@abraca/resend 2.16.0

package/dist/abracadabra-resend.esm.js

@@ -0,0 +1,1638 @@
+#!/usr/bin/env node
+import { AbracadabraClient, AbracadabraProvider, Kind, SERVER_ROOT_ID, WebSocketStatus, makeEntryMap, patchEntry, toPlain } from "@abraca/dabra";
+import * as Y from "yjs";
+import { populateYDocFromMarkdown, yjsToHtml } from "@abraca/convert";
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { Resend } from "resend";
+import * as ed from "@noble/ed25519";
+import { existsSync } from "node:fs";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+
+//#region packages/resend/src/bootstrap.ts
+/**
+* Find or create the Inbox + Outbox documents under the bound Space.
+*
+* Idempotent: any existing top-level doc labelled "Inbox" or "Outbox" is reused
+* as-is — the user is allowed to rename, recolor, or restructure these docs
+* after they're created. Missing columns under the Outbox kanban are filled in.
+*/
+const INBOX_LABEL = "Inbox";
+const OUTBOX_LABEL = "Outbox";
+const OUTBOX_COLUMNS = [
+	"Draft",
+	"Ready",
+	"Sent",
+	"Failed"
+];
+function readEntries(treeMap, selfId) {
+	const entries = [];
+	treeMap.forEach((raw, id) => {
+		if (selfId && id === selfId) return;
+		const value = toPlain(raw);
+		if (typeof value !== "object" || value === null) return;
+		entries.push({
+			id,
+			label: typeof value.label === "string" ? value.label : "Untitled",
+			parentId: value.parentId ?? null,
+			order: typeof value.order === "number" ? value.order : 0,
+			type: typeof value.type === "string" ? value.type : void 0
+		});
+	});
+	return entries;
+}
+async function createDoc(server, opts) {
+	const treeMap = server.getTreeMap();
+	const rootDoc = server.rootDocument;
+	if (!treeMap || !rootDoc) throw new Error("Cannot create doc — server is not connected.");
+	const id = crypto.randomUUID();
+	const now = Date.now();
+	await server.client.createChild(opts.restParentId, {
+		child_id: id,
+		label: opts.label,
+		doc_type: opts.type,
+		kind: "page"
+	});
+	rootDoc.transact(() => {
+		treeMap.set(id, makeEntryMap({
+			label: opts.label,
+			parentId: opts.parentTreeId,
+			order: opts.order ?? now,
+			type: opts.type,
+			meta: opts.meta,
+			createdAt: now,
+			updatedAt: now
+		}));
+	});
+	return id;
+}
+async function bootstrap(server) {
+	const treeMap = server.getTreeMap();
+	const spaceDocId = server.spaceDocId;
+	if (!treeMap || !spaceDocId) throw new Error("Cannot bootstrap — server is not connected.");
+	const topLevel = readEntries(treeMap, spaceDocId).filter((e) => e.parentId === null);
+	const existingInbox = topLevel.find((e) => e.label.trim().toLowerCase() === INBOX_LABEL.toLowerCase());
+	const existingOutbox = topLevel.find((e) => e.label.trim().toLowerCase() === OUTBOX_LABEL.toLowerCase());
+	let inboxId;
+	if (existingInbox) {
+		inboxId = existingInbox.id;
+		console.error(`[abracadabra-resend] Inbox found: ${inboxId} (${existingInbox.label})`);
+	} else {
+		inboxId = await createDoc(server, {
+			parentTreeId: null,
+			restParentId: spaceDocId,
+			label: INBOX_LABEL,
+			type: "gallery",
+			meta: { icon: "inbox" }
+		});
+		console.error(`[abracadabra-resend] Inbox created: ${inboxId}`);
+	}
+	let outboxId;
+	if (existingOutbox) {
+		outboxId = existingOutbox.id;
+		console.error(`[abracadabra-resend] Outbox found: ${outboxId} (${existingOutbox.label})`);
+	} else {
+		outboxId = await createDoc(server, {
+			parentTreeId: null,
+			restParentId: spaceDocId,
+			label: OUTBOX_LABEL,
+			type: "kanban",
+			meta: { icon: "send" }
+		});
+		console.error(`[abracadabra-resend] Outbox created: ${outboxId}`);
+	}
+	const existingColumns = readEntries(treeMap, spaceDocId).filter((e) => e.parentId === outboxId);
+	const columns = {};
+	for (const colLabel of OUTBOX_COLUMNS) {
+		const match = existingColumns.find((e) => e.label.trim().toLowerCase() === colLabel.toLowerCase());
+		if (match) {
+			columns[colLabel] = match.id;
+			continue;
+		}
+		const id = await createDoc(server, {
+			parentTreeId: outboxId,
+			restParentId: outboxId,
+			label: colLabel,
+			order: Date.now() + OUTBOX_COLUMNS.indexOf(colLabel)
+		});
+		columns[colLabel] = id;
+		console.error(`[abracadabra-resend] Outbox column "${colLabel}" created: ${id}`);
+	}
+	return {
+		inboxId,
+		outboxId,
+		columns
+	};
+}
+
+//#endregion
+//#region packages/resend/src/utils.ts
+/**
+* Wait for a provider's `synced` event with a timeout.
+*
+* The `isSynced` short-circuit is load-bearing: providers that already synced
+* (e.g. cached child providers returned from `loadChild`) won't re-emit
+* `synced`, so without the short-circuit every later op on that doc times out.
+*/
+function waitForSync(provider, timeoutMs = 15e3) {
+	if (provider.isSynced) return Promise.resolve();
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			provider.off("synced", handler);
+			reject(/* @__PURE__ */ new Error(`Sync timed out after ${timeoutMs}ms`));
+		}, timeoutMs);
+		function handler() {
+			clearTimeout(timer);
+			provider.off("synced", handler);
+			resolve();
+		}
+		provider.on("synced", handler);
+	});
+}
+
+//#endregion
+//#region packages/resend/src/inbound-server.ts
+/**
+* Inbound webhook HTTP server.
+*
+* Single POST route: `/inbound`. Verifies Svix signature, parses Resend Inbound
+* payload, creates a child doc under the Inbox, uploads attachments. Operator
+* is responsible for exposing the port publicly (tunnel / reverse proxy) and
+* configuring Resend Inbound to deliver here.
+*/
+function addr(v) {
+	if (typeof v === "string") return v.trim() || void 0;
+	if (v && typeof v === "object") {
+		const obj = v;
+		if (typeof obj.email === "string") return obj.email.trim() || void 0;
+	}
+}
+function addrList(v) {
+	if (Array.isArray(v)) return v.map(addr).filter((s) => !!s);
+	const one = addr(v);
+	return one ? [one] : [];
+}
+function pickHeader(headers, name) {
+	if (!headers) return void 0;
+	const lower = name.toLowerCase();
+	for (const h of headers) if (typeof h?.name === "string" && h.name.toLowerCase() === lower) return h.value;
+}
+function decodeSecret(secret) {
+	const stripped = secret.startsWith("whsec_") ? secret.slice(6) : secret;
+	try {
+		return Buffer.from(stripped, "base64");
+	} catch {
+		return Buffer.from(stripped);
+	}
+}
+function constantTimeEquals(a, b) {
+	if (a.length !== b.length) return false;
+	return timingSafeEqual(a, b);
+}
+/**
+* Verify Svix-style signature. Headers carry `svix-id`, `svix-timestamp`,
+* `svix-signature` (space-separated `v1,<base64>` pairs). The signing input
+* is `${id}.${timestamp}.${body}` HMAC-SHA256 with the decoded secret.
+*/
+function verifySignature(body, headers, secret, toleranceSeconds) {
+	const id = headers["svix-id"];
+	const ts = headers["svix-timestamp"];
+	const sig = headers["svix-signature"];
+	if (typeof id !== "string" || typeof ts !== "string" || typeof sig !== "string") return {
+		ok: false,
+		reason: "missing Svix headers"
+	};
+	const tsNum = Number(ts);
+	if (!Number.isFinite(tsNum)) return {
+		ok: false,
+		reason: "invalid svix-timestamp"
+	};
+	const ageSec = Math.abs(Math.floor(Date.now() / 1e3) - tsNum);
+	if (ageSec > toleranceSeconds) return {
+		ok: false,
+		reason: `delivery too old (${ageSec}s)`
+	};
+	const toSign = `${id}.${ts}.${body}`;
+	const expected = createHmac("sha256", secret).update(toSign).digest();
+	const candidates = sig.split(" ").map((s) => s.trim()).filter(Boolean);
+	for (const candidate of candidates) {
+		const [version, value] = candidate.split(",");
+		if (version !== "v1" || !value) continue;
+		let provided;
+		try {
+			provided = Buffer.from(value, "base64");
+		} catch {
+			continue;
+		}
+		if (constantTimeEquals(expected, provided)) return { ok: true };
+	}
+	return {
+		ok: false,
+		reason: "signature mismatch"
+	};
+}
+function readBody(req, maxBytes = 25 * 1024 * 1024) {
+	return new Promise((resolve, reject) => {
+		const chunks = [];
+		let size = 0;
+		req.on("data", (chunk) => {
+			size += chunk.length;
+			if (size > maxBytes) {
+				reject(/* @__PURE__ */ new Error(`payload too large (>${maxBytes} bytes)`));
+				req.destroy();
+				return;
+			}
+			chunks.push(chunk);
+		});
+		req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+		req.on("error", reject);
+	});
+}
+var InboundServer = class {
+	constructor(opts) {
+		this.httpServer = null;
+		this.seenSvixIds = /* @__PURE__ */ new Set();
+		this.server = opts.server;
+		this.bootstrap = opts.bootstrap;
+		this.secret = decodeSecret(opts.secret);
+		this.toleranceSeconds = opts.toleranceSeconds ?? 300;
+		this.port = opts.port ?? 0;
+		this.host = opts.host ?? "0.0.0.0";
+	}
+	async start() {
+		this.httpServer = createServer((req, res) => {
+			this.handle(req, res);
+		});
+		await new Promise((resolve, reject) => {
+			this.httpServer.once("error", reject);
+			this.httpServer.listen(this.port, this.host, () => resolve());
+		});
+		const address = this.httpServer.address();
+		const boundPort = typeof address === "object" && address ? address.port : this.port;
+		console.error(`[abracadabra-resend] Inbound server listening on http://${this.host}:${boundPort}/inbound`);
+		return boundPort;
+	}
+	async stop() {
+		if (!this.httpServer) return;
+		await new Promise((resolve, reject) => {
+			this.httpServer.close((err) => err ? reject(err) : resolve());
+		});
+		this.httpServer = null;
+	}
+	async handle(req, res) {
+		try {
+			if (req.method === "GET" && (req.url === "/health" || req.url === "/")) {
+				res.writeHead(200, { "content-type": "text/plain" });
+				res.end("ok");
+				return;
+			}
+			if (req.method !== "POST" || req.url !== "/inbound") {
+				res.writeHead(404, { "content-type": "text/plain" });
+				res.end("not found");
+				return;
+			}
+			const body = await readBody(req);
+			const check = verifySignature(body, req.headers, this.secret, this.toleranceSeconds);
+			if (!check.ok) {
+				console.error(`[abracadabra-resend] inbound rejected: ${check.reason}`);
+				res.writeHead(401, { "content-type": "text/plain" });
+				res.end("unauthorized");
+				return;
+			}
+			const svixId = typeof req.headers["svix-id"] === "string" ? req.headers["svix-id"] : null;
+			if (svixId && this.seenSvixIds.has(svixId)) {
+				res.writeHead(200, { "content-type": "text/plain" });
+				res.end("duplicate");
+				return;
+			}
+			if (svixId) {
+				this.seenSvixIds.add(svixId);
+				if (this.seenSvixIds.size > 5e3) {
+					const first = this.seenSvixIds.values().next().value;
+					if (first) this.seenSvixIds.delete(first);
+				}
+			}
+			let env;
+			try {
+				env = JSON.parse(body);
+			} catch {
+				res.writeHead(400, { "content-type": "text/plain" });
+				res.end("invalid json");
+				return;
+			}
+			const data = env?.data ?? env;
+			await this.ingest(data);
+			res.writeHead(200, { "content-type": "text/plain" });
+			res.end("ok");
+		} catch (err) {
+			console.error(`[abracadabra-resend] inbound handler error: ${err?.message ?? err}`);
+			res.writeHead(500, { "content-type": "text/plain" });
+			res.end("error");
+		}
+	}
+	async ingest(data) {
+		await this.server.ensureConnected();
+		const treeMap = this.server.getTreeMap();
+		const rootDoc = this.server.rootDocument;
+		if (!treeMap || !rootDoc) throw new Error("Cannot ingest — server is not connected.");
+		const subjectRaw = typeof data.subject === "string" ? data.subject.trim() : "";
+		const subject = subjectRaw.length > 0 ? subjectRaw : "(no subject)";
+		const from = addr(data.from) ?? "(unknown)";
+		const to = addrList(data.to);
+		const cc = addrList(data.cc);
+		const inReplyTo = pickHeader(data.headers, "In-Reply-To");
+		const messageId = pickHeader(data.headers, "Message-ID") ?? data.id ?? null;
+		const inboxId = this.bootstrap.inboxId;
+		const id = crypto.randomUUID();
+		const now = Date.now();
+		const meta = {
+			icon: "mail",
+			from,
+			to,
+			cc: cc.length ? cc : void 0,
+			subject,
+			receivedAt: now,
+			messageId,
+			inReplyTo
+		};
+		if (typeof data.html === "string" && data.html.length > 0) meta.html = data.html;
+		await this.server.client.createChild(inboxId, {
+			child_id: id,
+			label: subject,
+			doc_type: "doc",
+			kind: "page"
+		});
+		rootDoc.transact(() => {
+			treeMap.set(id, makeEntryMap({
+				label: subject,
+				parentId: inboxId,
+				order: now,
+				type: "doc",
+				meta,
+				createdAt: now,
+				updatedAt: now
+			}));
+		});
+		const provider = await this.server.getChildProvider(id);
+		await waitForSync(provider);
+		populateYDocFromMarkdown(provider.document.getXmlFragment("default"), typeof data.text === "string" && data.text.length > 0 ? data.text : typeof data.html === "string" && data.html.length > 0 ? `<details><summary>HTML email (no text part)</summary>\n\n\`\`\`html\n${data.html}\n\`\`\`\n</details>` : "(empty body)", subject);
+		const attached = [];
+		const attachments = Array.isArray(data.attachments) ? data.attachments : [];
+		for (const att of attachments) {
+			if (typeof att?.content !== "string") continue;
+			const filename = typeof att.filename === "string" && att.filename.length > 0 ? att.filename : "attachment";
+			try {
+				const bytes = Buffer.from(att.content, "base64");
+				const blob = new Blob([bytes], { type: att.contentType ?? "application/octet-stream" });
+				const uploaded = await this.server.client.upload(id, blob, filename);
+				const uploadedId = uploaded?.id ?? uploaded?.uploadId ?? "";
+				attached.push({
+					id: uploadedId,
+					filename,
+					contentType: att.contentType,
+					size: bytes.length
+				});
+			} catch (err) {
+				console.error(`[abracadabra-resend] attachment upload failed (${filename}): ${err?.message ?? err}`);
+			}
+		}
+		if (attached.length > 0) {
+			const existingRaw = treeMap.get(id);
+			if (existingRaw) {
+				const existingMeta = (typeof existingRaw.toJSON === "function" ? existingRaw.toJSON()?.meta : existingRaw.meta) ?? {};
+				rootDoc.transact(() => {
+					treeMap.set(id, makeEntryMap({
+						label: subject,
+						parentId: inboxId,
+						order: now,
+						type: "doc",
+						meta: {
+							...existingMeta,
+							attachments: attached
+						},
+						createdAt: now,
+						updatedAt: Date.now()
+					}));
+				});
+			}
+		}
+		console.error(`[abracadabra-resend] inbound stored: "${subject}" from ${from} → doc ${id}`);
+	}
+};
+
+//#endregion
+//#region packages/resend/src/render.ts
+/**
+* Render an outbox document to an email-ready payload.
+*
+* Reads addressing from the doc's tree-entry `meta` (to/cc/bcc/subject/from/
+* replyTo) and renders the body Y.XmlFragment via `@abraca/convert`'s
+* `yjsToHtml` — which already emits a complete `<!DOCTYPE html>` doc with the
+* doc label as `<h1>`, so the result is suitable as-is for Resend's `html`
+* field.
+*/
+var RenderError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "RenderError";
+	}
+};
+function asStringArray(value) {
+	if (Array.isArray(value)) return value.filter((v) => typeof v === "string" && v.trim().length > 0).map((v) => v.trim());
+	if (typeof value === "string" && value.trim().length > 0) return value.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+	return [];
+}
+function asOptionalString(value) {
+	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function readEntry$1(server, docId) {
+	const treeMap = server.getTreeMap();
+	if (!treeMap) return null;
+	const raw = treeMap.get(docId);
+	if (!raw) return null;
+	const plain = toPlain(raw);
+	if (!plain || typeof plain !== "object") return null;
+	return {
+		label: typeof plain.label === "string" ? plain.label : "(no subject)",
+		meta: plain.meta && typeof plain.meta === "object" ? plain.meta : {}
+	};
+}
+async function renderEmail(server, docId, defaultFrom) {
+	const entry = readEntry$1(server, docId);
+	if (!entry) throw new RenderError(`Doc ${docId} has no tree entry.`);
+	const to = asStringArray(entry.meta.to);
+	if (to.length === 0) throw new RenderError(`Doc ${docId} has no recipients — set meta.to (array of email addresses).`);
+	const cc = asStringArray(entry.meta.cc);
+	const bcc = asStringArray(entry.meta.bcc);
+	const from = asOptionalString(entry.meta.from) ?? defaultFrom;
+	const replyTo = asOptionalString(entry.meta.replyTo);
+	const subject = asOptionalString(entry.meta.subject) ?? entry.label;
+	return {
+		subject,
+		html: yjsToHtml((await server.getChildProvider(docId)).document.getXmlFragment("default"), subject),
+		to,
+		cc: cc.length ? cc : void 0,
+		bcc: bcc.length ? bcc : void 0,
+		from,
+		replyTo
+	};
+}
+
+//#endregion
+//#region packages/resend/src/outbox-watcher.ts
+/**
+* Outbox watcher. Observes the doc-tree map (deeply, so per-entry parentId
+* updates surface) and dispatches any doc that lands under the "Ready" column.
+*
+* Dispatch flow per doc:
+*   render → resend.send → patch meta.resendId/sentAt → move to Sent
+* On failure:
+*   patch meta.error/errorAt → move to Failed (left for human triage)
+*
+* Idempotency:
+*   - `meta.resendId` already set → skip (recovers from a restart that landed
+*     between Resend ack and the post-send move).
+*   - In-flight `Set<docId>` prevents the same observe burst from double-firing.
+*/
+function readEntry(treeMap, id) {
+	const raw = treeMap.get(id);
+	if (!raw) return null;
+	const plain = toPlain(raw);
+	if (!plain || typeof plain !== "object") return null;
+	return {
+		id,
+		label: typeof plain.label === "string" ? plain.label : "Untitled",
+		parentId: plain.parentId ?? null,
+		meta: plain.meta && typeof plain.meta === "object" ? plain.meta : {}
+	};
+}
+var OutboxWatcher = class {
+	constructor(opts) {
+		this.inFlight = /* @__PURE__ */ new Set();
+		this.handled = /* @__PURE__ */ new Set();
+		this.observer = null;
+		this.treeMap = null;
+		this.rootDoc = null;
+		this.txHandler = null;
+		this.server = opts.server;
+		this.sender = opts.sender;
+		this.bootstrap = opts.bootstrap;
+		this.defaultFrom = opts.defaultFrom;
+	}
+	start() {
+		const treeMap = this.server.getTreeMap();
+		if (!treeMap) throw new Error("OutboxWatcher.start: server is not connected");
+		this.treeMap = treeMap;
+		const rootDoc = this.server.rootDocument;
+		if (!rootDoc) throw new Error("OutboxWatcher.start: root doc not connected");
+		this.rootDoc = rootDoc;
+		this.scan("init");
+		const obs = (events) => {
+			console.error(`[abracadabra-resend] observeDeep fired (${events.length} events)`);
+			this.scan("observeDeep");
+		};
+		treeMap.observeDeep(obs);
+		this.observer = obs;
+		const onTx = (tx) => {
+			const changed = [];
+			for (const [type, events] of tx.changedParentTypes.entries()) {
+				const name = type._item ? type._item.parentSub : type.constructor.name;
+				const keys = events.flatMap((ev) => Array.from(ev.keysChanged ?? []));
+				changed.push(`${name ?? "type"}[${keys.join(",")}]`);
+			}
+			console.error(`[abracadabra-resend] root afterTransaction (local=${tx.local}, origin=${String(tx.origin)}, changed=${changed.join(" | ") || "(none)"})`);
+			this.scan("afterTransaction");
+		};
+		rootDoc.on("afterTransaction", onTx);
+		this.txHandler = onTx;
+		const onSubdocs = (changes) => {
+			console.error(`[abracadabra-resend] subdocs: added=${changes.added.size} loaded=${changes.loaded.size}`);
+			for (const sub of [...changes.added, ...changes.loaded]) sub.on("afterTransaction", (tx) => {
+				console.error(`[abracadabra-resend] subdoc afterTransaction (guid=${sub.guid}, local=${tx.local})`);
+				this.scan("subdoc");
+			});
+		};
+		rootDoc.on("subdocs", onSubdocs);
+		rootDoc.on("update", (_update, origin) => {
+			console.error(`[abracadabra-resend] root update applied (origin=${String(origin)})`);
+			this.scan("update");
+		});
+		console.error(`[abracadabra-resend] Outbox watcher attached (ready column ${this.bootstrap.columns.Ready})`);
+	}
+	stop() {
+		if (this.rootDoc && this.txHandler) this.rootDoc.off("afterTransaction", this.txHandler);
+		if (this.treeMap && this.observer) this.treeMap.unobserveDeep(this.observer);
+		this.txHandler = null;
+		this.rootDoc = null;
+		this.observer = null;
+		this.treeMap = null;
+	}
+	async scan(reason) {
+		const treeMap = this.treeMap;
+		if (!treeMap) return;
+		const readyColId = this.bootstrap.columns.Ready;
+		const outboxId = this.bootstrap.outboxId;
+		const columnIds = new Set(Object.values(this.bootstrap.columns));
+		const candidates = [];
+		let inReadyCount = 0;
+		let totalEntries = 0;
+		const outboxSubtree = [];
+		treeMap.forEach((_raw, id) => {
+			totalEntries++;
+			const e = readEntry(treeMap, id);
+			if (!e) return;
+			if (e.parentId === outboxId || e.parentId && columnIds.has(e.parentId)) outboxSubtree.push({
+				id,
+				label: e.label,
+				parentId: e.parentId,
+				under: e.parentId === outboxId ? "Outbox" : e.parentId === this.bootstrap.columns.Draft ? "Draft" : e.parentId === this.bootstrap.columns.Ready ? "Ready" : e.parentId === this.bootstrap.columns.Sent ? "Sent" : e.parentId === this.bootstrap.columns.Failed ? "Failed" : "?"
+			});
+			if (e.parentId !== readyColId) return;
+			inReadyCount++;
+			if (this.inFlight.has(id) || this.handled.has(id)) return;
+			if (typeof e.meta.resendId === "string" && e.meta.resendId.length > 0) {
+				this.handled.add(id);
+				this.moveTo(id, this.bootstrap.columns.Sent);
+				return;
+			}
+			candidates.push(e);
+		});
+		console.error(`[abracadabra-resend] scan(${reason}): ${totalEntries} entries, ${inReadyCount} in Ready, ${candidates.length} to dispatch | Outbox subtree (${outboxSubtree.length}): ${outboxSubtree.map((e) => `${e.under}:"${e.label}"`).join(", ")}`);
+		for (const entry of candidates) {
+			this.inFlight.add(entry.id);
+			this.dispatch(entry).finally(() => {
+				this.inFlight.delete(entry.id);
+			});
+		}
+	}
+	async dispatch(entry) {
+		const { id, label } = entry;
+		try {
+			const payload = await renderEmail(this.server, id, this.defaultFrom);
+			console.error(`[abracadabra-resend] sending "${payload.subject}" → ${payload.to.join(", ")} (doc=${id})`);
+			const { id: resendId } = await this.sender.send(payload, { "X-Abra-Doc-Id": id });
+			this.handled.add(id);
+			this.patchMeta(id, {
+				resendId,
+				sentAt: Date.now(),
+				error: null
+			});
+			this.moveTo(id, this.bootstrap.columns.Sent);
+			console.error(`[abracadabra-resend] sent "${payload.subject}" (resend=${resendId}, doc=${id})`);
+		} catch (err) {
+			this.handled.add(id);
+			const message = err instanceof RenderError ? err.message : err?.message ? String(err.message) : String(err);
+			console.error(`[abracadabra-resend] send failed for "${label}" (${id}): ${message}`);
+			this.patchMeta(id, {
+				error: message,
+				errorAt: Date.now()
+			});
+			this.moveTo(id, this.bootstrap.columns.Failed);
+		}
+	}
+	patchMeta(id, patch) {
+		const treeMap = this.treeMap;
+		const rootDoc = this.server.rootDocument;
+		if (!treeMap || !rootDoc) return;
+		const current = readEntry(treeMap, id);
+		if (!current) return;
+		const nextMeta = {
+			...current.meta,
+			...patch
+		};
+		for (const [k, v] of Object.entries(patch)) if (v === null) delete nextMeta[k];
+		rootDoc.transact(() => {
+			patchEntry(treeMap, id, {
+				meta: nextMeta,
+				updatedAt: Date.now()
+			});
+		});
+	}
+	moveTo(id, newParentId) {
+		const treeMap = this.treeMap;
+		const rootDoc = this.server.rootDocument;
+		if (!treeMap || !rootDoc) return;
+		const now = Date.now();
+		rootDoc.transact(() => {
+			patchEntry(treeMap, id, {
+				parentId: newParentId,
+				order: now,
+				updatedAt: now
+			});
+		});
+		this.server.client.updateDocumentMeta(id, { parent_id: newParentId }).catch((e) => {
+			console.error(`[abracadabra-resend] REST reparent failed for ${id}: ${e?.message ?? e}`);
+		});
+	}
+};
+
+//#endregion
+//#region packages/resend/src/resend-client.ts
+/**
+* Thin wrapper around the official `resend` SDK. Kept separate so tests can
+* substitute a fake without mocking the SDK directly.
+*/
+var ResendClient = class {
+	constructor(apiKey) {
+		this.resend = new Resend(apiKey);
+	}
+	async send(payload, headers) {
+		if (!payload.from) throw new Error("ResendClient.send: payload.from is required");
+		const { data, error } = await this.resend.emails.send({
+			from: payload.from,
+			to: payload.to,
+			cc: payload.cc,
+			bcc: payload.bcc,
+			subject: payload.subject,
+			html: payload.html,
+			replyTo: payload.replyTo,
+			headers
+		});
+		if (error) throw new Error(`Resend rejected the message: ${error.message ?? JSON.stringify(error)}`);
+		if (!data?.id) throw new Error("Resend returned no id for the dispatched message");
+		return { id: data.id };
+	}
+};
+
+//#endregion
+//#region node_modules/@noble/hashes/utils.js
+/**
+* Checks if something is Uint8Array. Be careful: nodejs Buffer will return true.
+* @param a - value to test
+* @returns `true` when the value is a Uint8Array-compatible view.
+* @example
+* Check whether a value is a Uint8Array-compatible view.
+* ```ts
+* isBytes(new Uint8Array([1, 2, 3]));
+* ```
+*/
+function isBytes(a) {
+	return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+}
+/**
+* Asserts something is Uint8Array.
+* @param value - value to validate
+* @param length - optional exact length constraint
+* @param title - label included in thrown errors
+* @returns The validated byte array.
+* @throws On wrong argument types. {@link TypeError}
+* @throws On wrong argument ranges or values. {@link RangeError}
+* @example
+* Validate that a value is a byte array.
+* ```ts
+* abytes(new Uint8Array([1, 2, 3]));
+* ```
+*/
+function abytes(value, length, title = "") {
+	const bytes = isBytes(value);
+	const len = value?.length;
+	const needsLen = length !== void 0;
+	if (!bytes || needsLen && len !== length) {
+		const prefix = title && `"${title}" `;
+		const ofLen = needsLen ? ` of length ${length}` : "";
+		const got = bytes ? `length=${len}` : `type=${typeof value}`;
+		const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
+		if (!bytes) throw new TypeError(message);
+		throw new RangeError(message);
+	}
+	return value;
+}
+/**
+* Asserts a hash instance has not been destroyed or finished.
+* @param instance - hash instance to validate
+* @param checkFinished - whether to reject finalized instances
+* @throws If the hash instance has already been destroyed or finalized. {@link Error}
+* @example
+* Validate that a hash instance is still usable.
+* ```ts
+* import { aexists } from '@noble/hashes/utils.js';
+* import { sha256 } from '@noble/hashes/sha2.js';
+* const hash = sha256.create();
+* aexists(hash);
+* ```
+*/
+function aexists(instance, checkFinished = true) {
+	if (instance.destroyed) throw new Error("Hash instance has been destroyed");
+	if (checkFinished && instance.finished) throw new Error("Hash#digest() has already been called");
+}
+/**
+* Asserts output is a sufficiently-sized byte array.
+* @param out - destination buffer
+* @param instance - hash instance providing output length
+* Oversized buffers are allowed; downstream code only promises to fill the first `outputLen` bytes.
+* @throws On wrong argument types. {@link TypeError}
+* @throws On wrong argument ranges or values. {@link RangeError}
+* @example
+* Validate a caller-provided digest buffer.
+* ```ts
+* import { aoutput } from '@noble/hashes/utils.js';
+* import { sha256 } from '@noble/hashes/sha2.js';
+* const hash = sha256.create();
+* aoutput(new Uint8Array(hash.outputLen), hash);
+* ```
+*/
+function aoutput(out, instance) {
+	abytes(out, void 0, "digestInto() output");
+	const min = instance.outputLen;
+	if (out.length < min) throw new RangeError("\"digestInto() output\" expected to be of length >=" + min);
+}
+/**
+* Zeroizes typed arrays in place. Warning: JS provides no guarantees.
+* @param arrays - arrays to overwrite with zeros
+* @example
+* Zeroize sensitive buffers in place.
+* ```ts
+* clean(new Uint8Array([1, 2, 3]));
+* ```
+*/
+function clean(...arrays) {
+	for (let i = 0; i < arrays.length; i++) arrays[i].fill(0);
+}
+/**
+* Creates a DataView for byte-level manipulation.
+* @param arr - source typed array
+* @returns DataView over the same buffer region.
+* @example
+* Create a DataView over an existing buffer.
+* ```ts
+* createView(new Uint8Array(4));
+* ```
+*/
+function createView(arr) {
+	return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+/** Whether the current platform is little-endian. */
+const isLE = new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68;
+const hasHexBuiltin = typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function";
+/**
+* Creates a callable hash function from a stateful class constructor.
+* @param hashCons - hash constructor or factory
+* @param info - optional metadata such as DER OID
+* @returns Frozen callable hash wrapper with `.create()`.
+*   Wrapper construction eagerly calls `hashCons(undefined)` once to read
+*   `outputLen` / `blockLen`, so constructor side effects happen at module
+*   init time.
+* @example
+* Wrap a stateful hash constructor into a callable helper.
+* ```ts
+* import { createHasher } from '@noble/hashes/utils.js';
+* import { sha256 } from '@noble/hashes/sha2.js';
+* const wrapped = createHasher(sha256.create, { oid: sha256.oid });
+* wrapped(new Uint8Array([1]));
+* ```
+*/
+function createHasher(hashCons, info = {}) {
+	const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
+	const tmp = hashCons(void 0);
+	hashC.outputLen = tmp.outputLen;
+	hashC.blockLen = tmp.blockLen;
+	hashC.canXOF = tmp.canXOF;
+	hashC.create = (opts) => hashCons(opts);
+	Object.assign(hashC, info);
+	return Object.freeze(hashC);
+}
+/**
+* Creates OID metadata for NIST hashes with prefix `06 09 60 86 48 01 65 03 04 02`.
+* @param suffix - final OID byte for the selected hash.
+*   The helper accepts any byte even though only the documented NIST hash
+*   suffixes are meaningful downstream.
+* @returns Object containing the DER-encoded OID.
+* @example
+* Build OID metadata for a NIST hash.
+* ```ts
+* oidNist(0x01);
+* ```
+*/
+const oidNist = (suffix) => ({ oid: Uint8Array.from([
+	6,
+	9,
+	96,
+	134,
+	72,
+	1,
+	101,
+	3,
+	4,
+	2,
+	suffix
+]) });
+
+//#endregion
+//#region node_modules/@noble/hashes/_md.js
+/**
+* Internal Merkle-Damgard hash utils.
+* @module
+*/
+/**
+* Merkle-Damgard hash construction base class.
+* Could be used to create MD5, RIPEMD, SHA1, SHA2.
+* Accepts only byte-aligned `Uint8Array` input, even when the underlying spec describes bit
+* strings with partial-byte tails.
+* @param blockLen - internal block size in bytes
+* @param outputLen - digest size in bytes
+* @param padOffset - trailing length field size in bytes
+* @param isLE - whether length and state words are encoded in little-endian
+* @example
+* Use a concrete subclass to get the shared Merkle-Damgard update/digest flow.
+* ```ts
+* import { _SHA1 } from '@noble/hashes/legacy.js';
+* const hash = new _SHA1();
+* hash.update(new Uint8Array([97, 98, 99]));
+* hash.digest();
+* ```
+*/
+var HashMD = class {
+	blockLen;
+	outputLen;
+	canXOF = false;
+	padOffset;
+	isLE;
+	buffer;
+	view;
+	finished = false;
+	length = 0;
+	pos = 0;
+	destroyed = false;
+	constructor(blockLen, outputLen, padOffset, isLE) {
+		this.blockLen = blockLen;
+		this.outputLen = outputLen;
+		this.padOffset = padOffset;
+		this.isLE = isLE;
+		this.buffer = new Uint8Array(blockLen);
+		this.view = createView(this.buffer);
+	}
+	update(data) {
+		aexists(this);
+		abytes(data);
+		const { view, buffer, blockLen } = this;
+		const len = data.length;
+		for (let pos = 0; pos < len;) {
+			const take = Math.min(blockLen - this.pos, len - pos);
+			if (take === blockLen) {
+				const dataView = createView(data);
+				for (; blockLen <= len - pos; pos += blockLen) this.process(dataView, pos);
+				continue;
+			}
+			buffer.set(data.subarray(pos, pos + take), this.pos);
+			this.pos += take;
+			pos += take;
+			if (this.pos === blockLen) {
+				this.process(view, 0);
+				this.pos = 0;
+			}
+		}
+		this.length += data.length;
+		this.roundClean();
+		return this;
+	}
+	digestInto(out) {
+		aexists(this);
+		aoutput(out, this);
+		this.finished = true;
+		const { buffer, view, blockLen, isLE } = this;
+		let { pos } = this;
+		buffer[pos++] = 128;
+		clean(this.buffer.subarray(pos));
+		if (this.padOffset > blockLen - pos) {
+			this.process(view, 0);
+			pos = 0;
+		}
+		for (let i = pos; i < blockLen; i++) buffer[i] = 0;
+		view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE);
+		this.process(view, 0);
+		const oview = createView(out);
+		const len = this.outputLen;
+		if (len % 4) throw new Error("_sha2: outputLen must be aligned to 32bit");
+		const outLen = len / 4;
+		const state = this.get();
+		if (outLen > state.length) throw new Error("_sha2: outputLen bigger than state");
+		for (let i = 0; i < outLen; i++) oview.setUint32(4 * i, state[i], isLE);
+	}
+	digest() {
+		const { buffer, outputLen } = this;
+		this.digestInto(buffer);
+		const res = buffer.slice(0, outputLen);
+		this.destroy();
+		return res;
+	}
+	_cloneInto(to) {
+		to ||= new this.constructor();
+		to.set(...this.get());
+		const { blockLen, buffer, length, finished, destroyed, pos } = this;
+		to.destroyed = destroyed;
+		to.finished = finished;
+		to.length = length;
+		to.pos = pos;
+		if (length % blockLen) to.buffer.set(buffer);
+		return to;
+	}
+	clone() {
+		return this._cloneInto();
+	}
+};
+/** Initial SHA512 state from RFC 6234 §6.3: eight RFC 64-bit `H(0)` words stored as sixteen
+* big-endian 32-bit halves. Derived from the fractional parts of the square roots of the first
+* eight prime numbers. Exported as a shared table; callers must treat it as read-only because
+* constructors copy halves from it by index. */
+const SHA512_IV = /* @__PURE__ */ Uint32Array.from([
+	1779033703,
+	4089235720,
+	3144134277,
+	2227873595,
+	1013904242,
+	4271175723,
+	2773480762,
+	1595750129,
+	1359893119,
+	2917565137,
+	2600822924,
+	725511199,
+	528734635,
+	4215389547,
+	1541459225,
+	327033209
+]);
+
+//#endregion
+//#region node_modules/@noble/hashes/_u64.js
+const U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
+const _32n = /* @__PURE__ */ BigInt(32);
+function fromBig(n, le = false) {
+	if (le) return {
+		h: Number(n & U32_MASK64),
+		l: Number(n >> _32n & U32_MASK64)
+	};
+	return {
+		h: Number(n >> _32n & U32_MASK64) | 0,
+		l: Number(n & U32_MASK64) | 0
+	};
+}
+function split(lst, le = false) {
+	const len = lst.length;
+	let Ah = new Uint32Array(len);
+	let Al = new Uint32Array(len);
+	for (let i = 0; i < len; i++) {
+		const { h, l } = fromBig(lst[i], le);
+		[Ah[i], Al[i]] = [h, l];
+	}
+	return [Ah, Al];
+}
+const shrSH = (h, _l, s) => h >>> s;
+const shrSL = (h, l, s) => h << 32 - s | l >>> s;
+const rotrSH = (h, l, s) => h >>> s | l << 32 - s;
+const rotrSL = (h, l, s) => h << 32 - s | l >>> s;
+const rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32;
+const rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s;
+function add(Ah, Al, Bh, Bl) {
+	const l = (Al >>> 0) + (Bl >>> 0);
+	return {
+		h: Ah + Bh + (l / 2 ** 32 | 0) | 0,
+		l: l | 0
+	};
+}
+const add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
+const add3H = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0;
+const add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
+const add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0;
+const add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
+const add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
+
+//#endregion
+//#region node_modules/@noble/hashes/sha2.js
+/**
+* SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.
+* SHA256 is the fastest hash implementable in JS, even faster than Blake3.
+* Check out {@link https://www.rfc-editor.org/rfc/rfc4634 | RFC 4634} and
+* {@link https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf | FIPS 180-4}.
+* @module
+*/
+const K512 = split([
+	"0x428a2f98d728ae22",
+	"0x7137449123ef65cd",
+	"0xb5c0fbcfec4d3b2f",
+	"0xe9b5dba58189dbbc",
+	"0x3956c25bf348b538",
+	"0x59f111f1b605d019",
+	"0x923f82a4af194f9b",
+	"0xab1c5ed5da6d8118",
+	"0xd807aa98a3030242",
+	"0x12835b0145706fbe",
+	"0x243185be4ee4b28c",
+	"0x550c7dc3d5ffb4e2",
+	"0x72be5d74f27b896f",
+	"0x80deb1fe3b1696b1",
+	"0x9bdc06a725c71235",
+	"0xc19bf174cf692694",
+	"0xe49b69c19ef14ad2",
+	"0xefbe4786384f25e3",
+	"0x0fc19dc68b8cd5b5",
+	"0x240ca1cc77ac9c65",
+	"0x2de92c6f592b0275",
+	"0x4a7484aa6ea6e483",
+	"0x5cb0a9dcbd41fbd4",
+	"0x76f988da831153b5",
+	"0x983e5152ee66dfab",
+	"0xa831c66d2db43210",
+	"0xb00327c898fb213f",
+	"0xbf597fc7beef0ee4",
+	"0xc6e00bf33da88fc2",
+	"0xd5a79147930aa725",
+	"0x06ca6351e003826f",
+	"0x142929670a0e6e70",
+	"0x27b70a8546d22ffc",
+	"0x2e1b21385c26c926",
+	"0x4d2c6dfc5ac42aed",
+	"0x53380d139d95b3df",
+	"0x650a73548baf63de",
+	"0x766a0abb3c77b2a8",
+	"0x81c2c92e47edaee6",
+	"0x92722c851482353b",
+	"0xa2bfe8a14cf10364",
+	"0xa81a664bbc423001",
+	"0xc24b8b70d0f89791",
+	"0xc76c51a30654be30",
+	"0xd192e819d6ef5218",
+	"0xd69906245565a910",
+	"0xf40e35855771202a",
+	"0x106aa07032bbd1b8",
+	"0x19a4c116b8d2d0c8",
+	"0x1e376c085141ab53",
+	"0x2748774cdf8eeb99",
+	"0x34b0bcb5e19b48a8",
+	"0x391c0cb3c5c95a63",
+	"0x4ed8aa4ae3418acb",
+	"0x5b9cca4f7763e373",
+	"0x682e6ff3d6b2b8a3",
+	"0x748f82ee5defb2fc",
+	"0x78a5636f43172f60",
+	"0x84c87814a1f0ab72",
+	"0x8cc702081a6439ec",
+	"0x90befffa23631e28",
+	"0xa4506cebde82bde9",
+	"0xbef9a3f7b2c67915",
+	"0xc67178f2e372532b",
+	"0xca273eceea26619c",
+	"0xd186b8c721c0c207",
+	"0xeada7dd6cde0eb1e",
+	"0xf57d4f7fee6ed178",
+	"0x06f067aa72176fba",
+	"0x0a637dc5a2c898a6",
+	"0x113f9804bef90dae",
+	"0x1b710b35131c471b",
+	"0x28db77f523047d84",
+	"0x32caab7b40c72493",
+	"0x3c9ebe0a15c9bebc",
+	"0x431d67c49c100d4c",
+	"0x4cc5d4becb3e42b6",
+	"0x597f299cfc657e2a",
+	"0x5fcb6fab3ad6faec",
+	"0x6c44198c4a475817"
+].map((n) => BigInt(n)));
+const SHA512_Kh = K512[0];
+const SHA512_Kl = K512[1];
+const SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
+const SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
+/** Internal SHA-384 / SHA-512 compression engine from RFC 6234 §6.4. */
+var SHA2_64B = class extends HashMD {
+	constructor(outputLen) {
+		super(128, outputLen, 16, false);
+	}
+	get() {
+		const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+		return [
+			Ah,
+			Al,
+			Bh,
+			Bl,
+			Ch,
+			Cl,
+			Dh,
+			Dl,
+			Eh,
+			El,
+			Fh,
+			Fl,
+			Gh,
+			Gl,
+			Hh,
+			Hl
+		];
+	}
+	set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {
+		this.Ah = Ah | 0;
+		this.Al = Al | 0;
+		this.Bh = Bh | 0;
+		this.Bl = Bl | 0;
+		this.Ch = Ch | 0;
+		this.Cl = Cl | 0;
+		this.Dh = Dh | 0;
+		this.Dl = Dl | 0;
+		this.Eh = Eh | 0;
+		this.El = El | 0;
+		this.Fh = Fh | 0;
+		this.Fl = Fl | 0;
+		this.Gh = Gh | 0;
+		this.Gl = Gl | 0;
+		this.Hh = Hh | 0;
+		this.Hl = Hl | 0;
+	}
+	process(view, offset) {
+		for (let i = 0; i < 16; i++, offset += 4) {
+			SHA512_W_H[i] = view.getUint32(offset);
+			SHA512_W_L[i] = view.getUint32(offset += 4);
+		}
+		for (let i = 16; i < 80; i++) {
+			const W15h = SHA512_W_H[i - 15] | 0;
+			const W15l = SHA512_W_L[i - 15] | 0;
+			const s0h = rotrSH(W15h, W15l, 1) ^ rotrSH(W15h, W15l, 8) ^ shrSH(W15h, W15l, 7);
+			const s0l = rotrSL(W15h, W15l, 1) ^ rotrSL(W15h, W15l, 8) ^ shrSL(W15h, W15l, 7);
+			const W2h = SHA512_W_H[i - 2] | 0;
+			const W2l = SHA512_W_L[i - 2] | 0;
+			const s1h = rotrSH(W2h, W2l, 19) ^ rotrBH(W2h, W2l, 61) ^ shrSH(W2h, W2l, 6);
+			const s1l = rotrSL(W2h, W2l, 19) ^ rotrBL(W2h, W2l, 61) ^ shrSL(W2h, W2l, 6);
+			const SUMl = add4L(s0l, s1l, SHA512_W_L[i - 7], SHA512_W_L[i - 16]);
+			SHA512_W_H[i] = add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]) | 0;
+			SHA512_W_L[i] = SUMl | 0;
+		}
+		let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+		for (let i = 0; i < 80; i++) {
+			const sigma1h = rotrSH(Eh, El, 14) ^ rotrSH(Eh, El, 18) ^ rotrBH(Eh, El, 41);
+			const sigma1l = rotrSL(Eh, El, 14) ^ rotrSL(Eh, El, 18) ^ rotrBL(Eh, El, 41);
+			const CHIh = Eh & Fh ^ ~Eh & Gh;
+			const CHIl = El & Fl ^ ~El & Gl;
+			const T1ll = add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);
+			const T1h = add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);
+			const T1l = T1ll | 0;
+			const sigma0h = rotrSH(Ah, Al, 28) ^ rotrBH(Ah, Al, 34) ^ rotrBH(Ah, Al, 39);
+			const sigma0l = rotrSL(Ah, Al, 28) ^ rotrBL(Ah, Al, 34) ^ rotrBL(Ah, Al, 39);
+			const MAJh = Ah & Bh ^ Ah & Ch ^ Bh & Ch;
+			const MAJl = Al & Bl ^ Al & Cl ^ Bl & Cl;
+			Hh = Gh | 0;
+			Hl = Gl | 0;
+			Gh = Fh | 0;
+			Gl = Fl | 0;
+			Fh = Eh | 0;
+			Fl = El | 0;
+			({h: Eh, l: El} = add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));
+			Dh = Ch | 0;
+			Dl = Cl | 0;
+			Ch = Bh | 0;
+			Cl = Bl | 0;
+			Bh = Ah | 0;
+			Bl = Al | 0;
+			const All = add3L(T1l, sigma0l, MAJl);
+			Ah = add3H(All, T1h, sigma0h, MAJh);
+			Al = All | 0;
+		}
+		({h: Ah, l: Al} = add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));
+		({h: Bh, l: Bl} = add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));
+		({h: Ch, l: Cl} = add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));
+		({h: Dh, l: Dl} = add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));
+		({h: Eh, l: El} = add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));
+		({h: Fh, l: Fl} = add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));
+		({h: Gh, l: Gl} = add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));
+		({h: Hh, l: Hl} = add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));
+		this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);
+	}
+	roundClean() {
+		clean(SHA512_W_H, SHA512_W_L);
+	}
+	destroy() {
+		this.destroyed = true;
+		clean(this.buffer);
+		this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+	}
+};
+/** Internal SHA-512 hash class grounded in RFC 6234 §6.3 and §6.4. */
+var _SHA512 = class extends SHA2_64B {
+	Ah = SHA512_IV[0] | 0;
+	Al = SHA512_IV[1] | 0;
+	Bh = SHA512_IV[2] | 0;
+	Bl = SHA512_IV[3] | 0;
+	Ch = SHA512_IV[4] | 0;
+	Cl = SHA512_IV[5] | 0;
+	Dh = SHA512_IV[6] | 0;
+	Dl = SHA512_IV[7] | 0;
+	Eh = SHA512_IV[8] | 0;
+	El = SHA512_IV[9] | 0;
+	Fh = SHA512_IV[10] | 0;
+	Fl = SHA512_IV[11] | 0;
+	Gh = SHA512_IV[12] | 0;
+	Gl = SHA512_IV[13] | 0;
+	Hh = SHA512_IV[14] | 0;
+	Hl = SHA512_IV[15] | 0;
+	constructor() {
+		super(64);
+	}
+};
+/**
+* SHA2-512 hash function from RFC 4634.
+* @param msg - message bytes to hash
+* @returns Digest bytes.
+* @example
+* Hash a message with SHA2-512.
+* ```ts
+* sha512(new Uint8Array([97, 98, 99]));
+* ```
+*/
+const sha512 = /* @__PURE__ */ createHasher(() => new _SHA512(), /* @__PURE__ */ oidNist(3));
+
+//#endregion
+//#region packages/resend/src/crypto.ts
+/**
+* Ed25519 key generation, persistence, and challenge signing for the Resend bridge.
+* Same shape as @abraca/mcp's crypto module; intentionally vendored so this package
+* doesn't depend on @abraca/mcp.
+*/
+ed.hashes.sha512 = sha512;
+ed.hashes.sha512Async = (m) => Promise.resolve(sha512(m));
+const DEFAULT_KEY_PATH = join(homedir(), ".abracadabra", "resend.key");
+function toBase64url(bytes) {
+	return Buffer.from(bytes).toString("base64url");
+}
+function fromBase64url(b64) {
+	return new Uint8Array(Buffer.from(b64, "base64url"));
+}
+async function loadOrCreateKeypair(keyPath) {
+	const path = keyPath || DEFAULT_KEY_PATH;
+	if (existsSync(path)) {
+		const seed = await readFile(path);
+		if (seed.length !== 32) throw new Error(`Invalid key file at ${path}: expected 32 bytes, got ${seed.length}`);
+		const privateKey = new Uint8Array(seed);
+		return {
+			privateKey,
+			publicKeyB64: toBase64url(ed.getPublicKey(privateKey))
+		};
+	}
+	const privateKey = ed.utils.randomSecretKey();
+	const publicKey = ed.getPublicKey(privateKey);
+	const dir = dirname(path);
+	if (!existsSync(dir)) await mkdir(dir, {
+		recursive: true,
+		mode: 448
+	});
+	await writeFile(path, Buffer.from(privateKey), { mode: 384 });
+	console.error(`[abracadabra-resend] Generated new agent keypair at ${path}`);
+	console.error(`[abracadabra-resend] Public key: ${toBase64url(publicKey)}`);
+	return {
+		privateKey,
+		publicKeyB64: toBase64url(publicKey)
+	};
+}
+function signChallenge(challengeB64, privateKey) {
+	const challenge = fromBase64url(challengeB64);
+	return toBase64url(ed.sign(challenge, privateKey));
+}
+
+//#endregion
+//#region packages/resend/src/server.ts
+const IDLE_TIMEOUT_MS = 300 * 1e3;
+var AbracadabraResendServer = class {
+	constructor(config) {
+		this._serverInfo = null;
+		this._spaces = [];
+		this._connection = null;
+		this.childCache = /* @__PURE__ */ new Map();
+		this.evictionTimer = null;
+		this._userId = null;
+		this._signFn = null;
+		this._reconnecting = null;
+		this.config = config;
+		this.client = new AbracadabraClient({
+			url: config.url,
+			persistAuth: false
+		});
+	}
+	get agentName() {
+		return this.config.agentName || "Resend Bridge";
+	}
+	get serverInfo() {
+		return this._serverInfo;
+	}
+	get spaceDocId() {
+		return this._connection?.docId ?? null;
+	}
+	get rootDocument() {
+		return this._connection?.doc ?? null;
+	}
+	get rootProvider() {
+		return this._connection?.provider ?? null;
+	}
+	get userId() {
+		return this._userId;
+	}
+	get spaces() {
+		return this._spaces;
+	}
+	/** Authenticate, discover spaces, connect to the configured (or first) space. */
+	async connect() {
+		const keypair = await loadOrCreateKeypair(this.config.keyFile);
+		this._userId = keypair.publicKeyB64;
+		const signFn = (challenge) => Promise.resolve(signChallenge(challenge, keypair.privateKey));
+		this._signFn = signFn;
+		try {
+			await this.client.loginWithKey(keypair.publicKeyB64, signFn);
+		} catch (err) {
+			const status = err?.status ?? err?.response?.status;
+			const msg = String(err?.message ?? "").toLowerCase();
+			if (!(status === 404 || status === 422 || status === 401 && /not registered|user not found|no such user/.test(msg))) throw err;
+			console.error("[abracadabra-resend] Key not registered, creating new account...");
+			await this.client.registerWithKey({
+				publicKey: keypair.publicKeyB64,
+				username: this.agentName.replace(/\s+/g, "-").toLowerCase(),
+				displayName: this.agentName,
+				deviceName: "Resend Bridge",
+				inviteCode: this.config.inviteCode
+			});
+			await this.client.loginWithKey(keypair.publicKeyB64, signFn);
+		}
+		console.error(`[abracadabra-resend] Authenticated as ${this.agentName} (pubkey=${keypair.publicKeyB64})`);
+		this._serverInfo = await this.client.serverInfo();
+		const roots = await this.client.listChildren();
+		this._spaces = roots.filter((d) => d.kind === Kind.Space);
+		let targetId = this.config.spaceId;
+		if (targetId) {
+			if (!(this._spaces.find((s) => s.id === targetId) ?? roots.find((d) => d.id === targetId))) throw new Error(`Configured ABRA_SPACE_ID=${targetId} not found among server roots`);
+		} else {
+			targetId = this._spaces[0]?.id ?? roots[0]?.id;
+			if (!targetId) throw new Error(`No entry point found: server has no top-level documents under ${SERVER_ROOT_ID}.`);
+		}
+		console.error(`[abracadabra-resend] Binding to space ${targetId}`);
+		await this._connectToSpace(targetId);
+		console.error("[abracadabra-resend] Space doc synced");
+		this.evictionTimer = setInterval(() => this.evictIdle(), 6e4);
+	}
+	async _connectToSpace(docId) {
+		if (!this.client.isTokenValid() && this._signFn && this._userId) {
+			console.error("[abracadabra-resend] JWT expired, re-authenticating...");
+			await this.client.loginWithKey(this._userId, this._signFn);
+		}
+		const doc = new Y.Doc({ guid: docId });
+		const provider = new AbracadabraProvider({
+			name: docId,
+			document: doc,
+			client: this.client,
+			disableOfflineStore: true,
+			subdocLoading: "lazy"
+		});
+		await waitForSync(provider);
+		provider.awareness?.setLocalStateField("user", {
+			name: this.agentName,
+			color: "hsl(170, 70%, 45%)",
+			publicKey: this._userId,
+			isAgent: true
+		});
+		const conn = {
+			doc,
+			provider,
+			docId
+		};
+		this._connection = conn;
+		return conn;
+	}
+	_wsConnected(provider) {
+		return provider.connectionStatus === WebSocketStatus.Connected;
+	}
+	/**
+	* Heal a dropped socket / expired JWT before tool ops. De-duped across
+	* concurrent callers; best-effort (never throws — a failed heal falls
+	* through to the caller's normal error handling).
+	*/
+	async ensureConnected() {
+		if (this._reconnecting) return this._reconnecting;
+		this._reconnecting = (async () => {
+			try {
+				if (!this.client.isTokenValid() && this._signFn && this._userId) try {
+					await this.client.loginWithKey(this._userId, this._signFn);
+				} catch (e) {
+					console.error("[abracadabra-resend] Re-auth during heal failed:", e);
+				}
+				const conn = this._connection;
+				if (!conn) return;
+				if (this._wsConnected(conn.provider)) return;
+				try {
+					await waitForSync(conn.provider, 6e3);
+				} catch {}
+				if (this._wsConnected(conn.provider)) return;
+				console.error("[abracadabra-resend] Active connection dead — rebuilding…");
+				const docId = conn.docId;
+				try {
+					conn.provider.destroy();
+				} catch {}
+				for (const [, cached] of this.childCache) try {
+					cached.provider.destroy();
+				} catch {}
+				this.childCache.clear();
+				try {
+					await this._connectToSpace(docId);
+					console.error("[abracadabra-resend] Space provider rebuilt + synced");
+				} catch (e) {
+					console.error("[abracadabra-resend] Connection rebuild failed:", e);
+				}
+			} finally {
+				this._reconnecting = null;
+			}
+		})();
+		return this._reconnecting;
+	}
+	getTreeMap() {
+		return this._connection?.doc.getMap("doc-tree") ?? null;
+	}
+	async getChildProvider(docId) {
+		await this.ensureConnected();
+		const cached = this.childCache.get(docId);
+		if (cached && cached.provider.connectionStatus !== WebSocketStatus.Disconnected) {
+			cached.lastAccessed = Date.now();
+			return cached.provider;
+		}
+		if (cached) {
+			try {
+				cached.provider.destroy();
+			} catch {}
+			this.childCache.delete(docId);
+		}
+		const root = this._connection?.provider;
+		if (!root) throw new Error("Not connected. Call connect() first.");
+		if (!this.client.isTokenValid() && this._signFn && this._userId) await this.client.loginWithKey(this._userId, this._signFn);
+		const childProvider = await root.loadChild(docId);
+		await waitForSync(childProvider);
+		this.childCache.set(docId, {
+			provider: childProvider,
+			lastAccessed: Date.now()
+		});
+		return childProvider;
+	}
+	evictIdle() {
+		const now = Date.now();
+		for (const [docId, cached] of this.childCache) if (now - cached.lastAccessed > IDLE_TIMEOUT_MS) {
+			cached.provider.destroy();
+			this.childCache.delete(docId);
+			console.error(`[abracadabra-resend] Evicted idle provider: ${docId}`);
+		}
+	}
+	async destroy() {
+		if (this.evictionTimer) {
+			clearInterval(this.evictionTimer);
+			this.evictionTimer = null;
+		}
+		for (const [, cached] of this.childCache) try {
+			cached.provider.destroy();
+		} catch {}
+		this.childCache.clear();
+		if (this._connection) {
+			try {
+				this._connection.provider.destroy();
+			} catch {}
+			this._connection = null;
+		}
+		console.error("[abracadabra-resend] Shutdown complete");
+	}
+};
+
+//#endregion
+//#region packages/resend/src/index.ts
+/**
+* @abraca/resend — entry point.
+*
+* Environment variables:
+*   ABRA_URL                  (required) — Abracadabra server URL
+*   ABRA_SPACE_ID             — Pin to a specific space (default: first visible)
+*   ABRA_KEY_FILE             — Ed25519 seed path (default ~/.abracadabra/resend.key)
+*   ABRA_INVITE_CODE          — Used only on first-run register
+*   ABRA_AGENT_NAME           — Display name (default "Resend Bridge")
+*
+*   RESEND_API_KEY            (required) — Resend API key
+*   RESEND_FROM               (required) — Default `from` address
+*   RESEND_INBOUND_ENABLED    — "false" to skip the webhook server (default true)
+*   RESEND_INBOUND_PORT       — Bind port for /inbound (default 0 = ephemeral)
+*   RESEND_INBOUND_HOST       — Bind host (default 0.0.0.0)
+*   RESEND_INBOUND_SECRET     — Required when inbound is enabled (Svix signing secret)
+*/
+function required(name) {
+	const value = process.env[name];
+	if (!value || value.trim().length === 0) {
+		console.error(`[abracadabra-resend] Missing required env var: ${name}`);
+		process.exit(1);
+	}
+	return value;
+}
+function boolEnv(name, fallback) {
+	const v = process.env[name];
+	if (v === void 0) return fallback;
+	const norm = v.trim().toLowerCase();
+	if ([
+		"0",
+		"false",
+		"no",
+		"off",
+		""
+	].includes(norm)) return false;
+	return true;
+}
+async function main() {
+	const url = required("ABRA_URL");
+	const resendApiKey = required("RESEND_API_KEY");
+	const defaultFrom = required("RESEND_FROM");
+	const inboundEnabled = boolEnv("RESEND_INBOUND_ENABLED", true);
+	const inboundSecret = inboundEnabled ? required("RESEND_INBOUND_SECRET") : process.env.RESEND_INBOUND_SECRET ?? "";
+	const inboundPort = process.env.RESEND_INBOUND_PORT ? Number(process.env.RESEND_INBOUND_PORT) : 0;
+	const inboundHost = process.env.RESEND_INBOUND_HOST ?? "0.0.0.0";
+	const server = new AbracadabraResendServer({
+		url,
+		spaceId: process.env.ABRA_SPACE_ID,
+		keyFile: process.env.ABRA_KEY_FILE,
+		inviteCode: process.env.ABRA_INVITE_CODE,
+		agentName: process.env.ABRA_AGENT_NAME
+	});
+	try {
+		await server.connect();
+	} catch (err) {
+		console.error(`[abracadabra-resend] Failed to connect: ${err?.message ?? err}`);
+		process.exit(1);
+	}
+	const boot = await bootstrap(server);
+	console.error(`[abracadabra-resend] Bootstrapped Inbox=${boot.inboxId} Outbox=${boot.outboxId}`);
+	const watcher = new OutboxWatcher({
+		server,
+		sender: new ResendClient(resendApiKey),
+		bootstrap: boot,
+		defaultFrom
+	});
+	watcher.start();
+	let inbound = null;
+	if (inboundEnabled) {
+		inbound = new InboundServer({
+			server,
+			bootstrap: boot,
+			secret: inboundSecret,
+			port: Number.isFinite(inboundPort) ? inboundPort : 0,
+			host: inboundHost
+		});
+		try {
+			await inbound.start();
+		} catch (err) {
+			console.error(`[abracadabra-resend] Inbound server failed to start: ${err?.message ?? err}`);
+			process.exit(1);
+		}
+	} else console.error("[abracadabra-resend] Inbound disabled (RESEND_INBOUND_ENABLED=false)");
+	console.error("[abracadabra-resend] Ready.");
+	const shutdown = async () => {
+		console.error("[abracadabra-resend] Shutting down...");
+		watcher.stop();
+		if (inbound) await inbound.stop();
+		await server.destroy();
+		process.exit(0);
+	};
+	process.on("SIGINT", shutdown);
+	process.on("SIGTERM", shutdown);
+}
+main().catch((err) => {
+	console.error("[abracadabra-resend] Fatal error:", err);
+	process.exit(1);
+});
+
+//#endregion
+export { AbracadabraResendServer, InboundServer, OutboxWatcher, RenderError, ResendClient, bootstrap, renderEmail };
+//# sourceMappingURL=abracadabra-resend.esm.js.map