@easybits.cloud/mailmask 0.4.12 → 0.6.1

package/dist/index.js

@@ -1,9 +1,13 @@
 // src/client.ts
 var MailMaskError = class extends Error {
-  constructor(status, message) {
+  constructor(status, message, opts = {}) {
     super(message);
     this.status = status;
     this.name = "MailMaskError";
+    if (opts.cause !== void 0) this.cause = opts.cause;
+    this.code = opts.code;
+    this.requestId = opts.requestId;
+    this.retryable = opts.retryable ?? (status === 0 || status === 429 || status >= 500);
   }
 };
 async function request(baseUrl, apiKey, path, opts, doFetch = fetch) {
@@ -585,13 +589,812 @@ function constantTimeEqual(a, b) {
 async function verifyWebhookSignature(secret, headers, rawBody, toleranceMs = 5 * 6e4) {
   const ts = Number(headers.timestamp);
   if (!Number.isFinite(ts) || Math.abs(Date.now() - ts) > toleranceMs) return false;
-  const enc = new TextEncoder();
-  const key = await crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-  const mac = await crypto.subtle.sign("HMAC", key, enc.encode(`${headers.timestamp}.${rawBody}`));
+  const enc2 = new TextEncoder();
+  const key = await crypto.subtle.importKey("raw", enc2.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const mac = await crypto.subtle.sign("HMAC", key, enc2.encode(`${headers.timestamp}.${rawBody}`));
   return constantTimeEqual(`sha256=${hex(mac)}`, headers.signature);
 }
+
+// src/partner-contract.ts
+var PARTNER_API_PREFIX = "/api/partner/v1";
+var PARTNER_HEADERS = {
+  /** Id público de la credencial: `mmk_…`. */
+  key: "X-MailMask-Key",
+  /** Segundos Unix (no milisegundos) del momento de firmar. */
+  ts: "X-MailMask-Ts",
+  /** HMAC-SHA256 en hex minúsculas (64 caracteres), sin prefijo. */
+  sig: "X-MailMask-Sig",
+  /** Opcional en `send`/`batch`: mismo efecto que `idempotencyKey` en el cuerpo. */
+  idempotencyKey: "Idempotency-Key",
+  /**
+   * Opcional en `send`/`batch`: `1` = modo de prueba. Valida todo igual (firma, tenant, dominio,
+   * cuerpo, variables, supresión, cuota) y responde como de verdad con `test: true`, pero no envía
+   * a SES, no consume cuota, no cuenta como tenant activo y no emite eventos al webhook. En las
+   * demás rutas se ignora.
+   */
+  test: "X-MailMask-Test"
+};
+var PARTNER_SIGNATURE_TOLERANCE_S = 300;
+function partnerSignatureBase(ts, keyId, method, pathAndQuery, rawBody) {
+  return `${ts}.${keyId}.${method.toUpperCase()}.${pathAndQuery}.${rawBody}`;
+}
+var PARTNER_ERROR_STATUS = {
+  /** Firma ausente, mala, vencida, de una credencial revocada o inexistente: SIEMPRE el mismo 401. */
+  unauthorized: 401,
+  /** Firma válida, pero el partner está desactivado o el tenant suspendido por MailMask. */
+  forbidden: 403,
+  /** `resume` de una pausa que puso MailMask o SES por reputación: sólo MailMask la levanta. */
+  reputation_hold: 403,
+  /** El tenant, dominio, lote o recurso no existe PARA ESTE partner (los de otros también dan 404). */
+  not_found: 404,
+  /** El dominio ya es de otra cuenta o de otro tenant; máximo de credenciales; estado incompatible. */
+  conflict: 409,
+  /** Validación: campos faltantes o inválidos, remitente fuera de los dominios del tenant,
+   * dominio sin verificar. */
+  invalid_request: 422,
+  /** El destinatario está suprimido para este stream (con `reason`, `stream` y `recipient`). No es
+   * un error del cuerpo: no reintentes ni cambies el código, marca a la persona en tu sistema. */
+  recipient_suppressed: 422,
+  /** El tenant está en pausa (por MailMask o por el partner). No se manda nada hasta `resume`. */
+  tenant_paused: 423,
+  /** Cuota mensual del tenant agotada. */
+  quota_exceeded: 429,
+  /** Demasiadas peticiones; reintenta tras `Retry-After`. */
+  rate_limited: 429,
+  /** Falla nuestra o de SES; reintentable con la misma `idempotencyKey`. */
+  internal: 500
+};
+var EXTERNAL_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+function isValidExternalId(id) {
+  return EXTERNAL_ID_RE.test(id);
+}
+var MAX_BATCH_RECIPIENTS = 1e4;
+var MAX_TAGS = 10;
+var TAG_RE = /^[A-Za-z0-9_-]{1,64}$/;
+var DOMAIN_CLAIM_TTL_DAYS = 7;
+var FALLBACK_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+var RESERVED_FALLBACK_LABELS = [
+  "www",
+  "mail",
+  "smtp",
+  "imap",
+  "pop",
+  "mx",
+  "bounce",
+  "admin",
+  "postmaster",
+  "abuse",
+  "noreply",
+  "no-reply"
+];
+function isValidFallbackLabel(label) {
+  return FALLBACK_LABEL_RE.test(label) && !RESERVED_FALLBACK_LABELS.includes(label);
+}
+var MESSAGE_STREAMS = ["transactional", "broadcast"];
+var TEMPLATE_VAR_NAME_RE = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+var MAX_TEMPLATE_VARS = 50;
+var MAX_TEMPLATE_VAR_NAME = 64;
+var MAX_TEMPLATE_VAR_VALUE = 2e3;
+var UNSUBSCRIBE_URL_VAR = "unsubscribe_url";
+var TEMPLATE_PLACEHOLDER_RE = /\{\{\s*([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g;
+function escapeHtml(v) {
+  return v.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+function renderTemplate(template, vars, opts = {}) {
+  return template.replace(TEMPLATE_PLACEHOLDER_RE, (_, name) => {
+    const v = Object.prototype.hasOwnProperty.call(vars, name) ? String(vars[name]) : "";
+    return opts.html ? escapeHtml(v) : v;
+  });
+}
+function templateUsesVar(template, name) {
+  TEMPLATE_PLACEHOLDER_RE.lastIndex = 0;
+  for (const m of template.matchAll(TEMPLATE_PLACEHOLDER_RE)) if (m[1] === name) return true;
+  return false;
+}
+var UNSUBSCRIBE_FOOTER_HTML = `<p style="margin:32px 0 0 0;font-size:12px;line-height:1.5;color:#8a8a8a;text-align:center">\xBFYa no quieres recibir estos correos? <a href="{{${UNSUBSCRIBE_URL_VAR}}}">Cancelar suscripci\xF3n</a></p>`;
+var UNSUBSCRIBE_FOOTER_TEXT = `
+
+--
+\xBFYa no quieres recibir estos correos? Cancela tu suscripci\xF3n: {{${UNSUBSCRIBE_URL_VAR}}}`;
+function appendToHtmlBody(html, fragment) {
+  const i = html.toLowerCase().lastIndexOf("</body>");
+  return i === -1 ? `${html}${fragment}` : `${html.slice(0, i)}${fragment}${html.slice(i)}`;
+}
+function personalizePartnerMessage(input) {
+  const vars = { ...input.vars ?? {} };
+  delete vars[UNSUBSCRIBE_URL_VAR];
+  if (input.unsubscribeUrl) vars[UNSUBSCRIBE_URL_VAR] = input.unsubscribeUrl;
+  let { html, text } = input;
+  if (input.unsubscribeUrl) {
+    if (html && !templateUsesVar(html, UNSUBSCRIBE_URL_VAR)) html = appendToHtmlBody(html, UNSUBSCRIBE_FOOTER_HTML);
+    if (text && !templateUsesVar(text, UNSUBSCRIBE_URL_VAR)) text = `${text.replace(/\s+$/, "")}${UNSUBSCRIBE_FOOTER_TEXT}`;
+  }
+  return {
+    // Un salto de línea en el asunto sería un header inyectado: se aplana.
+    subject: renderTemplate(input.subject, vars).replace(/[\r\n]+/g, " "),
+    ...html !== void 0 ? { html: renderTemplate(html, vars, { html: true }) } : {},
+    ...text !== void 0 ? { text: renderTemplate(text, vars) } : {}
+  };
+}
+var PARTNER_WEBHOOK_EVENTS = [
+  "email.sent",
+  "email.delivered",
+  "email.bounced",
+  "email.complained",
+  "email.received",
+  "contact.unsubscribed",
+  "tenant.paused",
+  "tenant.resumed",
+  "domain.verified"
+];
+var WEBHOOK_HEADERS = {
+  event: "X-MailMask-Event",
+  delivery: "X-MailMask-Delivery",
+  /** MILISEGUNDOS Unix, en texto (distinto de `X-MailMask-Ts` de las peticiones). */
+  timestamp: "X-MailMask-Timestamp",
+  /**
+   * `sha256=` + hex de HMAC-SHA256(secreto `whsec_…`, `webhookSignatureBase(...)`). Durante la gracia
+   * de una rotación vienen dos separadas por coma (`sha256=<nueva>,sha256=<vieja>`): el receptor
+   * acepta la entrega si CUALQUIERA coincide con su secreto.
+   */
+  signature: "X-MailMask-Signature"
+};
+var WEBHOOK_TOLERANCE_MS = 5 * 6e4;
+function webhookSignatureBase(timestamp, rawBody) {
+  return `${timestamp}.${rawBody}`;
+}
+var STRICT_FIRST_DAYS = 30;
+var PARTNER_ROUTES = {
+  putTenant: { method: "PUT", path: "/tenants/:externalId" },
+  listTenants: { method: "GET", path: "/tenants" },
+  getTenant: { method: "GET", path: "/tenants/:externalId" },
+  deleteTenant: { method: "DELETE", path: "/tenants/:externalId" },
+  pauseTenant: { method: "POST", path: "/tenants/:externalId/pause" },
+  resumeTenant: { method: "POST", path: "/tenants/:externalId/resume" },
+  addDomain: { method: "POST", path: "/tenants/:externalId/domains" },
+  getDomain: { method: "GET", path: "/tenants/:externalId/domains/:domain" },
+  send: { method: "POST", path: "/tenants/:externalId/send" },
+  batch: { method: "POST", path: "/tenants/:externalId/batch" },
+  getBatch: { method: "GET", path: "/tenants/:externalId/batch/:batchId" },
+  usage: { method: "GET", path: "/usage" },
+  getWebhook: { method: "GET", path: "/webhook" },
+  setWebhook: { method: "PUT", path: "/webhook" },
+  testWebhook: { method: "POST", path: "/webhook/test" },
+  rotateWebhookSecret: { method: "POST", path: "/webhook/rotate-secret" }
+};
+var PARTNER_ADMIN_ROUTES = {
+  listPartners: { method: "GET", path: "/api/partners" },
+  createPartner: { method: "POST", path: "/api/partners" },
+  setReputationPolicy: { method: "PUT", path: "/api/partners/:partnerId/reputation-policy" },
+  /** Sólo MailMask (admin): levanta cualquier pausa, incluida la de reputación. */
+  resumeTenant: { method: "POST", path: "/api/partners/:partnerId/tenants/:externalId/resume" },
+  /** Sólo MailMask (admin): crea o adopta la zona de respaldo y devuelve los NS a delegar. */
+  setFallbackZone: { method: "PUT", path: "/api/partners/:partnerId/fallback-zone" },
+  /** La zona de respaldo y si la delegación ya se ve en el DNS público. */
+  getFallbackZone: { method: "GET", path: "/api/partners/:partnerId/fallback-zone" },
+  listCredentials: { method: "GET", path: "/api/partners/:partnerId/credentials" },
+  createCredential: { method: "POST", path: "/api/partners/:partnerId/credentials" },
+  rotateCredential: { method: "POST", path: "/api/partners/:partnerId/credentials/:keyId/rotate" },
+  revokeCredential: { method: "DELETE", path: "/api/partners/:partnerId/credentials/:keyId" }
+};
+
+// src/partner.ts
+var PartnerApiError = class extends MailMaskError {
+  constructor(status, message, body = {}, meta = {}) {
+    super(status, message, {
+      code: body.code,
+      requestId: meta.requestId,
+      cause: meta.cause,
+      // `quota_exceeded` es un 429 que no se arregla reintentando: hasta el mes siguiente.
+      retryable: status === 0 || status >= 500 || status === 429 && body.code !== "quota_exceeded"
+    });
+    this.kind = "unknown";
+    this.name = "PartnerApiError";
+    this.body = body;
+    this.retryAfterMs = meta.retryAfterMs ?? null;
+    if (status >= 500) this.kind = "server";
+  }
+};
+var AuthError = class extends PartnerApiError {
+  constructor() {
+    super(...arguments);
+    this.name = "AuthError";
+    this.kind = "auth";
+    /**
+     * Diferencia entre el reloj de MailMask (header `Date` de la respuesta) y el tuyo, en ms
+     * (positivo = tu reloj va atrasado). null si la respuesta no trajo `Date`. Con más de
+     * `PARTNER_SIGNATURE_TOLERANCE_S` segundos la firma nunca va a pasar.
+     */
+    this.clockSkewMs = null;
+  }
+};
+var ForbiddenError = class extends PartnerApiError {
+  constructor() {
+    super(...arguments);
+    this.name = "ForbiddenError";
+    this.kind = "forbidden";
+  }
+};
+var ReputationHoldError = class extends ForbiddenError {
+  constructor() {
+    super(...arguments);
+    this.name = "ReputationHoldError";
+    this.kind = "reputation_hold";
+  }
+};
+var NotFoundError = class extends PartnerApiError {
+  constructor() {
+    super(...arguments);
+    this.name = "NotFoundError";
+    this.kind = "not_found";
+  }
+};
+var ConflictError = class extends PartnerApiError {
+  constructor() {
+    super(...arguments);
+    this.name = "ConflictError";
+    this.kind = "conflict";
+  }
+};
+var ValidationError = class extends PartnerApiError {
+  constructor() {
+    super(...arguments);
+    this.name = "ValidationError";
+    this.kind = "validation";
+  }
+  get field() {
+    return this.body.field;
+  }
+};
+var RecipientSuppressedError = class extends PartnerApiError {
+  constructor() {
+    super(...arguments);
+    this.name = "RecipientSuppressedError";
+    this.kind = "suppressed";
+  }
+  get reason() {
+    return this.body.reason;
+  }
+  get stream() {
+    return this.body.stream;
+  }
+  get recipient() {
+    return this.body.recipient;
+  }
+};
+var PausedError = class extends PartnerApiError {
+  constructor() {
+    super(...arguments);
+    this.name = "PausedError";
+    this.kind = "paused";
+  }
+};
+var QuotaError = class extends PartnerApiError {
+  constructor() {
+    super(...arguments);
+    this.name = "QuotaError";
+    this.kind = "quota";
+  }
+  get limit() {
+    return this.body.limit;
+  }
+  get resetsAt() {
+    return this.body.resetsAt;
+  }
+};
+var RateLimitError = class extends QuotaError {
+  constructor() {
+    super(...arguments);
+    this.name = "RateLimitError";
+    this.kind = "rate_limit";
+  }
+};
+var NetworkError = class extends PartnerApiError {
+  constructor(message, cause) {
+    super(0, message, {}, { cause });
+    this.name = "NetworkError";
+    this.kind = "network";
+  }
+};
+var TimeoutError = class extends NetworkError {
+  constructor() {
+    super(...arguments);
+    this.name = "TimeoutError";
+    this.kind = "timeout";
+  }
+};
+function errorFor(status, body, fallback, meta = {}) {
+  const msg = body.error || fallback;
+  if (body.code === "reputation_hold") return new ReputationHoldError(status, msg, body, meta);
+  if (body.code === "recipient_suppressed") return new RecipientSuppressedError(status, msg, body, meta);
+  if (status === 429 && body.code !== "quota_exceeded") return new RateLimitError(status, msg, body, meta);
+  switch (status) {
+    case 401:
+      return new AuthError(status, msg, body, meta);
+    case 403:
+      return new ForbiddenError(status, msg, body, meta);
+    case 404:
+      return new NotFoundError(status, msg, body, meta);
+    case 409:
+      return new ConflictError(status, msg, body, meta);
+    case 422:
+      return new ValidationError(status, msg, body, meta);
+    case 423:
+      return new PausedError(status, msg, body, meta);
+    case 429:
+      return new QuotaError(status, msg, body, meta);
+    default:
+      return new PartnerApiError(status, msg, body, meta);
+  }
+}
+var enc = new TextEncoder();
+function hex2(buf) {
+  return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function hmacHex(secret, text) {
+  const key = await crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  return hex2(await crypto.subtle.sign("HMAC", key, enc.encode(text)));
+}
+function constantTimeEqual2(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+async function signPartnerRequest(opts) {
+  const ts = String(opts.ts ?? Math.floor(Date.now() / 1e3));
+  const sig = await hmacHex(opts.secret, partnerSignatureBase(ts, opts.keyId, opts.method, opts.pathAndQuery, opts.rawBody ?? ""));
+  return { [PARTNER_HEADERS.key]: opts.keyId, [PARTNER_HEADERS.ts]: ts, [PARTNER_HEADERS.sig]: sig };
+}
+function newIdempotencyKey() {
+  return typeof crypto.randomUUID === "function" ? crypto.randomUUID() : hex2(crypto.getRandomValues(new Uint8Array(16)).buffer);
+}
+function parseRetryAfter(value) {
+  if (!value) return null;
+  const secs = Number(value);
+  if (Number.isFinite(secs)) return Math.max(0, secs * 1e3);
+  const at = Date.parse(value);
+  return Number.isFinite(at) ? Math.max(0, at - Date.now()) : null;
+}
+var IDEMPOTENT_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "PUT", "DELETE"]);
+var CLOCK_SKEW_HINT_MS = 6e4;
+function resolveTransport(config) {
+  return {
+    baseUrl: (config.baseUrl ?? "https://www.mailmask.studio").replace(/\/+$/, ""),
+    maxRetries: Math.min(10, Math.max(0, Math.floor(config.maxRetries ?? 3))),
+    retryBaseMs: Math.max(0, config.retryBaseMs ?? 500),
+    retryMaxDelayMs: Math.max(0, config.retryMaxDelayMs ?? 3e4),
+    timeoutMs: Math.max(1, config.timeoutMs ?? 3e4),
+    onRetry: config.onRetry,
+    doFetch: config.fetch ?? ((...a) => fetch(...a))
+  };
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function backoffMs(t, attempt) {
+  const exp = Math.min(t.retryMaxDelayMs, t.retryBaseMs * 2 ** attempt);
+  return Math.round(exp / 2 + Math.random() * (exp / 2));
+}
+function requestIdOf(res) {
+  return res.headers.get("x-request-id") ?? res.headers.get("fly-request-id") ?? void 0;
+}
+function clockSkewOf(res) {
+  const date = res.headers.get("date");
+  if (!date) return null;
+  const at = Date.parse(date);
+  return Number.isFinite(at) ? at - Date.now() : null;
+}
+function safeJson(text) {
+  try {
+    return text ? JSON.parse(text) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function attemptOnce(t, url, init) {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), t.timeoutMs);
+  try {
+    const res = await t.doFetch(url, { ...init, signal: ctrl.signal });
+    return { res, text: await res.text() };
+  } catch (err) {
+    if (ctrl.signal.aborted) throw new TimeoutError(`MailMask no respondi\xF3 en ${t.timeoutMs} ms`, err);
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new NetworkError(`No se pudo conectar con MailMask: ${reason}`, err);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function transportRequest(t, opts) {
+  for (let attempt = 0; ; attempt++) {
+    const headers = await opts.headersFor();
+    if (opts.rawBody) headers["Content-Type"] = "application/json";
+    let error;
+    try {
+      const { res, text } = await attemptOnce(t, `${t.baseUrl}${opts.path}`, { method: opts.method, headers, body: opts.rawBody || void 0 });
+      if (res.ok) return { data: safeJson(text), status: res.status, headers: res.headers };
+      const raw = safeJson(text);
+      const body = raw && typeof raw === "object" ? raw : {};
+      error = errorFor(res.status, body, res.statusText || `HTTP ${res.status}`, {
+        requestId: requestIdOf(res),
+        retryAfterMs: parseRetryAfter(res.headers.get("Retry-After"))
+      });
+      if (error instanceof AuthError) {
+        error.clockSkewMs = clockSkewOf(res);
+        if (error.clockSkewMs !== null && Math.abs(error.clockSkewMs) > CLOCK_SKEW_HINT_MS) {
+          const secs = Math.round(Math.abs(error.clockSkewMs) / 1e3);
+          error.message += ` (tu reloj va ${secs} s ${error.clockSkewMs > 0 ? "atrasado" : "adelantado"} respecto al de MailMask y la firma vence a los ${PARTNER_SIGNATURE_TOLERANCE_S} s: sincroniza la hora con NTP)`;
+        }
+      }
+    } catch (err) {
+      if (!(err instanceof PartnerApiError)) throw err;
+      error = err;
+    }
+    if (!error.retryable || !opts.canRetry || attempt >= t.maxRetries) throw error;
+    if (error.retryAfterMs !== null && error.retryAfterMs > t.retryMaxDelayMs) throw error;
+    const delayMs = error.retryAfterMs ?? backoffMs(t, attempt);
+    t.onRetry?.({ attempt: attempt + 1, delayMs, method: opts.method, path: opts.path, error });
+    await sleep(delayMs);
+  }
+}
+var SECRETS = /* @__PURE__ */ new WeakMap();
+var MailMaskPartner = class {
+  constructor(config) {
+    if (!config?.keyId || !config?.secret) throw new Error("MailMaskPartner: faltan keyId y secret");
+    this.keyId = config.keyId;
+    SECRETS.set(this, config.secret);
+    this.transport = resolveTransport(config);
+    this.test = config.test === true;
+    this.tenants = new PartnerTenantsResource(this);
+    this.domains = new PartnerDomainsResource(this);
+    this.webhook = new PartnerWebhookResource(this);
+  }
+  /** Base URL efectiva (sin barra final). */
+  get baseUrl() {
+    return this.transport.baseUrl;
+  }
+  /**
+   * Petición firmada. Cada intento se firma de nuevo (ts fresco) con el MISMO cuerpo, así que la
+   * `idempotencyKey` del cuerpo viaja idéntica en los reintentos.
+   * @internal
+   */
+  async request(method, path, body, extraHeaders = {}, opts = {}) {
+    const pathAndQuery = `${PARTNER_API_PREFIX}${path}`;
+    const rawBody = body === void 0 ? "" : JSON.stringify(body);
+    const secret = SECRETS.get(this);
+    const test = opts.test ?? this.test;
+    const res = await transportRequest(this.transport, {
+      method,
+      path: pathAndQuery,
+      rawBody,
+      canRetry: opts.idempotent === true || IDEMPOTENT_METHODS.has(method) || PARTNER_HEADERS.idempotencyKey in extraHeaders,
+      headersFor: async () => ({
+        ...test ? { [PARTNER_HEADERS.test]: "1" } : {},
+        ...extraHeaders,
+        ...await signPartnerRequest({ keyId: this.keyId, secret, method, pathAndQuery, rawBody })
+      })
+    });
+    return { data: res.data, meta: { status: res.status, idempotentReplayed: res.headers.get("Idempotent-Replayed") === "true" } };
+  }
+  /**
+   * Manda un correo a nombre de un tenant. Pone `idempotencyKey` si no viene (la misma en cada
+   * reintento). `stream` default `transactional` (sin baja de un clic); usa `broadcast` para
+   * boletines. `vars` sustituye los `{{nombre}}`. Un destinatario suprimido lanza `RecipientSuppressedError`.
+   */
+  async send(externalId, input, opts = {}) {
+    const idempotencyKey = input.idempotencyKey ?? newIdempotencyKey();
+    const { data, meta } = await this.request(
+      "POST",
+      routePath(PARTNER_ROUTES.send.path, { externalId }),
+      { ...input, idempotencyKey },
+      { [PARTNER_HEADERS.idempotencyKey]: idempotencyKey },
+      { test: opts.test }
+    );
+    return { ...data, idempotencyKey, replayed: meta.idempotentReplayed };
+  }
+  /**
+   * Encola un lote (hasta 10,000 destinatarios: correos pelados o `{ to, vars }`). Pone
+   * `idempotencyKey` si no viene. `stream` default `broadcast` (cada correo lleva baja de un clic);
+   * los suprimidos se saltan.
+   */
+  async batch(externalId, input, opts = {}) {
+    const idempotencyKey = input.idempotencyKey ?? newIdempotencyKey();
+    const { data, meta } = await this.request(
+      "POST",
+      routePath(PARTNER_ROUTES.batch.path, { externalId }),
+      { ...input, idempotencyKey },
+      { [PARTNER_HEADERS.idempotencyKey]: idempotencyKey },
+      { test: opts.test }
+    );
+    return { ...data, idempotencyKey, replayed: meta.idempotentReplayed };
+  }
+  /** Estado de un lote (`batchId` del resultado de `batch`): envíos y, después, entregas, rebotes, quejas y bajas. */
+  async batchStatus(externalId, batchId) {
+    return (await this.request("GET", routePath(PARTNER_ROUTES.getBatch.path, { externalId, batchId }))).data;
+  }
+  /** Uso del mes (`YYYY-MM`, default el mes en curso UTC): tenants activos y envíos. */
+  async usage(opts = {}) {
+    const q = opts.month ? `?month=${encodeURIComponent(opts.month)}` : "";
+    return (await this.request("GET", `${PARTNER_ROUTES.usage.path}${q}`)).data;
+  }
+};
+function routePath(path, params) {
+  return path.replace(/:([A-Za-z]+)/g, (_, k) => {
+    const v = params[k];
+    if (v === void 0 || v === "") throw new Error(`MailMask: falta el par\xE1metro ${k}`);
+    return encodeURIComponent(v);
+  });
+}
+var PartnerTenantsResource = class {
+  constructor(c) {
+    this.c = c;
+  }
+  /** Crea o actualiza el tenant (idempotente por `externalId`). */
+  async put(externalId, input = {}) {
+    return (await this.c.request("PUT", routePath(PARTNER_ROUTES.putTenant.path, { externalId }), input)).data;
+  }
+  async get(externalId) {
+    return (await this.c.request("GET", routePath(PARTNER_ROUTES.getTenant.path, { externalId }))).data;
+  }
+  /** Una página de tenants; sigue `nextCursor` para la siguiente. */
+  async list(query = {}) {
+    const qs = new URLSearchParams();
+    if (query.status) qs.set("status", query.status);
+    if (query.limit !== void 0) qs.set("limit", String(query.limit));
+    if (query.cursor) qs.set("cursor", query.cursor);
+    const q = qs.toString();
+    return (await this.c.request("GET", `${PARTNER_ROUTES.listTenants.path}${q ? `?${q}` : ""}`)).data;
+  }
+  /**
+   * Borra el tenant y suelta sus dominios (los que nadie más usa se borran con sus recursos en SES).
+   * Sin vuelta atrás. `ConflictError` si está en pausa por reputación.
+   */
+  async delete(externalId) {
+    return (await this.c.request("DELETE", routePath(PARTNER_ROUTES.deleteTenant.path, { externalId }))).data;
+  }
+  async pause(externalId, reason) {
+    return (await this.c.request("POST", routePath(PARTNER_ROUTES.pauseTenant.path, { externalId }), reason === void 0 ? {} : { reason }, {}, { idempotent: true })).data;
+  }
+  /**
+   * Levanta una pausa que puso el partner (`pausedBy: "partner"`). Sobre una pausa por reputación
+   * (`mailmask` o `ses`) lanza `ReputationHoldError`.
+   */
+  async resume(externalId) {
+    return (await this.c.request("POST", routePath(PARTNER_ROUTES.resumeTenant.path, { externalId }), void 0, {}, { idempotent: true })).data;
+  }
+};
+var PartnerDomainsResource = class {
+  constructor(c) {
+    this.c = c;
+  }
+  /** Da de alta el dominio en el tenant y devuelve los registros DNS a pegar. */
+  async add(externalId, domain) {
+    return (await this.c.request("POST", routePath(PARTNER_ROUTES.addDomain.path, { externalId }), { domain }, {}, { idempotent: true })).data;
+  }
+  /** Estado en vivo (SES y DNS público) de cada registro. */
+  async status(externalId, domain) {
+    return (await this.c.request("GET", routePath(PARTNER_ROUTES.getDomain.path, { externalId, domain }))).data;
+  }
+};
+var PartnerWebhookResource = class {
+  constructor(c) {
+    this.c = c;
+  }
+  async get() {
+    return (await this.c.request("GET", PARTNER_ROUTES.getWebhook.path)).data;
+  }
+  /**
+   * Configura la URL. `secret` (`whsec_…`) sólo viene la primera vez; después es null porque cambiar
+   * la URL no rota el secreto (para eso, `rotateSecret`).
+   */
+  async set(input) {
+    return (await this.c.request("PUT", PARTNER_ROUTES.setWebhook.path, input)).data;
+  }
+  /**
+   * Secreto nuevo (se ve UNA vez). Durante la gracia (default 24 h, 0–10080 min) cada entrega lleva
+   * las dos firmas: despliega el nuevo y pasa los dos a `verifyWebhook` mientras tanto. No se
+   * reintenta solo: un segundo intento rotaría otra vez y el secreto de la respuesta perdida no
+   * lo vería nadie.
+   */
+  async rotateSecret(input = {}) {
+    return (await this.c.request("POST", PARTNER_ROUTES.rotateWebhookSecret.path, input)).data;
+  }
+  /** Encola un `ping` al webhook. No se reintenta solo (un reintento encolaría otro ping). */
+  async test() {
+    return (await this.c.request("POST", PARTNER_ROUTES.testWebhook.path)).data;
+  }
+};
+function headerValue(headers, name) {
+  if (typeof headers.get === "function") return headers.get(name) ?? void 0;
+  const lower = name.toLowerCase();
+  for (const [k, v] of Object.entries(headers)) {
+    if (k.toLowerCase() === lower) return Array.isArray(v) ? v[0] : v;
+  }
+  return void 0;
+}
+async function verifyWebhook(opts) {
+  const signature = headerValue(opts.headers, WEBHOOK_HEADERS.signature);
+  const timestamp = headerValue(opts.headers, WEBHOOK_HEADERS.timestamp);
+  const secrets = (typeof opts.secret === "string" ? [opts.secret] : [...opts.secret ?? []]).filter(Boolean);
+  if (!signature || !timestamp || secrets.length === 0) return null;
+  const ts = Number(timestamp);
+  const tolerance = opts.toleranceMs ?? WEBHOOK_TOLERANCE_MS;
+  if (!Number.isFinite(ts) || Math.abs((opts.now ?? Date.now()) - ts) > tolerance) return null;
+  const provided = signature.split(",").map((x) => x.trim()).filter(Boolean);
+  let ok = false;
+  for (const secret of secrets) {
+    const expected = `sha256=${await hmacHex(secret, webhookSignatureBase(timestamp, opts.rawBody))}`;
+    for (const p of provided) ok = constantTimeEqual2(expected, p) || ok;
+  }
+  if (!ok) return null;
+  try {
+    return JSON.parse(opts.rawBody);
+  } catch {
+    return null;
+  }
+}
+function createWebhookHandler(opts) {
+  return async (request2) => {
+    const rawBody = await request2.text();
+    const event = await verifyWebhook({ rawBody, headers: request2.headers, secret: opts.secret, toleranceMs: opts.toleranceMs });
+    if (!event) return new Response(JSON.stringify({ error: "firma inv\xE1lida" }), { status: 401, headers: { "content-type": "application/json" } });
+    try {
+      await opts.onEvent(event);
+    } catch {
+      return new Response(JSON.stringify({ error: "onEvent fall\xF3" }), { status: 500, headers: { "content-type": "application/json" } });
+    }
+    return new Response(JSON.stringify({ ok: true }), { status: 200, headers: { "content-type": "application/json" } });
+  };
+}
+var PLACEHOLDER_RE = /\{\{\s*([a-zA-Z_][a-zA-Z0-9_]*)\s*\}\}/g;
+function templateVarNames(template) {
+  return [...new Set([...template.matchAll(PLACEHOLDER_RE)].map((m) => m[1]))];
+}
+function templateVarsProblem(vars) {
+  if (vars === void 0 || vars === null) return null;
+  if (typeof vars !== "object" || Array.isArray(vars)) return "vars debe ser un objeto { nombre: valor }";
+  const entries = Object.entries(vars);
+  if (entries.length > MAX_TEMPLATE_VARS) return `M\xE1ximo ${MAX_TEMPLATE_VARS} variables por destinatario`;
+  for (const [k, v] of entries) {
+    if (!TEMPLATE_VAR_NAME_RE.test(k) || k.length > MAX_TEMPLATE_VAR_NAME) return `Nombre de variable inv\xE1lido: \xAB${k.slice(0, 64)}\xBB`;
+    if (k === UNSUBSCRIBE_URL_VAR) return `${UNSUBSCRIBE_URL_VAR} es reservada: la pone MailMask en los broadcast`;
+    if (typeof v !== "string") return `El valor de ${k} debe ser texto`;
+    if (v.length > MAX_TEMPLATE_VAR_VALUE) return `El valor de ${k} excede ${MAX_TEMPLATE_VAR_VALUE} caracteres`;
+  }
+  return null;
+}
+function previewMessage(input, opts = {}) {
+  const stream = input.stream ?? "transactional";
+  const unsubscribeUrl = stream === "broadcast" ? opts.unsubscribeUrl ?? "https://www.mailmask.studio/u/vista-previa" : null;
+  const out = personalizePartnerMessage({ subject: input.subject, html: input.html, text: input.text, vars: input.vars, unsubscribeUrl });
+  const used = new Set([input.subject, input.html ?? "", input.text ?? ""].flatMap(templateVarNames));
+  const vars = input.vars ?? {};
+  const footer = unsubscribeUrl !== null && [input.html, input.text].some((t) => t !== void 0 && !templateUsesVar(t, UNSUBSCRIBE_URL_VAR));
+  return {
+    ...out,
+    stream,
+    unsubscribeFooter: footer,
+    missingVars: [...used].filter((n) => n !== UNSUBSCRIBE_URL_VAR && !Object.prototype.hasOwnProperty.call(vars, n)),
+    unusedVars: Object.keys(vars).filter((n) => !used.has(n))
+  };
+}
+function adminRoutePath(route, params = {}) {
+  return routePath(PARTNER_ADMIN_ROUTES[route].path, params);
+}
+var MailMaskPartnerAdmin = class {
+  constructor(config) {
+    if (!config?.apiKey) throw new Error("MailMaskPartnerAdmin: falta apiKey");
+    SECRETS.set(this, config.apiKey);
+    this.transport = resolveTransport(config);
+  }
+  async req(route, params = {}, body) {
+    const { method } = PARTNER_ADMIN_ROUTES[route];
+    const apiKey = SECRETS.get(this);
+    const res = await transportRequest(this.transport, {
+      method,
+      path: adminRoutePath(route, params),
+      rawBody: body === void 0 ? "" : JSON.stringify(body),
+      // Emitir o rotar dos veces deja secretos que nadie vio: sólo se reintentan lecturas y borrados.
+      canRetry: method === "GET" || method === "DELETE" || method === "PUT",
+      headersFor: async () => ({ Authorization: `Bearer ${apiKey}` })
+    });
+    return res.data;
+  }
+  /** Los partners de la cuenta. */
+  listPartners() {
+    return this.req("listPartners");
+  }
+  /** Sólo MailMask (admin). */
+  createPartner(input) {
+    return this.req("createPartner", {}, input);
+  }
+  /** Sólo MailMask (admin); null = automática (Strict el primer mes, Standard después). */
+  setReputationPolicy(partnerId, policy) {
+    return this.req("setReputationPolicy", { partnerId }, { policy });
+  }
+  /** Sólo MailMask (admin): levanta cualquier pausa, también la de reputación. */
+  resumeTenant(partnerId, externalId) {
+    return this.req("resumeTenant", { partnerId, externalId });
+  }
+  /**
+   * Sólo MailMask (admin): crea o adopta la hosted zone de la zona de respaldo (`marketing.denik.me`)
+   * y devuelve los NS que el partner tiene que delegar. Idempotente con la misma zona.
+   */
+  setFallbackZone(partnerId, zone) {
+    return this.req("setFallbackZone", { partnerId }, { zone });
+  }
+  /** La zona de respaldo y si el DNS público ya ve la delegación. */
+  getFallbackZone(partnerId) {
+    return this.req("getFallbackZone", { partnerId });
+  }
+  listCredentials(partnerId) {
+    return this.req("listCredentials", { partnerId });
+  }
+  /** El secreto `mms_…` viene UNA vez en la respuesta. */
+  createCredential(partnerId, input = {}) {
+    return this.req("createCredential", { partnerId }, input);
+  }
+  /** Secreto nuevo (una vez); el anterior sigue firmando `graceMinutes` (default 60). */
+  rotateCredential(partnerId, keyId, input = {}) {
+    return this.req("rotateCredential", { partnerId, keyId }, input);
+  }
+  /** Inmediato y sin vuelta. */
+  revokeCredential(partnerId, keyId) {
+    return this.req("revokeCredential", { partnerId, keyId });
+  }
+};
 export {
+  AuthError,
+  ConflictError,
+  DOMAIN_CLAIM_TTL_DAYS,
+  EXTERNAL_ID_RE,
+  FALLBACK_LABEL_RE,
+  ForbiddenError,
+  MAX_BATCH_RECIPIENTS,
+  MAX_TAGS,
+  MAX_TEMPLATE_VARS,
+  MAX_TEMPLATE_VAR_NAME,
+  MAX_TEMPLATE_VAR_VALUE,
+  MESSAGE_STREAMS,
   MailMask,
   MailMaskError,
-  verifyWebhookSignature
+  MailMaskPartner,
+  MailMaskPartnerAdmin,
+  NetworkError,
+  NotFoundError,
+  PARTNER_ADMIN_ROUTES,
+  PARTNER_API_PREFIX,
+  PARTNER_ERROR_STATUS,
+  PARTNER_HEADERS,
+  PARTNER_ROUTES,
+  PARTNER_SIGNATURE_TOLERANCE_S,
+  PARTNER_WEBHOOK_EVENTS,
+  PartnerApiError,
+  PausedError,
+  QuotaError,
+  RESERVED_FALLBACK_LABELS,
+  RateLimitError,
+  RecipientSuppressedError,
+  ReputationHoldError,
+  STRICT_FIRST_DAYS,
+  TAG_RE,
+  TEMPLATE_VAR_NAME_RE,
+  TimeoutError,
+  UNSUBSCRIBE_URL_VAR,
+  ValidationError,
+  WEBHOOK_HEADERS,
+  WEBHOOK_TOLERANCE_MS,
+  createWebhookHandler,
+  isValidExternalId,
+  isValidFallbackLabel,
+  partnerSignatureBase,
+  personalizePartnerMessage,
+  previewMessage,
+  renderTemplate,
+  signPartnerRequest,
+  templateUsesVar,
+  templateVarNames,
+  templateVarsProblem,
+  verifyWebhook,
+  verifyWebhookSignature,
+  webhookSignatureBase
 };