@agent-native/core 0.7.13 → 0.7.15

package/dist/integrations/adapters/email.js

@@ -0,0 +1,740 @@
+import { getHeader, readRawBody as h3ReadRawBody } from "h3";
+import { timingSafeEqual } from "node:crypto";
+import { getIntegrationConfig } from "../config-store.js";
+import { getDbExec } from "../../db/client.js";
+import { sendEmail, isEmailConfigured, getEmailProvider, } from "../../server/email.js";
+/** Max body length before truncation */
+const EMAIL_MAX_BODY_LENGTH = 15000;
+/** Rate limit: max emails per sender within the window */
+const RATE_LIMIT_MAX = 20;
+/** Rate limit window in ms (1 hour) */
+const RATE_LIMIT_WINDOW_MS = 60 * 60 * 1000;
+/**
+ * One-shot warning flags so we don't spam logs on every webhook.
+ * Cleared per process — one warning per cold start is enough to surface
+ * a misconfiguration without leaking config status to anyone with log access
+ * (M6 in the webhook security audit).
+ */
+let _resendUnverifiedWarned = false;
+let _sendgridUnverifiedWarned = false;
+/**
+ * Returns true when the deployment is running in production mode and the
+ * operator has NOT explicitly opted into accepting unverified webhooks for
+ * local testing. In production we MUST refuse webhooks whose signature can't
+ * be verified — accepting them with attacker-controlled `from:` addresses
+ * lets the dispatch owner-resolution path run as the victim (C1 in the
+ * webhook security audit).
+ */
+function shouldRefuseWhenSecretMissing() {
+    if (process.env.AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS === "1")
+        return false;
+    return process.env.NODE_ENV === "production";
+}
+/**
+ * Create an Email platform adapter for inbound/outbound email via
+ * Resend or SendGrid webhooks.
+ *
+ * Required env vars:
+ * - EMAIL_AGENT_ADDRESS — The email address the agent receives mail at
+ *
+ * One of these must also be set (checked via isEmailConfigured()):
+ * - RESEND_API_KEY — For sending/receiving via Resend
+ * - SENDGRID_API_KEY — For sending/receiving via SendGrid
+ *
+ * Optional:
+ * - EMAIL_INBOUND_WEBHOOK_SECRET — Webhook signature verification secret
+ */
+export function emailAdapter() {
+    return {
+        platform: "email",
+        label: "Email",
+        getRequiredEnvKeys() {
+            return [
+                {
+                    key: "EMAIL_AGENT_ADDRESS",
+                    label: "Agent Email Address",
+                    required: true,
+                    helpText: "The email address people will use to message your agent (e.g. `agent@yourcompany.com`, or pick from your `<slug>.resend.app` sandbox).",
+                },
+                {
+                    key: "RESEND_API_KEY",
+                    label: "Resend API Key",
+                    required: false,
+                    helpText: "From resend.com → API keys (starts with `re_`). Either Resend or SendGrid is required for sending and receiving mail.",
+                },
+                {
+                    key: "SENDGRID_API_KEY",
+                    label: "SendGrid API Key",
+                    required: false,
+                    helpText: "From sendgrid.com → Settings → API Keys (starts with `SG.`). Either Resend or SendGrid is required.",
+                },
+                {
+                    key: "EMAIL_INBOUND_WEBHOOK_SECRET",
+                    label: "Inbound Webhook Secret",
+                    required: false,
+                    helpText: "Optional. From Resend (Webhooks → Signing Secret, starts with `whsec_`) or your SendGrid Inbound Parse basic-auth password. Used to verify inbound webhooks are real.",
+                },
+            ];
+        },
+        async handleVerification(_event) {
+            // Email webhooks don't need challenge handshakes
+            return { handled: false };
+        },
+        async verifyWebhook(event) {
+            const secret = process.env.EMAIL_INBOUND_WEBHOOK_SECRET;
+            const provider = getEmailProvider();
+            if (provider === "resend") {
+                return verifyResendWebhook(event, secret);
+            }
+            if (provider === "sendgrid") {
+                return verifySendGridWebhook(event, secret);
+            }
+            // No provider configured — reject
+            console.warn("[email] No email provider configured, rejecting webhook");
+            return false;
+        },
+        async parseIncomingMessage(event) {
+            const provider = getEmailProvider();
+            const agentAddress = process.env.EMAIL_AGENT_ADDRESS?.toLowerCase();
+            if (!agentAddress) {
+                console.warn("[email] EMAIL_AGENT_ADDRESS not configured");
+                return null;
+            }
+            let parsed = null;
+            if (provider === "resend") {
+                parsed = await parseResendWebhook(event);
+            }
+            else if (provider === "sendgrid") {
+                parsed = await parseSendGridWebhook(event);
+            }
+            if (!parsed)
+                return null;
+            // Rate limiting (SQL-backed heuristic — counts the sender's already-queued
+            // tasks within the last hour). The previous in-memory map reset on every
+            // serverless cold start, so the actual ceiling per attacker was
+            // RATE_LIMIT_MAX × number_of_active_instances. SQL-backed counting holds
+            // across instances. See H4 in the webhook security audit.
+            const senderEmail = parsed.from.email.toLowerCase();
+            if (await isRateLimited(senderEmail)) {
+                console.warn(`[email] Rate limited sender: ${senderEmail} (>${RATE_LIMIT_MAX}/hr)`);
+                return null;
+            }
+            // Check allowed domains
+            const config = await getIntegrationConfig("email");
+            if (config?.configData?.allowedDomains) {
+                const allowed = config.configData.allowedDomains;
+                if (allowed.length > 0) {
+                    const senderDomain = senderEmail.split("@")[1];
+                    if (!senderDomain || !allowed.includes(senderDomain)) {
+                        console.warn(`[email] Rejected email from ${senderEmail}: domain not in allowedDomains`);
+                        return null;
+                    }
+                }
+            }
+            // Determine if agent was CC'd (not in To, but in CC)
+            const toAddresses = parsed.to.map((a) => a.toLowerCase());
+            const ccAddresses = (parsed.cc ?? []).map((a) => a.toLowerCase());
+            const isCC = !toAddresses.includes(agentAddress) &&
+                ccAddresses.includes(agentAddress);
+            // Build thread ID from References chain (Gmail-style: oldest Message-ID is thread root).
+            // Scope the thread root by sender so an attacker who can forge a `References:`
+            // header pointing at someone else's thread root can't graft into that thread.
+            // Without this scoping, a third party could craft an inbound email whose
+            // References chain matches a known victim's Message-ID and inject messages into
+            // the victim's existing conversation — leaking prior content via the agent's
+            // reply (M1 in the webhooks security audit).
+            const threadRootId = scopeThreadIdToSender(getThreadRootId(parsed.messageId, parsed.references), senderEmail);
+            // Build body text
+            let bodyText = parsed.text || stripHtmlForPlainText(parsed.html || "");
+            // Truncate if needed
+            if (bodyText.length > EMAIL_MAX_BODY_LENGTH) {
+                bodyText =
+                    bodyText.slice(0, EMAIL_MAX_BODY_LENGTH) + "\n[Message truncated]";
+            }
+            // Prefix CC'd emails with context
+            if (isCC) {
+                const otherRecipients = toAddresses
+                    .filter((a) => a !== agentAddress)
+                    .join(", ");
+                bodyText =
+                    `[CC'd on email between ${senderEmail} and ${otherRecipients || "others"}]\n` +
+                        `Subject: ${parsed.subject}\n\n` +
+                        bodyText;
+            }
+            return {
+                platform: "email",
+                externalThreadId: threadRootId,
+                text: bodyText,
+                senderName: parsed.from.name,
+                senderId: senderEmail,
+                platformContext: {
+                    messageId: parsed.messageId,
+                    subject: parsed.subject,
+                    from: senderEmail,
+                    to: parsed.to,
+                    cc: parsed.cc,
+                    inReplyTo: parsed.inReplyTo,
+                    references: parsed.references,
+                    isCC,
+                },
+                timestamp: parsed.date ? new Date(parsed.date).getTime() : Date.now(),
+            };
+        },
+        async sendResponse(message, context) {
+            const agentAddress = process.env.EMAIL_AGENT_ADDRESS;
+            if (!agentAddress) {
+                console.error("[email] EMAIL_AGENT_ADDRESS not configured");
+                return;
+            }
+            const config = await getIntegrationConfig("email");
+            const displayName = config?.configData?.displayName || "Dispatch Agent";
+            // EMAIL_FROM overrides the from-address — required when the receiving
+            // address is on a sub-domain that can't be a verified sender (e.g.
+            // *.resend.app). Inbound and outbound addresses can differ.
+            const fromAddress = process.env.EMAIL_FROM
+                ? process.env.EMAIL_FROM
+                : `${displayName} <${agentAddress}>`;
+            const subject = context.platformContext.subject;
+            const reSubject = subject.startsWith("Re: ") ? subject : `Re: ${subject}`;
+            try {
+                await sendEmail({
+                    to: context.senderId,
+                    from: fromAddress,
+                    subject: reSubject,
+                    html: message.text,
+                    text: stripHtmlForPlainText(message.text),
+                    inReplyTo: context.platformContext.messageId,
+                    references: buildReferencesHeader(context.platformContext),
+                    cc: context.platformContext.isCC
+                        ? buildReplyAllCc(context)
+                        : undefined,
+                });
+            }
+            catch (err) {
+                console.error("[email] Failed to send response:", err);
+            }
+        },
+        async sendMessageToTarget(message, target) {
+            const agentAddress = process.env.EMAIL_AGENT_ADDRESS;
+            if (!agentAddress) {
+                console.error("[email] EMAIL_AGENT_ADDRESS not configured");
+                return;
+            }
+            const config = await getIntegrationConfig("email");
+            const displayName = config?.configData?.displayName || "Dispatch Agent";
+            try {
+                await sendEmail({
+                    to: target.destination,
+                    from: `${displayName} <${agentAddress}>`,
+                    subject: target.label || "Message from Dispatch Agent",
+                    html: message.text,
+                    text: stripHtmlForPlainText(message.text),
+                    ...(target.threadRef
+                        ? {
+                            inReplyTo: target.threadRef,
+                            references: target.threadRef,
+                        }
+                        : {}),
+                });
+            }
+            catch (err) {
+                console.error("[email] Failed to send proactive message:", err);
+                throw err;
+            }
+        },
+        formatAgentResponse(text) {
+            const bodyHtml = markdownToHtml(text);
+            const html = wrapInEmailTemplate(bodyHtml);
+            return { text: html, platformContext: {} };
+        },
+        async getStatus(_baseUrl) {
+            const hasAgentAddress = !!process.env.EMAIL_AGENT_ADDRESS;
+            const hasEmailProvider = isEmailConfigured();
+            const hasWebhookSecret = !!process.env.EMAIL_INBOUND_WEBHOOK_SECRET;
+            const configured = hasAgentAddress && hasEmailProvider;
+            return {
+                platform: "email",
+                label: "Email",
+                enabled: false, // overridden by plugin
+                configured,
+                details: {
+                    hasAgentAddress,
+                    hasEmailProvider,
+                    hasWebhookSecret,
+                    provider: getEmailProvider(),
+                },
+                error: !configured
+                    ? "Set EMAIL_AGENT_ADDRESS and either RESEND_API_KEY or SENDGRID_API_KEY"
+                    : undefined,
+            };
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Webhook verification
+// ---------------------------------------------------------------------------
+async function verifyResendWebhook(event, secret) {
+    if (!secret) {
+        if (shouldRefuseWhenSecretMissing()) {
+            if (!_resendUnverifiedWarned) {
+                _resendUnverifiedWarned = true;
+                console.error("[email] EMAIL_INBOUND_WEBHOOK_SECRET not set — refusing Resend webhook in production. " +
+                    "Set EMAIL_INBOUND_WEBHOOK_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.");
+            }
+            return false;
+        }
+        if (!_resendUnverifiedWarned) {
+            _resendUnverifiedWarned = true;
+            console.warn("[email] EMAIL_INBOUND_WEBHOOK_SECRET not set — accepting Resend webhook without verification (dev mode)");
+        }
+        return true;
+    }
+    const svixId = getHeader(event, "svix-id");
+    const svixTimestamp = getHeader(event, "svix-timestamp");
+    const svixSignature = getHeader(event, "svix-signature");
+    if (!svixId || !svixTimestamp || !svixSignature) {
+        console.warn("[email] Missing Svix signature headers");
+        return false;
+    }
+    // Reject requests older than 5 minutes (replay protection)
+    const ts = parseInt(svixTimestamp, 10);
+    if (Math.abs(Date.now() / 1000 - ts) > 300) {
+        console.warn("[email] Svix timestamp too old, rejecting");
+        return false;
+    }
+    const body = await readRawBody(event);
+    const crypto = await import("node:crypto");
+    // Svix signing secret may be prefixed with "whsec_"
+    const rawSecret = secret.startsWith("whsec_") ? secret.slice(6) : secret;
+    const secretBytes = Buffer.from(rawSecret, "base64");
+    const signedContent = `${svixId}.${svixTimestamp}.${body}`;
+    const expectedSignature = crypto
+        .createHmac("sha256", secretBytes)
+        .update(signedContent)
+        .digest("base64");
+    // Svix sends multiple signatures separated by spaces, each prefixed with "v1,"
+    const signatures = svixSignature.split(" ");
+    for (const sig of signatures) {
+        const sigValue = sig.startsWith("v1,") ? sig.slice(3) : sig;
+        try {
+            if (crypto.timingSafeEqual(Buffer.from(expectedSignature), Buffer.from(sigValue))) {
+                return true;
+            }
+        }
+        catch {
+            // Length mismatch — try next signature
+        }
+    }
+    console.warn("[email] Svix signature verification failed");
+    return false;
+}
+function safeEq(a, b) {
+    const aBuf = Buffer.from(a);
+    const bBuf = Buffer.from(b);
+    if (aBuf.length !== bBuf.length)
+        return false;
+    return timingSafeEqual(aBuf, bBuf);
+}
+async function verifySendGridWebhook(event, secret) {
+    if (!secret) {
+        if (shouldRefuseWhenSecretMissing()) {
+            if (!_sendgridUnverifiedWarned) {
+                _sendgridUnverifiedWarned = true;
+                console.error("[email] EMAIL_INBOUND_WEBHOOK_SECRET not set — refusing SendGrid webhook in production. " +
+                    "Set EMAIL_INBOUND_WEBHOOK_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.");
+            }
+            return false;
+        }
+        if (!_sendgridUnverifiedWarned) {
+            _sendgridUnverifiedWarned = true;
+            console.warn("[email] EMAIL_INBOUND_WEBHOOK_SECRET not set — accepting SendGrid webhook without verification (dev mode)");
+        }
+        return true;
+    }
+    // Check for the secret in a custom header or basic auth
+    const authHeader = getHeader(event, "authorization");
+    if (authHeader) {
+        // Basic auth: "Basic base64(user:pass)" — secret is the password
+        if (authHeader.startsWith("Basic ")) {
+            const decoded = Buffer.from(authHeader.slice(6), "base64").toString();
+            const password = decoded.split(":")[1];
+            if (password !== undefined && safeEq(password, secret))
+                return true;
+        }
+    }
+    // Also check a custom header (common SendGrid Inbound Parse pattern)
+    const customSecret = getHeader(event, "x-webhook-secret");
+    if (customSecret !== undefined && safeEq(customSecret, secret))
+        return true;
+    console.warn("[email] SendGrid webhook secret verification failed");
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Inbound email parsing
+// ---------------------------------------------------------------------------
+async function parseResendWebhook(event) {
+    const raw = await readRawBody(event);
+    const body = JSON.parse(raw);
+    if (!body || body.type !== "email.received")
+        return null;
+    const data = body.data;
+    if (!data)
+        return null;
+    // Resend webhook payload provides email metadata directly in data
+    // Fields: from, to, cc, subject, text, html, headers, created_at
+    const fromRaw = data.from;
+    const from = fromRaw ? parseEmailAddress(fromRaw) : null;
+    if (!from)
+        return null;
+    const toRaw = data.to;
+    const to = normalizeAddressList(toRaw);
+    const ccRaw = data.cc;
+    const cc = normalizeAddressList(ccRaw);
+    // Parse headers for Message-ID, In-Reply-To, References
+    const headers = parseHeadersObject(data.headers);
+    const messageId = headers["message-id"] || data.email_id || `resend-${Date.now()}`;
+    return {
+        messageId,
+        subject: data.subject || "(no subject)",
+        from,
+        to,
+        cc: cc.length > 0 ? cc : undefined,
+        text: data.text,
+        html: data.html,
+        inReplyTo: headers["in-reply-to"] || undefined,
+        references: parseReferencesHeader(headers["references"]),
+        date: data.created_at || undefined,
+    };
+}
+async function parseSendGridWebhook(event) {
+    const raw = await readRawBody(event);
+    const body = JSON.parse(raw);
+    if (!body)
+        return null;
+    // SendGrid Inbound Parse sends form data with fields:
+    // from, to, cc, subject, text, html, headers, envelope
+    const fromRaw = body.from;
+    const from = fromRaw ? parseEmailAddress(fromRaw) : null;
+    if (!from)
+        return null;
+    const toRaw = body.to;
+    const to = toRaw ? toRaw.split(",").map((a) => a.trim()) : [];
+    const ccRaw = body.cc;
+    const cc = ccRaw ? ccRaw.split(",").map((a) => a.trim()) : [];
+    // Parse raw headers string
+    const headersStr = body.headers;
+    const headers = parseHeadersString(headersStr);
+    const messageId = headers["message-id"] || `sendgrid-${Date.now()}`;
+    return {
+        messageId,
+        subject: body.subject || "(no subject)",
+        from,
+        to,
+        cc: cc.length > 0 ? cc : undefined,
+        text: body.text,
+        html: body.html,
+        inReplyTo: headers["in-reply-to"] || undefined,
+        references: parseReferencesHeader(headers["references"]),
+        date: headers["date"] || undefined,
+    };
+}
+// ---------------------------------------------------------------------------
+// Rate limiting
+// ---------------------------------------------------------------------------
+/**
+ * Rate-limit heuristic backed by the `integration_pending_tasks` queue.
+ *
+ * Counts how many tasks this sender has produced in the last hour. The count
+ * INCLUDES tasks already processed (status = completed/failed) because the
+ * rows aren't deleted on completion — that's enough signal to throttle a
+ * single noisy/abusive sender without needing a dedicated counter table.
+ *
+ * Two trade-offs worth knowing:
+ *   - This is a coarse heuristic, not exact metering. Within one hour the
+ *     count is correct; rows produced more than an hour ago naturally drop
+ *     off. We don't try to be precise, only to raise the bar past the
+ *     "send 10K emails through one Lambda burst" failure mode.
+ *   - The query relies on the `idx_pending_tasks_status_created` index plus
+ *     a sender substring match. A targeted attacker could amortise the cost
+ *     by reusing one sender address — that's fine, the goal here is to bound
+ *     the attack within a single attacker identity, not to detect spoofing.
+ *
+ * If the table doesn't yet exist on this deployment (no inbound webhook has
+ * been processed before), we silently allow the message — the schema is
+ * provisioned on first task insert. See H4 in the webhook security audit.
+ */
+async function isRateLimited(senderEmail) {
+    const cutoff = Date.now() - RATE_LIMIT_WINDOW_MS;
+    try {
+        const client = getDbExec();
+        const { rows } = await client.execute({
+            sql: `
+        SELECT COUNT(*) AS c
+          FROM integration_pending_tasks
+         WHERE platform = ?
+           AND created_at >= ?
+           AND payload LIKE ?
+      `,
+            args: ["email", cutoff, `%"senderId":"${senderEmail}"%`],
+        });
+        const count = Number(rows[0]?.c ?? 0);
+        return count >= RATE_LIMIT_MAX;
+    }
+    catch {
+        // Table doesn't exist yet (first webhook on a fresh deployment) — allow.
+        return false;
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers — email address parsing
+// ---------------------------------------------------------------------------
+/** Parse "Name <addr@example.com>" or plain "addr@example.com" */
+function parseEmailAddress(raw) {
+    const match = raw.match(/^\s*(.*?)\s*<([^>]+)>\s*$/);
+    if (match && match[2]) {
+        return {
+            name: match[1].replace(/^["']|["']$/g, "").trim() || undefined,
+            email: match[2].trim(),
+        };
+    }
+    return { email: raw.trim() };
+}
+/** Normalize a to/cc field that may be a string, array, or undefined into a string[] of addresses */
+function normalizeAddressList(raw) {
+    if (!raw)
+        return [];
+    if (Array.isArray(raw))
+        return raw.map((a) => a.trim());
+    return raw.split(",").map((a) => a.trim());
+}
+// ---------------------------------------------------------------------------
+// Helpers — header parsing
+// ---------------------------------------------------------------------------
+/** Parse a headers object (Resend format: array of {name, value} or Record) */
+function parseHeadersObject(headers) {
+    const result = {};
+    if (!headers)
+        return result;
+    if (Array.isArray(headers)) {
+        for (const h of headers) {
+            if (h && typeof h === "object" && "name" in h && "value" in h) {
+                result[h.name.toLowerCase()] = h.value;
+            }
+        }
+    }
+    else if (typeof headers === "object") {
+        for (const [key, value] of Object.entries(headers)) {
+            result[key.toLowerCase()] = String(value);
+        }
+    }
+    return result;
+}
+/** Parse a raw headers string (SendGrid format: "Key: Value\nKey: Value\n...") */
+function parseHeadersString(raw) {
+    const result = {};
+    if (!raw)
+        return result;
+    const lines = raw.split(/\r?\n/);
+    let currentKey = "";
+    let currentValue = "";
+    for (const line of lines) {
+        // Continuation line (starts with whitespace)
+        if (/^\s/.test(line) && currentKey) {
+            currentValue += " " + line.trim();
+            continue;
+        }
+        // Save previous header
+        if (currentKey) {
+            result[currentKey.toLowerCase()] = currentValue;
+        }
+        const colonIdx = line.indexOf(":");
+        if (colonIdx > 0) {
+            currentKey = line.slice(0, colonIdx).trim();
+            currentValue = line.slice(colonIdx + 1).trim();
+        }
+        else {
+            currentKey = "";
+            currentValue = "";
+        }
+    }
+    // Save last header
+    if (currentKey) {
+        result[currentKey.toLowerCase()] = currentValue;
+    }
+    return result;
+}
+/** Parse a References header value into an array of Message-IDs */
+function parseReferencesHeader(references) {
+    if (!references)
+        return undefined;
+    const ids = references.match(/<[^>]+>/g);
+    return ids && ids.length > 0 ? ids : undefined;
+}
+// ---------------------------------------------------------------------------
+// Helpers — threading
+// ---------------------------------------------------------------------------
+/**
+ * Get the thread root ID using a Gmail-style approach:
+ * the oldest Message-ID from the References chain is the thread root.
+ * If no References, use the current Message-ID.
+ */
+function getThreadRootId(messageId, references) {
+    if (references && references.length > 0) {
+        return references[0];
+    }
+    return messageId;
+}
+/**
+ * Scope a raw thread root id by the sender's email address. Two different
+ * senders crafting the same `References:` header value should NOT collide
+ * onto the same internal thread mapping — that's the email-side fix for the
+ * thread-injection finding (M1 in the webhook security audit).
+ *
+ * The returned id is opaque to callers and stays stable across messages
+ * from the same sender on the same conversation thread, so reply behaviour
+ * is unchanged.
+ */
+function scopeThreadIdToSender(rawThreadId, senderEmail) {
+    return `${senderEmail.toLowerCase()}::${rawThreadId}`;
+}
+// ---------------------------------------------------------------------------
+// Helpers — reply building
+// ---------------------------------------------------------------------------
+/** Build a References header from the platform context */
+function buildReferencesHeader(ctx) {
+    const parts = [];
+    // Include existing references
+    const refs = ctx.references;
+    if (refs) {
+        parts.push(...refs);
+    }
+    // Append the current message ID
+    const messageId = ctx.messageId;
+    if (messageId) {
+        // Avoid duplicates
+        if (!parts.includes(messageId)) {
+            parts.push(messageId);
+        }
+    }
+    return parts.join(" ");
+}
+/**
+ * Build CC list for reply-all when agent was CC'd.
+ * Include original To addresses and other CC addresses, excluding the agent and the original sender.
+ */
+function buildReplyAllCc(context) {
+    const agentAddress = process.env.EMAIL_AGENT_ADDRESS?.toLowerCase();
+    const senderEmail = context.senderId?.toLowerCase();
+    const toAddresses = context.platformContext.to || [];
+    const ccAddresses = context.platformContext.cc || [];
+    const allRecipients = new Set();
+    for (const addr of [...toAddresses, ...ccAddresses]) {
+        const normalized = addr.toLowerCase().trim();
+        // Exclude agent address and original sender (sender goes in To)
+        if (normalized !== agentAddress && normalized !== senderEmail) {
+            allRecipients.add(normalized);
+        }
+    }
+    return allRecipients.size > 0 ? Array.from(allRecipients) : undefined;
+}
+// ---------------------------------------------------------------------------
+// Helpers — text conversion
+// ---------------------------------------------------------------------------
+/** Strip HTML tags for a plain-text version of the email */
+function stripHtmlForPlainText(html) {
+    return html
+        .replace(/<br\s*\/?>/gi, "\n")
+        .replace(/<\/p>/gi, "\n\n")
+        .replace(/<\/div>/gi, "\n")
+        .replace(/<\/li>/gi, "\n")
+        .replace(/<li[^>]*>/gi, "- ")
+        .replace(/<\/h[1-6]>/gi, "\n\n")
+        .replace(/<[^>]+>/g, "")
+        .replace(/&nbsp;/g, " ")
+        .replace(/&amp;/g, "&")
+        .replace(/&lt;/g, "<")
+        .replace(/&gt;/g, ">")
+        .replace(/&quot;/g, '"')
+        .replace(/&#39;/g, "'")
+        .replace(/\n{3,}/g, "\n\n")
+        .trim();
+}
+/** Convert basic markdown to HTML for email rendering */
+function markdownToHtml(md) {
+    let html = md;
+    // Escape HTML entities in the source (but not our generated tags)
+    html = html
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;");
+    // Bold: **text** or __text__
+    html = html.replace(/\*\*(.+?)\*\*/g, "<strong>$1</strong>");
+    html = html.replace(/__(.+?)__/g, "<strong>$1</strong>");
+    // Italic: *text* or _text_ (but not inside words with underscores)
+    html = html.replace(/(?<!\w)\*([^*]+?)\*(?!\w)/g, "<em>$1</em>");
+    html = html.replace(/(?<!\w)_([^_]+?)_(?!\w)/g, "<em>$1</em>");
+    // Links: [text](url)
+    html = html.replace(/\[([^\]]+)\]\(([^)]+)\)/g, '<a href="$2" style="color:#2563eb;text-decoration:underline;">$1</a>');
+    // Inline code: `code`
+    html = html.replace(/`([^`]+)`/g, '<code style="background:#f1f5f9;padding:1px 4px;border-radius:3px;font-size:0.9em;">$1</code>');
+    // Unordered lists: lines starting with "- " or "* "
+    html = html.replace(/^([*-]) (.+)$/gm, "<li>$2</li>");
+    // Wrap consecutive <li> in <ul>
+    html = html.replace(/(<li>.*?<\/li>\n?)+/g, '<ul style="margin:8px 0;padding-left:20px;">$&</ul>');
+    // Ordered lists: lines starting with "1. ", "2. " etc.
+    html = html.replace(/^\d+\. (.+)$/gm, "<li>$1</li>");
+    // Wrap consecutive <li> that aren't in <ul> in <ol>
+    html = html.replace(/(?<!<\/ul>)(<li>.*?<\/li>\n?)+/g, (match) => {
+        if (match.includes("<ul"))
+            return match;
+        return `<ol style="margin:8px 0;padding-left:20px;">${match}</ol>`;
+    });
+    // Headings: # through ###
+    html = html.replace(/^### (.+)$/gm, '<h3 style="margin:16px 0 8px;font-size:1.1em;">$1</h3>');
+    html = html.replace(/^## (.+)$/gm, '<h2 style="margin:16px 0 8px;font-size:1.25em;">$1</h2>');
+    html = html.replace(/^# (.+)$/gm, '<h1 style="margin:16px 0 8px;font-size:1.4em;">$1</h1>');
+    // Horizontal rules: --- or ***
+    html = html.replace(/^(-{3,}|\*{3,})$/gm, '<hr style="border:none;border-top:1px solid #e2e8f0;margin:16px 0;">');
+    // Paragraphs: double newlines
+    html = html.replace(/\n\n/g, "</p><p>");
+    // Single newlines → <br>
+    html = html.replace(/\n/g, "<br>");
+    // Wrap in paragraph tags
+    html = `<p>${html}</p>`;
+    // Clean up empty paragraphs
+    html = html.replace(/<p>\s*<\/p>/g, "");
+    return html;
+}
+/** Wrap body HTML in a minimal email template with inline styles */
+function wrapInEmailTemplate(bodyHtml) {
+    return `<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+</head>
+<body style="margin:0;padding:0;background-color:#ffffff;">
+<div style="max-width:600px;margin:0 auto;padding:20px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Helvetica,Arial,sans-serif;font-size:14px;line-height:1.6;color:#1a1a1a;">
+${bodyHtml}
+</div>
+</body>
+</html>`;
+}
+// ---------------------------------------------------------------------------
+// Raw body reader (matches Slack adapter pattern)
+// ---------------------------------------------------------------------------
+/**
+ * Read the raw request body as a string and cache on the event context.
+ * Reads raw bytes from the request stream — never re-stringifies a parsed
+ * body, since the Resend / Svix HMAC is computed over the exact bytes sent
+ * (M2 in the webhook security audit).
+ */
+async function readRawBody(event) {
+    const cached = event.context.__rawBody;
+    if (typeof cached === "string")
+        return cached;
+    const raw = (await h3ReadRawBody(event)) ?? "";
+    event.context.__rawBody = raw;
+    return raw;
+}
+//# sourceMappingURL=email.js.map