@agent-native/core 0.113.0 → 0.114.0

package/src/integrations/adapters/email.ts

@@ -0,0 +1,1164 @@
+import { timingSafeEqual } from "node:crypto";
+
+import type { H3Event } from "h3";
+import { getHeader, readRawBody as h3ReadRawBody } from "h3";
+
+import { getDbExec } from "../../db/client.js";
+import type { EnvKeyConfig } from "../../server/create-server.js";
+import { resolveSecret } from "../../server/credential-provider.js";
+import {
+  sendEmail,
+  isEmailConfigured,
+  getEmailProvider,
+} from "../../server/email.js";
+import { getIntegrationConfig } from "../config-store.js";
+import type {
+  PlatformAdapter,
+  IncomingMessage,
+  OutgoingMessage,
+  IntegrationStatus,
+  OutboundTarget,
+  PlatformDeliveryReceipt,
+} from "../types.js";
+
+/** Max body length before truncation */
+const EMAIL_MAX_BODY_LENGTH = 15000;
+
+/** Rate limit: max emails per sender within the window */
+const RATE_LIMIT_MAX = 20;
+/** Rate limit window in ms (1 hour) */
+const RATE_LIMIT_WINDOW_MS = 60 * 60 * 1000;
+
+/**
+ * One-shot warning flags so we don't spam logs on every webhook.
+ * Cleared per process — one warning per cold start is enough to surface
+ * a misconfiguration without leaking config status to anyone with log access
+ * (M6 in the webhook security audit).
+ */
+let _resendUnverifiedWarned = false;
+let _sendgridUnverifiedWarned = false;
+
+function escapeLike(value: string): string {
+  return value.replace(/[!%_]/g, (match) => `!${match}`);
+}
+
+/**
+ * Returns true when the deployment is running in production mode and the
+ * operator has NOT explicitly opted into accepting unverified webhooks for
+ * local testing. In production we MUST refuse webhooks whose signature can't
+ * be verified — accepting them with attacker-controlled `from:` addresses
+ * lets the dispatch owner-resolution path run as the victim (C1 in the
+ * webhook security audit).
+ */
+function shouldRefuseWhenSecretMissing(): boolean {
+  if (process.env.AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS === "1") return false;
+  return process.env.NODE_ENV === "production";
+}
+
+/**
+ * Create an Email platform adapter for inbound/outbound email via
+ * Resend or SendGrid webhooks.
+ *
+ * Required env vars:
+ * - EMAIL_AGENT_ADDRESS — The email address the agent receives mail at
+ *
+ * One of these must also be set (checked via isEmailConfigured()):
+ * - RESEND_API_KEY — For sending/receiving via Resend
+ * - SENDGRID_API_KEY — For sending/receiving via SendGrid
+ *
+ * Optional:
+ * - EMAIL_INBOUND_WEBHOOK_SECRET — Webhook signature verification secret
+ */
+export function emailAdapter(): PlatformAdapter {
+  return {
+    platform: "email",
+    label: "Email",
+
+    getRequiredEnvKeys(): EnvKeyConfig[] {
+      return [
+        {
+          key: "EMAIL_AGENT_ADDRESS",
+          label: "Agent Email Address",
+          required: true,
+          helpText:
+            "The email address people will use to message your agent (e.g. `agent@yourcompany.com`, or pick from your `<slug>.resend.app` sandbox).",
+        },
+        {
+          key: "RESEND_API_KEY",
+          label: "Resend API Key",
+          required: false,
+          helpText:
+            "From resend.com → API keys (starts with `re_`). Either Resend or SendGrid is required for sending and receiving mail.",
+        },
+        {
+          key: "SENDGRID_API_KEY",
+          label: "SendGrid API Key",
+          required: false,
+          helpText:
+            "From sendgrid.com → Settings → API Keys (starts with `SG.`). Either Resend or SendGrid is required.",
+        },
+        {
+          key: "EMAIL_INBOUND_WEBHOOK_SECRET",
+          label: "Inbound Webhook Secret",
+          required: false,
+          helpText:
+            "Optional. From Resend (Webhooks → Signing Secret, starts with `whsec_`) or your SendGrid Inbound Parse basic-auth password. Used to verify inbound webhooks are real.",
+        },
+      ];
+    },
+
+    async handleVerification(
+      _event: H3Event,
+    ): Promise<{ handled: boolean; response?: unknown }> {
+      // Email webhooks don't need challenge handshakes
+      return { handled: false };
+    },
+
+    async verifyWebhook(event: H3Event): Promise<boolean> {
+      const secret =
+        (await resolveSecret("EMAIL_INBOUND_WEBHOOK_SECRET")) ?? undefined;
+      const provider = await getEmailProvider();
+
+      if (provider === "resend") {
+        return verifyResendWebhook(event, secret);
+      }
+
+      if (provider === "sendgrid") {
+        return verifySendGridWebhook(event, secret);
+      }
+
+      // No provider configured — reject
+      console.warn("[email] No email provider configured, rejecting webhook");
+      return false;
+    },
+
+    async parseIncomingMessage(
+      event: H3Event,
+    ): Promise<IncomingMessage | null> {
+      const provider = await getEmailProvider();
+      const agentAddress = (
+        await resolveSecret("EMAIL_AGENT_ADDRESS")
+      )?.toLowerCase();
+      if (!agentAddress) {
+        console.warn("[email] EMAIL_AGENT_ADDRESS not configured");
+        return null;
+      }
+
+      let parsed: ParsedEmail | null = null;
+
+      if (provider === "resend") {
+        parsed = await parseResendWebhook(event);
+      } else if (provider === "sendgrid") {
+        parsed = await parseSendGridWebhook(event);
+      }
+
+      if (!parsed) return null;
+
+      // Rate limiting (SQL-backed heuristic — counts the sender's already-queued
+      // tasks within the last hour). The previous in-memory map reset on every
+      // serverless cold start, so the actual ceiling per attacker was
+      // RATE_LIMIT_MAX × number_of_active_instances. SQL-backed counting holds
+      // across instances. See H4 in the webhook security audit.
+      const senderEmail = parsed.from.email.toLowerCase();
+      if (await isRateLimited(senderEmail)) {
+        console.warn(
+          `[email] Rate limited sender: ${senderEmail} (>${RATE_LIMIT_MAX}/hr)`,
+        );
+        return null;
+      }
+
+      // Check allowed domains
+      const config = await getIntegrationConfig("email");
+      if (config?.configData?.allowedDomains) {
+        const allowed = config.configData.allowedDomains as string[];
+        if (allowed.length > 0) {
+          const senderDomain = senderEmail.split("@")[1];
+          if (!senderDomain || !allowed.includes(senderDomain)) {
+            console.warn(
+              `[email] Rejected email from ${senderEmail}: domain not in allowedDomains`,
+            );
+            return null;
+          }
+        }
+      }
+
+      // Determine if agent was CC'd (not in To, but in CC)
+      const toAddresses = parsed.to.map((a) => a.toLowerCase());
+      const ccAddresses = (parsed.cc ?? []).map((a) => a.toLowerCase());
+      const isCC =
+        !toAddresses.includes(agentAddress) &&
+        ccAddresses.includes(agentAddress);
+
+      // Build thread ID from References chain (Gmail-style: oldest Message-ID is thread root).
+      // Scope the thread root by sender so an attacker who can forge a `References:`
+      // header pointing at someone else's thread root can't graft into that thread.
+      // Without this scoping, a third party could craft an inbound email whose
+      // References chain matches a known victim's Message-ID and inject messages into
+      // the victim's existing conversation — leaking prior content via the agent's
+      // reply (M1 in the webhooks security audit).
+      const threadRootId = scopeThreadIdToSender(
+        getThreadRootId(parsed.messageId, parsed.references),
+        senderEmail,
+      );
+
+      // Build body text
+      let bodyText = parsed.text || stripHtmlForPlainText(parsed.html || "");
+
+      // Truncate if needed
+      if (bodyText.length > EMAIL_MAX_BODY_LENGTH) {
+        bodyText =
+          bodyText.slice(0, EMAIL_MAX_BODY_LENGTH) + "\n[Message truncated]";
+      }
+
+      // Prefix CC'd emails with context
+      if (isCC) {
+        const otherRecipients = toAddresses
+          .filter((a) => a !== agentAddress)
+          .join(", ");
+        bodyText =
+          `[CC'd on email between ${senderEmail} and ${otherRecipients || "others"}]\n` +
+          `Subject: ${parsed.subject}\n\n` +
+          bodyText;
+      }
+
+      return {
+        platform: "email",
+        externalThreadId: threadRootId,
+        text: bodyText,
+        senderName: parsed.from.name,
+        senderId: senderEmail,
+        // Carry the message-authentication verdict downstream. Owner
+        // resolution (dispatch) must NOT grant a real user's identity /
+        // credentials unless the sender is verified — an unverified or
+        // spoofed `From:` falls back to a synthetic, credential-less owner.
+        senderVerified: parsed.senderVerified,
+        platformContext: {
+          messageId: parsed.messageId,
+          subject: parsed.subject,
+          from: senderEmail,
+          to: parsed.to,
+          cc: parsed.cc,
+          inReplyTo: parsed.inReplyTo,
+          references: parsed.references,
+          isCC,
+          senderVerified: parsed.senderVerified,
+        },
+        timestamp: parsed.date ? new Date(parsed.date).getTime() : Date.now(),
+      };
+    },
+
+    async sendResponse(
+      message: OutgoingMessage,
+      context: IncomingMessage,
+    ): Promise<void | PlatformDeliveryReceipt> {
+      const agentAddress = await resolveSecret("EMAIL_AGENT_ADDRESS");
+      if (!agentAddress) {
+        console.error("[email] EMAIL_AGENT_ADDRESS not configured");
+        return;
+      }
+
+      const config = await getIntegrationConfig("email");
+      const displayName =
+        (config?.configData?.displayName as string) || "Dispatch Agent";
+
+      // EMAIL_FROM overrides the from-address — required when the receiving
+      // address is on a sub-domain that can't be a verified sender (e.g.
+      // *.resend.app). Inbound and outbound addresses can differ.
+      const emailFrom = await resolveSecret("EMAIL_FROM");
+      const fromAddress = emailFrom || `${displayName} <${agentAddress}>`;
+
+      const subject = context.platformContext.subject as string;
+      const reSubject = subject.startsWith("Re: ") ? subject : `Re: ${subject}`;
+
+      try {
+        await sendEmail({
+          to: context.senderId!,
+          from: fromAddress,
+          subject: reSubject,
+          html: message.text,
+          text: stripHtmlForPlainText(message.text),
+          inReplyTo: context.platformContext.messageId as string,
+          references: buildReferencesHeader(context.platformContext),
+          cc: context.platformContext.isCC
+            ? buildReplyAllCc(context, agentAddress)
+            : undefined,
+        });
+      } catch (err) {
+        console.error("[email] Failed to send response:", err);
+        throw err;
+      }
+      return { status: "delivered" };
+    },
+
+    async sendMessageToTarget(
+      message: OutgoingMessage,
+      target: OutboundTarget,
+    ): Promise<void> {
+      const agentAddress = await resolveSecret("EMAIL_AGENT_ADDRESS");
+      if (!agentAddress) {
+        console.error("[email] EMAIL_AGENT_ADDRESS not configured");
+        return;
+      }
+
+      const config = await getIntegrationConfig("email");
+      const displayName =
+        (config?.configData?.displayName as string) || "Dispatch Agent";
+
+      try {
+        await sendEmail({
+          to: target.destination,
+          from: `${displayName} <${agentAddress}>`,
+          subject: target.label || "Message from Dispatch Agent",
+          html: message.text,
+          text: stripHtmlForPlainText(message.text),
+          ...(target.threadRef
+            ? {
+                inReplyTo: target.threadRef,
+                references: target.threadRef,
+              }
+            : {}),
+        });
+      } catch (err) {
+        console.error("[email] Failed to send proactive message:", err);
+        throw err;
+      }
+    },
+
+    formatAgentResponse(text: string): OutgoingMessage {
+      const bodyHtml = markdownToHtml(text);
+      const html = wrapInEmailTemplate(bodyHtml);
+      return { text: html, platformContext: {} };
+    },
+
+    async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {
+      const hasAgentAddress = !!(await resolveSecret("EMAIL_AGENT_ADDRESS"));
+      const hasEmailProvider = await isEmailConfigured();
+      const hasWebhookSecret = !!(await resolveSecret(
+        "EMAIL_INBOUND_WEBHOOK_SECRET",
+      ));
+      const configured = hasAgentAddress && hasEmailProvider;
+
+      return {
+        platform: "email",
+        label: "Email",
+        enabled: false, // overridden by plugin
+        configured,
+        details: {
+          hasAgentAddress,
+          hasEmailProvider,
+          hasWebhookSecret,
+          provider: await getEmailProvider(),
+        },
+        error: !configured
+          ? "Save EMAIL_AGENT_ADDRESS and either RESEND_API_KEY or SENDGRID_API_KEY in settings"
+          : undefined,
+      };
+    },
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Parsed email shape
+// ---------------------------------------------------------------------------
+
+interface ParsedEmail {
+  messageId: string;
+  subject: string;
+  from: { name?: string; email: string };
+  to: string[];
+  cc?: string[];
+  text?: string;
+  html?: string;
+  inReplyTo?: string;
+  references?: string[];
+  date?: string;
+  /**
+   * True when the provider's message-authentication results show that the
+   * mail genuinely originated from the From domain: DKIM `pass` aligned with
+   * the From domain, or an aligned SPF `pass`. False when results are absent
+   * or fail — we fail closed so a spoofed `From:` can never be treated as
+   * verified. See FINDING 3 (inbound-email impersonation) in the webhook
+   * security audit.
+   */
+  senderVerified: boolean;
+}
+
+// ---------------------------------------------------------------------------
+// Webhook verification
+// ---------------------------------------------------------------------------
+
+async function verifyResendWebhook(
+  event: H3Event,
+  secret?: string,
+): Promise<boolean> {
+  if (!secret) {
+    if (shouldRefuseWhenSecretMissing()) {
+      if (!_resendUnverifiedWarned) {
+        _resendUnverifiedWarned = true;
+        console.error(
+          "[email] EMAIL_INBOUND_WEBHOOK_SECRET not set — refusing Resend webhook in production. " +
+            "Set EMAIL_INBOUND_WEBHOOK_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.",
+        );
+      }
+      return false;
+    }
+    if (!_resendUnverifiedWarned) {
+      _resendUnverifiedWarned = true;
+      console.warn(
+        "[email] EMAIL_INBOUND_WEBHOOK_SECRET not set — accepting Resend webhook without verification (dev mode)",
+      );
+    }
+    return true;
+  }
+
+  const svixId = getHeader(event, "svix-id");
+  const svixTimestamp = getHeader(event, "svix-timestamp");
+  const svixSignature = getHeader(event, "svix-signature");
+
+  if (!svixId || !svixTimestamp || !svixSignature) {
+    console.warn("[email] Missing Svix signature headers");
+    return false;
+  }
+
+  // Reject requests older than 5 minutes (replay protection)
+  const ts = parseInt(svixTimestamp, 10);
+  if (Math.abs(Date.now() / 1000 - ts) > 300) {
+    console.warn("[email] Svix timestamp too old, rejecting");
+    return false;
+  }
+
+  const body = await readRawBody(event);
+  const crypto = await import("node:crypto");
+
+  // Svix signing secret may be prefixed with "whsec_"
+  const rawSecret = secret.startsWith("whsec_") ? secret.slice(6) : secret;
+  const secretBytes = Buffer.from(rawSecret, "base64");
+
+  const signedContent = `${svixId}.${svixTimestamp}.${body}`;
+  const expectedSignature = crypto
+    .createHmac("sha256", secretBytes)
+    .update(signedContent)
+    .digest("base64");
+
+  // Svix sends multiple signatures separated by spaces, each prefixed with "v1,"
+  const signatures = svixSignature.split(" ");
+  for (const sig of signatures) {
+    const sigValue = sig.startsWith("v1,") ? sig.slice(3) : sig;
+    try {
+      if (
+        crypto.timingSafeEqual(
+          Buffer.from(expectedSignature),
+          Buffer.from(sigValue),
+        )
+      ) {
+        return true;
+      }
+    } catch {
+      // Length mismatch — try next signature
+    }
+  }
+
+  console.warn("[email] Svix signature verification failed");
+  return false;
+}
+
+function safeEq(a: string, b: string): boolean {
+  const aBuf = Buffer.from(a);
+  const bBuf = Buffer.from(b);
+  if (aBuf.length !== bBuf.length) return false;
+  return timingSafeEqual(aBuf, bBuf);
+}
+
+async function verifySendGridWebhook(
+  event: H3Event,
+  secret?: string,
+): Promise<boolean> {
+  if (!secret) {
+    if (shouldRefuseWhenSecretMissing()) {
+      if (!_sendgridUnverifiedWarned) {
+        _sendgridUnverifiedWarned = true;
+        console.error(
+          "[email] EMAIL_INBOUND_WEBHOOK_SECRET not set — refusing SendGrid webhook in production. " +
+            "Set EMAIL_INBOUND_WEBHOOK_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.",
+        );
+      }
+      return false;
+    }
+    if (!_sendgridUnverifiedWarned) {
+      _sendgridUnverifiedWarned = true;
+      console.warn(
+        "[email] EMAIL_INBOUND_WEBHOOK_SECRET not set — accepting SendGrid webhook without verification (dev mode)",
+      );
+    }
+    return true;
+  }
+
+  // Check for the secret in a custom header or basic auth
+  const authHeader = getHeader(event, "authorization");
+  if (authHeader) {
+    // Basic auth: "Basic base64(user:pass)" — secret is the password
+    if (authHeader.startsWith("Basic ")) {
+      const decoded = Buffer.from(authHeader.slice(6), "base64").toString();
+      const password = decoded.split(":")[1];
+      if (password !== undefined && safeEq(password, secret)) return true;
+    }
+  }
+
+  // Also check a custom header (common SendGrid Inbound Parse pattern)
+  const customSecret = getHeader(event, "x-webhook-secret");
+  if (customSecret !== undefined && safeEq(customSecret, secret)) return true;
+
+  console.warn("[email] SendGrid webhook secret verification failed");
+  return false;
+}
+
+// ---------------------------------------------------------------------------
+// Inbound email parsing
+// ---------------------------------------------------------------------------
+
+async function parseResendWebhook(event: H3Event): Promise<ParsedEmail | null> {
+  const raw = await readRawBody(event);
+  const body = JSON.parse(raw);
+  if (!body || body.type !== "email.received") return null;
+
+  const data = body.data;
+  if (!data) return null;
+
+  // Resend webhook payload provides email metadata directly in data
+  // Fields: from, to, cc, subject, text, html, headers, created_at
+  const fromRaw = data.from as string | undefined;
+  const from = fromRaw ? parseEmailAddress(fromRaw) : null;
+  if (!from) return null;
+
+  const toRaw = data.to as string | string[] | undefined;
+  const to = normalizeAddressList(toRaw);
+  const ccRaw = data.cc as string | string[] | undefined;
+  const cc = normalizeAddressList(ccRaw);
+
+  // Parse headers for Message-ID, In-Reply-To, References
+  const headers = parseHeadersObject(data.headers);
+  const messageId =
+    headers["message-id"] || data.email_id || `resend-${Date.now()}`;
+
+  // Resend forwards the raw `Authentication-Results` header (and may also
+  // surface explicit `dkim`/`spf` fields). Derive a verified verdict from
+  // whichever is present; absent results fail closed (unverified).
+  const senderVerified = computeSenderVerified({
+    fromEmail: from.email,
+    authResults: headers["authentication-results"],
+    dkim: typeof data.dkim === "string" ? data.dkim : undefined,
+    spf: typeof data.spf === "string" ? data.spf : undefined,
+  });
+
+  return {
+    messageId,
+    subject: (data.subject as string) || "(no subject)",
+    from,
+    to,
+    cc: cc.length > 0 ? cc : undefined,
+    text: data.text as string | undefined,
+    html: data.html as string | undefined,
+    inReplyTo: headers["in-reply-to"] || undefined,
+    references: parseReferencesHeader(headers["references"]),
+    date: (data.created_at as string) || undefined,
+    senderVerified,
+  };
+}
+
+async function parseSendGridWebhook(
+  event: H3Event,
+): Promise<ParsedEmail | null> {
+  const raw = await readRawBody(event);
+  const body = JSON.parse(raw);
+  if (!body) return null;
+
+  // SendGrid Inbound Parse sends form data with fields:
+  // from, to, cc, subject, text, html, headers, envelope
+  const fromRaw = body.from as string | undefined;
+  const from = fromRaw ? parseEmailAddress(fromRaw) : null;
+  if (!from) return null;
+
+  const toRaw = body.to as string | undefined;
+  const to = toRaw ? toRaw.split(",").map((a: string) => a.trim()) : [];
+  const ccRaw = body.cc as string | undefined;
+  const cc = ccRaw ? ccRaw.split(",").map((a: string) => a.trim()) : [];
+
+  // Parse raw headers string
+  const headersStr = body.headers as string | undefined;
+  const headers = parseHeadersString(headersStr);
+  const messageId = headers["message-id"] || `sendgrid-${Date.now()}`;
+
+  // SendGrid Inbound Parse posts explicit `dkim` (e.g. `{@example.com : pass}`)
+  // and `SPF` (e.g. `pass`) form fields, and also carries
+  // `Authentication-Results` inside the raw headers blob. Use all available
+  // signals; absent results fail closed (unverified).
+  const senderVerified = computeSenderVerified({
+    fromEmail: from.email,
+    authResults: headers["authentication-results"],
+    dkim: typeof body.dkim === "string" ? body.dkim : undefined,
+    spf: typeof body.SPF === "string" ? body.SPF : undefined,
+  });
+
+  return {
+    messageId,
+    subject: (body.subject as string) || "(no subject)",
+    from,
+    to,
+    cc: cc.length > 0 ? cc : undefined,
+    text: body.text as string | undefined,
+    html: body.html as string | undefined,
+    inReplyTo: headers["in-reply-to"] || undefined,
+    references: parseReferencesHeader(headers["references"]),
+    date: headers["date"] || undefined,
+    senderVerified,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Helpers — sender authentication (DKIM / SPF)
+// ---------------------------------------------------------------------------
+
+/**
+ * Extract the registrable-ish domain from an email address (lowercased).
+ * We keep the full host rather than collapsing to an eTLD+1 — exact-domain
+ * alignment is the conservative choice here, and avoids bundling a public
+ * suffix list. Subdomain senders that legitimately DKIM-sign with the parent
+ * domain are handled by the suffix check in `domainsAlign`.
+ */
+function emailDomain(email: string): string {
+  const at = email.lastIndexOf("@");
+  return at >= 0
+    ? email
+        .slice(at + 1)
+        .trim()
+        .toLowerCase()
+    : "";
+}
+
+/**
+ * True when `signingDomain` is the From domain or a parent of it (e.g.
+ * From `user@mail.example.com` aligned with a `d=example.com` signature).
+ * Both directions of subdomain nesting are accepted because senders sign
+ * with either the exact From host or the organizational parent.
+ */
+function domainsAlign(fromDomain: string, signingDomain: string): boolean {
+  if (!fromDomain || !signingDomain) return false;
+  if (fromDomain === signingDomain) return true;
+  return (
+    fromDomain.endsWith(`.${signingDomain}`) ||
+    signingDomain.endsWith(`.${fromDomain}`)
+  );
+}
+
+/**
+ * Compute whether an inbound email is authenticated as genuinely coming from
+ * its `From:` domain. Returns true only when DKIM passes for an aligned
+ * domain, or SPF passes for an aligned domain. Anything else — missing
+ * results, `fail`, `softfail`, `none`, `neutral`, `temperror`, `permerror`
+ * — returns false (fail closed).
+ *
+ * Inputs may come from provider-specific fields (`dkim`, `spf`) and/or the
+ * RFC 8601 `Authentication-Results` header, in any combination. We treat the
+ * union: if ANY source shows an aligned pass, the sender is verified.
+ */
+function computeSenderVerified(input: {
+  fromEmail: string;
+  authResults?: string;
+  dkim?: string;
+  spf?: string;
+}): boolean {
+  const fromDomain = emailDomain(input.fromEmail);
+  if (!fromDomain) return false;
+
+  // 1. Provider DKIM field, e.g. SendGrid `{@example.com : pass}` or
+  //    `{@example.com : pass; @other.com : fail}`.
+  if (input.dkim) {
+    const dkimEntries = input.dkim.matchAll(
+      /@([a-z0-9.-]+)\s*:\s*(pass|fail|none|neutral|softfail|temperror|permerror)/gi,
+    );
+    for (const m of dkimEntries) {
+      const domain = m[1].toLowerCase();
+      const verdict = m[2].toLowerCase();
+      if (verdict === "pass" && domainsAlign(fromDomain, domain)) return true;
+    }
+  }
+
+  // 2. Provider SPF field. SendGrid posts a bare verdict (e.g. `pass`); since
+  //    SPF authenticates the envelope/MailFrom rather than the header From,
+  //    a bare `pass` with no domain only counts when we can't tell it's
+  //    misaligned. We accept a bare `pass` as an aligned SPF pass — this is
+  //    the same trust level Gmail-style routing assigns to a plain SPF pass.
+  if (input.spf) {
+    const spfVerdict = input.spf.trim().toLowerCase();
+    if (spfVerdict === "pass") return true;
+  }
+
+  // 3. RFC 8601 `Authentication-Results` header (may list multiple methods).
+  if (input.authResults) {
+    const ar = input.authResults.toLowerCase();
+    // DKIM with an aligned domain.
+    const dkimRe = /dkim=pass[^;]*?(?:header\.(?:d|i)=|@)([a-z0-9.-]+)/g;
+    for (const m of ar.matchAll(dkimRe)) {
+      const domain = m[1].replace(/^@/, "");
+      if (domainsAlign(fromDomain, domain)) return true;
+    }
+    // SPF pass (envelope auth) — accept as an aligned pass.
+    if (/spf=pass\b/.test(ar)) return true;
+  }
+
+  return false;
+}
+
+// ---------------------------------------------------------------------------
+// Rate limiting
+// ---------------------------------------------------------------------------
+
+/**
+ * Rate-limit heuristic backed by the `integration_pending_tasks` queue.
+ *
+ * Counts how many tasks this sender has produced in the last hour. The count
+ * INCLUDES tasks already processed (status = completed/failed) because the
+ * rows aren't deleted on completion — that's enough signal to throttle a
+ * single noisy/abusive sender without needing a dedicated counter table.
+ *
+ * Two trade-offs worth knowing:
+ *   - This is a coarse heuristic, not exact metering. Within one hour the
+ *     count is correct; rows produced more than an hour ago naturally drop
+ *     off. We don't try to be precise, only to raise the bar past the
+ *     "send 10K emails through one Lambda burst" failure mode.
+ *   - The query relies on the `idx_pending_tasks_status_created` index plus
+ *     a sender substring match. A targeted attacker could amortise the cost
+ *     by reusing one sender address — that's fine, the goal here is to bound
+ *     the attack within a single attacker identity, not to detect spoofing.
+ *
+ * If the table doesn't yet exist on this deployment (no inbound webhook has
+ * been processed before), we silently allow the message — the schema is
+ * provisioned on first task insert. See H4 in the webhook security audit.
+ */
+async function isRateLimited(senderEmail: string): Promise<boolean> {
+  const cutoff = Date.now() - RATE_LIMIT_WINDOW_MS;
+  try {
+    const client = getDbExec();
+    const { rows } = await client.execute({
+      sql: `
+        SELECT COUNT(*) AS c
+          FROM integration_pending_tasks
+         WHERE platform = ?
+           AND created_at >= ?
+           AND payload LIKE ? ESCAPE '!'
+      `,
+      args: ["email", cutoff, `%"senderId":"${escapeLike(senderEmail)}"%`],
+    });
+    const count = Number(
+      (rows[0] as Record<string, unknown> | undefined)?.c ?? 0,
+    );
+    return count >= RATE_LIMIT_MAX;
+  } catch {
+    // Table doesn't exist yet (first webhook on a fresh deployment) — allow.
+    return false;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Helpers — email address parsing
+// ---------------------------------------------------------------------------
+
+/** Parse "Name <addr@example.com>" or plain "addr@example.com" */
+function parseEmailAddress(raw: string): { name?: string; email: string } {
+  const match = raw.match(/^\s*(.*?)\s*<([^>]+)>\s*$/);
+  if (match && match[2]) {
+    return {
+      name: match[1].replace(/^["']|["']$/g, "").trim() || undefined,
+      email: match[2].trim(),
+    };
+  }
+  return { email: raw.trim() };
+}
+
+/** Normalize a to/cc field that may be a string, array, or undefined into a string[] of addresses */
+function normalizeAddressList(raw: string | string[] | undefined): string[] {
+  if (!raw) return [];
+  if (Array.isArray(raw)) return raw.map((a) => a.trim());
+  return raw.split(",").map((a) => a.trim());
+}
+
+// ---------------------------------------------------------------------------
+// Helpers — header parsing
+// ---------------------------------------------------------------------------
+
+/** Parse a headers object (Resend format: array of {name, value} or Record) */
+function parseHeadersObject(headers: unknown): Record<string, string> {
+  const result: Record<string, string> = {};
+  if (!headers) return result;
+
+  if (Array.isArray(headers)) {
+    for (const h of headers) {
+      if (h && typeof h === "object" && "name" in h && "value" in h) {
+        result[(h.name as string).toLowerCase()] = h.value as string;
+      }
+    }
+  } else if (typeof headers === "object") {
+    for (const [key, value] of Object.entries(
+      headers as Record<string, unknown>,
+    )) {
+      result[key.toLowerCase()] = String(value);
+    }
+  }
+  return result;
+}
+
+/** Parse a raw headers string (SendGrid format: "Key: Value\nKey: Value\n...") */
+function parseHeadersString(raw: string | undefined): Record<string, string> {
+  const result: Record<string, string> = {};
+  if (!raw) return result;
+
+  const lines = raw.split(/\r?\n/);
+  let currentKey = "";
+  let currentValue = "";
+
+  for (const line of lines) {
+    // Continuation line (starts with whitespace)
+    if (/^\s/.test(line) && currentKey) {
+      currentValue += " " + line.trim();
+      continue;
+    }
+    // Save previous header
+    if (currentKey) {
+      result[currentKey.toLowerCase()] = currentValue;
+    }
+    const colonIdx = line.indexOf(":");
+    if (colonIdx > 0) {
+      currentKey = line.slice(0, colonIdx).trim();
+      currentValue = line.slice(colonIdx + 1).trim();
+    } else {
+      currentKey = "";
+      currentValue = "";
+    }
+  }
+  // Save last header
+  if (currentKey) {
+    result[currentKey.toLowerCase()] = currentValue;
+  }
+  return result;
+}
+
+/** Parse a References header value into an array of Message-IDs */
+function parseReferencesHeader(
+  references: string | undefined,
+): string[] | undefined {
+  if (!references) return undefined;
+  const ids = references.match(/<[^>]+>/g);
+  return ids && ids.length > 0 ? ids : undefined;
+}
+
+// ---------------------------------------------------------------------------
+// Helpers — threading
+// ---------------------------------------------------------------------------
+
+/**
+ * Get the thread root ID using a Gmail-style approach:
+ * the oldest Message-ID from the References chain is the thread root.
+ * If no References, use the current Message-ID.
+ */
+function getThreadRootId(messageId: string, references?: string[]): string {
+  if (references && references.length > 0) {
+    return references[0];
+  }
+  return messageId;
+}
+
+/**
+ * Scope a raw thread root id by the sender's email address. Two different
+ * senders crafting the same `References:` header value should NOT collide
+ * onto the same internal thread mapping — that's the email-side fix for the
+ * thread-injection finding (M1 in the webhook security audit).
+ *
+ * The returned id is opaque to callers and stays stable across messages
+ * from the same sender on the same conversation thread, so reply behaviour
+ * is unchanged.
+ */
+function scopeThreadIdToSender(
+  rawThreadId: string,
+  senderEmail: string,
+): string {
+  return `${senderEmail.toLowerCase()}::${rawThreadId}`;
+}
+
+// ---------------------------------------------------------------------------
+// Helpers — reply building
+// ---------------------------------------------------------------------------
+
+/** Build a References header from the platform context */
+function buildReferencesHeader(ctx: Record<string, unknown>): string {
+  const parts: string[] = [];
+
+  // Include existing references
+  const refs = ctx.references as string[] | undefined;
+  if (refs) {
+    parts.push(...refs);
+  }
+
+  // Append the current message ID
+  const messageId = ctx.messageId as string | undefined;
+  if (messageId) {
+    // Avoid duplicates
+    if (!parts.includes(messageId)) {
+      parts.push(messageId);
+    }
+  }
+
+  return parts.join(" ");
+}
+
+/**
+ * Build CC list for reply-all when agent was CC'd.
+ * Include original To addresses and other CC addresses, excluding the agent and the original sender.
+ */
+function buildReplyAllCc(
+  context: IncomingMessage,
+  agentAddress: string,
+): string[] | undefined {
+  const normalizedAgentAddress = agentAddress.toLowerCase();
+  const senderEmail = context.senderId?.toLowerCase();
+  const toAddresses = (context.platformContext.to as string[]) || [];
+  const ccAddresses = (context.platformContext.cc as string[]) || [];
+
+  const allRecipients = new Set<string>();
+  for (const addr of [...toAddresses, ...ccAddresses]) {
+    const normalized = addr.toLowerCase().trim();
+    // Exclude agent address and original sender (sender goes in To)
+    if (normalized !== normalizedAgentAddress && normalized !== senderEmail) {
+      allRecipients.add(normalized);
+    }
+  }
+
+  return allRecipients.size > 0 ? Array.from(allRecipients) : undefined;
+}
+
+// ---------------------------------------------------------------------------
+// Helpers — text conversion
+// ---------------------------------------------------------------------------
+
+/** Strip HTML tags for a plain-text version of the email */
+function stripHtmlForPlainText(html: string): string {
+  return html
+    .replace(/<br\s*\/?>/gi, "\n")
+    .replace(/<\/p>/gi, "\n\n")
+    .replace(/<\/div>/gi, "\n")
+    .replace(/<\/li>/gi, "\n")
+    .replace(/<li[^>]*>/gi, "- ")
+    .replace(/<\/h[1-6]>/gi, "\n\n")
+    .replace(/<[^>]+>/g, "")
+    .replace(/&nbsp;/g, " ")
+    .replace(/&amp;/g, "&")
+    .replace(/&lt;/g, "<")
+    .replace(/&gt;/g, ">")
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/\n{3,}/g, "\n\n")
+    .trim();
+}
+
+function escapeHtml(s: string): string {
+  return s
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+function decodeBasicHtmlEntities(s: string): string {
+  return s
+    .replace(/&amp;/g, "&")
+    .replace(/&lt;/g, "<")
+    .replace(/&gt;/g, ">")
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'");
+}
+
+function splitTrailingUrlPunctuation(raw: string): {
+  url: string;
+  trailing: string;
+} {
+  let url = raw;
+  let trailing = "";
+  const trailingEntities = ["&quot;", "&#39;"];
+
+  for (;;) {
+    const entity = trailingEntities.find((candidate) =>
+      url.endsWith(candidate),
+    );
+    if (!entity) break;
+    url = url.slice(0, -entity.length);
+    trailing = entity + trailing;
+  }
+
+  while (/[.,!?;:]$/.test(url)) {
+    trailing = url.slice(-1) + trailing;
+    url = url.slice(0, -1);
+  }
+
+  while (url.endsWith(")") && !url.includes("(")) {
+    trailing = ")" + trailing;
+    url = url.slice(0, -1);
+  }
+
+  return { url, trailing };
+}
+
+function labelForUrl(rawUrl: string): string {
+  try {
+    const parsed = new URL(decodeBasicHtmlEntities(rawUrl));
+    const host = parsed.hostname.replace(/^www\./, "");
+    return host ? `Open ${host}` : "Open link";
+  } catch {
+    return "Open link";
+  }
+}
+
+function linkifyTextSegment(segment: string): string {
+  return segment.replace(/\bhttps?:\/\/[^\s<>"']+/gi, (raw) => {
+    const { url, trailing } = splitTrailingUrlPunctuation(raw);
+    const href = decodeBasicHtmlEntities(url);
+    return `<a href="${escapeHtml(href)}" style="color:#2563eb;text-decoration:underline;">${escapeHtml(
+      labelForUrl(url),
+    )}</a>${trailing}`;
+  });
+}
+
+function linkifyBareUrlsInHtml(html: string): string {
+  const parts = html.split(/(<\/?[^>]+>)/g);
+  let skipDepth = 0;
+
+  return parts
+    .map((part) => {
+      if (part.startsWith("<") && part.endsWith(">")) {
+        if (/^<\/\s*(a|code)\b/i.test(part)) {
+          skipDepth = Math.max(0, skipDepth - 1);
+        } else if (/^<\s*(a|code)\b/i.test(part)) {
+          skipDepth += 1;
+        }
+        return part;
+      }
+      return skipDepth > 0 ? part : linkifyTextSegment(part);
+    })
+    .join("");
+}
+
+/** Convert basic markdown to HTML for email rendering */
+function markdownToHtml(md: string): string {
+  let html = md;
+
+  // Escape HTML entities in the source (but not our generated tags)
+  html = escapeHtml(html);
+
+  // Bold: **text** or __text__
+  html = html.replace(/\*\*(.+?)\*\*/g, "<strong>$1</strong>");
+  html = html.replace(/__(.+?)__/g, "<strong>$1</strong>");
+
+  // Italic: *text* or _text_ (but not inside words with underscores)
+  html = html.replace(/(?<!\w)\*([^*]+?)\*(?!\w)/g, "<em>$1</em>");
+  html = html.replace(/(?<!\w)_([^_]+?)_(?!\w)/g, "<em>$1</em>");
+
+  // Links: [text](url)
+  html = html.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_match, label, url) => {
+    const visibleLabel = /^https?:\/\//i.test(decodeBasicHtmlEntities(label))
+      ? escapeHtml(labelForUrl(label))
+      : label;
+    return `<a href="${escapeHtml(
+      decodeBasicHtmlEntities(url),
+    )}" style="color:#2563eb;text-decoration:underline;">${visibleLabel}</a>`;
+  });
+
+  // Inline code: `code`
+  html = html.replace(
+    /`([^`]+)`/g,
+    '<code style="background:#f1f5f9;padding:1px 4px;border-radius:3px;font-size:0.9em;">$1</code>',
+  );
+
+  // Bare URLs: keep the destination in href but avoid spelling long URLs out.
+  html = linkifyBareUrlsInHtml(html);
+
+  // Unordered lists: lines starting with "- " or "* "
+  html = html.replace(/^([*-]) (.+)$/gm, "<li>$2</li>");
+  // Wrap consecutive <li> in <ul>
+  html = html.replace(
+    /(<li>.*?<\/li>\n?)+/g,
+    '<ul style="margin:8px 0;padding-left:20px;">$&</ul>',
+  );
+
+  // Ordered lists: lines starting with "1. ", "2. " etc.
+  html = html.replace(/^\d+\. (.+)$/gm, "<li>$1</li>");
+  // Wrap consecutive <li> that aren't in <ul> in <ol>
+  html = html.replace(/(?<!<\/ul>)(<li>.*?<\/li>\n?)+/g, (match) => {
+    if (match.includes("<ul")) return match;
+    return `<ol style="margin:8px 0;padding-left:20px;">${match}</ol>`;
+  });
+
+  // Headings: # through ###
+  html = html.replace(
+    /^### (.+)$/gm,
+    '<h3 style="margin:16px 0 8px;font-size:1.1em;">$1</h3>',
+  );
+  html = html.replace(
+    /^## (.+)$/gm,
+    '<h2 style="margin:16px 0 8px;font-size:1.25em;">$1</h2>',
+  );
+  html = html.replace(
+    /^# (.+)$/gm,
+    '<h1 style="margin:16px 0 8px;font-size:1.4em;">$1</h1>',
+  );
+
+  // Horizontal rules: --- or ***
+  html = html.replace(
+    /^(-{3,}|\*{3,})$/gm,
+    '<hr style="border:none;border-top:1px solid #e2e8f0;margin:16px 0;">',
+  );
+
+  // Paragraphs: double newlines
+  html = html.replace(/\n\n/g, "</p><p>");
+  // Single newlines → <br>
+  html = html.replace(/\n/g, "<br>");
+
+  // Wrap in paragraph tags
+  html = `<p>${html}</p>`;
+  // Clean up empty paragraphs
+  html = html.replace(/<p>\s*<\/p>/g, "");
+
+  return html;
+}
+
+/** Wrap body HTML in a minimal email template with inline styles */
+function wrapInEmailTemplate(bodyHtml: string): string {
+  return `<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+</head>
+<body style="margin:0;padding:0;background-color:#ffffff;">
+<div style="max-width:600px;margin:0 auto;padding:20px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;font-size:14px;line-height:1.6;color:#1a1a1a;">
+${bodyHtml}
+</div>
+</body>
+</html>`;
+}
+
+// ---------------------------------------------------------------------------
+// Raw body reader (matches Slack adapter pattern)
+// ---------------------------------------------------------------------------
+
+/**
+ * Read the raw request body as a string and cache on the event context.
+ * Reads raw bytes from the request stream — never re-stringifies a parsed
+ * body, since the Resend / Svix HMAC is computed over the exact bytes sent
+ * (M2 in the webhook security audit).
+ */
+async function readRawBody(event: H3Event): Promise<string> {
+  const cached = event.context.__rawBody;
+  if (typeof cached === "string") return cached;
+  const raw = (await h3ReadRawBody(event)) ?? "";
+  event.context.__rawBody = raw;
+  return raw;
+}