@agentcomms/resend 0.15.2 → 0.16.0

package/README.md

@@ -9,6 +9,10 @@ npm install -g @agentcomms/resend    # or run it with npx @agentcomms/resend <co
 
 New in 0.7.0.
 
+The local event daemon, [`@agentcomms/events-daemon`](../events-daemon/README.md), may call this package's internal
+read-only event operation. It adds no Resend command
+or MCP tool, and it cannot send.
+
 ## What it promises, and who enforces it
 
 **Read-only is enforced by this package, not by the key.** Resend has no read-only API key. A full-access key can

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as exemptFromUpdateGate, B as UPDATE_CHECK_CHILD_COMMAND, C as policyChange, D as sendPolicyOf, E as removeAccountChange, Et as writeResult, F as CHANNEL_SERVERS, G as canPrompt, H as approvalsOf, I as CommsError, J as cliHandoffs, L as EXIT_CODES, N as checkNewName, Nt as VERSION, O as showAccount, Ot as RESEND_CALLER, Q as escapeForDisplay, R as PATH_OPTIONS, S as policyApprovalRefusal, T as policyWanted, Tt as wholeNumber, U as approveChangeAtTerminal, V as agentMarker, W as approveRefusedHint, X as commandPathOf, Y as colorEnabled, Z as describeFenceReport, _ as runDoctor, _t as serverPruneChange, a as revokeSendApproval, at as kindOf, b as listAccounts, bt as truncateDisplay, c as downloadReceived, ct as pathOverridesFromCliOptions, d as listReceived, dt as renderInstall, f as listScheduled, ft as renderPrune, g as showSentEmail, gt as serverInstallChange, h as showReceived, ht as runUpdateCheckChild, i as prepareSend, it as installExitStatus, k as ResendContext, l as getMetrics, lt as refuseUnclaimedApproval, m as listSuppressions, mt as runCommand, n as executeSend, nt as handoffSentence, o as sendStatus, ot as openCore, p as listSentEmails, pt as resolvePaths, r as finishSendApproval, rt as handoffSentenceToFill, s as cancelScheduledChange, st as paint, t as beginSendApproval, tt as gatedChangeAtTerminal, u as listDomains, ut as renderApprovalWait, v as addAccountChange, vt as terminalUpdateHooks, w as policyReport, wt as waitForApproval, x as modeOf, xt as updateGateAtTerminal, y as inspectKey, z as SEND_LOOKUP } from "./send-V6GB4P5p.mjs";
+import { A as removeAccountChange, At as updateGateAtTerminal, C as inspectKey, Ct as runUpdateCheckChild, D as policyChange, Dt as terminalUpdateHooks, E as policyApprovalRefusal, Ft as writeResult, G as SEND_LOOKUP, H as CommsError, Ht as VERSION, J as approvalsOf, K as UPDATE_CHECK_CHILD_COMMAND, Lt as RESEND_CALLER, M as showAccount, Nt as waitForApproval, O as policyReport, P as ResendContext, Pt as wholeNumber, R as checkNewName, S as addAccountChange, St as runCommand, T as modeOf, Tt as serverPruneChange, U as EXIT_CODES, V as CHANNEL_SERVERS, W as PATH_OPTIONS, X as approveRefusedHint, Y as approveChangeAtTerminal, Z as canPrompt, _ as showSentEmail, _t as refuseUnclaimedApproval, a as revokeSendApproval, at as exemptFromUpdateGate, bt as renderPrune, c as downloadReceived, ct as handoffSentence, d as listReceived, dt as kindOf, et as cliHandoffs, f as listScheduled, g as showReceived, gt as pathOverridesFromCliOptions, ht as paint, i as prepareSend, it as escapeForDisplay, j as sendPolicyOf, k as policyWanted, kt as truncateDisplay, l as getMetrics, lt as handoffSentenceToFill, m as listSuppressions, mt as openCore, n as executeSend, nt as commandPathOf, o as sendStatus, p as listSentEmails, q as agentMarker, r as finishSendApproval, rt as describeFenceReport, s as cancelScheduledChange, st as gatedChangeAtTerminal, t as beginSendApproval, tt as colorEnabled, u as listDomains, ut as installExitStatus, vt as renderApprovalWait, w as listAccounts, wt as serverInstallChange, x as runDoctor, xt as resolvePaths, yt as renderInstall } from "./send-BwyJM23a.mjs";
 import path from "node:path";
 import { createInterface } from "node:readline/promises";
 import { stripVTControlCharacters } from "node:util";
@@ -3497,7 +3497,7 @@ is out: update first, or put it off (the stop names both commands) · 64 usage
 	}));
 	const mcp = program.command("mcp").description("run the MCP server on stdio, for a coding agent to connect to").option("--account <name>", "pin the server to one account; every tool then acts on it and no other").action(async (flags) => {
 		ran = true;
-		const startResendStdioServer = deps.startMcp ?? (await import("./stdio-entry-DGMgTUnO.mjs")).startResendStdioServer;
+		const startResendStdioServer = deps.startMcp ?? (await import("./stdio-entry-BGq1Q5V_.mjs")).startResendStdioServer;
 		const core = coreForInvocation();
 		await startResendStdioServer({
 			...deps,

package/dist/index.d.mts

@@ -4322,7 +4322,7 @@ declare namespace external_d_exports {
   export { $brand, $input, $output, BRAND, CompileOptions, GlobalMeta, INVALID, Infer$1 as Infer, IssueData, JSONType, NEVER, $RefinementCtx as RefinementCtx, SafeExtendShape, Schema, TimePrecision, TypeOf, ZodAny, ZodArray, ZodBase64, ZodBase64URL, ZodBigInt, ZodBigIntFormat, ZodBoolean, ZodCIDRv4, ZodCIDRv6, ZodCUID, ZodCUID2, ZodCatch, ZodCodec, ZodCoercedBigInt, ZodCoercedBoolean, ZodCoercedDate, ZodCoercedNumber, ZodCoercedString, ZodCompileAsyncError, ZodCompileUnsupportedError, ZodCreditCard, ZodCustom, ZodCustomStringFormat, ZodDate, ZodDefault, ZodDiscriminatedUnion, ZodE164, ZodEmail, ZodEmoji, ZodEnum, ZodError, ZodErrorMap, ZodExactOptional, ZodFile, ZodFirstPartySchemaTypes, ZodFirstPartyTypeKind, ZodFlattenedError, ZodFloat32, ZodFloat64, ZodFormattedError, ZodFunction, ZodGUID, ZodIBAN, ZodIPv4, ZodIPv6, ZodISODate, ZodISODateTime, ZodISODuration, ZodISOTime, ZodInstanceOf, ZodInt, ZodInt32, ZodInt64, ZodIntersection, ZodIssue, ZodIssueCode, ZodJSONSchema, ZodJSONSchemaInternals, ZodJWT, ZodKSUID, ZodLazy, ZodLiteral, ZodMAC, ZodMap, ZodNaN, ZodNanoID, ZodNever, ZodNonOptional, ZodNull, ZodNullable, ZodNumber, ZodNumberFormat, ZodObject, ZodOptional, ZodPipe, ZodPrefault, ZodPreprocess, ZodPromise, ZodRawShape$1 as ZodRawShape, ZodReadonly, ZodRealError, ZodRecord, ZodSafeParseError, ZodSafeParseResult, ZodSafeParseSuccess, ZodSchema, ZodSet, ZodStandardSchemaWithJSON, ZodString, ZodStringFormat, ZodSuccess, ZodSymbol, ZodTemplateLiteral, ZodTransform, ZodTuple, ZodType, ZodTypeAny, ZodUInt32, ZodUInt64, ZodULID, ZodURL, ZodUUID, ZodUndefined, ZodUnion, ZodUnknown, ZodVoid, ZodXID, ZodXor, _ZodBigInt, _ZodBoolean, _ZodDate, _ZodNumber, _ZodString, _ZodType, _default, _function, any, array, base64, base64url, bigint$1 as bigint, boolean$1 as boolean, _catch as catch, check, cidrv4, cidrv6, clone, codec, coerce_d_exports as coerce, compile, config, index_d_exports$1 as core, creditCard, cuid, cuid2, currencyCode, custom, date$2 as date, decode, decodeAsync, deepPartial, describe, discriminatedUnion, e164, email, emoji, encode, encodeAsync, _endsWith as endsWith, _enum as enum, exactOptional, file, flattenError, float32, float64, formatError, fromJSONSchema, _function as function, getDiscriminatedOption, getErrorMap, globalRegistry, _gt as gt, _gte as gte, guid, hash, hex, hostname, httpUrl, iban, _includes as includes, output$1 as infer, inferFlattenedErrors, inferFormattedError, input, _instanceof as instanceof, int, int32, int64, intersection, invertCodec, ipv4, ipv6, iso_d_exports as iso, json, jwt, keyof, ksuid, lazy, _length as length, literal, index_d_exports$2 as locales, looseObject, looseRecord, _lowercase as lowercase, _lt as lt, _lte as lte, mac, map, _maxLength as maxLength, _maxSize as maxSize, memoizer, meta, _mime as mime, _minLength as minLength, _minSize as minSize, _multipleOf as multipleOf, nan, nanoid, nativeEnum, _negative as negative, never, _nonnegative as nonnegative, nonoptional, _nonpositive as nonpositive, _normalize as normalize, _null as null, nullable, nullish, number$1 as number, object, optional, output, _overwrite as overwrite, parse, parseAsync, partialRecord, pipe, _positive as positive, prefault, preprocess, prettifyError, promise, _properties as properties, _property as property, readonly, record, refine, _regex as regex, regexes_d_exports as regexes, registry, safeDecode, safeDecodeAsync, safeEncode, safeEncodeAsync, safeParse, safeParseAsync, set, setErrorMap, _size as size, _slugify as slugify, _startsWith as startsWith, strictObject, string$1 as string, stringFormat, stringbool, success, superRefine, symbol, templateLiteral, toJSONSchema, _toLowerCase as toLowerCase, _toUpperCase as toUpperCase, toZod, transform, treeifyError, _trim as trim, tuple, uint32, uint64, ulid, _undefined as undefined, union, unknown, _uppercase as uppercase, url, util_d_exports as util, uuid, uuidv4, uuidv6, uuidv7, validate, validateAsync, _void as void, withParser, xid, xor };
 }
 //#endregion
-//#region ../core/dist/change-flow-mr6T-6nU.d.mts
+//#region ../core/dist/change-flow-B_bGbrkO.d.mts
 //#region src/config-hooks.d.ts
 /**
  * Test-only pauses inside `ConfigStore.convertToVersion3`, for the tests that prove a write racing the conversion is
@@ -4414,7 +4414,7 @@ interface ResolvedPaths {
    */
   downloadsDir: string;
 }
-type ErrorCode = "UNEXPECTED" | "APPROVAL_REQUIRED" | "APPROVAL_PENDING" | "APPROVAL_EXPIRED" | "APPROVAL_VOID" | "SEND_OUTCOME_UNKNOWN" | "SEND_REFUSED" | "POLICY_NEVER" | "RATE_CAPPED" | "UNSENDABLE_HTML" | "LOOSENING_REFUSED" | "UPDATE_REQUIRED" | "USAGE" | "CURSOR_MISMATCH" | "BAD_DATA" | "REPLY_INVALID" | "NOT_FOUND" | "PROVIDER_UNAVAILABLE" | "SECRET_STORE_UNAVAILABLE" | "TRANSIENT" | "KEYCHAIN_APPROVAL_PENDING" | "LOCK_TIMEOUT" | "AUTH_REQUIRED" | "SCOPE_MISSING" | "CONFIG";
+type ErrorCode = "UNEXPECTED" | "APPROVAL_REQUIRED" | "APPROVAL_PENDING" | "APPROVAL_EXPIRED" | "APPROVAL_VOID" | "SEND_OUTCOME_UNKNOWN" | "SEND_REFUSED" | "POLICY_NEVER" | "RATE_CAPPED" | "UNSENDABLE_HTML" | "LOOSENING_REFUSED" | "UPDATE_REQUIRED" | "USAGE" | "CURSOR_MISMATCH" | "BAD_DATA" | "REPLY_INVALID" | "NOT_FOUND" | "PROVIDER_UNAVAILABLE" | "SOURCE_UNAVAILABLE" | "SECRET_STORE_UNAVAILABLE" | "TRANSIENT" | "KEYCHAIN_APPROVAL_PENDING" | "LOCK_TIMEOUT" | "AUTH_REQUIRED" | "SCOPE_MISSING" | "WHATSAPP_VISIBILITY_SEAM_REQUIRED" | "CONFIG";
 interface CommsErrorOptions {
   hint?: string;
   details?: Record<string, unknown>;
@@ -5044,6 +5044,28 @@ interface LooseningConsent {
  * change's is the live change policy. It never changes when the configuration does.
  */
 type ApprovalRoute = "chat" | "confirm";
+/** The four activation documents that may receive standing disclosure authority. */
+type DisclosureActivationKind = "rule" | "judge-budget" | "judge-kind" | "enable-all";
+/** An immutable version named by a standing disclosure authorisation. */
+type DisclosureVersionKind = "rule" | "target" | "subscriber" | "judge" | "judge-budget" | "judge-kind";
+interface DisclosureVersion {
+  readonly kind: DisclosureVersionKind;
+  readonly id: string;
+  readonly version: number;
+}
+/**
+ * The content-free, canonical authority for a future disclosure (local-event design D2).
+ *
+ * The event daemon derives this from one canonical activation document. Core does not construct
+ * that document; it verifies the closed shape that makes an independently supplied version list
+ * impossible to smuggle into a disclosure record.
+ */
+interface DisclosureBinding {
+  readonly digest: string;
+  readonly activationIntentId: string;
+  readonly activationKind: DisclosureActivationKind;
+  readonly versions: readonly DisclosureVersion[];
+}
 /**
  * What a record's `inboxId` names. `owner` — a mailbox or account that existed when it was made (every send and
  * download, and a change to one). `prospective` — a change that creates its owner, which has no id yet. `global` — a
@@ -5175,7 +5197,10 @@ interface AuditRecord {
   recipients?: string[];
   approvalId?: string;
   reason?: string;
-  surface?: "cli" | "mcp";
+  /** The process that performed the work; daemon work keeps its caller separately in `origin`. */
+  surface?: "cli" | "mcp" | "app" | "daemon";
+  /** The requesting client surface; autonomous work is `daemon`/`daemon`. */
+  origin?: "cli" | "mcp" | "app" | "daemon";
   /**
    * The policy that decided how this was approved. Written by change approvals, where it is the whole question
    * afterwards: a loosening a person typed a code for and one an agent claimed after a yes in chat look the same in
@@ -5295,7 +5320,7 @@ interface CorruptStub {
   readonly reason: UnreadableReason | IntegrityReason;
 }
 /** What an attribution-verified corrupt record may still show its owner: the fields its binding was made over. */
-interface SafeFields {
+interface OrdinarySafeFields {
   readonly kind: ApprovalKind;
   readonly channel: string;
   readonly ownerScope: OwnerScope;
@@ -5305,6 +5330,11 @@ interface SafeFields {
   readonly draftMessageId: string;
   readonly expect: Expectation;
 }
+/** A disclosure record has no channel owner or sender-controlled operational fields to expose. */
+interface DisclosureSafeFields {
+  readonly kind: "disclosure";
+}
+type SafeFields = OrdinarySafeFields | DisclosureSafeFields;
 type StoredApproval = {
   readonly form: "v2";
   readonly record: ApprovalRecord;
@@ -5430,7 +5460,7 @@ type ApprovalChannel = "elicitation" | "terminal";
  * and a kind on every record, so that none can be spent as another. Without it, a person who approved a post at a
  * terminal would also have approved whatever change an agent claimed under the same id.
  */
-type ApprovalKind = "send" | "change" | "download";
+type ApprovalKind = "send" | "change" | "download" | "disclosure";
 /** The inbox or account a change is about. `id` is absent when the change connects it, and it does not exist yet. */
 interface ChangeTarget {
   kind: "inbox" | "account";
@@ -5607,6 +5637,17 @@ interface ApprovalRecord {
   change?: ChangeBinding | undefined;
   /** For a download's question: what it asked about, and the folders it offered. `contentDigest` is `downloadDigest`. */
   download?: DownloadBinding | undefined;
+  /** For a standing disclosure: the canonical, content-free event activation authority. */
+  disclosure?: DisclosureBinding | undefined;
+}
+/**
+ * The stored branch for standing disclosure. Its runtime decoder refuses every field belonging to send, change or
+ * download records; this type is what the three disclosure-only methods return.
+ */
+interface DisclosureApprovalRecord extends Omit<ApprovalRecord, "kind" | "disclosure" | "approvedVia" | "channel" | "ownerScope" | "route" | "inboxId" | "inboxSub" | "draftId" | "draftMessageId" | "contentDigest" | "sendEpoch" | "policy" | "requiredPolicy" | "riskFlags" | "expect" | "approvedBindingDigest" | "sendingAt" | "sendingHeartbeatAt" | "sentAt" | "sentMessageId" | "failedAt" | "change" | "download"> {
+  kind: "disclosure";
+  disclosure: DisclosureBinding;
+  approvedVia?: "terminal" | "app" | undefined;
 }
 interface CreateApprovalInput {
   /** The manifest channel preparing the send. A channel this release does not know is refused. */
@@ -5751,6 +5792,8 @@ declare class ApprovalStore {
    */
   ensurePruned(options?: MaintenanceOptions): Promise<MaintenanceStatus>;
   create(input: CreateApprovalInput): Promise<ApprovalRecord>;
+  /** Creates only a pending standing disclosure approval from a daemon-derived canonical binding. */
+  createDisclosure(binding: DisclosureBinding): Promise<DisclosureApprovalRecord>;
   /**
    * One approval, in whichever of its four forms it is (`StoredApproval`), read against one configuration snapshot —
    * or null when there is none. Nothing is written.
@@ -5793,6 +5836,21 @@ declare class ApprovalStore {
   issueChallenge(approvalId: string, kind?: ApprovalKind, _platform?: NodeJS.Platform, options?: {
     usedSaid?: UsedSaid | undefined;
   }): Promise<string>;
+  /** Issues the typed challenge that a terminal or the trusted desktop app must answer for disclosure. */
+  issueDisclosureChallenge(approvalId: string): Promise<string>;
+  /**
+   * Approves one exact standing disclosure authority. MCP/chat forms are never an approval channel here: `app` means
+   * the desktop application's trusted typed-challenge bridge, not a client form.
+   */
+  approveDisclosure(approvalId: string, liveBinding: DisclosureBinding, answer: string, via: "terminal" | "app"): Promise<DisclosureApprovalRecord>;
+  /**
+   * Claims an approved disclosure once, persisting the exact `usedAt` that recovery must subsequently reuse.
+   * A specialised caller may impose a shorter deadline; it is evaluated while this record's transition lock is held,
+   * so a check made before waiting on that lock cannot accidentally consume the approval after it has expired.
+   */
+  claimForDisclosure(approvalId: string, liveBinding: DisclosureBinding, options?: {
+    readonly deadlineMs?: number | undefined;
+  }): Promise<DisclosureApprovalRecord>;
   /**
    * A human approved through a confirm channel by typing the issued challenge. The draft must still be exactly what the
    * record was prepared for; otherwise the record is voided, because the human would be approving content the record
@@ -6114,9 +6172,13 @@ interface TaintHandle {
   id: string;
 }
 type TaintSource = "header" | "body";
+/** Why the content reached this process. This is separate from `TaintSource`, which remains the cap priority. */
+type TaintOrigin = "read" | "event";
 interface TaintObservation {
   address: string;
   source: TaintSource;
+  /** Old readers did not record this, so an omitted origin remains an ordinary read. */
+  origin?: TaintOrigin | undefined;
   inboxId: string;
   messageId?: string | undefined;
 }
@@ -6124,6 +6186,8 @@ interface TaintObservation {
 interface TaintHandleObservation {
   handle: TaintHandle;
   source: TaintSource;
+  /** Old readers did not record this, so an omitted origin remains an ordinary read. */
+  origin?: TaintOrigin | undefined;
   inboxId: string;
   messageId?: string | undefined;
 }
@@ -6147,6 +6211,8 @@ interface TaintAggregate {
   readonly at: string;
   readonly source: TaintSource;
   readonly inboxIds: readonly string[];
+  /** Sorted, duplicate-free provenance. A base entry with no sidecar record is a legacy read. */
+  readonly origins: readonly TaintOrigin[];
 }
 interface TaintCheck {
   address: boolean;
@@ -6156,10 +6222,15 @@ interface TaintCheck {
   /** Its domain's, when that counts — not a public mailbox provider — and is in the window. */
   domainSeen?: TaintAggregate | undefined;
 }
+/** Testable interruption point for the crash-safe, two-lock sidecar protocol. */
+interface TaintStoreHooks {
+  afterOriginsCommit?: (() => Promise<void>) | undefined;
+  onLockAcquired?: ((lock: "origins" | "taint" | "handles") => void) | undefined;
+}
 declare class TaintStore {
   #private;
   readonly directory: string;
-  constructor(stateDir: string, now?: () => Date);
+  constructor(stateDir: string, now?: () => Date, hooks?: TaintStoreHooks);
   /**
    * Records observations. Throws if it cannot — callers must fail the read rather than return content whose taint
    * was not recorded.
@@ -6177,6 +6248,8 @@ declare class TaintStore {
    * carries a domain: two ids sharing a workspace says nothing about either of them.
    */
   checkHandle(handle: TaintHandle): Promise<boolean>;
+  /** The merged provenance of a retained handle, or no origins when it is not in the taint window. */
+  checkHandleOrigins(handle: TaintHandle): Promise<readonly TaintOrigin[]>;
 }
 //#endregion
 //#region src/core.d.ts
@@ -13415,10 +13488,68 @@ type RegisteredPrompt = {
   remove(): void;
 };
 //#endregion
+//#region src/accounts.d.ts
+declare const MODES: readonly ["read", "send"];
+type Mode = (typeof MODES)[number];
+/** A Resend account: core's generic record, checked, with Resend's one key of its own. */
+interface ResendAccount extends AccountConfig {
+  platform: "resend";
+  /** `read` or `send`, and nothing else: a record with another word is refused. `tier` says the same. */
+  mode: Mode;
+  /** For a `sending_access` key: the one domain the person said it is restricted to. Declared, not detected. */
+  domainLock?: string | undefined;
+}
+interface NamedAccount {
+  name: string;
+  account: ResendAccount;
+}
+/**
+ * Reading accounts from core's configuration as it is now. Writes go through `core.config.update`, which validates
+ * the file and refuses any loosening the caller holds no consent for.
+ */
+declare class AccountStore {
+  #private;
+  constructor(load: () => Promise<Config$1>, handoffs: CliHandoffs);
+  list(): Promise<NamedAccount[]>;
+  find(name: string): Promise<NamedAccount | null>;
+  findById(id: string): Promise<NamedAccount | null>;
+  require(name: string): Promise<NamedAccount>;
+}
+//#endregion
 //#region src/api/guard.d.ts
+/**
+ * The one door every Resend request goes through.
+ *
+ * The Slack package's guard, for Resend: it sits under every operation, on the `fetch` the transport actually calls,
+ * so a request added anywhere in this package meets it whether or not its author knew this file existed. It fails
+ * closed in every direction:
+ *
+ * - **Two origins, hardcoded, and no argument for either.** `https://api.resend.com` for the API and
+ *   `https://inbound-cdn.resend.com` for a received attachment's bytes. A test reaches a fake Resend by rewriting an
+ *   already-approved URL in the *inner* fetch, after this has approved it, so there is no mode in which the check is
+ *   off.
+ * - **A closed route table** (`routes.ts`). Anything not in it is refused, the most tempting ones with a reason.
+ * - **Writes need a one-shot permit**, opened by the one operation that owns the route, for exactly one request.
+ *   `emails.send` must also carry the approval id as its `Idempotency-Key` and as the `agentcomms_approval` tag, so
+ *   a send that somehow reached here without going through the gate's own request builder is refused too.
+ * - **The key never goes to the CDN.** A download carrying an `Authorization` header is refused: the signed link is
+ *   its own credential, and the API key belongs to `api.resend.com` alone.
+ * - **No redirects.** A 30x is a second request nothing here checked, and Resend's API does not redirect.
+ */
+interface WritePermit {
+  /**
+   * What the open permit is for, or null when no write is allowed — which is almost always.
+   *
+   * For `emails.send` the approval id; for `emails.cancel` the id of the one email it may cancel.
+   */
+  grant: string | null;
+  /** The route the permit opens. A permit to cancel does not open the door to send, nor the other way round. */
+  route: string | null;
+}
 type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
 //#endregion
 //#region src/api/throttle.d.ts
+type ThrottlePriority = "interactive" | "background-event";
 interface ThrottleOptions {
   now?: () => number;
   sleep?: (ms: number) => Promise<void>;
@@ -13429,6 +13560,47 @@ interface ThrottleOptions {
   /** How long a request may wait for the lock in all: `LOCK_MAX_WAIT_MS`. Tests shorten this too. */
   lockMaxWaitMs?: number;
 }
+declare class Throttle {
+  #private;
+  readonly path: string;
+  /** Takes no account on purpose: see above. Every throttle on a state directory is the same one. */
+  constructor(stateDir: string, options?: ThrottleOptions);
+  /** When Resend will next be asked anything from this machine, or null when it is not holding off. */
+  blockedUntil(): Promise<string | null>;
+  /**
+   * Waits for this request's slot, or refuses at once while Resend has asked for none.
+   *
+   * The slot is reserved under the lock and waited for outside it, so a slow request does not hold every other
+   * process's reservation. **And the hold is looked at again after the wait**: a request queued behind another is
+   * still waiting when that one comes back 429, and the stop Resend asked for covers it as much as anything asked
+   * later.
+   */
+  before(priority?: ThrottlePriority): Promise<void>;
+  /**
+   * Reads what Resend said about the budget, and stops every account on this machine when it says to — whichever
+   * account's request it answered. Returns the stop, if any.
+   */
+  after(status: number, headers: Headers): Promise<number | null>;
+}
+//#endregion
+//#region src/api/client.d.ts
+/**
+ * One Resend call: through the throttle, through the guard, with Resend's failures turned into this repository's codes
+ * — and with the key taken out of anything that could be printed.
+ *
+ * The key appears in exactly one place in this package's requests, the `Authorization` header built below, and in
+ * no message, detail or hint: every text that came back from Resend or from the network passes through `redact` on
+ * its way into an error, in case either ever echoes it.
+ */
+interface ResendTransport {
+  /** The inner fetch: the real one in production, a loopback fake in tests. Always wrapped by the guard. */
+  readonly fetch?: FetchLike | undefined;
+  readonly key: string;
+  readonly throttle: Throttle;
+  /** Closed except inside the one operation that opens it for one request. */
+  readonly permit?: WritePermit | undefined;
+  readonly timeoutMs?: number | undefined;
+}
 //#endregion
 //#region src/context.d.ts
 /**
@@ -13453,6 +13625,43 @@ interface ResendContextOptions {
   /** How a throttled send waits (design 2026-10-08 §R2): core's pacing; a test injects one on the throttle's clock. */
   sendPacing?: (() => SendPacing) | undefined;
 }
+declare class ResendContext {
+  #private;
+  readonly core: Core;
+  readonly env: NodeJS.ProcessEnv;
+  readonly now: () => Date;
+  readonly platform: NodeJS.Platform;
+  readonly surface: "cli" | "mcp";
+  /**
+   * What every result, refusal and hint names for a person to run: Resend's own CLI as this installation runs it, or
+   * core's through its installed dependency (`own`, `core`), quoted for `platform` — or why there is none here.
+   */
+  readonly handoffs: CliHandoffs;
+  readonly accounts: AccountStore;
+  /** A fresh pacing for each send: how a throttled one waits before it tries again. */
+  readonly sendPacing: () => SendPacing;
+  constructor(options?: ResendContextOptions);
+  config(): Promise<Config$1>;
+  /** The secret store this configuration chose, or the keychain before anything has been stored. */
+  secrets(): Promise<SecretStore>;
+  /** The machine's default send policy, which an account without one of its own inherits. */
+  defaultSendPolicy(): Promise<SendPolicy>;
+  /**
+   * The machine's one Resend throttle. Not one per account: Resend's budget is the team's, and nothing here can tell
+   * which accounts share a team, so every account — and a key being checked before it is stored — shares one.
+   */
+  throttle(): Throttle;
+  /**
+   * The team's verified domains for an account, from `load` at most every five minutes in this process: received mail
+   * is read a page at a time, and asking Resend for the same list before every page would spend the team's budget on
+   * an answer that changes when a person adds a domain.
+   */
+  teamDomains(accountId: string, load: () => Promise<readonly string[]>): Promise<readonly string[]>;
+  /** A transport for a key that is not stored yet — `account add` checking what it was given. */
+  transportForKey(key: string): ResendTransport;
+  /** A transport for a connected account: its key from the secret store, the machine's throttle, and any open permit. */
+  transport(named: NamedAccount, permit?: WritePermit): Promise<ResendTransport>;
+}
 //#endregion
 //#region src/mcp/server.d.ts
 /**
@@ -13481,4 +13690,89 @@ interface ResendMcpServer {
 }
 export declare function createResendMcpServer(options?: ResendMcpOptions): Promise<ResendMcpServer>;
 //#endregion
-export type { ResendMcpOptions, ResendMcpServer, Route, RouteKind };
+//#region src/operations/events.d.ts
+interface ResendEventReceivedListItem {
+  readonly id: string;
+}
+interface ResendEventAddress {
+  readonly address: string;
+  readonly name: string | null;
+}
+interface ResendEventReceivedAttachment {
+  readonly id: string;
+  readonly filename: string;
+  readonly riskFlags: readonly string[];
+  readonly contentType: string | null;
+  readonly size: number | null;
+  readonly inline: boolean;
+}
+interface ResendEventAuthentication {
+  readonly spf: string | null;
+  readonly dkim: string | null;
+  readonly dmarc: string | null;
+  readonly evaluatedBy: "resend" | null;
+}
+interface ResendEventReceivedCandidate {
+  readonly emailId: string;
+  readonly receivedAt: string;
+  readonly subject: string;
+  readonly body?: string | undefined;
+  readonly bodyTruncated?: boolean | undefined;
+  readonly attachments: readonly ResendEventReceivedAttachment[];
+  readonly attachmentCount: number;
+  readonly from: ResendEventAddress | null;
+  readonly replyTo: readonly ResendEventAddress[];
+  readonly to: readonly string[];
+  readonly cc: readonly string[];
+  readonly receivedFor: readonly string[];
+  readonly messageId: string | null;
+  readonly authentication: ResendEventAuthentication;
+}
+interface ResendEventSentItem {
+  readonly id: string;
+  readonly lastEvent: string;
+  readonly from: ResendEventAddress | null;
+  readonly to: readonly string[];
+  readonly cc: readonly string[];
+  readonly bcc: readonly string[];
+  readonly subject: string;
+  readonly createdAt: string | null;
+  readonly scheduledAt: string | null;
+  readonly messageId: string | null;
+}
+interface ResendEventReader {
+  listReceived(after?: string): Promise<Readonly<{
+    emails: readonly ResendEventReceivedListItem[];
+    next: string | null;
+  }>>;
+  getReceived(id: string): Promise<Readonly<{
+    kind: "candidate";
+    candidate: ResendEventReceivedCandidate;
+  }> | Readonly<{
+    kind: "vanished";
+  }>>;
+  listSent(after?: string): Promise<Readonly<{
+    emails: readonly ResendEventSentItem[];
+    next: string | null;
+  }>>;
+}
+/**
+ * Converts the already-capped body produced by the Resend reader into the
+ * event representation.  `bodyTruncated` is that reader's fact: this layer
+ * must not recompute it from Unicode code points.
+ */
+export declare function normaliseResendEventBody(value: string, bodyTruncated: boolean): Readonly<{
+  body: string;
+  bodyTruncated: boolean;
+}>;
+/** A structural read adapter: no permit, no sender, and each request is labelled background-event. */
+export declare function createResendEventReader(context: ResendContext, account: string, accountId?: string): ResendEventReader;
+/** Opens Resend's guarded, read-only context for the held event owner. */
+export declare function createResendEventReaderForPaths(input: Readonly<{
+  account: string;
+  /** A daemon binding: resolve every request by this stable id, never by its presentation alias. */
+  accountId?: string | undefined;
+  pathOverrides: PathOverrides;
+}>): ResendEventReader;
+//#endregion
+export type { ResendEventAddress, ResendEventAuthentication, ResendEventReader, ResendEventReceivedAttachment, ResendEventReceivedCandidate, ResendEventReceivedListItem, ResendEventSentItem, ResendMcpOptions, ResendMcpServer, Route, RouteKind };