@brandlab-digital/site-next 3.13.0 → 3.15.0

package/dist/contact/resend-webhook.d.ts

@@ -0,0 +1,72 @@
+import 'server-only';
+import { type BrandlabContactDeliveryAlert } from './delivery.js';
+import { type BrandlabContactRateLimitRule } from './rate-limit.js';
+/**
+ * The signed Resend webhook route (3.14.0): it learns, the same day, when the business's copy of an enquiry bounced,
+ * was suppressed, was reported as spam or failed, and records each as a delivery failure. Serve it at
+ * `src/app/api/brandlab/resend-webhook/route.ts`:
+ *
+ * ```ts
+ * import { createBrandlabResendWebhookRoute } from '@brandlab-digital/site-next/contact/server'
+ * import { contactContract } from '@/config/contact'
+ *
+ * export const { POST } = createBrandlabResendWebhookRoute({ projectId: contactContract.projectId })
+ * ```
+ *
+ * Resend signs every event with Svix (`svix-id`, `svix-timestamp`, `svix-signature`): HMAC-SHA256 over
+ * `<svix-id>.<svix-timestamp>.<raw body>` keyed with the base64 part of the endpoint's `whsec_` signing secret, held in
+ * `RESEND_WEBHOOK_SECRET` and never logged. Webhooks are account-wide, so the route records only the emails this site's
+ * contact route sent (their `project_id` tag) and answers 200 to everything else so Resend stops retrying it.
+ *
+ * Answers: 200 `{ ok: true, recorded }` (`duplicate: true` for a retry this instance already recorded); 400 for an
+ * unreadable body; 401 for a missing or wrong signature or a timestamp more than 5 minutes off; 413 for a body over
+ * 256 KB; 429 with `Retry-After` once one client IP (`x-real-ip`) has failed those checks past the rate limit; 503 when
+ * the secret is not set; 500 when the alert hook failed (Resend retries).
+ *
+ * Retries are de-duplicated by `svix-id` in a small in-memory list per server instance: best effort only, so the daily
+ * monitor still de-duplicates on `webhookId`. Only failed attempts count towards the rate limit, so Resend's correctly
+ * signed requests are never refused with 429, and without `x-real-ip` nothing is rate-limited.
+ */
+export declare const BRANDLAB_RESEND_WEBHOOK_SECRET_ENV: "RESEND_WEBHOOK_SECRET";
+/** Failed attempts (bad signature, stale timestamp, oversized body) per client IP before the route answers 429. */
+export declare const BRANDLAB_RESEND_WEBHOOK_RATE_LIMIT: Readonly<{
+    limit: 10;
+    windowMs: number;
+}>;
+export interface BrandlabResendWebhookRouteOptions {
+    /** The contact contract's canonical project id; only emails tagged with it are recorded. */
+    projectId: string;
+    /** Defaults to `process.env`, read on each request: `RESEND_WEBHOOK_SECRET` (the endpoint's `whsec_` secret). */
+    environment?: Readonly<Record<string, string | undefined>>;
+    /** The same-day alert for a bounced, suppressed, complained or failed business copy. */
+    onDeliveryFailure?: BrandlabContactDeliveryAlert;
+    /**
+     * Failed attempts per client IP (`x-real-ip`) before the route answers 429, held in memory per server instance
+     * (BRANDLAB_RESEND_WEBHOOK_RATE_LIMIT by default); `false` turns it off. Correctly signed requests never count.
+     */
+    rateLimit?: BrandlabContactRateLimitRule | false;
+    /** Defaults to `Date.now`. */
+    now?: () => number;
+}
+export interface BrandlabResendWebhookRoute {
+    POST(request: Request): Promise<Response>;
+}
+/**
+ * Verifies a Resend (Svix) webhook signature: one `v1,<base64>` entry in the space-separated `svix-signature` list must
+ * equal HMAC-SHA256 of `<id>.<timestamp>.<body>`, and the timestamp must be within 5 minutes of `now` (milliseconds).
+ */
+export declare function verifyResendWebhookSignature(input: {
+    secret: string;
+    id: string;
+    timestamp: string;
+    signature: string;
+    body: string;
+    now: number;
+}): Promise<boolean>;
+/**
+ * Creates the signed Resend webhook route for one site. Create it once at module level. In Resend, add a webhook to
+ * `https://<site>/api/brandlab/resend-webhook` with the email events (at least delivered, delivery delayed, bounced,
+ * complained, suppressed and failed) and copy its signing secret into `RESEND_WEBHOOK_SECRET`.
+ */
+export declare function createBrandlabResendWebhookRoute(options: BrandlabResendWebhookRouteOptions): BrandlabResendWebhookRoute;
+//# sourceMappingURL=resend-webhook.d.ts.map

package/dist/contact/resend-webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-webhook.d.ts","sourceRoot":"","sources":["../../src/contact/resend-webhook.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAA;AAGpB,OAAO,EAIL,KAAK,4BAA4B,EAElC,MAAM,eAAe,CAAA;AACtB,OAAO,EAAoC,KAAK,4BAA4B,EAAE,MAAM,iBAAiB,CAAA;AAGrG;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,eAAO,MAAM,kCAAkC,EAAG,uBAAgC,CAAA;AAWlF,mHAAmH;AACnH,eAAO,MAAM,kCAAkC;;;EAA0D,CAAA;AAazG,MAAM,WAAW,iCAAiC;IAChD,4FAA4F;IAC5F,SAAS,EAAE,MAAM,CAAA;IACjB,iHAAiH;IACjH,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IAC1D,wFAAwF;IACxF,iBAAiB,CAAC,EAAE,4BAA4B,CAAA;IAChD;;;OAGG;IACH,SAAS,CAAC,EAAE,4BAA4B,GAAG,KAAK,CAAA;IAChD,8BAA8B;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC1C;AAgDD;;;GAGG;AACH,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,MAAM,EAAE,MAAM,CAAA;IACd,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,OAAO,CAAC,CAmBnB;AA4DD;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,iCAAiC,GACzC,0BAA0B,CAqH5B"}

package/dist/contact/resend-webhook.js

@@ -0,0 +1,300 @@
+import 'server-only';
+import { isBrandlabCanonicalEntityId } from '@brandlab-digital/site-core/entity-id';
+import { BRANDLAB_CONTACT_DELIVERY_FAILED_EVENT, BRANDLAB_CONTACT_DELIVERY_STATUS_EVENT, reportContactDeliveryFailure, } from './delivery.js';
+import { createBrandlabContactRateLimiter } from './rate-limit.js';
+import { encodeBrandlabEntityIdForResendTag } from './resend.js';
+/**
+ * The signed Resend webhook route (3.14.0): it learns, the same day, when the business's copy of an enquiry bounced,
+ * was suppressed, was reported as spam or failed, and records each as a delivery failure. Serve it at
+ * `src/app/api/brandlab/resend-webhook/route.ts`:
+ *
+ * ```ts
+ * import { createBrandlabResendWebhookRoute } from '@brandlab-digital/site-next/contact/server'
+ * import { contactContract } from '@/config/contact'
+ *
+ * export const { POST } = createBrandlabResendWebhookRoute({ projectId: contactContract.projectId })
+ * ```
+ *
+ * Resend signs every event with Svix (`svix-id`, `svix-timestamp`, `svix-signature`): HMAC-SHA256 over
+ * `<svix-id>.<svix-timestamp>.<raw body>` keyed with the base64 part of the endpoint's `whsec_` signing secret, held in
+ * `RESEND_WEBHOOK_SECRET` and never logged. Webhooks are account-wide, so the route records only the emails this site's
+ * contact route sent (their `project_id` tag) and answers 200 to everything else so Resend stops retrying it.
+ *
+ * Answers: 200 `{ ok: true, recorded }` (`duplicate: true` for a retry this instance already recorded); 400 for an
+ * unreadable body; 401 for a missing or wrong signature or a timestamp more than 5 minutes off; 413 for a body over
+ * 256 KB; 429 with `Retry-After` once one client IP (`x-real-ip`) has failed those checks past the rate limit; 503 when
+ * the secret is not set; 500 when the alert hook failed (Resend retries).
+ *
+ * Retries are de-duplicated by `svix-id` in a small in-memory list per server instance: best effort only, so the daily
+ * monitor still de-duplicates on `webhookId`. Only failed attempts count towards the rate limit, so Resend's correctly
+ * signed requests are never refused with 429, and without `x-real-ip` nothing is rate-limited.
+ */
+export const BRANDLAB_RESEND_WEBHOOK_SECRET_ENV = 'RESEND_WEBHOOK_SECRET';
+const MAX_BODY_BYTES = 256 * 1_024;
+const MAX_CLOCK_SKEW_SECONDS = 300;
+const LOG_EVENT = 'brandlab_resend_webhook';
+const WEBHOOK_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+const EMAIL_ID_PATTERN = /^[A-Za-z0-9-]{1,128}$/;
+const SUBMISSION_PATTERN = /^[0-9a-f]{64}$/;
+const DETAIL_PART_PATTERN = /^[A-Za-z0-9_]{1,64}$/;
+const SEEN_IDS_LIMIT = 512;
+/** Failed attempts (bad signature, stale timestamp, oversized body) per client IP before the route answers 429. */
+export const BRANDLAB_RESEND_WEBHOOK_RATE_LIMIT = Object.freeze({ limit: 10, windowMs: 10 * 60 * 1_000 });
+const FAILURES = {
+    'email.bounced': 'recipient_bounced',
+    'email.complained': 'recipient_complained',
+    'email.suppressed': 'recipient_suppressed',
+    'email.failed': 'provider_failed',
+};
+const STATES = {
+    'email.delivered': { state: 'delivered', level: 'info' },
+    'email.delivery_delayed': { state: 'delayed', level: 'warn' },
+};
+function json(status, body) {
+    return Response.json(body, { status, headers: { 'cache-control': 'no-store' } });
+}
+function refusedLog(reason) {
+    console.error(JSON.stringify({ event: LOG_EVENT, result: 'refused', reason }));
+}
+/** The platform-set client IP (Vercel's `x-real-ip`); `x-forwarded-for` can be written by the client, so it is not read. */
+function clientIp(request) {
+    const candidate = request.headers.get('x-real-ip')?.trim();
+    return candidate && candidate.length <= 64 && /^[0-9A-Fa-f:.]+$/.test(candidate) ? candidate : undefined;
+}
+function base64ToBytes(value) {
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(value))
+        return undefined;
+    try {
+        const binary = atob(value);
+        return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+    }
+    catch {
+        return undefined;
+    }
+}
+function bytesToBase64(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary);
+}
+/** Equal texts compared in time that does not depend on where they differ. */
+function sameText(a, b) {
+    let difference = a.length ^ b.length;
+    const reference = a.length === b.length ? b : a;
+    for (let index = 0; index < a.length; index += 1)
+        difference |= a.charCodeAt(index) ^ reference.charCodeAt(index);
+    return difference === 0;
+}
+/** The HMAC key inside a `whsec_` signing secret, or undefined when the value is not one. */
+function signingKey(secret) {
+    const trimmed = typeof secret === 'string' ? secret.trim() : '';
+    if (!trimmed.startsWith('whsec_') || trimmed.length > 512)
+        return undefined;
+    const key = base64ToBytes(trimmed.slice('whsec_'.length));
+    return key && key.byteLength >= 16 ? key : undefined;
+}
+/**
+ * Verifies a Resend (Svix) webhook signature: one `v1,<base64>` entry in the space-separated `svix-signature` list must
+ * equal HMAC-SHA256 of `<id>.<timestamp>.<body>`, and the timestamp must be within 5 minutes of `now` (milliseconds).
+ */
+export async function verifyResendWebhookSignature(input) {
+    const key = signingKey(input.secret);
+    if (!key || !WEBHOOK_ID_PATTERN.test(input.id) || !/^\d{1,12}$/.test(input.timestamp))
+        return false;
+    if (Math.abs(input.now / 1_000 - Number(input.timestamp)) > MAX_CLOCK_SKEW_SECONDS)
+        return false;
+    const candidates = input.signature
+        .split(' ')
+        .filter((entry) => entry.startsWith('v1,'))
+        .map((entry) => entry.slice(3));
+    if (candidates.length === 0)
+        return false;
+    const cryptoKey = await crypto.subtle.importKey('raw', key, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const digest = await crypto.subtle.sign('HMAC', cryptoKey, new TextEncoder().encode(`${input.id}.${input.timestamp}.${input.body}`));
+    const expected = bytesToBase64(new Uint8Array(digest));
+    let matched = false;
+    for (const candidate of candidates)
+        if (sameText(candidate, expected))
+            matched = true;
+    return matched;
+}
+async function readCappedText(request, limit) {
+    if (!request.body)
+        return '';
+    const reader = request.body.getReader();
+    const chunks = [];
+    let size = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        size += value.byteLength;
+        if (size > limit) {
+            await reader.cancel().catch(() => undefined);
+            return null;
+        }
+        chunks.push(value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(bytes);
+}
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+/** Resend's tags as a name-to-value map, from either the object or the name/value list form. */
+function readTags(value) {
+    const tags = new Map();
+    if (Array.isArray(value)) {
+        for (const entry of value) {
+            const tag = asRecord(entry);
+            if (typeof tag?.name === 'string' && typeof tag.value === 'string')
+                tags.set(tag.name, tag.value);
+        }
+    }
+    else {
+        for (const [name, tagValue] of Object.entries(asRecord(value) ?? {})) {
+            if (typeof tagValue === 'string')
+                tags.set(name, tagValue);
+        }
+    }
+    return tags;
+}
+/** Resend's own plain type words (bounce type/subtype, suppression type, failure reason); free text is never kept. */
+function failureDetail(type, data) {
+    const parts = type === 'email.bounced'
+        ? [asRecord(data.bounce)?.type, asRecord(data.bounce)?.subType]
+        : type === 'email.suppressed'
+            ? [asRecord(data.suppressed)?.type]
+            : type === 'email.failed'
+                ? [asRecord(data.failed)?.reason]
+                : [];
+    const plain = parts.filter((part) => typeof part === 'string' && DETAIL_PART_PATTERN.test(part));
+    return plain.length > 0 ? plain.join('/') : undefined;
+}
+/**
+ * Creates the signed Resend webhook route for one site. Create it once at module level. In Resend, add a webhook to
+ * `https://<site>/api/brandlab/resend-webhook` with the email events (at least delivered, delivery delayed, bounced,
+ * complained, suppressed and failed) and copy its signing secret into `RESEND_WEBHOOK_SECRET`.
+ */
+export function createBrandlabResendWebhookRoute(options) {
+    if (!options || typeof options !== 'object')
+        throw new TypeError('Resend webhook route options must be an object.');
+    if (!isBrandlabCanonicalEntityId(options.projectId)) {
+        throw new Error('The Resend webhook route needs the contact contract\'s canonical project id.');
+    }
+    if (options.onDeliveryFailure !== undefined && typeof options.onDeliveryFailure !== 'function') {
+        throw new TypeError('onDeliveryFailure must be a function.');
+    }
+    const projectTag = encodeBrandlabEntityIdForResendTag(options.projectId);
+    const now = options.now ?? Date.now;
+    const rule = options.rateLimit === undefined ? BRANDLAB_RESEND_WEBHOOK_RATE_LIMIT : options.rateLimit;
+    const limiter = rule === false ? undefined : createBrandlabContactRateLimiter({ perIp: rule, perAddress: false });
+    // svix-ids this instance recorded, oldest first (a Map keeps insertion order): a best-effort retry filter.
+    const seen = new Map();
+    const remember = (id) => {
+        seen.set(id, true);
+        if (seen.size > SEEN_IDS_LIMIT)
+            seen.delete(seen.keys().next().value);
+    };
+    return Object.freeze({
+        async POST(request) {
+            const at = now();
+            // Only failed attempts count towards the limit, so Resend's signed requests are never locked out.
+            const refuse = (status, error, reason) => {
+                const ip = limiter ? clientIp(request) : undefined;
+                if (limiter && ip) {
+                    const decision = limiter.check({ ipKey: ip, submissionId: crypto.randomUUID(), now: at });
+                    if (!decision.ok) {
+                        refusedLog('rate-limited');
+                        return Response.json({ ok: false, error: 'rate-limited' }, { status: 429, headers: { 'cache-control': 'no-store', 'retry-after': String(decision.retryAfterSeconds) } });
+                    }
+                }
+                refusedLog(reason);
+                return json(status, { ok: false, error });
+            };
+            const environment = options.environment ?? process.env;
+            const secret = environment[BRANDLAB_RESEND_WEBHOOK_SECRET_ENV] ?? '';
+            if (!signingKey(secret)) {
+                refusedLog('not-configured');
+                return json(503, { ok: false, error: 'not-configured' });
+            }
+            const declaredLength = Number(request.headers.get('content-length') ?? '0');
+            if (Number.isFinite(declaredLength) && declaredLength > MAX_BODY_BYTES)
+                return refuse(413, 'too-large', 'too-large');
+            const body = await readCappedText(request, MAX_BODY_BYTES);
+            if (body === null)
+                return refuse(413, 'too-large', 'too-large');
+            const id = request.headers.get('svix-id')?.trim() ?? '';
+            const verified = await verifyResendWebhookSignature({
+                secret,
+                id,
+                timestamp: request.headers.get('svix-timestamp')?.trim() ?? '',
+                signature: request.headers.get('svix-signature')?.trim() ?? '',
+                body,
+                now: at,
+            });
+            if (!verified)
+                return refuse(401, 'unauthorised', 'signature');
+            if (seen.has(id))
+                return json(200, { ok: true, recorded: false, duplicate: true });
+            let parsed;
+            try {
+                parsed = JSON.parse(body);
+            }
+            catch {
+                refusedLog('invalid-body');
+                return json(400, { ok: false, error: 'invalid-body' });
+            }
+            const event = asRecord(parsed);
+            const data = asRecord(event?.data);
+            const type = typeof event?.type === 'string' ? event.type : '';
+            if (!event || !data) {
+                refusedLog('invalid-body');
+                return json(400, { ok: false, error: 'invalid-body' });
+            }
+            const code = FAILURES[type];
+            const state = STATES[type];
+            const tags = readTags(data.tags);
+            if ((!code && !state) || tags.get('project_id') !== projectTag)
+                return json(200, { ok: true, recorded: false });
+            const submissionTag = tags.get('submission_hash') ?? '';
+            const submission = SUBMISSION_PATTERN.test(submissionTag) ? submissionTag.slice(0, 16) : undefined;
+            const emailId = typeof data.email_id === 'string' && EMAIL_ID_PATTERN.test(data.email_id) ? data.email_id : undefined;
+            const shared = {
+                ...(submission ? { submission } : {}),
+                ...(emailId ? { emailId } : {}),
+                webhookId: id,
+            };
+            if (state) {
+                const line = JSON.stringify({ event: BRANDLAB_CONTACT_DELIVERY_STATUS_EVENT, provider: 'resend', state: state.state, ...shared });
+                if (state.level === 'info')
+                    console.info(line);
+                else
+                    console.warn(line);
+                remember(id);
+                return json(200, { ok: true, recorded: true });
+            }
+            const detail = failureDetail(type, data);
+            const alerted = await reportContactDeliveryFailure({
+                event: BRANDLAB_CONTACT_DELIVERY_FAILED_EVENT,
+                provider: 'resend',
+                code: code,
+                source: 'webhook',
+                ...shared,
+                ...(detail ? { detail } : {}),
+                at: new Date(at).toISOString(),
+            }, options.onDeliveryFailure);
+            if (!alerted)
+                return json(500, { ok: false, error: 'alert-failed' });
+            remember(id);
+            return json(200, { ok: true, recorded: true });
+        },
+    });
+}
+//# sourceMappingURL=resend-webhook.js.map

package/dist/contact/resend-webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-webhook.js","sourceRoot":"","sources":["../../src/contact/resend-webhook.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAA;AAEpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,uCAAuC,CAAA;AACnF,OAAO,EACL,sCAAsC,EACtC,sCAAsC,EACtC,4BAA4B,GAG7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,gCAAgC,EAAqC,MAAM,iBAAiB,CAAA;AACrG,OAAO,EAAE,kCAAkC,EAAE,MAAM,aAAa,CAAA;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,CAAC,MAAM,kCAAkC,GAAG,uBAAgC,CAAA;AAElF,MAAM,cAAc,GAAG,GAAG,GAAG,KAAK,CAAA;AAClC,MAAM,sBAAsB,GAAG,GAAG,CAAA;AAClC,MAAM,SAAS,GAAG,yBAAyB,CAAA;AAC3C,MAAM,kBAAkB,GAAG,wBAAwB,CAAA;AACnD,MAAM,gBAAgB,GAAG,uBAAuB,CAAA;AAChD,MAAM,kBAAkB,GAAG,gBAAgB,CAAA;AAC3C,MAAM,mBAAmB,GAAG,sBAAsB,CAAA;AAClD,MAAM,cAAc,GAAG,GAAG,CAAA;AAE1B,mHAAmH;AACnH,MAAM,CAAC,MAAM,kCAAkC,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;AAEzG,MAAM,QAAQ,GAAiE;IAC7E,eAAe,EAAE,mBAAmB;IACpC,kBAAkB,EAAE,sBAAsB;IAC1C,kBAAkB,EAAE,sBAAsB;IAC1C,cAAc,EAAE,iBAAiB;CAClC,CAAA;AACD,MAAM,MAAM,GAAyF;IACnG,iBAAiB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE;IACxD,wBAAwB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;CAC9D,CAAA;AAsBD,SAAS,IAAI,CAAC,MAAc,EAAE,IAA6B;IACzD,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;AAClF,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;AAChF,CAAC;AAED,4HAA4H;AAC5H,SAAS,QAAQ,CAAC,OAAgB;IAChC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAA;IAC1D,OAAO,SAAS,IAAI,SAAS,CAAC,MAAM,IAAI,EAAE,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1G,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1B,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC;AAED,8EAA8E;AAC9E,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS;IACpC,IAAI,UAAU,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAA;IACpC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;QAAE,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACjH,OAAO,UAAU,KAAK,CAAC,CAAA;AACzB,CAAC;AAED,6FAA6F;AAC7F,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,OAAO,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC/D,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,SAAS,CAAA;IAC3E,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACzD,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAOlD;IACC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IACnG,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,sBAAsB;QAAE,OAAO,KAAK,CAAA;IAChG,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS;SAC/B,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;SAC1C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACzC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/G,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACrC,MAAM,EACN,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CACzE,CAAA;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IACtD,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,KAAK,MAAM,SAAS,IAAI,UAAU;QAAE,IAAI,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;YAAE,OAAO,GAAG,IAAI,CAAA;IACrF,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAgB,EAAE,KAAa;IAC3D,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAA;IACvC,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,IAAI;YAAE,MAAK;QACf,IAAI,IAAI,KAAK,CAAC,UAAU,CAAA;QACxB,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;YACjB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YAC5C,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACxB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAA;IAC5B,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,SAAS,CAAA;AACrH,CAAC;AAED,gGAAgG;AAChG,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;YAC3B,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;QACnG,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACrE,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,sHAAsH;AACtH,SAAS,aAAa,CAAC,IAAY,EAAE,IAA6B;IAChE,MAAM,KAAK,GACT,IAAI,KAAK,eAAe;QACtB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAC/D,CAAC,CAAC,IAAI,KAAK,kBAAkB;YAC3B,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC;YACnC,CAAC,CAAC,IAAI,KAAK,cAAc;gBACvB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBACjC,CAAC,CAAC,EAAE,CAAA;IACZ,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAChH,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAC9C,OAA0C;IAE1C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAA;IACnH,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;IACjG,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,iBAAiB,KAAK,UAAU,EAAE,CAAC;QAC/F,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,UAAU,GAAG,kCAAkC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAA;IACrG,MAAM,OAAO,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gCAAgC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IACjH,2GAA2G;IAC3G,MAAM,IAAI,GAAG,IAAI,GAAG,EAAgB,CAAA;IACpC,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAClB,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAM,CAAC,CAAA;IACxE,CAAC,CAAA;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,OAAgB;YACzB,MAAM,EAAE,GAAG,GAAG,EAAE,CAAA;YAChB,kGAAkG;YAClG,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc,EAAE,EAAE;gBAC/D,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBAClD,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;oBAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAA;oBACzF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;wBACjB,UAAU,CAAC,cAAc,CAAC,CAAA;wBAC1B,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EACpC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAC7G,CAAA;oBACH,CAAC;gBACH,CAAC;gBACD,UAAU,CAAC,MAAM,CAAC,CAAA;gBAClB,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;YAC3C,CAAC,CAAA;YACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAA;YACtD,MAAM,MAAM,GAAG,WAAW,CAAC,kCAAkC,CAAC,IAAI,EAAE,CAAA;YACpE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxB,UAAU,CAAC,gBAAgB,CAAC,CAAA;gBAC5B,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;YAC1D,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAA;YAC3E,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,cAAc;gBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,CAAA;YACpH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;YAC1D,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,CAAA;YAE/D,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;YACvD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC;gBAClD,MAAM;gBACN,EAAE;gBACF,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;gBAC9D,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE;gBAC9D,IAAI;gBACJ,GAAG,EAAE,EAAE;aACR,CAAC,CAAA;YACF,IAAI,CAAC,QAAQ;gBAAE,OAAO,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,WAAW,CAAC,CAAA;YAC9D,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAElF,IAAI,MAAe,CAAA;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,CAAC,cAAc,CAAC,CAAA;gBAC1B,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;YACxD,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;YAClC,MAAM,IAAI,GAAG,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;YAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;gBACpB,UAAU,CAAC,cAAc,CAAC,CAAA;gBAC1B,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;YACxD,CAAC;YAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;YAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;YAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAChC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;YAE/G,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAA;YACvD,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAClG,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;YACrH,MAAM,MAAM,GAAG;gBACb,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/B,SAAS,EAAE,EAAE;aACd,CAAA;YAED,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;gBACjI,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM;oBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;;oBACzC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACvB,QAAQ,CAAC,EAAE,CAAC,CAAA;gBACZ,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;YAChD,CAAC;YAED,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACxC,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAChD;gBACE,KAAK,EAAE,sCAAsC;gBAC7C,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,IAAK;gBACX,MAAM,EAAE,SAAS;gBACjB,GAAG,MAAM;gBACT,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;aAC/B,EACD,OAAO,CAAC,iBAAiB,CAC1B,CAAA;YACD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAA;YACpE,QAAQ,CAAC,EAAE,CAAC,CAAA;YACZ,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QAChD,CAAC;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import 'server-only'\n\nimport { isBrandlabCanonicalEntityId } from '@brandlab-digital/site-core/entity-id'\nimport {\n  BRANDLAB_CONTACT_DELIVERY_FAILED_EVENT,\n  BRANDLAB_CONTACT_DELIVERY_STATUS_EVENT,\n  reportContactDeliveryFailure,\n  type BrandlabContactDeliveryAlert,\n  type BrandlabContactDeliveryFailureCode,\n} from './delivery.js'\nimport { createBrandlabContactRateLimiter, type BrandlabContactRateLimitRule } from './rate-limit.js'\nimport { encodeBrandlabEntityIdForResendTag } from './resend.js'\n\n/**\n * The signed Resend webhook route (3.14.0): it learns, the same day, when the business's copy of an enquiry bounced,\n * was suppressed, was reported as spam or failed, and records each as a delivery failure. Serve it at\n * `src/app/api/brandlab/resend-webhook/route.ts`:\n *\n * ```ts\n * import { createBrandlabResendWebhookRoute } from '@brandlab-digital/site-next/contact/server'\n * import { contactContract } from '@/config/contact'\n *\n * export const { POST } = createBrandlabResendWebhookRoute({ projectId: contactContract.projectId })\n * ```\n *\n * Resend signs every event with Svix (`svix-id`, `svix-timestamp`, `svix-signature`): HMAC-SHA256 over\n * `<svix-id>.<svix-timestamp>.<raw body>` keyed with the base64 part of the endpoint's `whsec_` signing secret, held in\n * `RESEND_WEBHOOK_SECRET` and never logged. Webhooks are account-wide, so the route records only the emails this site's\n * contact route sent (their `project_id` tag) and answers 200 to everything else so Resend stops retrying it.\n *\n * Answers: 200 `{ ok: true, recorded }` (`duplicate: true` for a retry this instance already recorded); 400 for an\n * unreadable body; 401 for a missing or wrong signature or a timestamp more than 5 minutes off; 413 for a body over\n * 256 KB; 429 with `Retry-After` once one client IP (`x-real-ip`) has failed those checks past the rate limit; 503 when\n * the secret is not set; 500 when the alert hook failed (Resend retries).\n *\n * Retries are de-duplicated by `svix-id` in a small in-memory list per server instance: best effort only, so the daily\n * monitor still de-duplicates on `webhookId`. Only failed attempts count towards the rate limit, so Resend's correctly\n * signed requests are never refused with 429, and without `x-real-ip` nothing is rate-limited.\n */\n\nexport const BRANDLAB_RESEND_WEBHOOK_SECRET_ENV = 'RESEND_WEBHOOK_SECRET' as const\n\nconst MAX_BODY_BYTES = 256 * 1_024\nconst MAX_CLOCK_SKEW_SECONDS = 300\nconst LOG_EVENT = 'brandlab_resend_webhook'\nconst WEBHOOK_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/\nconst EMAIL_ID_PATTERN = /^[A-Za-z0-9-]{1,128}$/\nconst SUBMISSION_PATTERN = /^[0-9a-f]{64}$/\nconst DETAIL_PART_PATTERN = /^[A-Za-z0-9_]{1,64}$/\nconst SEEN_IDS_LIMIT = 512\n\n/** Failed attempts (bad signature, stale timestamp, oversized body) per client IP before the route answers 429. */\nexport const BRANDLAB_RESEND_WEBHOOK_RATE_LIMIT = Object.freeze({ limit: 10, windowMs: 10 * 60 * 1_000 })\n\nconst FAILURES: Readonly<Record<string, BrandlabContactDeliveryFailureCode>> = {\n  'email.bounced': 'recipient_bounced',\n  'email.complained': 'recipient_complained',\n  'email.suppressed': 'recipient_suppressed',\n  'email.failed': 'provider_failed',\n}\nconst STATES: Readonly<Record<string, { state: 'delivered' | 'delayed'; level: 'info' | 'warn' }>> = {\n  'email.delivered': { state: 'delivered', level: 'info' },\n  'email.delivery_delayed': { state: 'delayed', level: 'warn' },\n}\n\nexport interface BrandlabResendWebhookRouteOptions {\n  /** The contact contract's canonical project id; only emails tagged with it are recorded. */\n  projectId: string\n  /** Defaults to `process.env`, read on each request: `RESEND_WEBHOOK_SECRET` (the endpoint's `whsec_` secret). */\n  environment?: Readonly<Record<string, string | undefined>>\n  /** The same-day alert for a bounced, suppressed, complained or failed business copy. */\n  onDeliveryFailure?: BrandlabContactDeliveryAlert\n  /**\n   * Failed attempts per client IP (`x-real-ip`) before the route answers 429, held in memory per server instance\n   * (BRANDLAB_RESEND_WEBHOOK_RATE_LIMIT by default); `false` turns it off. Correctly signed requests never count.\n   */\n  rateLimit?: BrandlabContactRateLimitRule | false\n  /** Defaults to `Date.now`. */\n  now?: () => number\n}\n\nexport interface BrandlabResendWebhookRoute {\n  POST(request: Request): Promise<Response>\n}\n\nfunction json(status: number, body: Record<string, unknown>) {\n  return Response.json(body, { status, headers: { 'cache-control': 'no-store' } })\n}\n\nfunction refusedLog(reason: string) {\n  console.error(JSON.stringify({ event: LOG_EVENT, result: 'refused', reason }))\n}\n\n/** The platform-set client IP (Vercel's `x-real-ip`); `x-forwarded-for` can be written by the client, so it is not read. */\nfunction clientIp(request: Request) {\n  const candidate = request.headers.get('x-real-ip')?.trim()\n  return candidate && candidate.length <= 64 && /^[0-9A-Fa-f:.]+$/.test(candidate) ? candidate : undefined\n}\n\nfunction base64ToBytes(value: string): Uint8Array<ArrayBuffer> | undefined {\n  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(value)) return undefined\n  try {\n    const binary = atob(value)\n    return Uint8Array.from(binary, (character) => character.charCodeAt(0))\n  } catch {\n    return undefined\n  }\n}\n\nfunction bytesToBase64(bytes: Uint8Array) {\n  let binary = ''\n  for (const byte of bytes) binary += String.fromCharCode(byte)\n  return btoa(binary)\n}\n\n/** Equal texts compared in time that does not depend on where they differ. */\nfunction sameText(a: string, b: string) {\n  let difference = a.length ^ b.length\n  const reference = a.length === b.length ? b : a\n  for (let index = 0; index < a.length; index += 1) difference |= a.charCodeAt(index) ^ reference.charCodeAt(index)\n  return difference === 0\n}\n\n/** The HMAC key inside a `whsec_` signing secret, or undefined when the value is not one. */\nfunction signingKey(secret: string): Uint8Array<ArrayBuffer> | undefined {\n  const trimmed = typeof secret === 'string' ? secret.trim() : ''\n  if (!trimmed.startsWith('whsec_') || trimmed.length > 512) return undefined\n  const key = base64ToBytes(trimmed.slice('whsec_'.length))\n  return key && key.byteLength >= 16 ? key : undefined\n}\n\n/**\n * Verifies a Resend (Svix) webhook signature: one `v1,<base64>` entry in the space-separated `svix-signature` list must\n * equal HMAC-SHA256 of `<id>.<timestamp>.<body>`, and the timestamp must be within 5 minutes of `now` (milliseconds).\n */\nexport async function verifyResendWebhookSignature(input: {\n  secret: string\n  id: string\n  timestamp: string\n  signature: string\n  body: string\n  now: number\n}): Promise<boolean> {\n  const key = signingKey(input.secret)\n  if (!key || !WEBHOOK_ID_PATTERN.test(input.id) || !/^\\d{1,12}$/.test(input.timestamp)) return false\n  if (Math.abs(input.now / 1_000 - Number(input.timestamp)) > MAX_CLOCK_SKEW_SECONDS) return false\n  const candidates = input.signature\n    .split(' ')\n    .filter((entry) => entry.startsWith('v1,'))\n    .map((entry) => entry.slice(3))\n  if (candidates.length === 0) return false\n  const cryptoKey = await crypto.subtle.importKey('raw', key, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n  const digest = await crypto.subtle.sign(\n    'HMAC',\n    cryptoKey,\n    new TextEncoder().encode(`${input.id}.${input.timestamp}.${input.body}`),\n  )\n  const expected = bytesToBase64(new Uint8Array(digest))\n  let matched = false\n  for (const candidate of candidates) if (sameText(candidate, expected)) matched = true\n  return matched\n}\n\nasync function readCappedText(request: Request, limit: number): Promise<string | null> {\n  if (!request.body) return ''\n  const reader = request.body.getReader()\n  const chunks: Uint8Array[] = []\n  let size = 0\n  for (;;) {\n    const { done, value } = await reader.read()\n    if (done) break\n    size += value.byteLength\n    if (size > limit) {\n      await reader.cancel().catch(() => undefined)\n      return null\n    }\n    chunks.push(value)\n  }\n  const bytes = new Uint8Array(size)\n  let offset = 0\n  for (const chunk of chunks) {\n    bytes.set(chunk, offset)\n    offset += chunk.byteLength\n  }\n  return new TextDecoder().decode(bytes)\n}\n\nfunction asRecord(value: unknown): Record<string, unknown> | undefined {\n  return value && typeof value === 'object' && !Array.isArray(value) ? (value as Record<string, unknown>) : undefined\n}\n\n/** Resend's tags as a name-to-value map, from either the object or the name/value list form. */\nfunction readTags(value: unknown): Map<string, string> {\n  const tags = new Map<string, string>()\n  if (Array.isArray(value)) {\n    for (const entry of value) {\n      const tag = asRecord(entry)\n      if (typeof tag?.name === 'string' && typeof tag.value === 'string') tags.set(tag.name, tag.value)\n    }\n  } else {\n    for (const [name, tagValue] of Object.entries(asRecord(value) ?? {})) {\n      if (typeof tagValue === 'string') tags.set(name, tagValue)\n    }\n  }\n  return tags\n}\n\n/** Resend's own plain type words (bounce type/subtype, suppression type, failure reason); free text is never kept. */\nfunction failureDetail(type: string, data: Record<string, unknown>): string | undefined {\n  const parts =\n    type === 'email.bounced'\n      ? [asRecord(data.bounce)?.type, asRecord(data.bounce)?.subType]\n      : type === 'email.suppressed'\n        ? [asRecord(data.suppressed)?.type]\n        : type === 'email.failed'\n          ? [asRecord(data.failed)?.reason]\n          : []\n  const plain = parts.filter((part): part is string => typeof part === 'string' && DETAIL_PART_PATTERN.test(part))\n  return plain.length > 0 ? plain.join('/') : undefined\n}\n\n/**\n * Creates the signed Resend webhook route for one site. Create it once at module level. In Resend, add a webhook to\n * `https://<site>/api/brandlab/resend-webhook` with the email events (at least delivered, delivery delayed, bounced,\n * complained, suppressed and failed) and copy its signing secret into `RESEND_WEBHOOK_SECRET`.\n */\nexport function createBrandlabResendWebhookRoute(\n  options: BrandlabResendWebhookRouteOptions,\n): BrandlabResendWebhookRoute {\n  if (!options || typeof options !== 'object') throw new TypeError('Resend webhook route options must be an object.')\n  if (!isBrandlabCanonicalEntityId(options.projectId)) {\n    throw new Error('The Resend webhook route needs the contact contract\\'s canonical project id.')\n  }\n  if (options.onDeliveryFailure !== undefined && typeof options.onDeliveryFailure !== 'function') {\n    throw new TypeError('onDeliveryFailure must be a function.')\n  }\n  const projectTag = encodeBrandlabEntityIdForResendTag(options.projectId)\n  const now = options.now ?? Date.now\n  const rule = options.rateLimit === undefined ? BRANDLAB_RESEND_WEBHOOK_RATE_LIMIT : options.rateLimit\n  const limiter = rule === false ? undefined : createBrandlabContactRateLimiter({ perIp: rule, perAddress: false })\n  // svix-ids this instance recorded, oldest first (a Map keeps insertion order): a best-effort retry filter.\n  const seen = new Map<string, true>()\n  const remember = (id: string) => {\n    seen.set(id, true)\n    if (seen.size > SEEN_IDS_LIMIT) seen.delete(seen.keys().next().value!)\n  }\n\n  return Object.freeze({\n    async POST(request: Request): Promise<Response> {\n      const at = now()\n      // Only failed attempts count towards the limit, so Resend's signed requests are never locked out.\n      const refuse = (status: number, error: string, reason: string) => {\n        const ip = limiter ? clientIp(request) : undefined\n        if (limiter && ip) {\n          const decision = limiter.check({ ipKey: ip, submissionId: crypto.randomUUID(), now: at })\n          if (!decision.ok) {\n            refusedLog('rate-limited')\n            return Response.json(\n              { ok: false, error: 'rate-limited' },\n              { status: 429, headers: { 'cache-control': 'no-store', 'retry-after': String(decision.retryAfterSeconds) } },\n            )\n          }\n        }\n        refusedLog(reason)\n        return json(status, { ok: false, error })\n      }\n      const environment = options.environment ?? process.env\n      const secret = environment[BRANDLAB_RESEND_WEBHOOK_SECRET_ENV] ?? ''\n      if (!signingKey(secret)) {\n        refusedLog('not-configured')\n        return json(503, { ok: false, error: 'not-configured' })\n      }\n\n      const declaredLength = Number(request.headers.get('content-length') ?? '0')\n      if (Number.isFinite(declaredLength) && declaredLength > MAX_BODY_BYTES) return refuse(413, 'too-large', 'too-large')\n      const body = await readCappedText(request, MAX_BODY_BYTES)\n      if (body === null) return refuse(413, 'too-large', 'too-large')\n\n      const id = request.headers.get('svix-id')?.trim() ?? ''\n      const verified = await verifyResendWebhookSignature({\n        secret,\n        id,\n        timestamp: request.headers.get('svix-timestamp')?.trim() ?? '',\n        signature: request.headers.get('svix-signature')?.trim() ?? '',\n        body,\n        now: at,\n      })\n      if (!verified) return refuse(401, 'unauthorised', 'signature')\n      if (seen.has(id)) return json(200, { ok: true, recorded: false, duplicate: true })\n\n      let parsed: unknown\n      try {\n        parsed = JSON.parse(body)\n      } catch {\n        refusedLog('invalid-body')\n        return json(400, { ok: false, error: 'invalid-body' })\n      }\n      const event = asRecord(parsed)\n      const data = asRecord(event?.data)\n      const type = typeof event?.type === 'string' ? event.type : ''\n      if (!event || !data) {\n        refusedLog('invalid-body')\n        return json(400, { ok: false, error: 'invalid-body' })\n      }\n\n      const code = FAILURES[type]\n      const state = STATES[type]\n      const tags = readTags(data.tags)\n      if ((!code && !state) || tags.get('project_id') !== projectTag) return json(200, { ok: true, recorded: false })\n\n      const submissionTag = tags.get('submission_hash') ?? ''\n      const submission = SUBMISSION_PATTERN.test(submissionTag) ? submissionTag.slice(0, 16) : undefined\n      const emailId = typeof data.email_id === 'string' && EMAIL_ID_PATTERN.test(data.email_id) ? data.email_id : undefined\n      const shared = {\n        ...(submission ? { submission } : {}),\n        ...(emailId ? { emailId } : {}),\n        webhookId: id,\n      }\n\n      if (state) {\n        const line = JSON.stringify({ event: BRANDLAB_CONTACT_DELIVERY_STATUS_EVENT, provider: 'resend', state: state.state, ...shared })\n        if (state.level === 'info') console.info(line)\n        else console.warn(line)\n        remember(id)\n        return json(200, { ok: true, recorded: true })\n      }\n\n      const detail = failureDetail(type, data)\n      const alerted = await reportContactDeliveryFailure(\n        {\n          event: BRANDLAB_CONTACT_DELIVERY_FAILED_EVENT,\n          provider: 'resend',\n          code: code!,\n          source: 'webhook',\n          ...shared,\n          ...(detail ? { detail } : {}),\n          at: new Date(at).toISOString(),\n        },\n        options.onDeliveryFailure,\n      )\n      if (!alerted) return json(500, { ok: false, error: 'alert-failed' })\n      remember(id)\n      return json(200, { ok: true, recorded: true })\n    },\n  })\n}\n"]}

package/dist/contact/route-handler.d.ts

@@ -2,6 +2,7 @@ import 'server-only';
 import type { BrandlabContactContract } from '@brandlab-digital/site-core/contact';
 import type { BrandlabEnvironment } from '@brandlab-digital/site-core/site';
 import { type BrandlabContactRateLimitOptions } from './rate-limit.js';
+import { type BrandlabContactDeliveryAlert, type BrandlabContactSuppressionCheck } from './delivery.js';
 import { type ResendContactSend } from './resend.js';
 import { type BrandlabContactRuntimeDefinitionOptions } from './server.js';
 import type { ContactBotGuard } from './shared.js';
@@ -20,6 +21,21 @@ export interface BrandlabContactRouteHandlerOptions {
      * by default; `false` turns them off). They apply only where enquiries are delivered (production and Preview).
      */
     rateLimit?: BrandlabContactRateLimitOptions | false;
+    /**
+     * The pre-send check of each business inbox against Resend's suppression list (3.14.0), held for the life of the
+     * route module so its answers are cached (5 minutes per inbox). On by default with Resend's suppressions API and a
+     * full-access key: `RESEND_LOOKUP_API_KEY` when set, otherwise `RESEND_API_KEY`. A sending-only key is refused, logged
+     * once per 5 minutes naming the missing permission, and the enquiry is sent as before. Off by default when
+     * `createResendSend` replaces the provider, and `false` turns it off.
+     */
+    suppressionCheck?: BrandlabContactSuppressionCheck | false;
+    /**
+     * Opt-in only (default `false`): when every business inbox is suppressed, refuse and ask the visitor to call. By
+     * default the suppression check only records and alerts, and the enquiry is sent to the client's own inbox.
+     */
+    refuseWhenAllSuppressed?: boolean;
+    /** The same-day alert for a delivery failure the route finds before sending (3.14.0). */
+    onDeliveryFailure?: BrandlabContactDeliveryAlert;
 }
 /**
  * A Resend send function that loads the optional `resend` peer only when an

package/dist/contact/route-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-handler.d.ts","sourceRoot":"","sources":["../../src/contact/route-handler.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAA;AAEpB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAClF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AAC3E,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAA8B,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAChF,OAAO,EAGL,KAAK,uCAAuC,EAC7C,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,WAAW,kCAAkC;IACjD,QAAQ,EAAE,uBAAuB,CAAA;IACjC,mFAAmF;IACnF,OAAO,EAAE,uCAAuC,CAAA;IAChD,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,sDAAsD;IACtD,WAAW,CAAC,EAAE,mBAAmB,CAAA;IACjC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;IAChB,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,iBAAiB,CAAA;IACxD;;;OAGG;IACH,SAAS,CAAC,EAAE,+BAA+B,GAAG,KAAK,CAAA;CACpD;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAQ7E;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,kCAAkC,GAC1C,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CA2BzC"}
+{"version":3,"file":"route-handler.d.ts","sourceRoot":"","sources":["../../src/contact/route-handler.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAA;AAEpB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAClF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AAC3E,OAAO,EAEL,KAAK,+BAA+B,EACrC,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAEL,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACrC,MAAM,eAAe,CAAA;AACtB,OAAO,EAA8B,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAChF,OAAO,EAGL,KAAK,uCAAuC,EAC7C,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,MAAM,WAAW,kCAAkC;IACjD,QAAQ,EAAE,uBAAuB,CAAA;IACjC,mFAAmF;IACnF,OAAO,EAAE,uCAAuC,CAAA;IAChD,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,sDAAsD;IACtD,WAAW,CAAC,EAAE,mBAAmB,CAAA;IACjC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;IAChB,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,iBAAiB,CAAA;IACxD;;;OAGG;IACH,SAAS,CAAC,EAAE,+BAA+B,GAAG,KAAK,CAAA;IACnD;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,+BAA+B,GAAG,KAAK,CAAA;IAC1D;;;OAGG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,yFAAyF;IACzF,iBAAiB,CAAC,EAAE,4BAA4B,CAAA;CACjD;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAQ7E;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,kCAAkC,GAC1C,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAmCzC"}

package/dist/contact/route-handler.js

@@ -1,5 +1,6 @@
 import 'server-only';
 import { createBrandlabContactRateLimiter, } from './rate-limit.js';
+import { createResendSuppressionCheck, } from './delivery.js';
 import { createResendSdkContactSend } from './resend.js';
 import { createBrandlabContactRuntime, detectBrandlabContactDeploymentMode, } from './server.js';
 /**
@@ -29,6 +30,10 @@ export function createBrandlabContactRouteHandler(options) {
         throw new TypeError('createResendSend must be a function.');
     }
     const createResendSend = options.createResendSend ?? createLazyResendContactSend;
+    // One suppression cache for the module. A synthetic test that replaces the provider never asks the real one.
+    const suppressionCheck = options.suppressionCheck === false
+        ? undefined
+        : options.suppressionCheck ?? (options.createResendSend ? undefined : createResendSuppressionCheck());
     // One limiter for the module, shared by every per-request runtime, so its windows outlive each request.
     const rateLimit = options.rateLimit === false ? false : createBrandlabContactRateLimiter(options.rateLimit);
     const runtimeFor = (environment) => createBrandlabContactRuntime({
@@ -40,6 +45,9 @@ export function createBrandlabContactRouteHandler(options) {
         ...(options.botGuard ? { botGuard: options.botGuard } : {}),
         ...(options.now ? { now: options.now } : {}),
         rateLimit,
+        ...(suppressionCheck ? { suppressionCheck } : {}),
+        ...(options.onDeliveryFailure ? { onDeliveryFailure: options.onDeliveryFailure } : {}),
+        ...(options.refuseWhenAllSuppressed === true ? { refuseWhenAllSuppressed: true } : {}),
     });
     // Fail at module load, not on a customer's first enquiry.
     runtimeFor({});

package/dist/contact/route-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"route-handler.js","sourceRoot":"","sources":["../../src/contact/route-handler.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAA;AAIpB,OAAO,EACL,gCAAgC,GAEjC,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,0BAA0B,EAA0B,MAAM,aAAa,CAAA;AAChF,OAAO,EACL,4BAA4B,EAC5B,mCAAmC,GAEpC,MAAM,aAAa,CAAA;AAoBpB;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,IAAI,IAA4C,CAAA;IAChD,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAChC,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAC5C,0BAA0B,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAC/C,CAAA;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACvC,CAAC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC,CAC/C,OAA2C;IAE3C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,sEAAsE,CAAC,CAAA;IAC7F,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;QAC7F,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAA;IAC7D,CAAC;IACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,2BAA2B,CAAA;IAChF,wGAAwG;IACxG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gCAAgC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3G,MAAM,UAAU,GAAG,CAAC,WAAgC,EAAE,EAAE,CACtD,4BAA4B,CAAC;QAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW;QACX,cAAc,EAAE,mCAAmC,CAAC,WAAW,CAAC;QAChE,gBAAgB;QAChB,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,SAAS;KACV,CAAC,CAAA;IAEJ,0DAA0D;IAC1D,UAAU,CAAC,EAAE,CAAC,CAAA;IAEd,OAAO,CAAC,OAAgB,EAAE,EAAE,CAC1B,UAAU,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAA;AAC/E,CAAC","sourcesContent":["import 'server-only'\n\nimport type { BrandlabContactContract } from '@brandlab-digital/site-core/contact'\nimport type { BrandlabEnvironment } from '@brandlab-digital/site-core/site'\nimport {\n  createBrandlabContactRateLimiter,\n  type BrandlabContactRateLimitOptions,\n} from './rate-limit.js'\nimport { createResendSdkContactSend, type ResendContactSend } from './resend.js'\nimport {\n  createBrandlabContactRuntime,\n  detectBrandlabContactDeploymentMode,\n  type BrandlabContactRuntimeDefinitionOptions,\n} from './server.js'\nimport type { ContactBotGuard } from './shared.js'\n\nexport interface BrandlabContactRouteHandlerOptions {\n  contract: BrandlabContactContract\n  /** Labels, brand name, canonical site URL, email style and attachment settings. */\n  runtime: BrandlabContactRuntimeDefinitionOptions\n  botGuard?: ContactBotGuard\n  /** Defaults to process.env, read on every request. */\n  environment?: BrandlabEnvironment\n  now?: () => Date\n  /** Replaces the Resend SDK in synthetic tests; production code omits it. */\n  createResendSend?: (apiKey: string) => ResendContactSend\n  /**\n   * Abuse limits per client IP and per email address, held for the life of the route module (BRANDLAB_CONTACT_RATE_LIMITS\n   * by default; `false` turns them off). They apply only where enquiries are delivered (production and Preview).\n   */\n  rateLimit?: BrandlabContactRateLimitOptions | false\n}\n\n/**\n * A Resend send function that loads the optional `resend` peer only when an\n * enquiry is actually delivered, so validation, bot and local requests never\n * load the provider SDK.\n */\nexport function createLazyResendContactSend(apiKey: string): ResendContactSend {\n  let send: Promise<ResendContactSend> | undefined\n  return async (payload, options) => {\n    send ??= import('resend').then(({ Resend }) =>\n      createResendSdkContactSend(new Resend(apiKey)),\n    )\n    return (await send)(payload, options)\n  }\n}\n\n/**\n * The whole of `src/app/api/contact/route.ts`:\n * `export const POST = createBrandlabContactRouteHandler({ contract, runtime })`.\n * The contract and runtime are validated when the route module loads; each\n * request then resolves the deployment from its environment and delegates to\n * createBrandlabContactRuntime exactly as a per-request runtime would.\n */\nexport function createBrandlabContactRouteHandler(\n  options: BrandlabContactRouteHandlerOptions,\n): (request: Request) => Promise<Response> {\n  if (!options || typeof options !== 'object') {\n    throw new TypeError('createBrandlabContactRouteHandler requires the contract and runtime.')\n  }\n  if (options.createResendSend !== undefined && typeof options.createResendSend !== 'function') {\n    throw new TypeError('createResendSend must be a function.')\n  }\n  const createResendSend = options.createResendSend ?? createLazyResendContactSend\n  // One limiter for the module, shared by every per-request runtime, so its windows outlive each request.\n  const rateLimit = options.rateLimit === false ? false : createBrandlabContactRateLimiter(options.rateLimit)\n  const runtimeFor = (environment: BrandlabEnvironment) =>\n    createBrandlabContactRuntime({\n      contract: options.contract,\n      runtime: options.runtime,\n      environment,\n      deploymentMode: detectBrandlabContactDeploymentMode(environment),\n      createResendSend,\n      ...(options.botGuard ? { botGuard: options.botGuard } : {}),\n      ...(options.now ? { now: options.now } : {}),\n      rateLimit,\n    })\n\n  // Fail at module load, not on a customer's first enquiry.\n  runtimeFor({})\n\n  return (request: Request) =>\n    runtimeFor(options.environment ?? process.env).contactRouteHandler(request)\n}\n"]}
+{"version":3,"file":"route-handler.js","sourceRoot":"","sources":["../../src/contact/route-handler.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAA;AAIpB,OAAO,EACL,gCAAgC,GAEjC,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,4BAA4B,GAG7B,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,0BAA0B,EAA0B,MAAM,aAAa,CAAA;AAChF,OAAO,EACL,4BAA4B,EAC5B,mCAAmC,GAEpC,MAAM,aAAa,CAAA;AAmCpB;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,IAAI,IAA4C,CAAA;IAChD,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;QAChC,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAC5C,0BAA0B,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAC/C,CAAA;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACvC,CAAC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC,CAC/C,OAA2C;IAE3C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,sEAAsE,CAAC,CAAA;IAC7F,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAAE,CAAC;QAC7F,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAA;IAC7D,CAAC;IACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,2BAA2B,CAAA;IAChF,6GAA6G;IAC7G,MAAM,gBAAgB,GACpB,OAAO,CAAC,gBAAgB,KAAK,KAAK;QAChC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,4BAA4B,EAAE,CAAC,CAAA;IACzG,wGAAwG;IACxG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gCAAgC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3G,MAAM,UAAU,GAAG,CAAC,WAAgC,EAAE,EAAE,CACtD,4BAA4B,CAAC;QAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW;QACX,cAAc,EAAE,mCAAmC,CAAC,WAAW,CAAC;QAChE,gBAAgB;QAChB,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,SAAS;QACT,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,OAAO,CAAC,uBAAuB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvF,CAAC,CAAA;IAEJ,0DAA0D;IAC1D,UAAU,CAAC,EAAE,CAAC,CAAA;IAEd,OAAO,CAAC,OAAgB,EAAE,EAAE,CAC1B,UAAU,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAA;AAC/E,CAAC","sourcesContent":["import 'server-only'\n\nimport type { BrandlabContactContract } from '@brandlab-digital/site-core/contact'\nimport type { BrandlabEnvironment } from '@brandlab-digital/site-core/site'\nimport {\n  createBrandlabContactRateLimiter,\n  type BrandlabContactRateLimitOptions,\n} from './rate-limit.js'\nimport {\n  createResendSuppressionCheck,\n  type BrandlabContactDeliveryAlert,\n  type BrandlabContactSuppressionCheck,\n} from './delivery.js'\nimport { createResendSdkContactSend, type ResendContactSend } from './resend.js'\nimport {\n  createBrandlabContactRuntime,\n  detectBrandlabContactDeploymentMode,\n  type BrandlabContactRuntimeDefinitionOptions,\n} from './server.js'\nimport type { ContactBotGuard } from './shared.js'\n\nexport interface BrandlabContactRouteHandlerOptions {\n  contract: BrandlabContactContract\n  /** Labels, brand name, canonical site URL, email style and attachment settings. */\n  runtime: BrandlabContactRuntimeDefinitionOptions\n  botGuard?: ContactBotGuard\n  /** Defaults to process.env, read on every request. */\n  environment?: BrandlabEnvironment\n  now?: () => Date\n  /** Replaces the Resend SDK in synthetic tests; production code omits it. */\n  createResendSend?: (apiKey: string) => ResendContactSend\n  /**\n   * Abuse limits per client IP and per email address, held for the life of the route module (BRANDLAB_CONTACT_RATE_LIMITS\n   * by default; `false` turns them off). They apply only where enquiries are delivered (production and Preview).\n   */\n  rateLimit?: BrandlabContactRateLimitOptions | false\n  /**\n   * The pre-send check of each business inbox against Resend's suppression list (3.14.0), held for the life of the\n   * route module so its answers are cached (5 minutes per inbox). On by default with Resend's suppressions API and a\n   * full-access key: `RESEND_LOOKUP_API_KEY` when set, otherwise `RESEND_API_KEY`. A sending-only key is refused, logged\n   * once per 5 minutes naming the missing permission, and the enquiry is sent as before. Off by default when\n   * `createResendSend` replaces the provider, and `false` turns it off.\n   */\n  suppressionCheck?: BrandlabContactSuppressionCheck | false\n  /**\n   * Opt-in only (default `false`): when every business inbox is suppressed, refuse and ask the visitor to call. By\n   * default the suppression check only records and alerts, and the enquiry is sent to the client's own inbox.\n   */\n  refuseWhenAllSuppressed?: boolean\n  /** The same-day alert for a delivery failure the route finds before sending (3.14.0). */\n  onDeliveryFailure?: BrandlabContactDeliveryAlert\n}\n\n/**\n * A Resend send function that loads the optional `resend` peer only when an\n * enquiry is actually delivered, so validation, bot and local requests never\n * load the provider SDK.\n */\nexport function createLazyResendContactSend(apiKey: string): ResendContactSend {\n  let send: Promise<ResendContactSend> | undefined\n  return async (payload, options) => {\n    send ??= import('resend').then(({ Resend }) =>\n      createResendSdkContactSend(new Resend(apiKey)),\n    )\n    return (await send)(payload, options)\n  }\n}\n\n/**\n * The whole of `src/app/api/contact/route.ts`:\n * `export const POST = createBrandlabContactRouteHandler({ contract, runtime })`.\n * The contract and runtime are validated when the route module loads; each\n * request then resolves the deployment from its environment and delegates to\n * createBrandlabContactRuntime exactly as a per-request runtime would.\n */\nexport function createBrandlabContactRouteHandler(\n  options: BrandlabContactRouteHandlerOptions,\n): (request: Request) => Promise<Response> {\n  if (!options || typeof options !== 'object') {\n    throw new TypeError('createBrandlabContactRouteHandler requires the contract and runtime.')\n  }\n  if (options.createResendSend !== undefined && typeof options.createResendSend !== 'function') {\n    throw new TypeError('createResendSend must be a function.')\n  }\n  const createResendSend = options.createResendSend ?? createLazyResendContactSend\n  // One suppression cache for the module. A synthetic test that replaces the provider never asks the real one.\n  const suppressionCheck =\n    options.suppressionCheck === false\n      ? undefined\n      : options.suppressionCheck ?? (options.createResendSend ? undefined : createResendSuppressionCheck())\n  // One limiter for the module, shared by every per-request runtime, so its windows outlive each request.\n  const rateLimit = options.rateLimit === false ? false : createBrandlabContactRateLimiter(options.rateLimit)\n  const runtimeFor = (environment: BrandlabEnvironment) =>\n    createBrandlabContactRuntime({\n      contract: options.contract,\n      runtime: options.runtime,\n      environment,\n      deploymentMode: detectBrandlabContactDeploymentMode(environment),\n      createResendSend,\n      ...(options.botGuard ? { botGuard: options.botGuard } : {}),\n      ...(options.now ? { now: options.now } : {}),\n      rateLimit,\n      ...(suppressionCheck ? { suppressionCheck } : {}),\n      ...(options.onDeliveryFailure ? { onDeliveryFailure: options.onDeliveryFailure } : {}),\n      ...(options.refuseWhenAllSuppressed === true ? { refuseWhenAllSuppressed: true } : {}),\n    })\n\n  // Fail at module load, not on a customer's first enquiry.\n  runtimeFor({})\n\n  return (request: Request) =>\n    runtimeFor(options.environment ?? process.env).contactRouteHandler(request)\n}\n"]}

package/dist/contact/server-entry.d.ts

@@ -1,4 +1,6 @@
 import 'server-only';
 export { BRANDLAB_CONTACT_API_KEY_ENV, BRANDLAB_CONTACT_MAX_REQUEST_BYTES, BRANDLAB_CONTACT_RATE_LIMITS, BRANDLAB_CONTACT_RUNTIME, createBrandlabContactRateLimiter, createBrandlabContactRuntime, createResendSdkContactSend, detectBrandlabContactDeploymentMode, type BrandlabContactRateLimitOptions, type BrandlabContactRateLimitRule, type BrandlabContactRateLimiter, type BrandlabContactRuntime, type BrandlabContactRuntimeDefinitionOptions, type BrandlabContactRuntimeOptions, type ResendContactSend, type ResendSdkContactClient, } from './server.js';
 export { createBrandlabContactRouteHandler, createLazyResendContactSend, type BrandlabContactRouteHandlerOptions, } from './route-handler.js';
+export { BRANDLAB_CONTACT_DELIVERY_ALERT_FAILED_EVENT, BRANDLAB_CONTACT_DELIVERY_FAILED_EVENT, BRANDLAB_CONTACT_DELIVERY_STATUS_EVENT, BRANDLAB_CONTACT_LOOKUP_API_KEY_ENV, BRANDLAB_CONTACT_SUPPRESSION_CACHE_MS, BRANDLAB_CONTACT_SUPPRESSION_UNAVAILABLE_EVENT, createResendSuppressionCheck, type BrandlabContactDeliveryAlert, type BrandlabContactDeliveryFailure, type BrandlabContactDeliveryFailureCode, type BrandlabContactSuppressionCheck, type BrandlabContactSuppressionStatus, type ResendSuppressionCheckOptions, } from './delivery.js';
+export { BRANDLAB_RESEND_WEBHOOK_RATE_LIMIT, BRANDLAB_RESEND_WEBHOOK_SECRET_ENV, createBrandlabResendWebhookRoute, verifyResendWebhookSignature, type BrandlabResendWebhookRoute, type BrandlabResendWebhookRouteOptions, } from './resend-webhook.js';
 //# sourceMappingURL=server-entry.d.ts.map

package/dist/contact/server-entry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-entry.d.ts","sourceRoot":"","sources":["../../src/contact/server-entry.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAA;AAEpB,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,EAClC,4BAA4B,EAC5B,wBAAwB,EACxB,gCAAgC,EAChC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,EACnC,KAAK,+BAA+B,EACpC,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,uCAAuC,EAC5C,KAAK,6BAA6B,EAClC,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iCAAiC,EACjC,2BAA2B,EAC3B,KAAK,kCAAkC,GACxC,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"server-entry.d.ts","sourceRoot":"","sources":["../../src/contact/server-entry.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAA;AAEpB,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,EAClC,4BAA4B,EAC5B,wBAAwB,EACxB,gCAAgC,EAChC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,EACnC,KAAK,+BAA+B,EACpC,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,uCAAuC,EAC5C,KAAK,6BAA6B,EAClC,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iCAAiC,EACjC,2BAA2B,EAC3B,KAAK,kCAAkC,GACxC,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,4CAA4C,EAC5C,sCAAsC,EACtC,sCAAsC,EACtC,mCAAmC,EACnC,qCAAqC,EACrC,8CAA8C,EAC9C,4BAA4B,EAC5B,KAAK,4BAA4B,EACjC,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,+BAA+B,EACpC,KAAK,gCAAgC,EACrC,KAAK,6BAA6B,GACnC,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,kCAAkC,EAClC,kCAAkC,EAClC,gCAAgC,EAChC,4BAA4B,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,GACvC,MAAM,qBAAqB,CAAA"}

package/dist/contact/server-entry.js

@@ -1,4 +1,6 @@
 import 'server-only';
 export { BRANDLAB_CONTACT_API_KEY_ENV, BRANDLAB_CONTACT_MAX_REQUEST_BYTES, BRANDLAB_CONTACT_RATE_LIMITS, BRANDLAB_CONTACT_RUNTIME, createBrandlabContactRateLimiter, createBrandlabContactRuntime, createResendSdkContactSend, detectBrandlabContactDeploymentMode, } from './server.js';
 export { createBrandlabContactRouteHandler, createLazyResendContactSend, } from './route-handler.js';
+export { BRANDLAB_CONTACT_DELIVERY_ALERT_FAILED_EVENT, BRANDLAB_CONTACT_DELIVERY_FAILED_EVENT, BRANDLAB_CONTACT_DELIVERY_STATUS_EVENT, BRANDLAB_CONTACT_LOOKUP_API_KEY_ENV, BRANDLAB_CONTACT_SUPPRESSION_CACHE_MS, BRANDLAB_CONTACT_SUPPRESSION_UNAVAILABLE_EVENT, createResendSuppressionCheck, } from './delivery.js';
+export { BRANDLAB_RESEND_WEBHOOK_RATE_LIMIT, BRANDLAB_RESEND_WEBHOOK_SECRET_ENV, createBrandlabResendWebhookRoute, verifyResendWebhookSignature, } from './resend-webhook.js';
 //# sourceMappingURL=server-entry.js.map

package/dist/contact/server-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-entry.js","sourceRoot":"","sources":["../../src/contact/server-entry.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAA;AAEpB,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,EAClC,4BAA4B,EAC5B,wBAAwB,EACxB,gCAAgC,EAChC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,GASpC,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iCAAiC,EACjC,2BAA2B,GAE5B,MAAM,oBAAoB,CAAA","sourcesContent":["import 'server-only'\n\nexport {\n  BRANDLAB_CONTACT_API_KEY_ENV,\n  BRANDLAB_CONTACT_MAX_REQUEST_BYTES,\n  BRANDLAB_CONTACT_RATE_LIMITS,\n  BRANDLAB_CONTACT_RUNTIME,\n  createBrandlabContactRateLimiter,\n  createBrandlabContactRuntime,\n  createResendSdkContactSend,\n  detectBrandlabContactDeploymentMode,\n  type BrandlabContactRateLimitOptions,\n  type BrandlabContactRateLimitRule,\n  type BrandlabContactRateLimiter,\n  type BrandlabContactRuntime,\n  type BrandlabContactRuntimeDefinitionOptions,\n  type BrandlabContactRuntimeOptions,\n  type ResendContactSend,\n  type ResendSdkContactClient,\n} from './server.js'\nexport {\n  createBrandlabContactRouteHandler,\n  createLazyResendContactSend,\n  type BrandlabContactRouteHandlerOptions,\n} from './route-handler.js'\n"]}
+{"version":3,"file":"server-entry.js","sourceRoot":"","sources":["../../src/contact/server-entry.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAA;AAEpB,OAAO,EACL,4BAA4B,EAC5B,kCAAkC,EAClC,4BAA4B,EAC5B,wBAAwB,EACxB,gCAAgC,EAChC,4BAA4B,EAC5B,0BAA0B,EAC1B,mCAAmC,GASpC,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,iCAAiC,EACjC,2BAA2B,GAE5B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,4CAA4C,EAC5C,sCAAsC,EACtC,sCAAsC,EACtC,mCAAmC,EACnC,qCAAqC,EACrC,8CAA8C,EAC9C,4BAA4B,GAO7B,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,kCAAkC,EAClC,kCAAkC,EAClC,gCAAgC,EAChC,4BAA4B,GAG7B,MAAM,qBAAqB,CAAA","sourcesContent":["import 'server-only'\n\nexport {\n  BRANDLAB_CONTACT_API_KEY_ENV,\n  BRANDLAB_CONTACT_MAX_REQUEST_BYTES,\n  BRANDLAB_CONTACT_RATE_LIMITS,\n  BRANDLAB_CONTACT_RUNTIME,\n  createBrandlabContactRateLimiter,\n  createBrandlabContactRuntime,\n  createResendSdkContactSend,\n  detectBrandlabContactDeploymentMode,\n  type BrandlabContactRateLimitOptions,\n  type BrandlabContactRateLimitRule,\n  type BrandlabContactRateLimiter,\n  type BrandlabContactRuntime,\n  type BrandlabContactRuntimeDefinitionOptions,\n  type BrandlabContactRuntimeOptions,\n  type ResendContactSend,\n  type ResendSdkContactClient,\n} from './server.js'\nexport {\n  createBrandlabContactRouteHandler,\n  createLazyResendContactSend,\n  type BrandlabContactRouteHandlerOptions,\n} from './route-handler.js'\nexport {\n  BRANDLAB_CONTACT_DELIVERY_ALERT_FAILED_EVENT,\n  BRANDLAB_CONTACT_DELIVERY_FAILED_EVENT,\n  BRANDLAB_CONTACT_DELIVERY_STATUS_EVENT,\n  BRANDLAB_CONTACT_LOOKUP_API_KEY_ENV,\n  BRANDLAB_CONTACT_SUPPRESSION_CACHE_MS,\n  BRANDLAB_CONTACT_SUPPRESSION_UNAVAILABLE_EVENT,\n  createResendSuppressionCheck,\n  type BrandlabContactDeliveryAlert,\n  type BrandlabContactDeliveryFailure,\n  type BrandlabContactDeliveryFailureCode,\n  type BrandlabContactSuppressionCheck,\n  type BrandlabContactSuppressionStatus,\n  type ResendSuppressionCheckOptions,\n} from './delivery.js'\nexport {\n  BRANDLAB_RESEND_WEBHOOK_RATE_LIMIT,\n  BRANDLAB_RESEND_WEBHOOK_SECRET_ENV,\n  createBrandlabResendWebhookRoute,\n  verifyResendWebhookSignature,\n  type BrandlabResendWebhookRoute,\n  type BrandlabResendWebhookRouteOptions,\n} from './resend-webhook.js'\n"]}