emit front door stop\n * being a library.\n */\n\nimport type { AnyServerManifest, WireRequest } from '@12-apps/wiring';\n\nimport { emailPreviewRoutes } from '../email/previews/routes';\nimport type { EmailPreviewsConfig } from '../email/previews/catalog';\nimport {\n  createApiNotifications,\n  NOTIFICATIONS_JOBS,\n  type ApiNotifications,\n  type NotificationsRoute,\n  type NotificationsServerConfig,\n} from '../server';\n\n/** The header names this surface reads — the device hint, and nothing else. */\nconst READ_HEADERS = ['user-agent'] as const;\n\n/** The headers the package expects, taken off the raw request when there is one. */\nfunction headersOf(request: WireRequest<never>): Record<string, string | undefined> {\n  const raw = request.request;\n  if (!raw) return {};\n  return Object.fromEntries(\n    READ_HEADERS.map((name) => [name, raw.headers.get(name) ?? undefined]),\n  );\n}\n\n/** One `NotificationsRoute` as the wiring contract reads it. */\nfunction asWireRoute(route: NotificationsRoute): {\n  method: NotificationsRoute['method'];\n  path: string;\n  handle(request: WireRequest<never>): Promise<{ status: number; body: unknown }>;\n} {\n  return {\n    method: route.method,\n    path: route.path,\n    handle: (request) =>\n      route.handle({\n        actor: request.actor,\n        params: request.params,\n        query: request.query,\n        body: request.body,\n        headers: headersOf(request),\n      }),\n  };\n}\n\n/** `createApiNotifications`, its routes re-shaped for the aggregate. */\nexport function createWireApiNotifications(\n  config: NotificationsServerConfig,\n): Omit<ApiNotifications, 'routes'> & { routes: ReturnType<typeof asWireRoute>[] } {\n  const api = createApiNotifications(config);\n  return { ...api, routes: api.routes.map(asWireRoute) };\n}\n\nexport const notificationsServerManifest = {\n  name: '@12-apps/notifications',\n  http: { create: createWireApiNotifications },\n  /**\n   * The dispatch fast path and the retry sweep, with their cadence. The host\n   * binds `{ dispatchDeliveries, drainPending }` off its own mount — the two\n   * methods the aggregate already hands it — and deletes the hand-rolled\n   * copies. See `../server/jobs` for why the numbers are the package's.\n   */\n  jobs: NOTIFICATIONS_JOBS,\n} as const satisfies AnyServerManifest;\n\n/**\n * The preview console's server half — the two endpoints over the catalogue.\n *\n * A CONSTANT, not a factory. `http.create(config)` receives whatever the host\n * bound at adoption, and \"which messages exist\" is precisely a host's binding:\n * a package cannot know that a product sends a \"your quota is exhausted\"\n * notice, let alone what data it renders from. Writing `EmailPreviewsConfig`\n * as a factory argument instead would move that decision out of\n * `bindings.http`, where `assemble()` can report on it, into a call the report\n * never sees.\n *\n * The routes carry `kind: 'authenticated'` — see `../email/previews/routes`\n * for why the descriptor states a posture it cannot itself enforce.\n */\nexport const notificationEmailPreviewsServerManifest = {\n  name: '@12-apps/notifications-email-previews',\n  http: {\n    create: (config: EmailPreviewsConfig) => ({ routes: emailPreviewRoutes(config) }),\n  },\n} as const satisfies AnyServerManifest;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAsCA,IAAM,eAAe,CAAC,YAAY;AAGlC,SAAS,UAAU,SAAiE;AAClF,QAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,SAAO,OAAO;AAAA,IACZ,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,QAAQ,IAAI,IAAI,KAAK,MAAS,CAAC;AAAA,EACvE;AACF;AANS;AAST,SAAS,YAAY,OAInB;AACA,SAAO;AAAA,IACL,QAAQ,MAAM;AAAA,IACd,MAAM,MAAM;AAAA,IACZ,QAAQ,wBAAC,YACP,MAAM,OAAO;AAAA,MACX,OAAO,QAAQ;AAAA,MACf,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ;AAAA,MACf,MAAM,QAAQ;AAAA,MACd,SAAS,UAAU,OAAO;AAAA,IAC5B,CAAC,GAPK;AAAA,EAQV;AACF;AAjBS;AAoBF,SAAS,2BACd,QACiF;AACjF,QAAM,MAAM,uBAAuB,MAAM;AACzC,SAAO,EAAE,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,WAAW,EAAE;AACvD;AALgB;AAOT,IAAM,8BAA8B;AAAA,EACzC,MAAM;AAAA,EACN,MAAM,EAAE,QAAQ,2BAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO3C,MAAM;AACR;AAgBO,IAAM,0CAA0C;AAAA,EACrD,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,QAAQ,wBAAC,YAAiC,EAAE,QAAQ,mBAAmB,MAAM,EAAE,IAAvE;AAAA,EACV;AACF;","names":[]}

package/dist/manifest/web.d.ts

@@ -1,7 +1,8 @@
-import { c as createWebNotifications } from '../create-web-notifications-BHCzaU2y.js';
+import { c as createEmailPreviewScreen } from '../preview-screen-DYJRAnAY.js';
+import { c as createWebNotifications } from '../create-web-notifications-B-xQ6R0B.js';
 import 'react';
-import '../wire-6dzyfDE7.js';
-import '../types-CXLAG3UU.js';
+import '../wire-_coV3tJk.js';
+import '../types-BFmAY0P5.js';
 
 /**
  * `@12-apps/notifications/manifest/web` — the web capabilities.
@@ -47,5 +48,18 @@ declare const notificationsWebManifest: {
         readonly create: typeof createWebNotifications;
     };
 };
+/**
+ * The preview console's web half.
+ *
+ * One screen, named `page`, because a screen's NAME is what an area row
+ * resolves against — a surface that was itself the component is the shape that
+ * made an area row resolve to `undefined` in `@12-apps/auth` for a release.
+ */
+declare const notificationEmailPreviewsWebManifest: {
+    readonly name: "@12-apps/notifications-email-previews";
+    readonly surface: {
+        readonly create: typeof createEmailPreviewScreen;
+    };
+};
 
-export { notificationsWebManifest };
+export { notificationEmailPreviewsWebManifest, notificationsWebManifest };

package/dist/manifest/web.js

@@ -1,7 +1,10 @@
 import {
   createWebNotifications
-} from "../chunk-MMLV4EZT.js";
+} from "../chunk-M5XTROYM.js";
 import "../chunk-BW723CX2.js";
+import {
+  createEmailPreviewScreen
+} from "../chunk-ZFIYBNZ7.js";
 import "../chunk-M2TVBVH2.js";
 import "../chunk-7QVYU63E.js";
 
@@ -10,7 +13,12 @@ var notificationsWebManifest = {
   name: "@12-apps/notifications",
   surface: { create: createWebNotifications }
 };
+var notificationEmailPreviewsWebManifest = {
+  name: "@12-apps/notifications-email-previews",
+  surface: { create: createEmailPreviewScreen }
+};
 export {
+  notificationEmailPreviewsWebManifest,
   notificationsWebManifest
 };
 //# sourceMappingURL=web.js.map

package/dist/manifest/web.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/manifest/web.ts"],"sourcesContent":["/**\n * `@12-apps/notifications/manifest/web` — the web capabilities.\n *\n * `surface.create` IS `createWebNotifications`, unchanged: the bell, the inbox\n * slide-over, the preferences screen and the bound store, built once per\n * adoption by the consumer's binder (the members are component TYPES, so\n * rebuilding per render unmounts the panel mid-interaction — the memoisation\n * rule every hand wiring carries as a comment today).\n *\n * ## Why this manifest exists now\n *\n * It was narrowed away with a reason that reads plausibly and is FALSE:\n * \"listing `web` would oblige every server host adopting this manifest to\n * answer for a React surface it never mounts.\" The consumer does not work\n * that way. A capability declared for the other runtime is reported\n * `out-of-scope` — \"a web host answers for this\" — and `assemble()` returns\n * fine; only a capability applicable to THIS runtime and unanswered is\n * `unbound`. `wiring`'s own fixture package declares both halves and its\n * server-host suite asserts exactly that.\n *\n * The narrowing therefore bought nothing and cost the thing the capability is\n * for. `./react` and `./web-push` ship Bell, Panel and Preferences — the exact\n * screens the adaptation report wanted to stop being hand-duplicated in hosts,\n * and the origin host duplicated the preferences screen and the push setup\n * anyway, because a manifest that never mentions them is a manifest nobody\n * discovers them from.\n *\n * ## Why there are no `areas`\n *\n * The bell is not a routed screen: it lives in a host's header chrome, beside\n * whatever else that host puts there, and no package can suggest a route for\n * it. Preferences IS routed, but where it belongs differs per host — under\n * account settings in one app, under a tenant's configuration in another — and\n * it is offered as `page` on the surface for the host to route at its own\n * call site. A suggested nav row would be wrong for every host but the first,\n * which is the `AreaContribution` doctrine's own test.\n */\n\nimport type { AnyWebManifest } from '@12-apps/wiring';\n\nimport { createWebNotifications } from '../react/create-web-notifications';\n\nexport const notificationsWebManifest = {\n  name: '@12-apps/notifications',\n  surface: { create: createWebNotifications },\n} as const satisfies AnyWebManifest;\n"],"mappings":";;;;;;;;AA0CO,IAAM,2BAA2B;AAAA,EACtC,MAAM;AAAA,EACN,SAAS,EAAE,QAAQ,uBAAuB;AAC5C;","names":[]}
+{"version":3,"sources":["../../src/manifest/web.ts"],"sourcesContent":["/**\n * `@12-apps/notifications/manifest/web` — the web capabilities.\n *\n * `surface.create` IS `createWebNotifications`, unchanged: the bell, the inbox\n * slide-over, the preferences screen and the bound store, built once per\n * adoption by the consumer's binder (the members are component TYPES, so\n * rebuilding per render unmounts the panel mid-interaction — the memoisation\n * rule every hand wiring carries as a comment today).\n *\n * ## Why this manifest exists now\n *\n * It was narrowed away with a reason that reads plausibly and is FALSE:\n * \"listing `web` would oblige every server host adopting this manifest to\n * answer for a React surface it never mounts.\" The consumer does not work\n * that way. A capability declared for the other runtime is reported\n * `out-of-scope` — \"a web host answers for this\" — and `assemble()` returns\n * fine; only a capability applicable to THIS runtime and unanswered is\n * `unbound`. `wiring`'s own fixture package declares both halves and its\n * server-host suite asserts exactly that.\n *\n * The narrowing therefore bought nothing and cost the thing the capability is\n * for. `./react` and `./web-push` ship Bell, Panel and Preferences — the exact\n * screens the adaptation report wanted to stop being hand-duplicated in hosts,\n * and the origin host duplicated the preferences screen and the push setup\n * anyway, because a manifest that never mentions them is a manifest nobody\n * discovers them from.\n *\n * ## Why there are no `areas`\n *\n * The bell is not a routed screen: it lives in a host's header chrome, beside\n * whatever else that host puts there, and no package can suggest a route for\n * it. Preferences IS routed, but where it belongs differs per host — under\n * account settings in one app, under a tenant's configuration in another — and\n * it is offered as `page` on the surface for the host to route at its own\n * call site. A suggested nav row would be wrong for every host but the first,\n * which is the `AreaContribution` doctrine's own test.\n */\n\nimport type { AnyWebManifest } from '@12-apps/wiring';\n\nimport { createEmailPreviewScreen } from '../email/previews/react/preview-screen';\nimport { createWebNotifications } from '../react/create-web-notifications';\n\nexport const notificationsWebManifest = {\n  name: '@12-apps/notifications',\n  surface: { create: createWebNotifications },\n} as const satisfies AnyWebManifest;\n\n/**\n * The preview console's web half.\n *\n * One screen, named `page`, because a screen's NAME is what an area row\n * resolves against — a surface that was itself the component is the shape that\n * made an area row resolve to `undefined` in `@12-apps/auth` for a release.\n */\nexport const notificationEmailPreviewsWebManifest = {\n  name: '@12-apps/notifications-email-previews',\n  surface: { create: createEmailPreviewScreen },\n} as const satisfies AnyWebManifest;\n"],"mappings":";;;;;;;;;;;AA2CO,IAAM,2BAA2B;AAAA,EACtC,MAAM;AAAA,EACN,SAAS,EAAE,QAAQ,uBAAuB;AAC5C;AASO,IAAM,uCAAuC;AAAA,EAClD,MAAM;AAAA,EACN,SAAS,EAAE,QAAQ,yBAAyB;AAC9C;","names":[]}

package/dist/{preferences-screen-IOW6Y2H2.js → preferences-screen-V3ZBWP7A.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-CQZMTFPY.js";
 import {
   NOTIFICATION_CHANNELS
-} from "./chunk-XE7HZVMH.js";
+} from "./chunk-BGI4BQ66.js";
 import {
   __name
 } from "./chunk-7QVYU63E.js";
@@ -291,4 +291,4 @@ __name(PreferencesScreen, "PreferencesScreen");
 export {
   PreferencesScreen
 };
-//# sourceMappingURL=preferences-screen-IOW6Y2H2.js.map
+//# sourceMappingURL=preferences-screen-V3ZBWP7A.js.map

package/dist/preview-screen-DYJRAnAY.d.ts

@@ -0,0 +1,83 @@
+import { JSX } from 'react';
+
+/**
+ * The SHAPE of the operator screen's words — no words.
+ *
+ * REQUIRED config with no default in any language, the copy-portability
+ * doctrine. `./copy.pt-BR` and `./copy.en-US` ship packs a host passes BY NAME.
+ *
+ * What is NOT here is anything from the mails themselves: a subject, a body and
+ * a button label all arrive from the server already rendered in whichever
+ * language the preview was asked for. That separation is the point of the
+ * language switch — the CHROME follows the operator, the MESSAGE follows its
+ * own recipient.
+ */
+interface EmailPreviewScreenCopy {
+    readonly title: string;
+    readonly description: string;
+    /** The sidebar's filter field. */
+    readonly searchLabel: string;
+    readonly searchPlaceholder: string;
+    /** Nothing matched the filter. */
+    readonly noMatches: string;
+    /** No row is selected yet. */
+    readonly pickOne: string;
+    /** The three views of one message. */
+    readonly tabHtml: string;
+    readonly tabText: string;
+    readonly tabSource: string;
+    /** The two widths the HTML view renders at. */
+    readonly widthDesktop: string;
+    readonly widthMobile: string;
+    /** The subject line's label above the preview. */
+    readonly subjectLabel: string;
+    /** The sandboxed frame's title, for screen readers. */
+    readonly frameTitle: string;
+    /** The coverage strip, when the surface reports a gap. */
+    readonly coverageTitle: string;
+    readonly missingSamples: (keys: string) => string;
+    readonly orphanSamples: (keys: string) => string;
+    /** Loading and failure states. */
+    readonly loading: string;
+    readonly loadError: string;
+    readonly retry: string;
+}
+
+/**
+ * The operator screen over the `./email/previews` catalogue.
+ *
+ * ## What a host supplies, and what it does not
+ *
+ * `apiBase` — where the routes are mounted — and `copy`, by name. Nothing else:
+ * the owners, the languages, the messages and their subjects all arrive from
+ * the surface, because they are facts about the host's own mail that no prop
+ * could usefully restate.
+ *
+ * ## The selection lives in the URL, without a router
+ *
+ * `?id=` and `?locale=`, read and written through `history.replaceState`. A
+ * link to one mail in one language is the actual workflow this screen serves —
+ * "look at what the reset mail says now" — and local state would make every
+ * such conversation a set of instructions instead of a link.
+ *
+ * Deliberately NOT a router integration: this package cannot know whether a
+ * host runs react-router, TanStack Router or a framework's own, and a screen
+ * that imported one would be unmountable in the other two. `replaceState` is
+ * the one API all of them are built on, and `replace` rather than `push` so
+ * browsing twenty mails is not twenty back-button steps.
+ */
+interface EmailPreviewScreenConfig {
+    /** Where the routes are mounted, e.g. `/api/platform/email-previews`. */
+    readonly apiBase: string;
+    /** The screen's words. REQUIRED — see `./copy`. */
+    readonly copy: EmailPreviewScreenCopy;
+}
+/**
+ * Build the screen. One call, one config object — the shape every factory in
+ * this estate has.
+ */
+declare function createEmailPreviewScreen(config: EmailPreviewScreenConfig): {
+    page: () => JSX.Element;
+};
+
+export { type EmailPreviewScreenCopy as E, type EmailPreviewScreenConfig as a, createEmailPreviewScreen as c };

package/dist/react/index.d.ts

@@ -1,8 +1,8 @@
-import { N as NotificationsApiClient } from '../create-web-notifications-BHCzaU2y.js';
-export { B as BADGE_POLL_MS, a as BADGE_RECONCILE_MS, b as BellButtonProps, I as InboxListStatus, d as InboxState, e as InboxStore, f as NotificationsHttpError, g as NotificationsPanelProps, h as NotificationsResult, i as NotificationsSignalHook, j as NotificationsSubscribe, k as NotificationsTransport, l as NotificationsWebConfig, P as PAGE_SIZE, m as PreferencesPayload, n as PreferencesScreenProps, o as PushRegistrationPayload, W as WebNotifications, p as WebPushPlatformHint, q as WebPushSetupConfig, r as createInboxStore, s as createNotificationsApiClient, c as createWebNotifications, t as httpNotificationsTransport, u as useInboxList, v as useInboxState, w as useUnreadCount } from '../create-web-notifications-BHCzaU2y.js';
+import { N as NotificationsApiClient } from '../create-web-notifications-B-xQ6R0B.js';
+export { B as BADGE_POLL_MS, a as BADGE_RECONCILE_MS, b as BellButtonProps, I as InboxListStatus, d as InboxState, e as InboxStore, f as NotificationsHttpError, g as NotificationsPanelProps, h as NotificationsResult, i as NotificationsSignalHook, j as NotificationsSubscribe, k as NotificationsTransport, l as NotificationsWebConfig, P as PAGE_SIZE, m as PreferencesPayload, n as PreferencesScreenProps, o as PushRegistrationPayload, W as WebNotifications, p as WebPushPlatformHint, q as WebPushSetupConfig, r as createInboxStore, s as createNotificationsApiClient, c as createWebNotifications, t as httpNotificationsTransport, u as useInboxList, v as useInboxState, w as useUnreadCount } from '../create-web-notifications-B-xQ6R0B.js';
 import { JSX } from 'react';
-import { N as NotificationMessages } from '../wire-6dzyfDE7.js';
-import '../types-CXLAG3UU.js';
+import { N as NotificationMessages } from '../wire-_coV3tJk.js';
+import '../types-BFmAY0P5.js';
 
 /** Inline SVG bell (no icon-library dependency in this package). */
 

package/dist/react/index.js

@@ -1,18 +1,12 @@
-import {
-  relativeTime
-} from "../chunk-O5BVUXPO.js";
-import {
-  disableWebPush,
-  enableWebPush,
-  getExistingPushSubscription,
-  pushSupported
-} from "../chunk-CQZMTFPY.js";
 import {
   NotificationsHttpError,
   createNotificationsApiClient,
   createWebNotifications,
   httpNotificationsTransport
-} from "../chunk-MMLV4EZT.js";
+} from "../chunk-M5XTROYM.js";
+import {
+  relativeTime
+} from "../chunk-O5BVUXPO.js";
 import {
   BADGE_POLL_MS,
   BADGE_RECONCILE_MS,
@@ -23,6 +17,12 @@ import {
   useInboxState,
   useUnreadCount
 } from "../chunk-BW723CX2.js";
+import {
+  disableWebPush,
+  enableWebPush,
+  getExistingPushSubscription,
+  pushSupported
+} from "../chunk-CQZMTFPY.js";
 import "../chunk-M2TVBVH2.js";
 import "../chunk-7QVYU63E.js";
 export {

package/dist/server/index.d.ts

@@ -1,11 +1,12 @@
-import { A as ApiNotifications } from '../create-api-notifications-B3u6Kx3x.js';
-export { C as CommittedNotification, E as EMAIL_DRIVERS, c as EmailDriver, d as EmailDriverDeclaration, e as EmailMessage, f as ExtraDrivers, L as ListNotificationsInput, g as NotificationAudienceDirectory, h as NotificationChannelPolicy, i as NotificationCommittedListener, j as NotificationContactDirectory, k as NotificationCreateData, l as NotificationDelegate, m as NotificationDeliveryDelegate, n as NotificationDeliveryRow, o as NotificationDeliveryWhere, p as NotificationDispatchScheduler, q as NotificationInboxStore, r as NotificationPageAfter, s as NotificationPreferenceDelegate, t as NotificationPreferenceRow, u as NotificationPreferenceStore, v as NotificationRouter, w as NotificationWhere, a as NotificationsActor, x as NotificationsApiError, y as NotificationsDb, z as NotificationsDbClient, B as NotificationsDbProvider, D as NotificationsRequest, F as NotificationsResponse, b as NotificationsRoute, N as NotificationsServerConfig, G as NotifyByPermission, H as NotifyOptions, I as NotifyResult, P as PermissionNotificationResult, J as PermissionNotificationSkip, K as PushSubscriptionDelegate, M as PushSubscriptionInput, O as PushSubscriptionRow, Q as PushSubscriptionStore, S as SMS_DRIVERS, R as SmsDriver, T as SmsDriverDeclaration, U as SmsMessage, V as TransportDeclaration, W as TransportRegistry, X as WHATSAPP_DRIVERS, Y as WhatsAppDriver, Z as WhatsAppDriverDeclaration, _ as WhatsAppMessage, $ as createApiNotifications, a0 as createTransportRegistry, a1 as emailTransport, a2 as foldApiError, a3 as formatEmail, a4 as formatSms, a5 as formatWhatsApp, a6 as ok, a7 as smsTransport, a8 as whatsAppTransport } from '../create-api-notifications-B3u6Kx3x.js';
-export { D as DriverDeclarationBase, F as FetchImpl, N as NotificationProviderError, W as WEB_PUSH_DRIVERS, a as WebPushDriverDeclaration, b as WebPushMessage, c as WebPushSender, d as WebPushSubscription, e as WebPushSubscriptionSource, f as absoluteLink, g as formatWebPush, w as webPushTransport } from '../web-push-Cs14Wp9u.js';
+import { A as ApiNotifications } from '../create-api-notifications-B-VMezVB.js';
+export { C as CommittedNotification, E as EMAIL_DRIVERS, c as EmailDriver, d as EmailDriverDeclaration, e as EmailMessage, f as ExtraDrivers, L as ListNotificationsInput, g as NotificationAudienceDirectory, h as NotificationChannelPolicy, i as NotificationCommittedListener, j as NotificationContactDirectory, k as NotificationCreateData, l as NotificationDelegate, m as NotificationDeliveryDelegate, n as NotificationDeliveryRow, o as NotificationDeliveryWhere, p as NotificationDispatchScheduler, q as NotificationInboxStore, r as NotificationPageAfter, s as NotificationPreferenceDelegate, t as NotificationPreferenceRow, u as NotificationPreferenceStore, v as NotificationRouter, w as NotificationWhere, a as NotificationsActor, x as NotificationsApiError, y as NotificationsDb, z as NotificationsDbClient, B as NotificationsDbProvider, D as NotificationsRequest, F as NotificationsResponse, b as NotificationsRoute, N as NotificationsServerConfig, G as NotifyByPermission, H as NotifyOptions, I as NotifyResult, P as PermissionNotificationResult, J as PermissionNotificationSkip, K as PushSubscriptionDelegate, M as PushSubscriptionInput, O as PushSubscriptionRow, Q as PushSubscriptionStore, S as SMS_DRIVERS, R as SmsDriver, T as SmsDriverDeclaration, U as SmsMessage, V as TransportDeclaration, W as TransportRegistry, X as WHATSAPP_DRIVERS, Y as WhatsAppDriver, Z as WhatsAppDriverDeclaration, _ as WhatsAppMessage, $ as createApiNotifications, a0 as createTransportRegistry, a1 as emailTransport, a2 as foldApiError, a3 as formatEmail, a4 as formatSms, a5 as formatWhatsApp, a6 as ok, a7 as smsTransport, a8 as whatsAppTransport } from '../create-api-notifications-B-VMezVB.js';
+export { D as DriverDeclarationBase, F as FetchImpl, N as NotificationProviderError, W as WEB_PUSH_DRIVERS, a as WebPushDriverDeclaration, b as WebPushMessage, c as WebPushSender, d as WebPushSubscription, e as WebPushSubscriptionSource, f as absoluteLink, g as formatWebPush, w as webPushTransport } from '../web-push-D-ysQd5h.js';
 import { NotifyPort } from '@12-apps/wiring/ports';
-export { a as NOTIFICATIONS_DRAIN_CRON, b as NOTIFICATIONS_DRAIN_LEASE_MS, c as NOTIFICATIONS_JOBS, d as NOTIFICATIONS_SWEEP_QUEUE, N as NotificationsJobDeps } from '../jobs-BDZ7aGHV.js';
-import '../generators-B9xt3sRh.js';
-import '../types-CXLAG3UU.js';
-import '../wire-6dzyfDE7.js';
+export { a as NOTIFICATIONS_DRAIN_CRON, b as NOTIFICATIONS_DRAIN_LEASE_MS, c as NOTIFICATIONS_JOBS, d as NOTIFICATIONS_SWEEP_QUEUE, N as NotificationsJobDeps } from '../jobs-D64B_bg7.js';
+import '../generators-BsuXe8Mp.js';
+import '../types-BFmAY0P5.js';
+import '../wire-_coV3tJk.js';
+import '../template-Dlt5S54z.js';
 import '@12-apps/wiring';
 
 /**

package/dist/server/index.js

@@ -4,7 +4,7 @@ import {
   NOTIFICATIONS_JOBS,
   NOTIFICATIONS_SWEEP_QUEUE,
   wireNotifyPort
-} from "../chunk-CUZW62JS.js";
+} from "../chunk-KU4FVOFA.js";
 import {
   EMAIL_DRIVERS,
   NotificationProviderError,
@@ -25,10 +25,11 @@ import {
   smsTransport,
   webPushTransport,
   whatsAppTransport
-} from "../chunk-WHBMPHQE.js";
-import "../chunk-HHMRCMQU.js";
-import "../chunk-XE7HZVMH.js";
+} from "../chunk-KZG7QGFA.js";
+import "../chunk-GGAZOLNN.js";
 import "../chunk-M2TVBVH2.js";
+import "../chunk-BGI4BQ66.js";
+import "../chunk-EKUSNUBT.js";
 import "../chunk-7QVYU63E.js";
 export {
   EMAIL_DRIVERS,

package/dist/template-Dlt5S54z.d.ts

@@ -0,0 +1,196 @@
+/**
+ * The layout's design tokens — the nine colours a mail is drawn from.
+ *
+ * ## Why a theme is a VALUE here and copy is required config
+ *
+ * The copy-portability doctrine is that a package ships no user-facing
+ * sentences: a default in the origin host's language reads as finished to the
+ * next host right up until somebody's customer gets mail in a language they do
+ * not speak. Colour is not that. {@link NEUTRAL_EMAIL_THEME} is not anybody's
+ * brand — it is grey on white, which reads as *unstyled but tidy* rather than
+ * as *somebody else's product*. A host that passes nothing gets a mail that
+ * looks plain, not a mail that looks like a different company.
+ *
+ * So this one has a default and the copy does not, and the difference is
+ * exactly whether getting it wrong is invisible. A missing theme is visible in
+ * the first preview; a wrong-language default is invisible until a customer
+ * complains.
+ *
+ * ## What a host should know before overriding it
+ *
+ * Two rungs of most brand palettes cannot carry light text, and a mail has no
+ * theme to fall back on when a client ignores a colour. {@link accent} is the
+ * one that MUST clear 4.5:1 against white — it is the CTA fill and every link.
+ * A warm mid-tone that looks fine on a screen at 2.6:1 is unreadable in an
+ * inbox, and nothing in the pipeline will say so.
+ */
+interface EmailTheme {
+    /** The page behind the card. Never pure white: a white card needs a ground. */
+    readonly page: string;
+    /** The card itself. */
+    readonly surface: string;
+    /** A quieter panel inside the card — the facts table. */
+    readonly panel: string;
+    /** Every hairline. */
+    readonly border: string;
+    /** Body text. */
+    readonly ink: string;
+    /** Secondary text: the footer, the fallback link, a fact's label. */
+    readonly muted: string;
+    /** The action colour — the CTA fill and every link. Must clear 4.5:1 on white. */
+    readonly accent: string;
+    /** Ink ON {@link accent}. */
+    readonly onAccent: string;
+    /** The rule under the wordmark. Decorative — nothing is written on it. */
+    readonly rule: string;
+}
+/**
+ * A brand-free default: greys, one blue, nothing anybody would mistake for a
+ * product. Every value clears its contrast requirement against its own ground.
+ */
+declare const NEUTRAL_EMAIL_THEME: EmailTheme;
+/**
+ * The font stack, as one string.
+ *
+ * System fonts only, and no web font: a `@font-face` is stripped by Gmail and
+ * by Outlook, so a mail that depends on one renders in whatever the client
+ * substitutes — never the fallback the designer chose. The stack ends in the
+ * emoji faces so a status glyph in a subject line does not drop to a tofu box
+ * on Windows.
+ */
+declare const EMAIL_FONT_STACK = "-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji'";
+/** The card's width. 600px is the width every client lays out without scroll. */
+declare const EMAIL_CONTENT_WIDTH = 600;
+
+/**
+ * THE transactional-mail layout: one document model, one HTML renderer, one
+ * plain-text twin.
+ *
+ * ## The problem it exists for
+ *
+ * A host that sends mail from more than one place ends up rendering it in more
+ * than one way — the notification pipeline emits a bold paragraph and a bare
+ * anchor, the sign-in flow emits a `div` with a max-width, the receipt builds
+ * its own list — and each grows its own `escapeHtml` and its own text twin. The
+ * three look like three different products, because a paragraph with no
+ * document around it inherits whatever the client decides: 13px Arial in Gmail,
+ * Times New Roman in Outlook, no centring anywhere.
+ *
+ * That is a LAYOUT problem rather than a wording one, which is what makes it a
+ * package's to solve. The words stay the host's; the document does not.
+ *
+ * ## Why the document is a MODEL and not a string
+ *
+ * Every caller hands over structure — a heading, some paragraphs, an optional
+ * facts table, at most one call to action — and never markup. Three things fall
+ * out of that, and each is a real defect in the hand-rolled renderers this
+ * replaces:
+ *
+ * 1. **Escaping cannot be forgotten.** Every field is escaped here, once. Of
+ *    the three renderers this was extracted from, two escaped the body and
+ *    interpolated the LINK raw.
+ * 2. **The plain-text twin cannot drift.** Both halves render from the same
+ *    object, so a line added to one is in the other. A `text/html` part with no
+ *    `text/plain` twin is scored by every major spam filter, and it is what a
+ *    watch, a terminal client and a screen reader in plain-text mode show.
+ * 3. **A preview is honest.** `./server`'s catalogue renders exactly this, from
+ *    exactly these inputs, so a preview cannot be right about a mail nobody
+ *    gets.
+ *
+ * ## The client constraints this encodes
+ *
+ * Stated once here, so no caller has to know them:
+ *
+ * - **Tables, not divs.** Outlook 2016+ on Windows lays HTML out with Word,
+ *   which supports no `flex`, no `grid` and no reliable `max-width` on a block.
+ *   A centred 600px table is the one construction every client agrees on.
+ * - **Inline styles.** Gmail strips `<style>` from the document it renders in
+ *   several contexts, and always in the Gmail app for a non-Gmail account. The
+ *   `<style>` block below therefore carries only the mobile media query —
+ *   progressive enhancement, never anything the layout depends on.
+ * - **No web fonts, no `color-mix()`, no CSS variables.** See `./theme`.
+ * - **A preheader.** The inbox list shows the first text in the body after the
+ *   subject; without one it shows the footer's legal line.
+ * - **`role="presentation"`** on every layout table, so a screen reader reads
+ *   the message rather than announcing a five-column grid.
+ */
+/** The words the LAYOUT itself needs — never the message's own sentences. */
+interface EmailChromeCopy {
+    /** "If the button does not work, paste this address into your browser:" */
+    readonly fallbackHint: string;
+    /** "This is an automated message — please do not reply." */
+    readonly automated: string;
+    /** The footer's one line about the product, given the brand name. */
+    readonly tagline: (brand: string) => string;
+}
+/** The one call to action a message may carry. More than one dilutes both. */
+interface EmailAction {
+    readonly label: string;
+    readonly href: string;
+}
+/** One row of the facts panel — a receipt's total, an order's reference. */
+interface EmailFact {
+    readonly label: string;
+    readonly value: string;
+    /** Renders bolder and larger — the one number the reader came for. */
+    readonly emphasis?: boolean;
+}
+/** Everything a message says, with no opinion about how it looks. */
+interface EmailDocument {
+    /** The subject line. Also the document `<title>`. */
+    readonly subject: string;
+    /**
+     * The inbox-list preview, ~90 chars. Falls back to the first paragraph,
+     * which is right far more often than it is wrong.
+     */
+    readonly preheader?: string;
+    /** The `<h1>`. Usually a restatement of the subject in the reader's terms. */
+    readonly heading: string;
+    /** The body, one entry per paragraph. Plain sentences — never markup. */
+    readonly paragraphs?: readonly string[];
+    /** An optional label/value panel under the body. */
+    readonly facts?: readonly EmailFact[];
+    /** At most one CTA. */
+    readonly action?: EmailAction;
+    /** Small print under the CTA — a deadline, a "you can ignore this". */
+    readonly notes?: readonly string[];
+    /**
+     * The layout's own words, in the recipient's language.
+     *
+     * REQUIRED, with no default in any language — the copy-portability doctrine.
+     * `@12-apps/notifications/email/locales` ships a pack per language and a host
+     * passes one BY
+     * NAME, which is a decision rather than a silence.
+     */
+    readonly chrome: EmailChromeCopy;
+    /**
+     * The product name in the header and the footer. REQUIRED: a package that
+     * defaulted this would sign another company's mail.
+     */
+    readonly brand: string;
+    /** The recipient's language, for the document's `lang` attribute. */
+    readonly locale: string;
+    /** Defaults to {@link NEUTRAL_EMAIL_THEME} — see `./theme` for why this one may. */
+    readonly theme?: EmailTheme;
+}
+/** A URL as an attribute value, or `#` when it is not one this layout will emit. */
+declare function safeHref(href: string): string;
+/**
+ * Render the document as the HTML half of the message.
+ *
+ * A complete document rather than a fragment: a `<!DOCTYPE>` is what puts
+ * Outlook into standards mode, and `x-apple-disable-message-reformatting` is
+ * what stops iOS Mail re-flowing the card to the screen width and shrinking the
+ * type with it.
+ */
+declare function renderEmailHtml(document: EmailDocument): string;
+/** Both halves plus the subject — what every driver in this repo is handed. */
+interface RenderedEmail {
+    readonly subject: string;
+    readonly html: string;
+    readonly text: string;
+}
+/** Render one document into the message shape `EmailDriver.send` takes. */
+declare function renderEmail(document: EmailDocument): RenderedEmail;
+
+export { type EmailDocument as E, NEUTRAL_EMAIL_THEME as N, type RenderedEmail as R, EMAIL_CONTENT_WIDTH as a, EMAIL_FONT_STACK as b, type EmailAction as c, type EmailChromeCopy as d, type EmailFact as e, type EmailTheme as f, renderEmailHtml as g, renderEmail as r, safeHref as s };