@aglyn/shared-util-email 1.0.0-beta.143

package/src/lib/send-email.js

@@ -0,0 +1,586 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The Resend send endpoint. Every outbound application email in Aglyn goes
+ * through here — invites, receipts, usage summaries, campaigns, staff alerts.
+ *
+ * Auth email (verification, password reset) is Firebase's job and does NOT
+ * come through this module.
+ */ import { emailSendRateWindowStartMs, getEmailSendGovernor, isRefusablePriority, resolveSendPriority } from "./send-rate.js";
+import { renderTextEmailHtml } from "./text-email-html.js";
+import { sendingIdentityRefusal, pooledMarketingRefusal } from "./sending-domain.js";
+import { appendUnsubscribeHtml, appendUnsubscribeText, getMarketingSendGate, isMarketingMessage, unsubscribeHeaders } from "./marketing-send.js";
+export const RESEND_SEND_ENDPOINT = 'https://api.resend.com/emails';
+/**
+ * The `context` tag, attached to every send (AGL-2407).
+ *
+ * ## Why this is here and not at 37 call sites
+ *
+ * Until now `tags` were set by exactly one sender, `campaign-send.ts`, which
+ * stamps `hostId` and `campaignId` for the opens/clicks webhook. Everything
+ * else went out with NO tags at all, so a bounce on an invite, a password
+ * reset, a receipt or a usage summary reached the webhook carrying nothing to
+ * identify it, and was dropped.
+ *
+ * The obvious fix — thread an identifier through every call site — asks 37
+ * places to remember, which is the shape that produces the 38th that does
+ * not. But `context` is ALREADY threaded through 35 of the 37 for logging,
+ * and it is exactly the right value: it names the sender. So the tag is
+ * derived here, once, and no caller changes.
+ *
+ * Resend tag values are restricted to ASCII letters, digits, `_` and `-`;
+ * anything else is rejected and would fail the whole send. Every `context` in
+ * the tree is already a plain slug, but this is mail delivery — a value that
+ * makes the send fail is far worse than a value that is sanitised — so the
+ * label is normalised rather than trusted, and a context that sanitises to
+ * nothing yields no tag rather than an invalid one.
+ */ export function contextTag(context) {
+    const value = String(context != null ? context : '').trim().replace(/[^A-Za-z0-9_-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 64);
+    return value ? [
+        {
+            name: 'context',
+            value
+        }
+    ] : [];
+}
+/**
+ * The retry instant when the platform send-rate governor deferred this
+ * message, or `null` for every other outcome (AGL-2409).
+ *
+ * A FUNCTION rather than `result.reason === 'rate-limited'` at each call site,
+ * because `strictNullChecks` is OFF repo-wide and TypeScript will not narrow a
+ * boolean-literal discriminant without it: `if (result.sent) … else
+ * result.reason` does not compile, in every consumer, for a reason that has
+ * nothing to do with this union. One helper is also one place to change if the
+ * shape of a deferral ever moves.
+ */ export function rateLimitedRetryAtMs(result) {
+    const failure = result;
+    if (!failure || failure.reason !== 'rate-limited') return null;
+    const retryAtMs = Number(failure.retryAtMs);
+    return Number.isFinite(retryAtMs) ? retryAtMs : 0;
+}
+/**
+ * How long to wait when the provider names no interval of its own.
+ *
+ * One second, because Resend's rate limit is counted per second — so a wait
+ * of a whole window is the shortest one that is certain to have cleared it.
+ */ const PROVIDER_RETRY_FALLBACK_MS = 1000;
+/**
+ * The longest wait a provider header may ask for.
+ *
+ * A `retry-after` is read off the network and reaches a scheduler, so it is
+ * clamped rather than trusted: a header of `86400` would park a campaign for
+ * a day on one response nobody saw. An hour is past every documented window
+ * and short enough that a wrong one costs a run rather than a day.
+ */ const PROVIDER_RETRY_MAX_MS = 3600000;
+/** One header as whole seconds, or null when it is absent or unreadable. */ function headerSeconds(headers, name) {
+    var _headers_get;
+    const raw = headers == null ? void 0 : (_headers_get = headers.get) == null ? void 0 : _headers_get.call(headers, name);
+    // `Number(null)` and `Number('')` are both 0, which would read as "retry
+    // immediately" for a header that is not there at all.
+    if (raw === null || raw === undefined || String(raw).trim() === '') return null;
+    const seconds = Number(raw);
+    return Number.isFinite(seconds) && seconds >= 0 ? seconds : null;
+}
+/**
+ * When the provider says a refused request may be repeated.
+ *
+ * Read from the two headers Resend documents beside a 429, both in whole
+ * seconds: `retry-after` first because it is the direct answer to this
+ * question, then `ratelimit-reset`, which names when the window rolls. A
+ * response carrying neither falls back to one window.
+ */ export function providerRetryAtMs(headers, nowMs = Date.now()) {
+    var _headerSeconds;
+    const seconds = (_headerSeconds = headerSeconds(headers, 'retry-after')) != null ? _headerSeconds : headerSeconds(headers, 'ratelimit-reset');
+    const waitMs = seconds === null ? PROVIDER_RETRY_FALLBACK_MS : Math.min(seconds * 1000, PROVIDER_RETRY_MAX_MS);
+    return nowMs + waitMs;
+}
+/**
+ * Why a send did not happen, or `null` when it did.
+ *
+ * The same accessor `rateLimitedRetryAtMs` is, generalized: `strictNullChecks`
+ * is OFF repo-wide, so TypeScript will not narrow the union on `result.sent`
+ * and reading `result.reason` at a call site does not compile.
+ */ export function sendFailureReason(result) {
+    var _failure_reason;
+    const failure = result;
+    if (!failure || failure.sent) return null;
+    return (_failure_reason = failure.reason) != null ? _failure_reason : null;
+}
+/**
+ * Whether this outcome is worth coming back for.
+ *
+ * TRUE only for the two refusals a later attempt can pass: the platform hour
+ * rolls, and so does the marketing frequency window. Everything else is
+ * either a delivery that happened or a failure a retry repeats — a
+ * suppression most of all, since retrying is the exact behavior a suppression
+ * exists to stop, and a sunset for the same reason at one remove: it clears
+ * when the recipient engages, which no amount of further mail from us brings
+ * about.
+ *
+ * A resumable sweep uses this to decide whether to leave its subject
+ * unstamped. Stamping on a deferrable refusal discards a message; NOT
+ * stamping on a terminal one re-reads the same doomed row on every beat until
+ * it crowds out the work that could succeed. Both are silent, so the
+ * distinction lives here instead of at each sweep.
+ *
+ * A FUNCTION rather than `result.reason === …` at each call site, because
+ * `strictNullChecks` is OFF repo-wide and TypeScript will not narrow a
+ * boolean-literal discriminant without it — the same reason
+ * {@link rateLimitedRetryAtMs} beside it is one.
+ */ export function isDeferrableSendResult(result) {
+    const reason = sendFailureReason(result);
+    return reason === 'rate-limited' || reason === 'frequency-capped';
+}
+/**
+ * Reads the email environment.
+ *
+ * Deliberately read per call rather than captured at module load: these run
+ * in serverless handlers where the module may be evaluated during a build,
+ * long before the runtime env exists.
+ */ export function getEmailConfig() {
+    return {
+        apiKey: process.env.RESEND_API_KEY || undefined,
+        from: process.env.USAGE_EMAIL_FROM || undefined
+    };
+}
+/**
+ * True when both `RESEND_API_KEY` and `USAGE_EMAIL_FROM` are present.
+ *
+ * Callers that answer an HTTP request (rather than firing best-effort mail)
+ * use this to return a 501 with an actionable message instead of pretending
+ * to have sent something.
+ */ export function isEmailConfigured() {
+    const { apiKey, from } = getEmailConfig();
+    return Boolean(apiKey && from);
+}
+/**
+ * Applies a white-label display name to a configured sender while keeping
+ * its verified address (White-Label Phase 1). Accepts either a bare address
+ * (`noreply@aglyn.com`) or an RFC-5322 `Name <addr>` header and returns
+ * `"<fromName>" <addr>`. A blank name, or a value with no extractable
+ * address, yields the original `from` untouched — the sender identity is
+ * never dropped on the floor.
+ */ export function applyFromName(from, fromName) {
+    const name = (fromName != null ? fromName : '').trim();
+    if (!from || !name) return from;
+    const angle = from.match(/<([^>]+)>/);
+    const address = (angle ? angle[1] : from).trim();
+    if (!address.includes('@')) return from;
+    // Quote the display name so commas/specials stay inside one mailbox.
+    return `"${name.replace(/"/g, '')}" <${address}>`;
+}
+function normalizeRecipients(to) {
+    const list = Array.isArray(to) ? to : [
+        to
+    ];
+    return list.map((address)=>String(address != null ? address : '').trim()).filter((address)=>address.includes('@'));
+}
+/**
+ * The one place that POSTs to Resend's send endpoint, and the last thing
+ * standing between a payload and the network.
+ *
+ * A payload carrying no recipient cannot become a message. Resend answers it
+ * `422 missing_required_field`, which costs an API call and then shows up in
+ * the vendor dashboard as a red line indistinguishable from mail that
+ * genuinely failed to deliver — carrying no subject, no recipient and nothing
+ * naming the code that produced it. Diagnosing that means reading a log
+ * outside the deployment and guessing. So the refusal happens here, before
+ * the fetch, and names the caller's `context`.
+ *
+ * It throws rather than returning a `SendEmailResult`: this is a programming
+ * error, not a delivery outcome. `sendEmail` filters recipients well before
+ * it reaches this call, so nothing on the ordinary path can trip it. The
+ * guard exists because `RESEND_SEND_ENDPOINT` is exported and any module can
+ * therefore reach the send endpoint on its own, bypassing every check
+ * `sendEmail` owns.
+ */ export async function postResendEmail(apiKey, payload, context) {
+    const raw = payload == null ? void 0 : payload.to;
+    const recipients = (Array.isArray(raw) ? raw : raw == null ? [] : [
+        raw
+    ]).map((address)=>String(address != null ? address : '').trim()).filter(Boolean);
+    if (!recipients.length) {
+        throw new Error(`${context ? `${context} ` : ''}send refused before the network — a ` + 'Resend payload with no `to` field cannot become a message, and the ' + 'attempt would surface only as a 422 in the Resend dashboard');
+    }
+    return fetch(RESEND_SEND_ENDPOINT, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${apiKey}`,
+            'Content-Type': 'application/json'
+        },
+        body: JSON.stringify(payload)
+    });
+}
+/**
+ * Sends one email through Resend.
+ *
+ * **Never throws and never rejects.** Outbound mail is best-effort across
+ * every caller in this codebase — a checkout must not fail because a receipt
+ * bounced — so every outcome comes back as a `SendEmailResult` instead. The
+ * one thing callers must not do is ignore the result: `sent` is what tells
+ * the user whether a message actually went out (AGL-708).
+ *
+ * When the env vars are missing this warns once per call and returns
+ * `{ sent: false, reason: 'unconfigured' }` rather than failing, so local and
+ * preview environments keep working without a Resend account.
+ */ export async function sendEmail(options) {
+    var _ref, _ref1, _ref2, _options_text;
+    var _options_sendingIdentity, _options_marketing, _options_marketing1, _options_headers;
+    const { apiKey, from: configuredFrom } = getEmailConfig();
+    const label = options.context ? `${options.context} email` : 'email';
+    /*
+   * THE SENDING-IDENTITY REFUSAL.
+   *
+   * Enforced here AND at the campaign route, independently, for the reason
+   * the send-rate governor is enforced twice: the route's check is the one a
+   * person sees, and this one is what holds when a caller does not make it.
+   * A governor is injectable and a route is skippable, so neither may be the
+   * only thing standing between an unverified domain and a send.
+   *
+   * Placed above the `apiKey`/`from` gate so a refusal cannot be reported as
+   * `unconfigured` — the two have different owners and different fixes.
+   */ const identityRefusal = sendingIdentityRefusal(options.sendingIdentity);
+    if (identityRefusal) {
+        console.warn(`${label} refused — ${identityRefusal.message}`);
+        return {
+            sent: false,
+            reason: 'unverified-domain',
+            detail: identityRefusal.message
+        };
+    }
+    // A resolved identity outranks the configured sender: it is the server's
+    // answer to which verified address this message leaves on. Without one, the
+    // white-label display name is applied to the configured verified sender
+    // (White-Label Phase 1).
+    //
+    // Two sources, and `options` is neither of them. Nothing the caller passes
+    // reaches the address — only the display name in front of it.
+    const resolvedFrom = (_ref = (_options_sendingIdentity = options.sendingIdentity) == null ? void 0 : _options_sendingIdentity.from) != null ? _ref : null;
+    /*
+   * THE PLATFORM DOMAIN IS NOT A FALLBACK FOR TENANT MAIL.
+   *
+   * `configuredFrom` is `USAGE_EMAIL_FROM` — an address on `aglyn.com`, where
+   * Aglyn's own billing, account and console mail leaves from. A site's mail
+   * reaching it means that site's list quality is charged against the domain
+   * every other customer's password reset depends on.
+   *
+   * `resolveHostSendingIdentity` already refuses above, so a tenant caller
+   * that resolved an identity never arrives here with `resolvedFrom` null.
+   * This is the arm for a tenant caller that resolved NOTHING — the shape a
+   * new send site takes when its author does not know an identity is owed —
+   * and it is checked here rather than left to the call sites because ninety
+   * of them cannot each be relied on to remember.
+   */ if (options.audience === 'tenant' && !resolvedFrom) {
+        console.warn(`${label} refused — a site's mail cannot leave on the shared platform ` + 'domain, and no sending identity was resolved for it');
+        return {
+            sent: false,
+            reason: 'unverified-domain',
+            detail: 'This message belongs to a site and no sending identity was ' + 'resolved for it, so it was refused rather than sent from the ' + 'shared Aglyn address.'
+        };
+    }
+    const from = applyFromName(resolvedFrom != null ? resolvedFrom : configuredFrom, options.fromName);
+    if (!apiKey || !from) {
+        console.warn(`${label} skipped — set RESEND_API_KEY and USAGE_EMAIL_FROM to ` + 'deliver mail');
+        return {
+            sent: false,
+            reason: 'unconfigured'
+        };
+    }
+    const to = normalizeRecipients(options.to);
+    if (!to.length) {
+        console.warn(`${label} skipped — no valid recipient address`);
+        return {
+            sent: false,
+            reason: 'no-recipient'
+        };
+    }
+    /*
+   * THE MARKETING GATE.
+   *
+   * Everything a marketing message owes, asked once, here — because the four
+   * merchant-triggered bulk paths that owed it discharged none of it, and
+   * asking four call sites to remember is the shape that produces the fifth
+   * that does not.
+   *
+   * Ahead of the send-rate governor deliberately. A refusal here is a message
+   * that must never leave, so spending platform hourly budget deciding that
+   * would be budget the rest of the hour's mail no longer has.
+   *
+   * Nothing installed is UNGATED. Same posture as the governor: the durable
+   * half lives in another library, and a deployment that never installs it
+   * must still send.
+   */ /*
+   * TWO URLS, and which one goes where is the whole RFC 8058 story.
+   *
+   * `unsubscribeUrl` is what a PERSON clicks in the footer below, and the
+   * gate points it at the preference page so the stream this message belongs
+   * to is one of the things they can stop instead of all of it.
+   * `oneClickUrl` is what `List-Unsubscribe` names, and it must stay on the
+   * route whose POST writes immediately — a mailbox provider POSTs it with
+   * nobody present and reads the 200 as "done", which a page of checkboxes
+   * cannot honor.
+   *
+   * It falls back to `unsubscribeUrl` for a caller that minted one link and
+   * named no page, which is the only shape that was ever possible before the
+   * gate minted the pair.
+   */ let unsubscribeUrl = (_ref1 = (_options_marketing = options.marketing) == null ? void 0 : _options_marketing.unsubscribeUrl) != null ? _ref1 : '';
+    let oneClickUrl = (_ref2 = (_options_marketing1 = options.marketing) == null ? void 0 : _options_marketing1.oneClickUrl) != null ? _ref2 : '';
+    if (options.marketing) {
+        if (to.length !== 1) {
+            // Not a delivery outcome — a caller error, and one that would put the
+            // first recipient's signed unsubscribe link in everybody else's copy.
+            console.error(`${label} refused — a marketing send addresses exactly one ` + `recipient, and this one names ${to.length}`);
+            return {
+                sent: false,
+                reason: 'no-recipient',
+                detail: 'A marketing send addresses exactly one recipient.'
+            };
+        }
+        const gate = getMarketingSendGate();
+        if (gate) {
+            let verdict;
+            try {
+                verdict = await gate(_extends({
+                    hostId: options.marketing.hostId,
+                    siteBase: options.marketing.siteBase,
+                    email: to[0],
+                    context: options.context,
+                    capped: options.marketing.capped !== false
+                }, options.marketing.topicId ? {
+                    topicId: options.marketing.topicId
+                } : {}));
+            } catch (error) {
+                /*
+         * FAILS OPEN, and the asymmetry with `filterSendableForHost` is
+         * deliberate rather than an oversight. That helper fails CLOSED
+         * because a suppression list it could not read is not a list that
+         * said an address is safe to mail — and it keeps doing so, inside
+         * the gate. What is being caught here is the gate itself being
+         * unreachable or throwing, which is an outage on the control; an
+         * outage on a control that becomes an outage on the product is the
+         * worse of the two bugs, and it is the posture `sendEmail` takes
+         * everywhere else.
+         */ console.error(`${label} marketing gate failed — allowing`, error);
+                verdict = null;
+            }
+            if (verdict && !verdict.allowed) {
+                var _verdict_detail;
+                /*
+         * A cadence refusal reports as `frequency-capped` rather than earning
+         * a value of its own in {@link SendEmailFailureReason}.
+         *
+         * That union is what {@link isDeferrableSendResult} switches on, and
+         * the two are deferrable for exactly the same reason: a later attempt
+         * passes because time went by. A third value would have to be added
+         * to that predicate as well, and a sweep built against the older
+         * vocabulary would silently treat the recipient's own request as
+         * terminal and stamp the subject — discarding a message the recipient
+         * asked to receive later rather than never. Which of the two it was
+         * is in `detail`, where a person reading a log needs it.
+         */ const reason = verdict.refusal === 'frequency-capped' || verdict.refusal === 'cadence-limited' ? 'frequency-capped' : verdict.refusal === 'unengaged' ? 'unengaged' : 'suppressed';
+                console.warn(`${label} not sent — ${(_verdict_detail = verdict.detail) != null ? _verdict_detail : reason}`);
+                return {
+                    sent: false,
+                    reason,
+                    detail: verdict.detail
+                };
+            }
+            unsubscribeUrl = unsubscribeUrl || (verdict == null ? void 0 : verdict.unsubscribeUrl) || '';
+            oneClickUrl = oneClickUrl || (verdict == null ? void 0 : verdict.oneClickUrl) || '';
+        }
+        if (!unsubscribeUrl) {
+            // A marketing message with no way out is the defect this gate exists to
+            // close, so it is said out loud rather than shipped quietly. Not a
+            // refusal: the cause is a missing `EMAIL_UNSUBSCRIBE_SECRET` or a host
+            // with no public origin — an operator's configuration, not the
+            // recipient's problem — and refusing here would turn it into silence.
+            console.warn(`${label} carries no unsubscribe link — set ` + 'EMAIL_UNSUBSCRIBE_SECRET and publish the site on a domain');
+        }
+    }
+    /*
+   * BULK MAIL WITH NO WAY OUT DOES NOT LEAVE ON THE POOLED IDENTITY.
+   *
+   * The pool carries marketing for every site that has no domain of its own,
+   * and what keeps that survivable is that a recipient can always stop it: the
+   * complaint that would otherwise be charged to every other site on the member
+   * has a cheaper alternative one click away. A message that lost its
+   * unsubscribe link removes that alternative, so it is refused here rather
+   * than sent at other people's expense.
+   *
+   * Asked AFTER the gate, because only here is the answer known. The URL may
+   * arrive from the caller, from the gate that mints one per recipient, or —
+   * for a campaign, which composes its own one-click pair upstream — as a
+   * `List-Unsubscribe` header and no marketing context at all. Reading only one
+   * of the three would refuse the senders that are behaving.
+   *
+   * The classification is DERIVED, never declared. See `isMarketingMessage`.
+   */ const pooledRefusal = isMarketingMessage(options) ? pooledMarketingRefusal(options.sendingIdentity, Boolean(unsubscribeUrl) || Boolean((_options_headers = options.headers) == null ? void 0 : _options_headers['List-Unsubscribe'])) : null;
+    if (pooledRefusal) {
+        console.warn(`${label} refused — ${pooledRefusal.message}`);
+        return {
+            sent: false,
+            reason: 'unverified-domain',
+            detail: pooledRefusal.message
+        };
+    }
+    /*
+   * THE PLATFORM SEND-RATE GOVERNOR (AGL-2409).
+   *
+   * Asked on EVERY send, including transactional ones, because the ceiling is
+   * about total volume on one sending domain — a governor that only saw
+   * campaigns would report a quiet hour while ten thousand receipts went out.
+   * The governor counts what it grants.
+   *
+   * Two properties this block must have, in order:
+   *
+   *  1. **A refusal is honoured only for a refusable priority.** This is the
+   *     second of the two enforcement points described in `send-rate.ts`.
+   *     `emailSendRateVerdict` already cannot refuse a transactional send;
+   *     the governor is INJECTABLE, so a wrong one is reachable, and the send
+   *     path must still be unable to drop a password reset. Anything that is
+   *     not explicitly a campaign or a bulk sweep sends regardless of the
+   *     answer.
+   *  2. **It fails open.** A governor that throws — Firestore unreachable, no
+   *     Admin app, a bug — must not stop mail. The counter being unavailable
+   *     is an outage on the control, and an outage on a control that turns
+   *     into an outage on the product is a worse bug than the burst it was
+   *     guarding. The same posture `sendEmail` takes everywhere else: it
+   *     never throws, and neither does this.
+   */ const priority = resolveSendPriority(options.context, options.priority);
+    const governor = getEmailSendGovernor();
+    if (governor) {
+        let verdict;
+        try {
+            verdict = await governor({
+                priority,
+                count: to.length,
+                context: options.context
+            });
+        } catch (error) {
+            console.error(`${label} send-rate governor failed — allowing`, error);
+            verdict = null;
+        }
+        if (verdict && !verdict.allowed && isRefusablePriority(priority)) {
+            var _verdict_retryAtMs, _verdict_used, _verdict_ceiling, _verdict_ceiling1;
+            const retryAtMs = (_verdict_retryAtMs = verdict.retryAtMs) != null ? _verdict_retryAtMs : emailSendRateWindowStartMs(Date.now());
+            console.warn(`${label} deferred — platform send rate reached ` + `(${(_verdict_used = verdict.used) != null ? _verdict_used : '?'}/${(_verdict_ceiling = verdict.ceiling) != null ? _verdict_ceiling : '?'} this hour)`);
+            return {
+                sent: false,
+                reason: 'rate-limited',
+                retryAtMs,
+                detail: `Platform hourly send rate reached (${(_verdict_ceiling1 = verdict.ceiling) != null ? _verdict_ceiling1 : '?'}/hour). ` + 'Transactional mail is unaffected.'
+            };
+        }
+    }
+    /*
+   * THE VISIBLE OPT-OUT, on both parts.
+   *
+   * The header pair below is for the mailbox provider; this is for the person
+   * — CAN-SPAM asks for a mechanism the recipient can see and use, and most
+   * clients render no control for the header at all. Both helpers are
+   * idempotent by URL, so a sender that placed its own link (a designed
+   * template rendering `{{unsubscribeUrl}}`, the campaign body's footer)
+   * keeps its own placement and does not get a second one.
+   *
+   * `text` first and `html` from the result, so the synthesized HTML part
+   * that stands in for a text-only message carries the link as an anchor
+   * rather than as characters.
+   */ const text = unsubscribeUrl ? appendUnsubscribeText((_options_text = options.text) != null ? _options_text : '', unsubscribeUrl) : options.text;
+    const html = unsubscribeUrl ? options.html ? appendUnsubscribeHtml(options.html, unsubscribeUrl) : renderTextEmailHtml(text != null ? text : '', options.subject) : options.html;
+    try {
+        var _ref3;
+        const response = await postResendEmail(apiKey, _extends({
+            from,
+            to,
+            subject: options.subject
+        }, text ? {
+            text
+        } : {}, (()=>{
+            const body = html || renderTextEmailHtml(text != null ? text : '', options.subject);
+            return body ? {
+                html: body
+            } : {};
+        })(), (()=>{
+            var _options_headers;
+            const headers = _extends({}, unsubscribeHeaders(oneClickUrl || unsubscribeUrl), (_options_headers = options.headers) != null ? _options_headers : {});
+            return Object.keys(headers).length ? {
+                headers
+            } : {};
+        })(), (()=>{
+            var _options_tags;
+            const caller = (_options_tags = options.tags) != null ? _options_tags : [];
+            const derived = caller.some((tag)=>(tag == null ? void 0 : tag.name) === 'context') ? [] : contextTag(options.context);
+            const tags = [
+                ...caller,
+                ...derived
+            ];
+            return tags.length ? {
+                tags
+            } : {};
+        })(), options.replyTo ? {
+            reply_to: options.replyTo
+        } : {}), options.context);
+        if (!response.ok) {
+            const detail = await response.text().catch(()=>'');
+            /*
+       * A 429 IS NOT A STATEMENT ABOUT THIS RECIPIENT, so it does not report
+       * as one. See the `rate-limited` member of
+       * {@link SendEmailFailureReason} for why the distinction is load-bearing
+       * rather than cosmetic — every caller in the tree already has a branch
+       * for a deferral, and none of them has one for "rejected, but try this
+       * exact address again later".
+       *
+       * A warning rather than an error: the provider asking for a slower pace
+       * is a normal thing to be told, and logging it at the level a failed
+       * delivery uses is what teaches an operator to skim past both.
+       */ if (response.status === 429) {
+                const retryAtMs = providerRetryAtMs(response.headers);
+                console.warn(`${label} deferred — the provider is rate limiting; retry in ` + `${Math.max(0, Math.round((retryAtMs - Date.now()) / 1000))}s`);
+                return {
+                    sent: false,
+                    reason: 'rate-limited',
+                    status: response.status,
+                    retryAtMs,
+                    detail: detail.slice(0, 500)
+                };
+            }
+            console.error(`${label} failed`, response.status, detail);
+            return {
+                sent: false,
+                reason: 'rejected',
+                status: response.status,
+                detail: detail.slice(0, 500)
+            };
+        }
+        const body = await response.json().catch(()=>null);
+        return {
+            sent: true,
+            id: (_ref3 = body == null ? void 0 : body.id) != null ? _ref3 : null
+        };
+    } catch (error) {
+        var _ref4;
+        console.error(`${label} failed`, error);
+        return {
+            sent: false,
+            reason: 'network',
+            detail: String((_ref4 = error == null ? void 0 : error.message) != null ? _ref4 : error).slice(0, 500)
+        };
+    }
+}
+export default sendEmail;
+
+//# sourceMappingURL=send-email.js.map