@baruk/core 0.1.0 → 0.2.0

package/dist/mail/provider.js

@@ -0,0 +1,248 @@
+import { buildDedupKey, InMemoryDedupStore } from './dedup-store.js';
+import { sendViaResend } from './resend-client.js';
+import { logSanitized, logSanitizedInfo } from './sanitize.js';
+import { StaticSenderResolver } from './sender-resolver.js';
+import { PassthroughTemplateRenderer } from './template-renderer.js';
+import { DEFAULT_REMOTE_RESERVATION_MAX_WAIT_MS, DEFAULT_REMOTE_RESERVATION_POLL_INTERVAL_MS, DEFAULT_TIMEOUT_MS, MIN_DEDUP_WINDOW_MS, } from './types.js';
+/** Validação prática de endereço (RFC §4 — borda do Provider): local@domínio.tld, sem espaços, um único "@". */
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function isValidEmailAddress(address) {
+    return EMAIL_PATTERN.test(address);
+}
+/**
+ * Valida os endereços que o Provider efetivamente usará na chamada ao provider externo
+ * (Correção 3 — Auditoria Codex). Roda depois de `from` resolvido, para pegar também
+ * remetentes vindos do `SenderResolver`/`defaultFrom`, não só o `input.from` explícito.
+ */
+function validateAddresses(fields) {
+    const invalidFields = [];
+    if (!isValidEmailAddress(fields.to))
+        invalidFields.push('to');
+    if (!isValidEmailAddress(fields.from))
+        invalidFields.push('from');
+    if (fields.replyTo !== undefined && !isValidEmailAddress(fields.replyTo))
+        invalidFields.push('replyTo');
+    if (invalidFields.length === 0)
+        return undefined;
+    return {
+        code: 'invalid-recipient',
+        message: `Endereço(s) de e-mail inválido(s): ${invalidFields.join(', ')}.`,
+    };
+}
+/**
+ * Provider canônico de `cap.communication.transactional-email` (RFC-CAPABILITY-TRANSACTIONAL-EMAIL-001 v0.2).
+ * Extensões (`templateRenderer`/`senderResolver`/`hooks`/`dedupStore`) são injetadas na construção,
+ * nunca descobertas por convenção (RFC §4.7).
+ */
+export function createTransactionalEmailProvider(config) {
+    const templateRenderer = config.templateRenderer ?? new PassthroughTemplateRenderer();
+    const senderResolver = config.senderResolver ?? new StaticSenderResolver(config.defaultFrom);
+    const hooks = config.hooks ?? [];
+    const dedupStore = config.dedupStore ?? new InMemoryDedupStore();
+    const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const remoteReservationPollIntervalMs = config.remoteReservationPollIntervalMs ?? DEFAULT_REMOTE_RESERVATION_POLL_INTERVAL_MS;
+    const remoteReservationMaxWaitMs = config.remoteReservationMaxWaitMs ?? DEFAULT_REMOTE_RESERVATION_MAX_WAIT_MS;
+    const apiKey = config.apiKey;
+    /**
+     * Nenhuma chamada ao `DedupStore` (`reserve`/`get`/`set`) pode escapar sem tratamento
+     * (Bloqueador 1 — Certification Round 2: sanitização não pode se limitar ao `DeliveryResult`;
+     * uma implementação de store real — Redis/Postgres — pode lançar erros de rede/conexão cuja
+     * mensagem contém credenciais, ex.: uma connection string). Toda chamada passa por aqui:
+     * nunca propaga a exceção, sempre loga sanitizado, sempre devolve um fallback seguro.
+     */
+    async function safeDedupCall(operation, fn, fallback) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            logSanitized(`[transactional-email] DedupStore.${operation} falhou (ignorado):`, errorMessage(err), [apiKey]);
+            return fallback;
+        }
+    }
+    function sleep(ms) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+    /**
+     * Aguarda, de forma limitada, o resultado de uma reserva mantida por outra instância/réplica
+     * (`DedupStore` `mode: 'shared'`) — é o mecanismo real de coalescência distribuída (Bloqueador 2).
+     * Nunca espera indefinidamente: `maxWaitMs` limita o tempo total, sempre com um valor determinístico
+     * ao final (achou o resultado, ou desistiu — nunca fica pendurado).
+     */
+    async function waitForRemoteResult(dedupKey, pollIntervalMs, maxWaitMs) {
+        const deadline = Date.now() + maxWaitMs;
+        while (Date.now() < deadline) {
+            await sleep(pollIntervalMs);
+            const entry = await safeDedupCall('get', () => dedupStore.get(dedupKey), null);
+            if (entry)
+                return entry;
+        }
+        return null;
+    }
+    /**
+     * Coalescência local de envios em andamento por `dedupKey` (Bloqueador 2 — Auditoria Codex).
+     * A checagem (`get`) e a reserva (criar e guardar a Promise) acontecem no mesmo trecho
+     * síncrono — sem `await` entre elas — então duas chamadas concorrentes (`Promise.all`)
+     * nunca observam um estado intermediário: a segunda sempre encontra a Promise da primeira
+     * já registrada e aguarda o mesmo resultado, em vez de disparar um segundo envio.
+     * Garantia real: só dentro deste processo Node (mesma instância do Provider). Atomicidade
+     * entre processos/réplicas depende do `dedupStore.reserve` fornecido (RFC §4.2).
+     */
+    const localSendsInFlight = new Map();
+    /** Resolve `from` e renderiza o template com segurança (Correção 4) — nunca deixa exceção escapar do contrato. */
+    function prepareSend(input) {
+        let from;
+        try {
+            from = input.from ?? senderResolver.resolveFrom(input.brand);
+        }
+        catch (err) {
+            logSanitized('[transactional-email] SenderResolver falhou:', errorMessage(err), [apiKey]);
+            return {
+                status: 'failed',
+                error: { code: 'unknown', message: 'Falha ao resolver o remetente do e-mail.' },
+            };
+        }
+        const addressError = validateAddresses({ to: input.to, from, replyTo: input.replyTo });
+        if (addressError) {
+            return { status: 'failed', error: addressError };
+        }
+        let rendered;
+        try {
+            rendered = templateRenderer.render(input.template, input.data);
+        }
+        catch (err) {
+            logSanitized('[transactional-email] TemplateRenderer falhou:', errorMessage(err), [apiKey]);
+            return {
+                status: 'failed',
+                error: { code: 'unknown', message: 'Falha ao renderizar o template do e-mail.' },
+            };
+        }
+        return { from, rendered };
+    }
+    async function performSend(input) {
+        const prepared = prepareSend(input);
+        if ('status' in prepared) {
+            return prepared;
+        }
+        return sendViaResend({
+            apiKey: apiKey,
+            from: prepared.from,
+            to: input.to,
+            replyTo: input.replyTo,
+            tag: input.tag,
+            rendered: prepared.rendered,
+            timeoutMs,
+        });
+    }
+    async function sendDeduplicated(input, dedupKey) {
+        const existingInFlight = localSendsInFlight.get(dedupKey);
+        if (existingInFlight) {
+            return existingInFlight;
+        }
+        const sendPromise = (async () => {
+            try {
+                let reservation = await safeDedupCall('reserve', () => dedupStore.reserve(dedupKey, MIN_DEDUP_WINDOW_MS), { acquired: true });
+                if (!reservation.acquired && reservation.entry) {
+                    return reservation.entry.result;
+                }
+                if (!reservation.acquired) {
+                    // Reserva de outra instância/réplica em andamento, sem resultado ainda disponível
+                    // (só ocorre com um DedupStore `mode: 'shared'` real — `InMemoryDedupStore` nunca
+                    // devolve esse caso, ver seu jsdoc). Bloqueador 2 (Certification Round 2): a versão
+                    // anterior caía direto em `performSend` aqui, reenviando às cegas. Agora espera de
+                    // forma limitada pelo resultado real da outra instância antes de decidir qualquer coisa.
+                    const remoteEntry = await waitForRemoteResult(dedupKey, remoteReservationPollIntervalMs, remoteReservationMaxWaitMs);
+                    if (remoteEntry) {
+                        return remoteEntry.result;
+                    }
+                    // Esgotado o tempo de espera: a reserva remota pode estar órfã (a instância que a
+                    // detinha morreu sem liberar) — tenta assumir. Se o TTL da reserva remota já expirou
+                    // no store, esta chamada adquire; caso contrário, ainda pertence a outra instância viva.
+                    reservation = await safeDedupCall('reserve', () => dedupStore.reserve(dedupKey, MIN_DEDUP_WINDOW_MS), { acquired: true });
+                    if (!reservation.acquired) {
+                        if (reservation.entry) {
+                            return reservation.entry.result;
+                        }
+                        // Ainda sem dono claro após a espera + nova tentativa: nunca reenviar às cegas
+                        // (romperia o invariante de dedup). Falha determinística e retryable — o consumidor
+                        // decide se tenta de novo (RFC §5, taxonomia por retryability).
+                        return {
+                            status: 'failed',
+                            error: {
+                                code: 'provider-unavailable',
+                                message: 'Coordenação de deduplicação não respondeu a tempo; tente novamente.',
+                            },
+                        };
+                    }
+                }
+                // `reservation.acquired === true`: este chamador é o dono do envio.
+                const result = await performSend(input);
+                await safeDedupCall('set', () => dedupStore.set(dedupKey, { result, expiresAt: Date.now() + MIN_DEDUP_WINDOW_MS }), undefined);
+                return result;
+            }
+            finally {
+                localSendsInFlight.delete(dedupKey);
+            }
+        })();
+        localSendsInFlight.set(dedupKey, sendPromise);
+        return sendPromise;
+    }
+    async function sendTransactionalEmail(rawInput) {
+        let input = rawInput;
+        for (const hook of hooks) {
+            if (hook.beforeSend) {
+                input = runSafely(() => hook.beforeSend(input), apiKey) ?? input;
+            }
+        }
+        const startedAt = Date.now();
+        if (!apiKey) {
+            const result = { status: 'skipped' };
+            logOutcome(input, result, startedAt, apiKey);
+            notifyAfterSend(hooks, input, result, apiKey);
+            return result;
+        }
+        const dedupKey = input.idempotencyKey
+            ? buildDedupKey(input.to, input.template, input.idempotencyKey)
+            : null;
+        const result = dedupKey ? await sendDeduplicated(input, dedupKey) : await performSend(input);
+        logOutcome(input, result, startedAt, apiKey);
+        notifyAfterSend(hooks, input, result, apiKey);
+        return result;
+    }
+    return { sendTransactionalEmail };
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * Log estruturado mínimo de observabilidade (validação operacional pré-certificação).
+ * Sempre sanitizado — nunca inclui a apiKey nem o corpo bruto do provider (Bloqueador 1).
+ * Não inclui identificador de correlação porque o contrato atual (`SendTransactionalEmailInput`)
+ * não define um — não é inventado aqui (RFC não estende o contrato nesta correção).
+ */
+function logOutcome(input, result, startedAt, apiKey) {
+    logSanitizedInfo('[transactional-email] outcome', {
+        status: result.status,
+        errorCode: result.error?.code,
+        durationMs: Date.now() - startedAt,
+        template: input.template,
+        deduplicated: Boolean(input.idempotencyKey),
+    }, [apiKey]);
+}
+/** Hooks nunca podem quebrar o envio principal — falha de um hook é ignorada (logada), não propagada. */
+function runSafely(fn, apiKey) {
+    try {
+        return fn();
+    }
+    catch (err) {
+        logSanitized('[transactional-email] hook falhou (ignorado):', errorMessage(err), [apiKey]);
+        return undefined;
+    }
+}
+function notifyAfterSend(hooks, input, result, apiKey) {
+    for (const hook of hooks) {
+        if (hook.afterSend) {
+            runSafely(() => hook.afterSend(input, result), apiKey);
+        }
+    }
+}
+//# sourceMappingURL=provider.js.map

package/dist/mail/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/mail/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EACL,sCAAsC,EACtC,2CAA2C,EAC3C,kBAAkB,EAClB,mBAAmB,GAapB,MAAM,YAAY,CAAC;AA0BpB,gHAAgH;AAChH,MAAM,aAAa,GAAG,4BAA4B,CAAC;AAEnD,SAAS,mBAAmB,CAAC,OAAe;IAC1C,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,MAI1B;IACC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC;QACtE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEhC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,sCAAsC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;KAC3E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAC9C,MAAwC;IAExC,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,IAAI,2BAA2B,EAAE,CAAC;IACtF,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,kBAAkB,EAAE,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACzD,MAAM,+BAA+B,GACnC,MAAM,CAAC,+BAA+B,IAAI,2CAA2C,CAAC;IACxF,MAAM,0BAA0B,GAC9B,MAAM,CAAC,0BAA0B,IAAI,sCAAsC,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAE7B;;;;;;OAMG;IACH,KAAK,UAAU,aAAa,CAC1B,SAAiB,EACjB,EAAwB,EACxB,QAAW;QAEX,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CACV,oCAAoC,SAAS,qBAAqB,EAClE,YAAY,CAAC,GAAG,CAAC,EACjB,CAAC,MAAM,CAAC,CACT,CAAC;YACF,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,SAAS,KAAK,CAAC,EAAU;QACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,mBAAmB,CAChC,QAAgB,EAChB,cAAsB,EACtB,SAAiB;QAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;YAC/E,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAmC,CAAC;IAEtE,kHAAkH;IAClH,SAAS,WAAW,CAClB,KAAkC;QAElC,IAAI,IAAkB,CAAC;QACvB,IAAI,CAAC;YACH,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,8CAA8C,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1F,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,0CAA0C,EAAE;aAChF,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,iBAAiB,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QACnD,CAAC;QAED,IAAI,QAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,gDAAgD,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5F,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,2CAA2C,EAAE;aACjF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,KAAkC;QAC3D,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;YACzB,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,aAAa,CAAC;YACnB,MAAM,EAAE,MAAO;YACf,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,KAAK,UAAU,gBAAgB,CAC7B,KAAkC,EAClC,QAAgB;QAEhB,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,KAAK,IAA6B,EAAE;YACvD,IAAI,CAAC;gBACH,IAAI,WAAW,GAAqB,MAAM,aAAa,CACrD,SAAS,EACT,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,EACvD,EAAE,QAAQ,EAAE,IAAI,EAAE,CACnB,CAAC;gBAEF,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;oBAC/C,OAAO,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;gBAClC,CAAC;gBAED,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;oBAC1B,kFAAkF;oBAClF,kFAAkF;oBAClF,oFAAoF;oBACpF,mFAAmF;oBACnF,yFAAyF;oBACzF,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAC3C,QAAQ,EACR,+BAA+B,EAC/B,0BAA0B,CAC3B,CAAC;oBACF,IAAI,WAAW,EAAE,CAAC;wBAChB,OAAO,WAAW,CAAC,MAAM,CAAC;oBAC5B,CAAC;oBAED,kFAAkF;oBAClF,qFAAqF;oBACrF,yFAAyF;oBACzF,WAAW,GAAG,MAAM,aAAa,CAC/B,SAAS,EACT,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,EACvD,EAAE,QAAQ,EAAE,IAAI,EAAE,CACnB,CAAC;oBAEF,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;wBAC1B,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;4BACtB,OAAO,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;wBAClC,CAAC;wBACD,+EAA+E;wBAC/E,oFAAoF;wBACpF,gEAAgE;wBAChE,OAAO;4BACL,MAAM,EAAE,QAAQ;4BAChB,KAAK,EAAE;gCACL,IAAI,EAAE,sBAAsB;gCAC5B,OAAO,EAAE,qEAAqE;6BAC/E;yBACF,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,oEAAoE;gBACpE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;gBACxC,MAAM,aAAa,CACjB,KAAK,EACL,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,EAAE,CAAC,EACvF,SAAS,CACV,CAAC;gBACF,OAAO,MAAM,CAAC;YAChB,CAAC;oBAAS,CAAC;gBACT,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC9C,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,sBAAsB,CACnC,QAAqC;QAErC,IAAI,KAAK,GAAG,QAAQ,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAW,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC;YACpE,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,MAAM,GAAmB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YACrD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAC7C,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc;YACnC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC;YAC/D,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;QAE7F,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC7C,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,EAAE,sBAAsB,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CACjB,KAAkC,EAClC,MAAsB,EACtB,SAAiB,EACjB,MAA0B;IAE1B,gBAAgB,CACd,+BAA+B,EAC/B;QACE,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI;QAC7B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;KAC5C,EACD,CAAC,MAAM,CAAC,CACT,CAAC;AACJ,CAAC;AAED,yGAAyG;AACzG,SAAS,SAAS,CAAI,EAAW,EAAE,MAA0B;IAC3D,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,+CAA+C,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3F,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,KAAqB,EACrB,KAAkC,EAClC,MAAsB,EACtB,MAA0B;IAE1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/mail/resend-client.d.ts

@@ -0,0 +1,16 @@
+import type { DeliveryResult, EmailAddress, RenderedEmail } from './types.js';
+export interface SendViaResendInput {
+    apiKey: string;
+    from: EmailAddress;
+    to: EmailAddress;
+    replyTo?: EmailAddress;
+    tag?: string;
+    rendered: RenderedEmail;
+    timeoutMs: number;
+}
+/**
+ * Cliente HTTP de baixo nível do Provider Resend. Nunca importado fora de `mail/` —
+ * o Resend é um Provider substituível (ADR-ECO-0019), não uma dependência do contrato.
+ */
+export declare function sendViaResend(input: SendViaResendInput): Promise<DeliveryResult>;
+//# sourceMappingURL=resend-client.d.ts.map

package/dist/mail/resend-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-client.d.ts","sourceRoot":"","sources":["../../src/mail/resend-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAqB,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAkBjG,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,YAAY,CAAC;IACjB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,aAAa,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC,CAmDtF"}

package/dist/mail/resend-client.js

@@ -0,0 +1,100 @@
+import { logSanitized } from './sanitize.js';
+const RESEND_ENDPOINT = 'https://api.resend.com/emails';
+/**
+ * Mensagens públicas canônicas por código de erro (Bloqueador 1 — RFC §4.2/invariante).
+ * `DeliveryResult.error.message` nunca contém o corpo bruto do provider — o detalhe
+ * técnico (sanitizado) só vai para o log interno via `logSanitized`.
+ */
+const CANONICAL_ERROR_MESSAGES = {
+    timeout: 'O provider de e-mail não respondeu dentro do tempo limite.',
+    'provider-unavailable': 'O provider de e-mail está indisponível no momento.',
+    'invalid-recipient': 'O provider de e-mail rejeitou o endereço informado.',
+    'provider-rejected': 'O provider de e-mail rejeitou a requisição.',
+    unknown: 'Falha desconhecida ao contatar o provider de e-mail.',
+};
+/**
+ * Cliente HTTP de baixo nível do Provider Resend. Nunca importado fora de `mail/` —
+ * o Resend é um Provider substituível (ADR-ECO-0019), não uma dependência do contrato.
+ */
+export async function sendViaResend(input) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), input.timeoutMs);
+    try {
+        const res = await fetch(RESEND_ENDPOINT, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${input.apiKey}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                from: input.from,
+                to: [input.to],
+                subject: input.rendered.subject,
+                html: input.rendered.html,
+                text: input.rendered.text,
+                reply_to: input.replyTo,
+                tags: input.tag ? [{ name: 'type', value: input.tag }] : undefined,
+            }),
+            signal: controller.signal,
+        });
+        const rawText = await res.text();
+        const json = rawText ? safeJsonParse(rawText) : {};
+        if (res.ok) {
+            return {
+                status: 'sent',
+                providerId: typeof json['id'] === 'string' ? json['id'] : undefined,
+            };
+        }
+        return { status: 'failed', error: classifyResendError(res.status, json, input.apiKey) };
+    }
+    catch (err) {
+        if (err instanceof Error && err.name === 'AbortError') {
+            return {
+                status: 'failed',
+                error: { code: 'timeout', message: `Resend não respondeu em ${input.timeoutMs}ms` },
+            };
+        }
+        return {
+            status: 'failed',
+            error: {
+                code: 'provider-unavailable',
+                message: 'Falha de rede ao contatar o provider de e-mail',
+            },
+        };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function safeJsonParse(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Classificação por retryability (RFC §5, R1). O corpo bruto do provider é lido só para
+ * classificar o status e para logging interno sanitizado (Bloqueador 1) — nunca é
+ * devolvido ao chamador. `DeliveryResult.error.message` é sempre a mensagem pública
+ * canônica correspondente ao código, nunca o texto que o provider enviou.
+ */
+function classifyResendError(status, body, apiKey) {
+    const providerMessage = typeof body['message'] === 'string' ? body['message'] : `Resend respondeu ${status}`;
+    const code = classifyResendStatus(status);
+    logSanitized('[transactional-email] provider respondeu com erro:', { status, code, providerMessage }, [apiKey]);
+    return { code, message: CANONICAL_ERROR_MESSAGES[code] };
+}
+function classifyResendStatus(status) {
+    if (status >= 500)
+        return 'provider-unavailable';
+    if (status === 401 || status === 403)
+        return 'provider-rejected';
+    if (status === 422)
+        return 'invalid-recipient';
+    if (status >= 400)
+        return 'provider-rejected';
+    return 'unknown';
+}
+//# sourceMappingURL=resend-client.js.map

package/dist/mail/resend-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-client.js","sourceRoot":"","sources":["../../src/mail/resend-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAExD;;;;GAIG;AACH,MAAM,wBAAwB,GAAsC;IAClE,OAAO,EAAE,4DAA4D;IACrE,sBAAsB,EAAE,oDAAoD;IAC5E,mBAAmB,EAAE,qDAAqD;IAC1E,mBAAmB,EAAE,6CAA6C;IAClE,OAAO,EAAE,sDAAsD;CAChE,CAAC;AAYF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAyB;IAC3D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAEpE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;gBACvC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;gBACd,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;gBAC/B,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;gBACzB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;gBACzB,QAAQ,EAAE,KAAK,CAAC,OAAO;gBACvB,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;aACnE,CAAC;YACF,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEnD,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,UAAU,EAAE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,IAAI,CAAY,CAAC,CAAC,CAAC,SAAS;aAChF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACtD,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,2BAA2B,KAAK,CAAC,SAAS,IAAI,EAAE;aACpF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,gDAAgD;aAC1D;SACF,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,MAAc,EACd,IAA6B,EAC7B,MAAc;IAEd,MAAM,eAAe,GACnB,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,oBAAoB,MAAM,EAAE,CAAC;IACvF,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAE1C,YAAY,CACV,oDAAoD,EACpD,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,EACjC,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc;IAC1C,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,sBAAsB,CAAC;IACjD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,mBAAmB,CAAC;IACjE,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,mBAAmB,CAAC;IAC/C,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,mBAAmB,CAAC;IAC9C,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/mail/resend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resend.d.ts","sourceRoot":"","sources":["../../src/mail/resend.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAY/F"}
+{"version":3,"file":"resend.d.ts","sourceRoot":"","sources":["../../src/mail/resend.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAc/F"}

package/dist/mail/resend.js

@@ -6,6 +6,8 @@ export async function sendEmail(apiKey, msg) {
             method: 'POST',
             headers: { authorization: `Bearer ${apiKey}`, 'content-type': 'application/json' },
             body: JSON.stringify(msg),
+            // Best-effort com teto: um Resend pendurado não pode segurar o chamador.
+            signal: AbortSignal.timeout(8000),
         });
         return res.ok;
     }

package/dist/mail/resend.js.map

@@ -1 +1 @@
-{"version":3,"file":"resend.js","sourceRoot":"","sources":["../../src/mail/resend.ts"],"names":[],"mappings":"AAYA,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAA0B,EAAE,GAAiB;IAC3E,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,+BAA+B,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAClF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;SAC1B,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"resend.js","sourceRoot":"","sources":["../../src/mail/resend.ts"],"names":[],"mappings":"AAYA,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAA0B,EAAE,GAAiB;IAC3E,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,+BAA+B,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAClF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;YACzB,yEAAyE;YACzE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/mail/sanitize.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Sanitização genérica de segredos (Bloqueador 1 — Auditoria Codex, Capability Certification 001/002).
+ * Nunca depende de um valor específico de teste, nem de um formato específico de credencial: redige
+ * a(s) credencial(is) conhecida(s) em tempo de execução (ex.: a apiKey configurada) e, defensivamente,
+ * a FORMA de um segredo (par chave=valor rotulado, credencial embutida em URI, token estruturado tipo
+ * JWT, ou qualquer string opaca de alta entropia) — nunca uma lista fechada de formatos conhecidos.
+ * Certification Round 2 (2026-07-21) apontou que a v1 só cobria padrões rotulados
+ * (`token=`/`Authorization:`/`Bearer `); esta versão adiciona duas camadas adicionais, também
+ * genéricas, para cobrir formatos desconhecidos a priori (ver Evidence Mapping, `CAPABILITY_REGRESSION_MATRIX.md`).
+ */
+/** Redige ocorrências de segredos conhecidos (por valor) e de padrões genéricos de credencial (por forma). */
+export declare function redactSecrets(text: string, knownSecrets: ReadonlyArray<string | undefined>): string;
+/** console.error sanitizado — nenhum segredo conhecido chega ao log (Bloqueador 1, requisito de logging). */
+export declare function logSanitized(prefix: string, detail: unknown, knownSecrets: ReadonlyArray<string | undefined>): void;
+/** console.log sanitizado — para eventos informativos (ex.: outcome de envio), não erros. */
+export declare function logSanitizedInfo(prefix: string, detail: unknown, knownSecrets: ReadonlyArray<string | undefined>): void;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/mail/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/mail/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAqBH,8GAA8G;AAC9G,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,GAC9C,MAAM,CAWR;AAED,6GAA6G;AAC7G,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,YAAY,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,GAC9C,IAAI,CAGN;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,YAAY,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,GAC9C,IAAI,CAGN"}

package/dist/mail/sanitize.js

@@ -0,0 +1,51 @@
+/**
+ * Sanitização genérica de segredos (Bloqueador 1 — Auditoria Codex, Capability Certification 001/002).
+ * Nunca depende de um valor específico de teste, nem de um formato específico de credencial: redige
+ * a(s) credencial(is) conhecida(s) em tempo de execução (ex.: a apiKey configurada) e, defensivamente,
+ * a FORMA de um segredo (par chave=valor rotulado, credencial embutida em URI, token estruturado tipo
+ * JWT, ou qualquer string opaca de alta entropia) — nunca uma lista fechada de formatos conhecidos.
+ * Certification Round 2 (2026-07-21) apontou que a v1 só cobria padrões rotulados
+ * (`token=`/`Authorization:`/`Bearer `); esta versão adiciona duas camadas adicionais, também
+ * genéricas, para cobrir formatos desconhecidos a priori (ver Evidence Mapping, `CAPABILITY_REGRESSION_MATRIX.md`).
+ */
+const REDACTED = '[REDACTED]';
+const SENSITIVE_VALUE_PATTERNS = [
+    // Camada 1 — segredo rotulado: "Bearer <token>" / "Authorization: <valor>" / "api_key=<valor>" etc.
+    /bearer\s+\S+/gi,
+    /authorization\s*[:=]\s*\S+/gi,
+    /\b(api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|client[_-]?secret|secret|token|password|passwd|pwd)\b\s*[:=]\s*['"]?[^\s'",;]{4,}['"]?/gi,
+    // Camada 2 — credencial embutida em URI (scheme://user:senha@host), formato comum de connection
+    // string (Redis/Postgres/etc.) que nenhuma regra rotulada acima captura.
+    /\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@'"]+:[^\s/@'"]+@/gi,
+    // Camada 3 — token estruturado tipo JWT (3 segmentos base64url separados por ".").
+    /\bey[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\b/g,
+    // Camada 4 — última linha de defesa: qualquer string opaca de alta entropia (>= 20 chars,
+    // mistura letras+dígitos, sem espaço) que sobrou sem rótulo reconhecido — cobre formatos de
+    // provider desconhecidos a priori (ex.: `re_...` do Resend, `sk_live_...` do Stripe, `AKIA...`
+    // da AWS) sem codificar nenhum deles por nome, conforme exigido pela Certification Round 2.
+    /\b(?=[a-zA-Z0-9_-]{20,}\b)(?=[a-zA-Z0-9_-]*[0-9])(?=[a-zA-Z0-9_-]*[a-zA-Z])[a-zA-Z0-9_-]{20,}\b/g,
+];
+/** Redige ocorrências de segredos conhecidos (por valor) e de padrões genéricos de credencial (por forma). */
+export function redactSecrets(text, knownSecrets) {
+    let redacted = text;
+    for (const secret of knownSecrets) {
+        if (secret && secret.length >= 4) {
+            redacted = redacted.split(secret).join(REDACTED);
+        }
+    }
+    for (const pattern of SENSITIVE_VALUE_PATTERNS) {
+        redacted = redacted.replace(pattern, REDACTED);
+    }
+    return redacted;
+}
+/** console.error sanitizado — nenhum segredo conhecido chega ao log (Bloqueador 1, requisito de logging). */
+export function logSanitized(prefix, detail, knownSecrets) {
+    const serialized = typeof detail === 'string' ? detail : JSON.stringify(detail);
+    console.error(prefix, redactSecrets(serialized, knownSecrets));
+}
+/** console.log sanitizado — para eventos informativos (ex.: outcome de envio), não erros. */
+export function logSanitizedInfo(prefix, detail, knownSecrets) {
+    const serialized = typeof detail === 'string' ? detail : JSON.stringify(detail);
+    console.log(prefix, redactSecrets(serialized, knownSecrets));
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/mail/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/mail/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,MAAM,wBAAwB,GAAa;IACzC,oGAAoG;IACpG,gBAAgB;IAChB,8BAA8B;IAC9B,mJAAmJ;IACnJ,gGAAgG;IAChG,yEAAyE;IACzE,mDAAmD;IACnD,mFAAmF;IACnF,mEAAmE;IACnE,0FAA0F;IAC1F,4FAA4F;IAC5F,+FAA+F;IAC/F,4FAA4F;IAC5F,kGAAkG;CACnG,CAAC;AAEF,8GAA8G;AAC9G,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,YAA+C;IAE/C,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACjC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,wBAAwB,EAAE,CAAC;QAC/C,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,MAAe,EACf,YAA+C;IAE/C,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChF,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,MAAe,EACf,YAA+C;IAE/C,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/mail/sender-resolver.d.ts

@@ -0,0 +1,8 @@
+import type { EmailAddress, SenderResolver } from './types.js';
+/** Default — sempre retorna o `from` configurado no Provider, ignorando `brand` (RFC §4.5, precedência 3). */
+export declare class StaticSenderResolver implements SenderResolver {
+    private readonly defaultFrom;
+    constructor(defaultFrom: EmailAddress);
+    resolveFrom(): EmailAddress;
+}
+//# sourceMappingURL=sender-resolver.d.ts.map

package/dist/mail/sender-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-resolver.d.ts","sourceRoot":"","sources":["../../src/mail/sender-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE/D,8GAA8G;AAC9G,qBAAa,oBAAqB,YAAW,cAAc;IAC7C,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,YAAY;IAEtD,WAAW,IAAI,YAAY;CAG5B"}

package/dist/mail/sender-resolver.js

@@ -0,0 +1,11 @@
+/** Default — sempre retorna o `from` configurado no Provider, ignorando `brand` (RFC §4.5, precedência 3). */
+export class StaticSenderResolver {
+    defaultFrom;
+    constructor(defaultFrom) {
+        this.defaultFrom = defaultFrom;
+    }
+    resolveFrom() {
+        return this.defaultFrom;
+    }
+}
+//# sourceMappingURL=sender-resolver.js.map

package/dist/mail/sender-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-resolver.js","sourceRoot":"","sources":["../../src/mail/sender-resolver.ts"],"names":[],"mappings":"AAEA,8GAA8G;AAC9G,MAAM,OAAO,oBAAoB;IACF;IAA7B,YAA6B,WAAyB;QAAzB,gBAAW,GAAX,WAAW,CAAc;IAAG,CAAC;IAE1D,WAAW;QACT,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF"}

package/dist/mail/template-renderer.d.ts

@@ -0,0 +1,10 @@
+import type { RenderedEmail, TemplateRenderer } from './types.js';
+/**
+ * Default — escape hatch para consumidores sem motor de template (RFC §4.3, melhoria recomendada).
+ * `data` já deve chegar como `{ subject, html, text? }` pronto; `template` é usado só como
+ * rótulo opaco (logging/tag), nunca resolvido.
+ */
+export declare class PassthroughTemplateRenderer implements TemplateRenderer {
+    render(template: string, data: Record<string, unknown>): RenderedEmail;
+}
+//# sourceMappingURL=template-renderer.d.ts.map

package/dist/mail/template-renderer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-renderer.d.ts","sourceRoot":"","sources":["../../src/mail/template-renderer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAElE;;;;GAIG;AACH,qBAAa,2BAA4B,YAAW,gBAAgB;IAClE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa;CAavE"}

package/dist/mail/template-renderer.js

@@ -0,0 +1,17 @@
+/**
+ * Default — escape hatch para consumidores sem motor de template (RFC §4.3, melhoria recomendada).
+ * `data` já deve chegar como `{ subject, html, text? }` pronto; `template` é usado só como
+ * rótulo opaco (logging/tag), nunca resolvido.
+ */
+export class PassthroughTemplateRenderer {
+    render(template, data) {
+        const subject = data['subject'];
+        const html = data['html'];
+        const text = data['text'];
+        if (typeof subject !== 'string' || typeof html !== 'string') {
+            throw new Error(`PassthroughTemplateRenderer: template "${template}" exige data.subject e data.html como string`);
+        }
+        return { subject, html, text: typeof text === 'string' ? text : undefined };
+    }
+}
+//# sourceMappingURL=template-renderer.js.map

package/dist/mail/template-renderer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-renderer.js","sourceRoot":"","sources":["../../src/mail/template-renderer.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,OAAO,2BAA2B;IACtC,MAAM,CAAC,QAAgB,EAAE,IAA6B;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAE1B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CACb,0CAA0C,QAAQ,8CAA8C,CACjG,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC9E,CAAC;CACF"}