@resq-systems/email-templates 0.3.0 → 0.4.0

package/lib/contract.d.ts

@@ -1,3 +1,4 @@
+import { EmailAddress } from "./schemas.js";
 import { EmailValidationError } from "./mailer.js";
 import { resqMailer } from "./suite.js";
 //#region src/contract.d.ts
@@ -17,7 +18,7 @@ type EmailTemplateData<N extends EmailName> = Extract<EmailPayload, {
  */
 declare const decodeEmailPayload: (input: unknown) => {
   readonly name: "incident-alert";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly incidentId: string;
     readonly title: string;
@@ -31,7 +32,7 @@ declare const decodeEmailPayload: (input: unknown) => {
   readonly unsubscribeUrl?: string;
 } | {
   readonly name: "mission-approval";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly missionId: string;
     readonly title: string;
@@ -45,7 +46,7 @@ declare const decodeEmailPayload: (input: unknown) => {
   readonly unsubscribeUrl?: string;
 } | {
   readonly name: "new-device-login";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly firstName?: string | undefined;
     readonly device?: string | undefined;
@@ -58,7 +59,7 @@ declare const decodeEmailPayload: (input: unknown) => {
   readonly unsubscribeUrl?: string;
 } | {
   readonly name: "notification";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly title: string;
     readonly body: string;
@@ -70,7 +71,7 @@ declare const decodeEmailPayload: (input: unknown) => {
   readonly unsubscribeUrl?: string;
 } | {
   readonly name: "org-invitation";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly orgName: string;
     readonly inviterName?: string | undefined;
@@ -82,7 +83,7 @@ declare const decodeEmailPayload: (input: unknown) => {
   readonly unsubscribeUrl?: string;
 } | {
   readonly name: "otp";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly code: string;
     readonly firstName?: string | undefined;
@@ -92,7 +93,7 @@ declare const decodeEmailPayload: (input: unknown) => {
   readonly unsubscribeUrl?: string;
 } | {
   readonly name: "password-changed";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly firstName?: string | undefined;
     readonly changedAt?: string | undefined;
@@ -102,7 +103,7 @@ declare const decodeEmailPayload: (input: unknown) => {
   readonly unsubscribeUrl?: string;
 } | {
   readonly name: "password-reset";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly firstName?: string | undefined;
     readonly resetUrl: string;
@@ -112,7 +113,7 @@ declare const decodeEmailPayload: (input: unknown) => {
   readonly unsubscribeUrl?: string;
 } | {
   readonly name: "welcome";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly firstName: string;
     readonly verifyUrl?: string | undefined;

package/lib/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","names":[],"sources":["../src/contract.ts"],"mappings":";;;;cAqBa,sCAAY;;KAGb,eAAe,kBAAkB,WAAW;;KAG5C,YAAY;;KAGZ,kBAAkB,UAAU,aAAa,QAAQ;EAAgB,MAAM;;;;;;cAMtE,qBAAkB"}
+{"version":3,"file":"contract.d.ts","names":[],"sources":["../src/contract.ts"],"mappings":";;;;;cAqBa,sCAAY;;KAGb,eAAe,kBAAkB,WAAW;;KAG5C,YAAY;;KAGZ,kBAAkB,UAAU,aAAa,QAAQ;EAAgB,MAAM;;;;;;cAMtE,qBAAkB;;eAAlB"}

package/lib/emails/theme.d.ts

@@ -1,5 +1,5 @@
-import { TailwindConfig } from "../node_modules/@react-email/tailwind/dist/index.js";
 import { EmailCategory } from "../schemas.js";
+import { TailwindConfig } from "../node_modules/@react-email/tailwind/dist/index.js";
 import { ReactElement } from "react";
 //#region src/emails/theme.d.ts
 interface EmailThemeFonts {

package/lib/index.d.ts

@@ -1,8 +1,8 @@
-import { EmailCategory, HttpUrl, IncidentAlertData, MissionApprovalData, NewDeviceLoginData, NotificationData, OrgInvitationData, OtpData, PasswordChangedData, PasswordResetData, WelcomeData, emailCategory, incidentAlertData, missionApprovalData, newDeviceLoginData, notificationData, orgInvitationData, otpData, passwordChangedData, passwordResetData, welcomeData } from "./schemas.js";
+import { EmailAddress, EmailCategory, HttpUrl, IncidentAlertData, MissionApprovalData, NewDeviceLoginData, NotificationData, OrgInvitationData, OtpData, PasswordChangedData, PasswordResetData, WelcomeData, emailCategory, incidentAlertData, missionApprovalData, newDeviceLoginData, notificationData, orgInvitationData, otpData, passwordChangedData, passwordResetData, welcomeData } from "./schemas.js";
 import { EmailMessage, EmailMessageContext, EmailOrgIdentity, EmailTheme, EmailThemeContext, EmailThemeFonts, EmailThemeOverride, buildTailwindConfig, defaultEmailTheme, mergeEmailTheme, resolveEmailTheme, withEmailMessage, withEmailTheme } from "./emails/theme.js";
 import { EmailRegistryEntry, EmailTemplateDef, EmailValidationError, Mailer, MailerPayload, MailerTemplateData, RenderEmailOptions, RenderedEmail, createMailer, defineEmailTemplate } from "./mailer.js";
 import { EmailName, EmailPayload, EmailTemplateData, decodeEmailPayload } from "./contract.js";
 import { registry } from "./registry.js";
 import { renderEmail } from "./render.js";
 import { incidentAlertTemplate, missionApprovalTemplate, newDeviceLoginTemplate, notificationTemplate, orgInvitationTemplate, otpTemplate, passwordChangedTemplate, passwordResetTemplate, resqEmailTemplates, welcomeTemplate } from "./templates.js";
-export { EmailCategory, EmailMessage, EmailMessageContext, EmailName, EmailOrgIdentity, EmailPayload, type EmailRegistryEntry, EmailTemplateData, type EmailTemplateDef, EmailTheme, EmailThemeContext, EmailThemeFonts, EmailThemeOverride, EmailValidationError, HttpUrl, IncidentAlertData, type Mailer, type MailerPayload, type MailerTemplateData, MissionApprovalData, NewDeviceLoginData, NotificationData, OrgInvitationData, OtpData, PasswordChangedData, PasswordResetData, type RenderEmailOptions, type RenderedEmail, WelcomeData, buildTailwindConfig, createMailer, decodeEmailPayload, defaultEmailTheme, defineEmailTemplate, emailCategory, incidentAlertData, incidentAlertTemplate, mergeEmailTheme, missionApprovalData, missionApprovalTemplate, newDeviceLoginData, newDeviceLoginTemplate, notificationData, notificationTemplate, orgInvitationData, orgInvitationTemplate, otpData, otpTemplate, passwordChangedData, passwordChangedTemplate, passwordResetData, passwordResetTemplate, registry, renderEmail, resolveEmailTheme, resqEmailTemplates, welcomeData, welcomeTemplate, withEmailMessage, withEmailTheme };
+export { EmailAddress, EmailCategory, EmailMessage, EmailMessageContext, EmailName, EmailOrgIdentity, EmailPayload, type EmailRegistryEntry, EmailTemplateData, type EmailTemplateDef, EmailTheme, EmailThemeContext, EmailThemeFonts, EmailThemeOverride, EmailValidationError, HttpUrl, IncidentAlertData, type Mailer, type MailerPayload, type MailerTemplateData, MissionApprovalData, NewDeviceLoginData, NotificationData, OrgInvitationData, OtpData, PasswordChangedData, PasswordResetData, type RenderEmailOptions, type RenderedEmail, WelcomeData, buildTailwindConfig, createMailer, decodeEmailPayload, defaultEmailTheme, defineEmailTemplate, emailCategory, incidentAlertData, incidentAlertTemplate, mergeEmailTheme, missionApprovalData, missionApprovalTemplate, newDeviceLoginData, newDeviceLoginTemplate, notificationData, notificationTemplate, orgInvitationData, orgInvitationTemplate, otpData, otpTemplate, passwordChangedData, passwordChangedTemplate, passwordResetData, passwordResetTemplate, registry, renderEmail, resolveEmailTheme, resqEmailTemplates, welcomeData, welcomeTemplate, withEmailMessage, withEmailTheme };

package/lib/index.js

@@ -1,8 +1,8 @@
 import { EmailMessageContext, EmailThemeContext, buildTailwindConfig, defaultEmailTheme, mergeEmailTheme, resolveEmailTheme, withEmailMessage, withEmailTheme } from "./emails/theme.js";
-import { HttpUrl, emailCategory, incidentAlertData, missionApprovalData, newDeviceLoginData, notificationData, orgInvitationData, otpData, passwordChangedData, passwordResetData, welcomeData } from "./schemas.js";
+import { EmailAddress, HttpUrl, emailCategory, incidentAlertData, missionApprovalData, newDeviceLoginData, notificationData, orgInvitationData, otpData, passwordChangedData, passwordResetData, welcomeData } from "./schemas.js";
 import { EmailValidationError, createMailer, defineEmailTemplate } from "./mailer.js";
 import { incidentAlertTemplate, missionApprovalTemplate, newDeviceLoginTemplate, notificationTemplate, orgInvitationTemplate, otpTemplate, passwordChangedTemplate, passwordResetTemplate, resqEmailTemplates, welcomeTemplate } from "./templates.js";
 import { EmailPayload, decodeEmailPayload } from "./contract.js";
 import { registry } from "./registry.js";
 import { renderEmail } from "./render.js";
-export { EmailMessageContext, EmailPayload, EmailThemeContext, EmailValidationError, HttpUrl, buildTailwindConfig, createMailer, decodeEmailPayload, defaultEmailTheme, defineEmailTemplate, emailCategory, incidentAlertData, incidentAlertTemplate, mergeEmailTheme, missionApprovalData, missionApprovalTemplate, newDeviceLoginData, newDeviceLoginTemplate, notificationData, notificationTemplate, orgInvitationData, orgInvitationTemplate, otpData, otpTemplate, passwordChangedData, passwordChangedTemplate, passwordResetData, passwordResetTemplate, registry, renderEmail, resolveEmailTheme, resqEmailTemplates, welcomeData, welcomeTemplate, withEmailMessage, withEmailTheme };
+export { EmailAddress, EmailMessageContext, EmailPayload, EmailThemeContext, EmailValidationError, HttpUrl, buildTailwindConfig, createMailer, decodeEmailPayload, defaultEmailTheme, defineEmailTemplate, emailCategory, incidentAlertData, incidentAlertTemplate, mergeEmailTheme, missionApprovalData, missionApprovalTemplate, newDeviceLoginData, newDeviceLoginTemplate, notificationData, notificationTemplate, orgInvitationData, orgInvitationTemplate, otpData, otpTemplate, passwordChangedData, passwordChangedTemplate, passwordResetData, passwordResetTemplate, registry, renderEmail, resolveEmailTheme, resqEmailTemplates, welcomeData, welcomeTemplate, withEmailMessage, withEmailTheme };

package/lib/mailer.d.ts

@@ -1,3 +1,4 @@
+import { EmailAddress } from "./schemas.js";
 import { EmailThemeOverride } from "./emails/theme.js";
 import { Schema } from "effect";
 import { ReactElement } from "react";
@@ -26,7 +27,7 @@ interface AnyTemplateDef {
 /** The `{ name, to, data, category?, unsubscribeUrl? }` payload for a single template def. */
 type PayloadFor<Def> = Def extends EmailTemplateDef<infer Name, infer DataSchema> ? {
   readonly name: Name;
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: DataSchema["Type"];
   /** Compliance class for this send; defaults to `transactional`. */
   readonly category?: "transactional" | "marketing";
@@ -41,7 +42,8 @@ type MailerTemplateData<Defs extends readonly AnyTemplateDef[], Name extends Mai
 }>["data"];
 /** The rendered, provider-ready email. */
 interface RenderedEmail {
-  to: string;
+  /** Validated recipient (branded {@link EmailAddress}), carried from decode. */
+  to: EmailAddress;
   subject: string;
   html: string;
   text: string;

package/lib/mailer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mailer.d.ts","names":[],"sources":["../src/mailer.tsx"],"mappings":";;;;;UA8BiB,iBAAiB,qBAAqB,mBAAmB,OAAO;WACvE,MAAM;WACN,MAAM;WACN,UAAU,MAAM;WAChB,YAAY,MAAM,uBAAuB;;;iBAInC,0BAA0B,qBAAqB,mBAAmB,OAAO,KACxF,KAAK,iBAAiB,MAAM,cAC1B,iBAAiB,MAAM;;;;;;;UAUhB;WACA;WACA,MAAM,OAAO;WACb,UAAU;WACV,YAAY,gBAAgB;;;KAIjC,WAAW,OACf,YAAY,uBAAuB,YAAY;WAEnC,MAAM;WACN;WACA,MAAM;;WAEN;;WAEA;;;KAKD,cAAc,sBAAsB,oBAAoB,WAAW;;KAGnE,mBACX,sBAAsB,kBACtB,aAAa,cAAc,iBACxB,QAAQ,cAAc;EAAS,MAAM;;;UAGxB;EAChB;EACA;EACA;EACA;;;UAIgB;;EAEhB,QAAQ;;;cAII,6BAA6B;WACvB;;;UAIF;EAChB,UAAU;EACV,SAAS,kBAAkB;;;UAIX,OAChB;WAA2B;WAAuB;WAAqB;;;WAG9D,QAAQ,OAAO;;WAEf,UAAU,OAAO,iBAAiB;;WAElC,gBAAgB;;EAEzB,OAAO,iBAAiB;;EAExB,YAAY,gBAAgB,UAAU,qBAAqB,QAAQ;;;;;;;;iBASpD,mBAAmB,sBAAsB,kBACxD,MAAM,OACJ,OAAO,cAAc"}
+{"version":3,"file":"mailer.d.ts","names":[],"sources":["../src/mailer.tsx"],"mappings":";;;;;;UAoCiB,iBAAiB,qBAAqB,mBAAmB,OAAO;WACvE,MAAM;WACN,MAAM;WACN,UAAU,MAAM;WAChB,YAAY,MAAM,uBAAuB;;;iBAInC,0BAA0B,qBAAqB,mBAAmB,OAAO,KACxF,KAAK,iBAAiB,MAAM,cAC1B,iBAAiB,MAAM;;;;;;;UAUhB;WACA;WACA,MAAM,OAAO;WACb,UAAU;WACV,YAAY,gBAAgB;;;KAIjC,WAAW,OACf,YAAY,uBAAuB,YAAY;WAEnC,MAAM;WACN,IAAI;WACJ,MAAM;;WAEN;;WAEA;;;KAKD,cAAc,sBAAsB,oBAAoB,WAAW;;KAGnE,mBACX,sBAAsB,kBACtB,aAAa,cAAc,iBACxB,QAAQ,cAAc;EAAS,MAAM;;;UAGxB;;EAEhB,IAAI;EACJ;EACA;EACA;;;UAIgB;;EAEhB,QAAQ;;;cAII,6BAA6B;WACvB;;;UAIF;EAChB,UAAU;EACV,SAAS,kBAAkB;;;UAIX,OAChB;WAA2B;WAAuB;WAAqB;;;WAG9D,QAAQ,OAAO;;WAEf,UAAU,OAAO,iBAAiB;;WAElC,gBAAgB;;EAEzB,OAAO,iBAAiB;;EAExB,YAAY,gBAAgB,UAAU,qBAAqB,QAAQ;;;;;;;;iBASpD,mBAAmB,sBAAsB,kBACxD,MAAM,OACJ,OAAO,cAAc"}

package/lib/mailer.js

@@ -1,5 +1,5 @@
 import { withEmailMessage, withEmailTheme } from "./emails/theme.js";
-import { HttpUrl, emailCategory } from "./schemas.js";
+import { EmailAddress, HttpUrl, emailCategory } from "./schemas.js";
 import { render } from "@react-email/render";
 import { Cause, Exit, Schema } from "effect";
 //#region src/mailer.tsx
@@ -18,7 +18,13 @@ import { Cause, Exit, Schema } from "effect";
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
-const Recipient = Schema.String;
+/**
+* Recipient schema for every payload's `to`. Validated (not a bare
+* `Schema.String`) so a malformed or header-injecting address is rejected at
+* the decode boundary and the decoded `to` carries the {@link EmailAddress}
+* brand all the way to the provider.
+*/
+const Recipient = EmailAddress;
 /** Identity helper that infers and preserves a template def's literal types. */
 function defineEmailTemplate(def) {
 	return def;

package/lib/mailer.js.map

@@ -1 +1 @@
-{"version":3,"file":"mailer.js","names":[],"sources":["../src/mailer.tsx"],"sourcesContent":["/**\n * Copyright 2026 ResQ Systems, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { render } from \"@react-email/render\";\nimport { Cause, Exit, Schema } from \"effect\";\nimport type { ReactElement } from \"react\";\nimport {\n\ttype EmailMessage,\n\ttype EmailThemeOverride,\n\twithEmailMessage,\n\twithEmailTheme,\n} from \"./emails/theme.js\";\nimport { HttpUrl, emailCategory } from \"./schemas.js\";\n\nconst Recipient = Schema.String;\n\n/** A template definition: its name, `data` schema, subject line, and component. */\nexport interface EmailTemplateDef<Name extends string, DataSchema extends Schema.Top> {\n\treadonly name: Name;\n\treadonly data: DataSchema;\n\treadonly subject: (data: DataSchema[\"Type\"]) => string;\n\treadonly Component: (data: DataSchema[\"Type\"]) => ReactElement;\n}\n\n/** Identity helper that infers and preserves a template def's literal types. */\nexport function defineEmailTemplate<const Name extends string, DataSchema extends Schema.Top>(\n\tdef: EmailTemplateDef<Name, DataSchema>,\n): EmailTemplateDef<Name, DataSchema> {\n\treturn def;\n}\n\n/**\n * The common supertype for a heterogeneous list of template defs. The `never`\n * parameters make every concrete `EmailTemplateDef<Name, DataSchema>` assignable\n * here (function parameters are contravariant), so defs with different `data`\n * types can live in one array.\n */\ninterface AnyTemplateDef {\n\treadonly name: string;\n\treadonly data: Schema.Top;\n\treadonly subject: (data: never) => string;\n\treadonly Component: (data: never) => ReactElement;\n}\n\n/** The `{ name, to, data, category?, unsubscribeUrl? }` payload for a single template def. */\ntype PayloadFor<Def> =\n\tDef extends EmailTemplateDef<infer Name, infer DataSchema>\n\t\t? {\n\t\t\t\treadonly name: Name;\n\t\t\t\treadonly to: string;\n\t\t\t\treadonly data: DataSchema[\"Type\"];\n\t\t\t\t/** Compliance class for this send; defaults to `transactional`. */\n\t\t\t\treadonly category?: \"transactional\" | \"marketing\";\n\t\t\t\t/** Unsubscribe/preferences URL, surfaced in the legal footer for `marketing`. */\n\t\t\t\treadonly unsubscribeUrl?: string;\n\t\t\t}\n\t\t: never;\n\n/** The discriminated payload union for a tuple of template defs. */\nexport type MailerPayload<Defs extends readonly AnyTemplateDef[]> = PayloadFor<Defs[number]>;\n\n/** The `data` type for a given template name within a set of defs. */\nexport type MailerTemplateData<\n\tDefs extends readonly AnyTemplateDef[],\n\tName extends MailerPayload<Defs>[\"name\"],\n> = Extract<MailerPayload<Defs>, { name: Name }>[\"data\"];\n\n/** The rendered, provider-ready email. */\nexport interface RenderedEmail {\n\tto: string;\n\tsubject: string;\n\thtml: string;\n\ttext: string;\n}\n\n/** Options for a mailer's `renderEmail`. */\nexport interface RenderEmailOptions {\n\t/** Rebrand this render by overriding theme colors/fonts (see `EmailThemeOverride`). */\n\ttheme?: EmailThemeOverride;\n}\n\n/** Thrown when an untrusted payload fails schema validation at the boundary. */\nexport class EmailValidationError extends Error {\n\toverride readonly name = \"EmailValidationError\";\n}\n\n/** A registry entry: the subject builder and component renderer for one template. */\nexport interface EmailRegistryEntry {\n\tsubject: (data: unknown) => string;\n\trender: (data: unknown) => ReactElement;\n}\n\n/** A composed set of templates: contract schema, decoder, registry, and renderer. */\nexport interface Mailer<\n\tPayload extends { readonly name: string; readonly to: string; readonly data: unknown },\n> {\n\t/** The Effect Schema union describing every `{ name, to, data }` payload. */\n\treadonly schema: Schema.Top;\n\t/** name → { subject, render } for every template. */\n\treadonly registry: Record<Payload[\"name\"], EmailRegistryEntry>;\n\t/** Every registered template name. */\n\treadonly names: readonly Payload[\"name\"][];\n\t/** Validate an untrusted payload (throws {@link EmailValidationError}). */\n\tdecode(input: unknown): Payload;\n\t/** Validate then render to `{ to, subject, html, text }` (headless, pipeline-safe). */\n\trenderEmail(input: unknown, options?: RenderEmailOptions): Promise<RenderedEmail>;\n}\n\n/**\n * Compose template definitions into a typed mailer: a discriminated\n * `{ name, to, data }` contract, a boundary decoder, a registry, and a headless\n * renderer. Spread the built-in `resqEmailTemplates` and add your own — each\n * template's `data` is validated by its Effect Schema.\n */\nexport function createMailer<const Defs extends readonly AnyTemplateDef[]>(\n\tdefs: Defs,\n): Mailer<MailerPayload<Defs>> {\n\ttype Payload = MailerPayload<Defs>;\n\n\tconst schema = Schema.Union(\n\t\tdefs.map((def) =>\n\t\t\tSchema.Struct({\n\t\t\t\tname: Schema.Literal(def.name),\n\t\t\t\tto: Recipient,\n\t\t\t\tdata: def.data,\n\t\t\t\tcategory: Schema.optional(emailCategory),\n\t\t\t\tunsubscribeUrl: Schema.optional(HttpUrl),\n\t\t\t}),\n\t\t),\n\t);\n\n\t// Entries are stored with `unknown` params; the def's data type is enforced at\n\t// the call boundary by `decode`, so these casts are safe.\n\tconst registry: Record<string, EmailRegistryEntry> = Object.fromEntries(\n\t\tdefs.map((def) => [\n\t\t\tdef.name,\n\t\t\t{\n\t\t\t\tsubject: def.subject as EmailRegistryEntry[\"subject\"],\n\t\t\t\trender: def.Component as EmailRegistryEntry[\"render\"],\n\t\t\t},\n\t\t]),\n\t);\n\n\tconst names = defs.map((def) => def.name);\n\n\t// Cast past the `Decoder` services constraint: the union's fields are concrete\n\t// schemas with no decoding services at runtime.\n\tconst decodeExit = Schema.decodeUnknownExit(\n\t\tschema as unknown as Parameters<typeof Schema.decodeUnknownExit>[0],\n\t);\n\n\tfunction decode(input: unknown): Payload {\n\t\tconst result = decodeExit(input);\n\t\tif (Exit.isFailure(result)) {\n\t\t\tconst squashed = Cause.squash(result.cause);\n\t\t\tthrow new EmailValidationError(\n\t\t\t\tsquashed instanceof Error ? squashed.message : String(squashed),\n\t\t\t);\n\t\t}\n\t\treturn result.value as Payload;\n\t}\n\n\tasync function renderEmail(input: unknown, options?: RenderEmailOptions): Promise<RenderedEmail> {\n\t\tconst payload = decode(input);\n\t\tconst entry = registry[payload.name as string];\n\t\tconst message: EmailMessage = {\n\t\t\tcategory: payload.category ?? \"transactional\",\n\t\t\tunsubscribeUrl: payload.unsubscribeUrl,\n\t\t};\n\t\tconst element = withEmailMessage(\n\t\t\twithEmailTheme(entry.render(payload.data), options?.theme),\n\t\t\tmessage,\n\t\t);\n\t\tconst [html, text] = await Promise.all([render(element), render(element, { plainText: true })]);\n\t\treturn { to: payload.to, subject: entry.subject(payload.data), html, text };\n\t}\n\n\treturn {\n\t\tschema,\n\t\tregistry: registry as Record<Payload[\"name\"], EmailRegistryEntry>,\n\t\tnames: names as readonly Payload[\"name\"][],\n\t\tdecode,\n\t\trenderEmail,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA2BA,MAAM,YAAY,OAAO;;AAWzB,SAAgB,oBACf,KACqC;CACrC,OAAO;AACR;;AAqDA,IAAa,uBAAb,cAA0C,MAAM;CAC/C,OAAyB;AAC1B;;;;;;;AA8BA,SAAgB,aACf,MAC8B;CAG9B,MAAM,SAAS,OAAO,MACrB,KAAK,KAAK,QACT,OAAO,OAAO;EACb,MAAM,OAAO,QAAQ,IAAI,IAAI;EAC7B,IAAI;EACJ,MAAM,IAAI;EACV,UAAU,OAAO,SAAS,aAAa;EACvC,gBAAgB,OAAO,SAAS,OAAO;CACxC,CAAC,CACF,CACD;CAIA,MAAM,WAA+C,OAAO,YAC3D,KAAK,KAAK,QAAQ,CACjB,IAAI,MACJ;EACC,SAAS,IAAI;EACb,QAAQ,IAAI;CACb,CACD,CAAC,CACF;CAEA,MAAM,QAAQ,KAAK,KAAK,QAAQ,IAAI,IAAI;CAIxC,MAAM,aAAa,OAAO,kBACzB,MACD;CAEA,SAAS,OAAO,OAAyB;EACxC,MAAM,SAAS,WAAW,KAAK;EAC/B,IAAI,KAAK,UAAU,MAAM,GAAG;GAC3B,MAAM,WAAW,MAAM,OAAO,OAAO,KAAK;GAC1C,MAAM,IAAI,qBACT,oBAAoB,QAAQ,SAAS,UAAU,OAAO,QAAQ,CAC/D;EACD;EACA,OAAO,OAAO;CACf;CAEA,eAAe,YAAY,OAAgB,SAAsD;EAChG,MAAM,UAAU,OAAO,KAAK;EAC5B,MAAM,QAAQ,SAAS,QAAQ;EAC/B,MAAM,UAAwB;GAC7B,UAAU,QAAQ,YAAY;GAC9B,gBAAgB,QAAQ;EACzB;EACA,MAAM,UAAU,iBACf,eAAe,MAAM,OAAO,QAAQ,IAAI,GAAG,SAAS,KAAK,GACzD,OACD;EACA,MAAM,CAAC,MAAM,QAAQ,MAAM,QAAQ,IAAI,CAAC,OAAO,OAAO,GAAG,OAAO,SAAS,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC;EAC9F,OAAO;GAAE,IAAI,QAAQ;GAAI,SAAS,MAAM,QAAQ,QAAQ,IAAI;GAAG;GAAM;EAAK;CAC3E;CAEA,OAAO;EACN;EACU;EACH;EACP;EACA;CACD;AACD"}
+{"version":3,"file":"mailer.js","names":[],"sources":["../src/mailer.tsx"],"sourcesContent":["/**\n * Copyright 2026 ResQ Systems, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { render } from \"@react-email/render\";\nimport { Cause, Exit, Schema } from \"effect\";\nimport type { ReactElement } from \"react\";\nimport {\n\ttype EmailMessage,\n\ttype EmailThemeOverride,\n\twithEmailMessage,\n\twithEmailTheme,\n} from \"./emails/theme.js\";\nimport { EmailAddress, HttpUrl, emailCategory } from \"./schemas.js\";\n\n/**\n * Recipient schema for every payload's `to`. Validated (not a bare\n * `Schema.String`) so a malformed or header-injecting address is rejected at\n * the decode boundary and the decoded `to` carries the {@link EmailAddress}\n * brand all the way to the provider.\n */\nconst Recipient = EmailAddress;\n\n/** A template definition: its name, `data` schema, subject line, and component. */\nexport interface EmailTemplateDef<Name extends string, DataSchema extends Schema.Top> {\n\treadonly name: Name;\n\treadonly data: DataSchema;\n\treadonly subject: (data: DataSchema[\"Type\"]) => string;\n\treadonly Component: (data: DataSchema[\"Type\"]) => ReactElement;\n}\n\n/** Identity helper that infers and preserves a template def's literal types. */\nexport function defineEmailTemplate<const Name extends string, DataSchema extends Schema.Top>(\n\tdef: EmailTemplateDef<Name, DataSchema>,\n): EmailTemplateDef<Name, DataSchema> {\n\treturn def;\n}\n\n/**\n * The common supertype for a heterogeneous list of template defs. The `never`\n * parameters make every concrete `EmailTemplateDef<Name, DataSchema>` assignable\n * here (function parameters are contravariant), so defs with different `data`\n * types can live in one array.\n */\ninterface AnyTemplateDef {\n\treadonly name: string;\n\treadonly data: Schema.Top;\n\treadonly subject: (data: never) => string;\n\treadonly Component: (data: never) => ReactElement;\n}\n\n/** The `{ name, to, data, category?, unsubscribeUrl? }` payload for a single template def. */\ntype PayloadFor<Def> =\n\tDef extends EmailTemplateDef<infer Name, infer DataSchema>\n\t\t? {\n\t\t\t\treadonly name: Name;\n\t\t\t\treadonly to: EmailAddress;\n\t\t\t\treadonly data: DataSchema[\"Type\"];\n\t\t\t\t/** Compliance class for this send; defaults to `transactional`. */\n\t\t\t\treadonly category?: \"transactional\" | \"marketing\";\n\t\t\t\t/** Unsubscribe/preferences URL, surfaced in the legal footer for `marketing`. */\n\t\t\t\treadonly unsubscribeUrl?: string;\n\t\t\t}\n\t\t: never;\n\n/** The discriminated payload union for a tuple of template defs. */\nexport type MailerPayload<Defs extends readonly AnyTemplateDef[]> = PayloadFor<Defs[number]>;\n\n/** The `data` type for a given template name within a set of defs. */\nexport type MailerTemplateData<\n\tDefs extends readonly AnyTemplateDef[],\n\tName extends MailerPayload<Defs>[\"name\"],\n> = Extract<MailerPayload<Defs>, { name: Name }>[\"data\"];\n\n/** The rendered, provider-ready email. */\nexport interface RenderedEmail {\n\t/** Validated recipient (branded {@link EmailAddress}), carried from decode. */\n\tto: EmailAddress;\n\tsubject: string;\n\thtml: string;\n\ttext: string;\n}\n\n/** Options for a mailer's `renderEmail`. */\nexport interface RenderEmailOptions {\n\t/** Rebrand this render by overriding theme colors/fonts (see `EmailThemeOverride`). */\n\ttheme?: EmailThemeOverride;\n}\n\n/** Thrown when an untrusted payload fails schema validation at the boundary. */\nexport class EmailValidationError extends Error {\n\toverride readonly name = \"EmailValidationError\";\n}\n\n/** A registry entry: the subject builder and component renderer for one template. */\nexport interface EmailRegistryEntry {\n\tsubject: (data: unknown) => string;\n\trender: (data: unknown) => ReactElement;\n}\n\n/** A composed set of templates: contract schema, decoder, registry, and renderer. */\nexport interface Mailer<\n\tPayload extends { readonly name: string; readonly to: string; readonly data: unknown },\n> {\n\t/** The Effect Schema union describing every `{ name, to, data }` payload. */\n\treadonly schema: Schema.Top;\n\t/** name → { subject, render } for every template. */\n\treadonly registry: Record<Payload[\"name\"], EmailRegistryEntry>;\n\t/** Every registered template name. */\n\treadonly names: readonly Payload[\"name\"][];\n\t/** Validate an untrusted payload (throws {@link EmailValidationError}). */\n\tdecode(input: unknown): Payload;\n\t/** Validate then render to `{ to, subject, html, text }` (headless, pipeline-safe). */\n\trenderEmail(input: unknown, options?: RenderEmailOptions): Promise<RenderedEmail>;\n}\n\n/**\n * Compose template definitions into a typed mailer: a discriminated\n * `{ name, to, data }` contract, a boundary decoder, a registry, and a headless\n * renderer. Spread the built-in `resqEmailTemplates` and add your own — each\n * template's `data` is validated by its Effect Schema.\n */\nexport function createMailer<const Defs extends readonly AnyTemplateDef[]>(\n\tdefs: Defs,\n): Mailer<MailerPayload<Defs>> {\n\ttype Payload = MailerPayload<Defs>;\n\n\t// `Schema.Union(defs.map(...))` maps the def tuple to an array, widening each\n\t// struct's literal `name` and collapsing the discriminant, so TS can't prove the\n\t// union's decoded type is the `Payload` union. Assert it as a services-free\n\t// `Codec<Payload, unknown>` (every field schema decodes without services — cf.\n\t// `@resq-systems/http`'s `SyncSchema`); `decode` returns the narrowed value.\n\tconst schema = Schema.Union(\n\t\tdefs.map((def) =>\n\t\t\tSchema.Struct({\n\t\t\t\tname: Schema.Literal(def.name),\n\t\t\t\tto: Recipient,\n\t\t\t\tdata: def.data,\n\t\t\t\tcategory: Schema.optional(emailCategory),\n\t\t\t\tunsubscribeUrl: Schema.optional(HttpUrl),\n\t\t\t}),\n\t\t),\n\t) as unknown as Schema.Codec<Payload, unknown, never>;\n\n\t// Entries are stored with `unknown` params; the def's data type is enforced at\n\t// the call boundary by `decode`, so these casts are safe.\n\tconst registry: Record<string, EmailRegistryEntry> = Object.fromEntries(\n\t\tdefs.map((def) => [\n\t\t\tdef.name,\n\t\t\t{\n\t\t\t\tsubject: def.subject as EmailRegistryEntry[\"subject\"],\n\t\t\t\trender: def.Component as EmailRegistryEntry[\"render\"],\n\t\t\t},\n\t\t]),\n\t);\n\n\tconst names = defs.map((def) => def.name);\n\n\tconst decodeExit = Schema.decodeUnknownExit(schema);\n\n\tfunction decode(input: unknown): Payload {\n\t\tconst result = decodeExit(input);\n\t\tif (Exit.isFailure(result)) {\n\t\t\tconst squashed = Cause.squash(result.cause);\n\t\t\tthrow new EmailValidationError(\n\t\t\t\tsquashed instanceof Error ? squashed.message : String(squashed),\n\t\t\t);\n\t\t}\n\t\treturn result.value;\n\t}\n\n\tasync function renderEmail(input: unknown, options?: RenderEmailOptions): Promise<RenderedEmail> {\n\t\tconst payload = decode(input);\n\t\tconst entry = registry[payload.name as string];\n\t\tconst message: EmailMessage = {\n\t\t\tcategory: payload.category ?? \"transactional\",\n\t\t\tunsubscribeUrl: payload.unsubscribeUrl,\n\t\t};\n\t\tconst element = withEmailMessage(\n\t\t\twithEmailTheme(entry.render(payload.data), options?.theme),\n\t\t\tmessage,\n\t\t);\n\t\tconst [html, text] = await Promise.all([render(element), render(element, { plainText: true })]);\n\t\treturn { to: payload.to, subject: entry.subject(payload.data), html, text };\n\t}\n\n\treturn {\n\t\tschema,\n\t\tregistry: registry as Record<Payload[\"name\"], EmailRegistryEntry>,\n\t\tnames: names as readonly Payload[\"name\"][],\n\t\tdecode,\n\t\trenderEmail,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,MAAM,YAAY;;AAWlB,SAAgB,oBACf,KACqC;CACrC,OAAO;AACR;;AAsDA,IAAa,uBAAb,cAA0C,MAAM;CAC/C,OAAyB;AAC1B;;;;;;;AA8BA,SAAgB,aACf,MAC8B;CAQ9B,MAAM,SAAS,OAAO,MACrB,KAAK,KAAK,QACT,OAAO,OAAO;EACb,MAAM,OAAO,QAAQ,IAAI,IAAI;EAC7B,IAAI;EACJ,MAAM,IAAI;EACV,UAAU,OAAO,SAAS,aAAa;EACvC,gBAAgB,OAAO,SAAS,OAAO;CACxC,CAAC,CACF,CACD;CAIA,MAAM,WAA+C,OAAO,YAC3D,KAAK,KAAK,QAAQ,CACjB,IAAI,MACJ;EACC,SAAS,IAAI;EACb,QAAQ,IAAI;CACb,CACD,CAAC,CACF;CAEA,MAAM,QAAQ,KAAK,KAAK,QAAQ,IAAI,IAAI;CAExC,MAAM,aAAa,OAAO,kBAAkB,MAAM;CAElD,SAAS,OAAO,OAAyB;EACxC,MAAM,SAAS,WAAW,KAAK;EAC/B,IAAI,KAAK,UAAU,MAAM,GAAG;GAC3B,MAAM,WAAW,MAAM,OAAO,OAAO,KAAK;GAC1C,MAAM,IAAI,qBACT,oBAAoB,QAAQ,SAAS,UAAU,OAAO,QAAQ,CAC/D;EACD;EACA,OAAO,OAAO;CACf;CAEA,eAAe,YAAY,OAAgB,SAAsD;EAChG,MAAM,UAAU,OAAO,KAAK;EAC5B,MAAM,QAAQ,SAAS,QAAQ;EAC/B,MAAM,UAAwB;GAC7B,UAAU,QAAQ,YAAY;GAC9B,gBAAgB,QAAQ;EACzB;EACA,MAAM,UAAU,iBACf,eAAe,MAAM,OAAO,QAAQ,IAAI,GAAG,SAAS,KAAK,GACzD,OACD;EACA,MAAM,CAAC,MAAM,QAAQ,MAAM,QAAQ,IAAI,CAAC,OAAO,OAAO,GAAG,OAAO,SAAS,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC;EAC9F,OAAO;GAAE,IAAI,QAAQ;GAAI,SAAS,MAAM,QAAQ,QAAQ,IAAI;GAAG;GAAM;EAAK;CAC3E;CAEA,OAAO;EACN;EACU;EACH;EACP;EACA;CACD;AACD"}

package/lib/schemas.d.ts

@@ -6,6 +6,25 @@ import { Schema } from "effect";
  * props stay ergonomic. Exported for consumers building their own templates.
  */
 declare const HttpUrl: Schema.String;
+/**
+ * A single, syntactically-valid recipient email address (branded).
+ *
+ * The pattern mirrors `@resq-systems/security`'s `EmailSchema` — one `@`, a
+ * dotted domain, and a 2+ character TLD, or a Punycode/IDN `xn--…` TLD (e.g.
+ * `.xn--p1ai` for `.рф`) so internationalized domains are not rejected. Because
+ * the character classes admit no whitespace or control characters and the check
+ * is anchored (`^…$`), it also rejects the CR/LF that underpins SMTP header
+ * injection: a `to` smuggling `"…\r\nBcc: attacker@evil"` into a provider that
+ * concatenates headers is a type-*and*-runtime error at the boundary, not a
+ * silent extra recipient.
+ *
+ * The {@link EmailAddress} brand marks a string that has cleared this check, so
+ * a validated address is not interchangeable with a raw `string` downstream
+ * (the `to` field on the decoded mailer payload and the rendered email).
+ */
+declare const EmailAddress: Schema.brand<Schema.String, "EmailAddress">;
+/** A recipient address that has passed {@link EmailAddress} validation. */
+type EmailAddress = typeof EmailAddress.Type;
 /**
  * Compliance class of an email send. `transactional` skips unsubscribe UI;
  * `marketing` requires an unsubscribe affordance in the legal footer.
@@ -82,5 +101,5 @@ type NewDeviceLoginData = typeof newDeviceLoginData.Type;
 type MissionApprovalData = typeof missionApprovalData.Type;
 type OrgInvitationData = typeof orgInvitationData.Type;
 //#endregion
-export { EmailCategory, HttpUrl, IncidentAlertData, MissionApprovalData, NewDeviceLoginData, NotificationData, OrgInvitationData, OtpData, PasswordChangedData, PasswordResetData, WelcomeData, emailCategory, incidentAlertData, missionApprovalData, newDeviceLoginData, notificationData, orgInvitationData, otpData, passwordChangedData, passwordResetData, welcomeData };
+export { EmailAddress, EmailCategory, HttpUrl, IncidentAlertData, MissionApprovalData, NewDeviceLoginData, NotificationData, OrgInvitationData, OtpData, PasswordChangedData, PasswordResetData, WelcomeData, emailCategory, incidentAlertData, missionApprovalData, newDeviceLoginData, notificationData, orgInvitationData, otpData, passwordChangedData, passwordResetData, welcomeData };
 //# sourceMappingURL=schemas.d.ts.map

package/lib/schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.ts","names":[],"sources":["../src/schemas.ts"],"mappings":";;;;;;;cAuBa,SAAO,OAAA;;;;;cAMP,eAAa,OAAA;KACd,uBAAuB,cAAc;cAEpC,SAAO,OAAA;;;;;cAMP,aAAW,OAAA;;;;cAKX,mBAAiB,OAAA;;;;;cAMjB,kBAAgB,OAAA;;;;;;;cAQhB,mBAAiB,OAAA;;;;;;;;;cAYjB,qBAAmB,OAAA;;;;;cAQnB,oBAAkB,OAAA;;;;;;;;cAalB,qBAAmB,OAAA;;;;;;;;;cAWnB,mBAAiB,OAAA;;;;;;;;KASlB,iBAAiB,QAAQ;KACzB,qBAAqB,YAAY;KACjC,2BAA2B,kBAAkB;KAC7C,0BAA0B,iBAAiB;KAC3C,2BAA2B,kBAAkB;KAC7C,6BAA6B,oBAAoB;KACjD,4BAA4B,mBAAmB;KAC/C,6BAA6B,oBAAoB;KACjD,2BAA2B,kBAAkB"}
+{"version":3,"file":"schemas.d.ts","names":[],"sources":["../src/schemas.ts"],"mappings":";;;;;;;cAuBa,SAAO,OAAA;;;;;;;;;;;;;;;;;cAkBP,cAAY,OAAA,MAAA,OAAA;;KAKb,sBAAsB,aAAa;;;;;cAMlC,eAAa,OAAA;KACd,uBAAuB,cAAc;cAEpC,SAAO,OAAA;;;;;cAMP,aAAW,OAAA;;;;cAKX,mBAAiB,OAAA;;;;;cAMjB,kBAAgB,OAAA;;;;;;;cAQhB,mBAAiB,OAAA;;;;;;;;;cAYjB,qBAAmB,OAAA;;;;;cAQnB,oBAAkB,OAAA;;;;;;;;cAalB,qBAAmB,OAAA;;;;;;;;;cAWnB,mBAAiB,OAAA;;;;;;;;KASlB,iBAAiB,QAAQ;KACzB,qBAAqB,YAAY;KACjC,2BAA2B,kBAAkB;KAC7C,0BAA0B,iBAAiB;KAC3C,2BAA2B,kBAAkB;KAC7C,6BAA6B,oBAAoB;KACjD,4BAA4B,mBAAmB;KAC/C,6BAA6B,oBAAoB;KACjD,2BAA2B,kBAAkB"}

package/lib/schemas.js

@@ -22,6 +22,23 @@ import { Schema } from "effect";
 */
 const HttpUrl = Schema.String.check(Schema.isPattern(/^https?:\/\/\S+$/i));
 /**
+* A single, syntactically-valid recipient email address (branded).
+*
+* The pattern mirrors `@resq-systems/security`'s `EmailSchema` — one `@`, a
+* dotted domain, and a 2+ character TLD, or a Punycode/IDN `xn--…` TLD (e.g.
+* `.xn--p1ai` for `.рф`) so internationalized domains are not rejected. Because
+* the character classes admit no whitespace or control characters and the check
+* is anchored (`^…$`), it also rejects the CR/LF that underpins SMTP header
+* injection: a `to` smuggling `"…\r\nBcc: attacker@evil"` into a provider that
+* concatenates headers is a type-*and*-runtime error at the boundary, not a
+* silent extra recipient.
+*
+* The {@link EmailAddress} brand marks a string that has cleared this check, so
+* a validated address is not interchangeable with a raw `string` downstream
+* (the `to` field on the decoded mailer payload and the rendered email).
+*/
+const EmailAddress = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.(?:[A-Za-z]{2,}|xn--[A-Za-z0-9-]+)$/)).pipe(Schema.brand("EmailAddress"));
+/**
 * Compliance class of an email send. `transactional` skips unsubscribe UI;
 * `marketing` requires an unsubscribe affordance in the legal footer.
 */
@@ -99,6 +116,6 @@ const orgInvitationData = Schema.Struct({
 	expiresInDays: Schema.optional(Schema.Number)
 });
 //#endregion
-export { HttpUrl, emailCategory, incidentAlertData, missionApprovalData, newDeviceLoginData, notificationData, orgInvitationData, otpData, passwordChangedData, passwordResetData, welcomeData };
+export { EmailAddress, HttpUrl, emailCategory, incidentAlertData, missionApprovalData, newDeviceLoginData, notificationData, orgInvitationData, otpData, passwordChangedData, passwordResetData, welcomeData };
 
 //# sourceMappingURL=schemas.js.map

package/lib/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","names":["S"],"sources":["../src/schemas.ts"],"sourcesContent":["/**\n * Copyright 2026 ResQ Systems, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Schema as S } from \"effect\";\n\n/**\n * A non-empty, absolute http(s) URL. Validated with a pattern check (blocks\n * `javascript:`/relative hrefs) but decoded as a plain `string`, so template\n * props stay ergonomic. Exported for consumers building their own templates.\n */\nexport const HttpUrl = S.String.check(S.isPattern(/^https?:\\/\\/\\S+$/i));\n\n/**\n * Compliance class of an email send. `transactional` skips unsubscribe UI;\n * `marketing` requires an unsubscribe affordance in the legal footer.\n */\nexport const emailCategory = S.Literals([\"transactional\", \"marketing\"]);\nexport type EmailCategory = typeof emailCategory.Type;\n\nexport const otpData = S.Struct({\n\tcode: S.NonEmptyString,\n\tfirstName: S.optional(S.String),\n\texpiresInMinutes: S.optional(S.Number),\n});\n\nexport const welcomeData = S.Struct({\n\tfirstName: S.NonEmptyString,\n\tverifyUrl: S.optional(HttpUrl),\n});\n\nexport const passwordResetData = S.Struct({\n\tfirstName: S.optional(S.String),\n\tresetUrl: HttpUrl,\n\texpiresInMinutes: S.optional(S.Number),\n});\n\nexport const notificationData = S.Struct({\n\ttitle: S.NonEmptyString,\n\tbody: S.NonEmptyString,\n\tseverity: S.optional(S.Literals([\"info\", \"success\", \"warning\", \"error\"])),\n\tactionUrl: S.optional(HttpUrl),\n\tactionLabel: S.optional(S.String),\n});\n\nexport const incidentAlertData = S.Struct({\n\tincidentId: S.NonEmptyString,\n\ttitle: S.NonEmptyString,\n\tseverity: S.Literals([\"info\", \"warning\", \"critical\"]),\n\tsummary: S.NonEmptyString,\n\tlocation: S.optional(S.String),\n\t// Preformatted timestamp string (caller formats/localizes) to avoid\n\t// timezone/format ambiguity inside the email.\n\tdetectedAt: S.optional(S.String),\n\tdashboardUrl: HttpUrl,\n});\n\nexport const passwordChangedData = S.Struct({\n\tfirstName: S.optional(S.String),\n\t// Preformatted timestamp string (caller formats/localizes).\n\tchangedAt: S.optional(S.String),\n\t// Where to secure the account if the change was not authorized.\n\tsecureAccountUrl: S.optional(HttpUrl),\n});\n\nexport const newDeviceLoginData = S.Struct({\n\tfirstName: S.optional(S.String),\n\t// Human-readable client, e.g. \"Chrome on macOS\".\n\tdevice: S.optional(S.String),\n\t// Human-readable place, e.g. \"Newark, DE, USA\".\n\tlocation: S.optional(S.String),\n\tipAddress: S.optional(S.String),\n\t// Preformatted timestamp string (caller formats/localizes).\n\tat: S.optional(S.String),\n\t// Where to review activity / secure the account if the sign-in was not the recipient.\n\tsecureAccountUrl: S.optional(HttpUrl),\n});\n\nexport const missionApprovalData = S.Struct({\n\tmissionId: S.NonEmptyString,\n\ttitle: S.NonEmptyString,\n\tsummary: S.optional(S.String),\n\trequestedBy: S.optional(S.String),\n\tseverity: S.optional(S.Literals([\"info\", \"warning\", \"critical\"])),\n\t// Approver sign-off link (e.g. the HCE mission-approval route).\n\tapproveUrl: HttpUrl,\n\texpiresInMinutes: S.optional(S.Number),\n});\n\nexport const orgInvitationData = S.Struct({\n\torgName: S.NonEmptyString,\n\tinviterName: S.optional(S.String),\n\torgRole: S.optional(S.String),\n\tacceptUrl: HttpUrl,\n\texpiresInDays: S.optional(S.Number),\n});\n\n/** Inferred `data` types for the built-in templates (used for component props). */\nexport type OtpData = typeof otpData.Type;\nexport type WelcomeData = typeof welcomeData.Type;\nexport type PasswordResetData = typeof passwordResetData.Type;\nexport type NotificationData = typeof notificationData.Type;\nexport type IncidentAlertData = typeof incidentAlertData.Type;\nexport type PasswordChangedData = typeof passwordChangedData.Type;\nexport type NewDeviceLoginData = typeof newDeviceLoginData.Type;\nexport type MissionApprovalData = typeof missionApprovalData.Type;\nexport type OrgInvitationData = typeof orgInvitationData.Type;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,UAAUA,OAAE,OAAO,MAAMA,OAAE,UAAU,mBAAmB,CAAC;;;;;AAMtE,MAAa,gBAAgBA,OAAE,SAAS,CAAC,iBAAiB,WAAW,CAAC;AAGtE,MAAa,UAAUA,OAAE,OAAO;CAC/B,MAAMA,OAAE;CACR,WAAWA,OAAE,SAASA,OAAE,MAAM;CAC9B,kBAAkBA,OAAE,SAASA,OAAE,MAAM;AACtC,CAAC;AAED,MAAa,cAAcA,OAAE,OAAO;CACnC,WAAWA,OAAE;CACb,WAAWA,OAAE,SAAS,OAAO;AAC9B,CAAC;AAED,MAAa,oBAAoBA,OAAE,OAAO;CACzC,WAAWA,OAAE,SAASA,OAAE,MAAM;CAC9B,UAAU;CACV,kBAAkBA,OAAE,SAASA,OAAE,MAAM;AACtC,CAAC;AAED,MAAa,mBAAmBA,OAAE,OAAO;CACxC,OAAOA,OAAE;CACT,MAAMA,OAAE;CACR,UAAUA,OAAE,SAASA,OAAE,SAAS;EAAC;EAAQ;EAAW;EAAW;CAAO,CAAC,CAAC;CACxE,WAAWA,OAAE,SAAS,OAAO;CAC7B,aAAaA,OAAE,SAASA,OAAE,MAAM;AACjC,CAAC;AAED,MAAa,oBAAoBA,OAAE,OAAO;CACzC,YAAYA,OAAE;CACd,OAAOA,OAAE;CACT,UAAUA,OAAE,SAAS;EAAC;EAAQ;EAAW;CAAU,CAAC;CACpD,SAASA,OAAE;CACX,UAAUA,OAAE,SAASA,OAAE,MAAM;CAG7B,YAAYA,OAAE,SAASA,OAAE,MAAM;CAC/B,cAAc;AACf,CAAC;AAED,MAAa,sBAAsBA,OAAE,OAAO;CAC3C,WAAWA,OAAE,SAASA,OAAE,MAAM;CAE9B,WAAWA,OAAE,SAASA,OAAE,MAAM;CAE9B,kBAAkBA,OAAE,SAAS,OAAO;AACrC,CAAC;AAED,MAAa,qBAAqBA,OAAE,OAAO;CAC1C,WAAWA,OAAE,SAASA,OAAE,MAAM;CAE9B,QAAQA,OAAE,SAASA,OAAE,MAAM;CAE3B,UAAUA,OAAE,SAASA,OAAE,MAAM;CAC7B,WAAWA,OAAE,SAASA,OAAE,MAAM;CAE9B,IAAIA,OAAE,SAASA,OAAE,MAAM;CAEvB,kBAAkBA,OAAE,SAAS,OAAO;AACrC,CAAC;AAED,MAAa,sBAAsBA,OAAE,OAAO;CAC3C,WAAWA,OAAE;CACb,OAAOA,OAAE;CACT,SAASA,OAAE,SAASA,OAAE,MAAM;CAC5B,aAAaA,OAAE,SAASA,OAAE,MAAM;CAChC,UAAUA,OAAE,SAASA,OAAE,SAAS;EAAC;EAAQ;EAAW;CAAU,CAAC,CAAC;CAEhE,YAAY;CACZ,kBAAkBA,OAAE,SAASA,OAAE,MAAM;AACtC,CAAC;AAED,MAAa,oBAAoBA,OAAE,OAAO;CACzC,SAASA,OAAE;CACX,aAAaA,OAAE,SAASA,OAAE,MAAM;CAChC,SAASA,OAAE,SAASA,OAAE,MAAM;CAC5B,WAAW;CACX,eAAeA,OAAE,SAASA,OAAE,MAAM;AACnC,CAAC"}
+{"version":3,"file":"schemas.js","names":["S"],"sources":["../src/schemas.ts"],"sourcesContent":["/**\n * Copyright 2026 ResQ Systems, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { Schema as S } from \"effect\";\n\n/**\n * A non-empty, absolute http(s) URL. Validated with a pattern check (blocks\n * `javascript:`/relative hrefs) but decoded as a plain `string`, so template\n * props stay ergonomic. Exported for consumers building their own templates.\n */\nexport const HttpUrl = S.String.check(S.isPattern(/^https?:\\/\\/\\S+$/i));\n\n/**\n * A single, syntactically-valid recipient email address (branded).\n *\n * The pattern mirrors `@resq-systems/security`'s `EmailSchema` — one `@`, a\n * dotted domain, and a 2+ character TLD, or a Punycode/IDN `xn--…` TLD (e.g.\n * `.xn--p1ai` for `.рф`) so internationalized domains are not rejected. Because\n * the character classes admit no whitespace or control characters and the check\n * is anchored (`^…$`), it also rejects the CR/LF that underpins SMTP header\n * injection: a `to` smuggling `\"…\\r\\nBcc: attacker@evil\"` into a provider that\n * concatenates headers is a type-*and*-runtime error at the boundary, not a\n * silent extra recipient.\n *\n * The {@link EmailAddress} brand marks a string that has cleared this check, so\n * a validated address is not interchangeable with a raw `string` downstream\n * (the `to` field on the decoded mailer payload and the rendered email).\n */\nexport const EmailAddress = S.String.check(\n\tS.isPattern(/^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.(?:[A-Za-z]{2,}|xn--[A-Za-z0-9-]+)$/),\n).pipe(S.brand(\"EmailAddress\"));\n\n/** A recipient address that has passed {@link EmailAddress} validation. */\nexport type EmailAddress = typeof EmailAddress.Type;\n\n/**\n * Compliance class of an email send. `transactional` skips unsubscribe UI;\n * `marketing` requires an unsubscribe affordance in the legal footer.\n */\nexport const emailCategory = S.Literals([\"transactional\", \"marketing\"]);\nexport type EmailCategory = typeof emailCategory.Type;\n\nexport const otpData = S.Struct({\n\tcode: S.NonEmptyString,\n\tfirstName: S.optional(S.String),\n\texpiresInMinutes: S.optional(S.Number),\n});\n\nexport const welcomeData = S.Struct({\n\tfirstName: S.NonEmptyString,\n\tverifyUrl: S.optional(HttpUrl),\n});\n\nexport const passwordResetData = S.Struct({\n\tfirstName: S.optional(S.String),\n\tresetUrl: HttpUrl,\n\texpiresInMinutes: S.optional(S.Number),\n});\n\nexport const notificationData = S.Struct({\n\ttitle: S.NonEmptyString,\n\tbody: S.NonEmptyString,\n\tseverity: S.optional(S.Literals([\"info\", \"success\", \"warning\", \"error\"])),\n\tactionUrl: S.optional(HttpUrl),\n\tactionLabel: S.optional(S.String),\n});\n\nexport const incidentAlertData = S.Struct({\n\tincidentId: S.NonEmptyString,\n\ttitle: S.NonEmptyString,\n\tseverity: S.Literals([\"info\", \"warning\", \"critical\"]),\n\tsummary: S.NonEmptyString,\n\tlocation: S.optional(S.String),\n\t// Preformatted timestamp string (caller formats/localizes) to avoid\n\t// timezone/format ambiguity inside the email.\n\tdetectedAt: S.optional(S.String),\n\tdashboardUrl: HttpUrl,\n});\n\nexport const passwordChangedData = S.Struct({\n\tfirstName: S.optional(S.String),\n\t// Preformatted timestamp string (caller formats/localizes).\n\tchangedAt: S.optional(S.String),\n\t// Where to secure the account if the change was not authorized.\n\tsecureAccountUrl: S.optional(HttpUrl),\n});\n\nexport const newDeviceLoginData = S.Struct({\n\tfirstName: S.optional(S.String),\n\t// Human-readable client, e.g. \"Chrome on macOS\".\n\tdevice: S.optional(S.String),\n\t// Human-readable place, e.g. \"Newark, DE, USA\".\n\tlocation: S.optional(S.String),\n\tipAddress: S.optional(S.String),\n\t// Preformatted timestamp string (caller formats/localizes).\n\tat: S.optional(S.String),\n\t// Where to review activity / secure the account if the sign-in was not the recipient.\n\tsecureAccountUrl: S.optional(HttpUrl),\n});\n\nexport const missionApprovalData = S.Struct({\n\tmissionId: S.NonEmptyString,\n\ttitle: S.NonEmptyString,\n\tsummary: S.optional(S.String),\n\trequestedBy: S.optional(S.String),\n\tseverity: S.optional(S.Literals([\"info\", \"warning\", \"critical\"])),\n\t// Approver sign-off link (e.g. the HCE mission-approval route).\n\tapproveUrl: HttpUrl,\n\texpiresInMinutes: S.optional(S.Number),\n});\n\nexport const orgInvitationData = S.Struct({\n\torgName: S.NonEmptyString,\n\tinviterName: S.optional(S.String),\n\torgRole: S.optional(S.String),\n\tacceptUrl: HttpUrl,\n\texpiresInDays: S.optional(S.Number),\n});\n\n/** Inferred `data` types for the built-in templates (used for component props). */\nexport type OtpData = typeof otpData.Type;\nexport type WelcomeData = typeof welcomeData.Type;\nexport type PasswordResetData = typeof passwordResetData.Type;\nexport type NotificationData = typeof notificationData.Type;\nexport type IncidentAlertData = typeof incidentAlertData.Type;\nexport type PasswordChangedData = typeof passwordChangedData.Type;\nexport type NewDeviceLoginData = typeof newDeviceLoginData.Type;\nexport type MissionApprovalData = typeof missionApprovalData.Type;\nexport type OrgInvitationData = typeof orgInvitationData.Type;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,UAAUA,OAAE,OAAO,MAAMA,OAAE,UAAU,mBAAmB,CAAC;;;;;;;;;;;;;;;;;AAkBtE,MAAa,eAAeA,OAAE,OAAO,MACpCA,OAAE,UAAU,wEAAwE,CACrF,CAAC,CAAC,KAAKA,OAAE,MAAM,cAAc,CAAC;;;;;AAS9B,MAAa,gBAAgBA,OAAE,SAAS,CAAC,iBAAiB,WAAW,CAAC;AAGtE,MAAa,UAAUA,OAAE,OAAO;CAC/B,MAAMA,OAAE;CACR,WAAWA,OAAE,SAASA,OAAE,MAAM;CAC9B,kBAAkBA,OAAE,SAASA,OAAE,MAAM;AACtC,CAAC;AAED,MAAa,cAAcA,OAAE,OAAO;CACnC,WAAWA,OAAE;CACb,WAAWA,OAAE,SAAS,OAAO;AAC9B,CAAC;AAED,MAAa,oBAAoBA,OAAE,OAAO;CACzC,WAAWA,OAAE,SAASA,OAAE,MAAM;CAC9B,UAAU;CACV,kBAAkBA,OAAE,SAASA,OAAE,MAAM;AACtC,CAAC;AAED,MAAa,mBAAmBA,OAAE,OAAO;CACxC,OAAOA,OAAE;CACT,MAAMA,OAAE;CACR,UAAUA,OAAE,SAASA,OAAE,SAAS;EAAC;EAAQ;EAAW;EAAW;CAAO,CAAC,CAAC;CACxE,WAAWA,OAAE,SAAS,OAAO;CAC7B,aAAaA,OAAE,SAASA,OAAE,MAAM;AACjC,CAAC;AAED,MAAa,oBAAoBA,OAAE,OAAO;CACzC,YAAYA,OAAE;CACd,OAAOA,OAAE;CACT,UAAUA,OAAE,SAAS;EAAC;EAAQ;EAAW;CAAU,CAAC;CACpD,SAASA,OAAE;CACX,UAAUA,OAAE,SAASA,OAAE,MAAM;CAG7B,YAAYA,OAAE,SAASA,OAAE,MAAM;CAC/B,cAAc;AACf,CAAC;AAED,MAAa,sBAAsBA,OAAE,OAAO;CAC3C,WAAWA,OAAE,SAASA,OAAE,MAAM;CAE9B,WAAWA,OAAE,SAASA,OAAE,MAAM;CAE9B,kBAAkBA,OAAE,SAAS,OAAO;AACrC,CAAC;AAED,MAAa,qBAAqBA,OAAE,OAAO;CAC1C,WAAWA,OAAE,SAASA,OAAE,MAAM;CAE9B,QAAQA,OAAE,SAASA,OAAE,MAAM;CAE3B,UAAUA,OAAE,SAASA,OAAE,MAAM;CAC7B,WAAWA,OAAE,SAASA,OAAE,MAAM;CAE9B,IAAIA,OAAE,SAASA,OAAE,MAAM;CAEvB,kBAAkBA,OAAE,SAAS,OAAO;AACrC,CAAC;AAED,MAAa,sBAAsBA,OAAE,OAAO;CAC3C,WAAWA,OAAE;CACb,OAAOA,OAAE;CACT,SAASA,OAAE,SAASA,OAAE,MAAM;CAC5B,aAAaA,OAAE,SAASA,OAAE,MAAM;CAChC,UAAUA,OAAE,SAASA,OAAE,SAAS;EAAC;EAAQ;EAAW;CAAU,CAAC,CAAC;CAEhE,YAAY;CACZ,kBAAkBA,OAAE,SAASA,OAAE,MAAM;AACtC,CAAC;AAED,MAAa,oBAAoBA,OAAE,OAAO;CACzC,SAASA,OAAE;CACX,aAAaA,OAAE,SAASA,OAAE,MAAM;CAChC,SAASA,OAAE,SAASA,OAAE,MAAM;CAC5B,WAAW;CACX,eAAeA,OAAE,SAASA,OAAE,MAAM;AACnC,CAAC"}

package/lib/suite.d.ts

@@ -1,3 +1,4 @@
+import { EmailAddress } from "./schemas.js";
 import { Mailer } from "./mailer.js";
 //#region src/suite.d.ts
 /**
@@ -22,7 +23,7 @@ import { Mailer } from "./mailer.js";
  */
 declare const resqMailer: Mailer<{
   readonly name: "incident-alert";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly incidentId: string;
     readonly title: string;
@@ -36,7 +37,7 @@ declare const resqMailer: Mailer<{
   readonly unsubscribeUrl?: string;
 } | {
   readonly name: "mission-approval";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly missionId: string;
     readonly title: string;
@@ -50,7 +51,7 @@ declare const resqMailer: Mailer<{
   readonly unsubscribeUrl?: string;
 } | {
   readonly name: "new-device-login";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly firstName?: string | undefined;
     readonly device?: string | undefined;
@@ -63,7 +64,7 @@ declare const resqMailer: Mailer<{
   readonly unsubscribeUrl?: string;
 } | {
   readonly name: "notification";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly title: string;
     readonly body: string;
@@ -75,7 +76,7 @@ declare const resqMailer: Mailer<{
   readonly unsubscribeUrl?: string;
 } | {
   readonly name: "org-invitation";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly orgName: string;
     readonly inviterName?: string | undefined;
@@ -87,7 +88,7 @@ declare const resqMailer: Mailer<{
   readonly unsubscribeUrl?: string;
 } | {
   readonly name: "otp";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly code: string;
     readonly firstName?: string | undefined;
@@ -97,7 +98,7 @@ declare const resqMailer: Mailer<{
   readonly unsubscribeUrl?: string;
 } | {
   readonly name: "password-changed";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly firstName?: string | undefined;
     readonly changedAt?: string | undefined;
@@ -107,7 +108,7 @@ declare const resqMailer: Mailer<{
   readonly unsubscribeUrl?: string;
 } | {
   readonly name: "password-reset";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly firstName?: string | undefined;
     readonly resetUrl: string;
@@ -117,7 +118,7 @@ declare const resqMailer: Mailer<{
   readonly unsubscribeUrl?: string;
 } | {
   readonly name: "welcome";
-  readonly to: string;
+  readonly to: EmailAddress;
   readonly data: {
     readonly firstName: string;
     readonly verifyUrl?: string | undefined;

package/lib/suite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"suite.d.ts","names":[],"sources":["../src/suite.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;cAwBa,YAAA"}
+{"version":3,"file":"suite.d.ts","names":[],"sources":["../src/suite.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;cAwBa;;eAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@resq-systems/email-templates",
-	"version": "0.3.0",
+	"version": "0.4.0",
 	"description": "Type-safe transactional email templates: an Effect Schema contract, React Email components, headless render-to-html/text, and an optional Resend sender",
 	"license": "Apache-2.0",
 	"author": {