@softure-ai/mailing 0.0.0-stage → 0.1.6

package/dist/server/options.js

@@ -0,0 +1,22 @@
+// The mailing options and routes of the running app, read from the configuration.
+import { getModule } from "@softure-ai/core";
+const MODULE_ID = "mailing";
+/** The enabled module. Throws when the app did not enable it: sending then is a bug. */
+export function getMailingModule(config) {
+    const module = getModule(config, MODULE_ID);
+    if (module === undefined) {
+        throw new Error("@softure-ai/mailing: the module is not enabled; add mailing({ ... }) to modules in softure.config.ts");
+    }
+    return module;
+}
+/** The module's options. Throws when the app did not enable it. */
+export function getMailingOptions(config) {
+    // The module factory parsed these options with mailingOptionsSchema.
+    return getMailingModule(config).options;
+}
+/** The module's routes, with the app's overrides. Throws when the app did not enable it. */
+export function getMailingRoutes(config) {
+    // The manifest declares both routes; the factory only replaces their paths.
+    return getMailingModule(config).routes;
+}
+//# sourceMappingURL=options.js.map

package/dist/server/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/server/options.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,OAAO,EAAE,SAAS,EAA6C,MAAM,kBAAkB,CAAC;AAGxF,MAAM,SAAS,GAAG,SAAS,CAAC;AAQ5B,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sGAAsG,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,MAAqB;IACrD,qEAAqE;IACrE,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAyB,CAAC;AAC5D,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,4EAA4E;IAC5E,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,MAAkC,CAAC;AACrE,CAAC"}

package/dist/server/send-mail.d.ts

@@ -0,0 +1,19 @@
+import { type SoftureConfig } from "@softure-ai/core";
+import type { Queryable } from "@softure-ai/db";
+import { type OutgoingMail, type SendMailOptions, type SendMailResult } from "../contract.js";
+/**
+ * What `sendMail` needs: the app's configuration and, for list mail, the database handle (the
+ * suppression check reads it). Transactional mail needs no `db`.
+ */
+export interface MailContext {
+    readonly config: SoftureConfig;
+    readonly db?: Queryable;
+}
+/**
+ * Sends `mail` and resolves with the provider's message id or a `mailing.*` code:
+ * `invalid_input` (fix the input), `rejected` (do not retry), `unavailable` (retry later with the
+ * same `idempotencyKey`), `suppressed` (a list mail to someone who unsubscribed; do not retry).
+ * Throws only when the module is not enabled, or for list mail without `context.db`.
+ */
+export declare function sendMail(context: MailContext, mail: OutgoingMail, options?: SendMailOptions): Promise<SendMailResult>;
+//# sourceMappingURL=send-mail.d.ts.map

package/dist/server/send-mail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"send-mail.d.ts","sourceRoot":"","sources":["../../src/server/send-mail.ts"],"names":[],"mappings":"AAKA,OAAO,EAAW,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAgE,KAAK,YAAY,EAA8C,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAQxM;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC;CACzB;AAID;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CA2B/H"}

package/dist/server/send-mail.js

@@ -0,0 +1,129 @@
+// Sends one mail through the configured provider. Ported from FIRE_TRACKER `src/lib/mail.ts` with
+// its three rules: it never throws for a failed send (every failure is a result), nothing of the
+// mail (address, subject, body, key) reaches a log or the result, and `headers` cannot replace the
+// envelope or the sender. List mail (any kind but `transactional`) also gets a signed unsubscribe
+// link in a footer and the RFC 8058 headers, and is refused for a recipient who unsubscribed.
+import { err, ok } from "@softure-ai/core";
+import { TRANSACTIONAL_KIND } from "../contract.js";
+import { addHtmlFooter, addTextFooter, getListUnsubscribeHeaders } from "./list-mail.js";
+import { getMailingModule, getMailingOptions } from "./options.js";
+import { isSuppressed } from "./suppressions.js";
+import { buildUnsubscribeLinks, MIN_UNSUBSCRIBE_SECRET_LENGTH, readUnsubscribeSecrets, UNSUBSCRIBE_SECRET_ENV } from "./unsubscribe-link.js";
+import { validateMail } from "./validate-mail.js";
+/**
+ * Sends `mail` and resolves with the provider's message id or a `mailing.*` code:
+ * `invalid_input` (fix the input), `rejected` (do not retry), `unavailable` (retry later with the
+ * same `idempotencyKey`), `suppressed` (a list mail to someone who unsubscribed; do not retry).
+ * Throws only when the module is not enabled, or for list mail without `context.db`.
+ */
+export async function sendMail(context, mail, options = {}) {
+    const { from, replyTo, provider, timeoutMs } = getMailingOptions(context.config);
+    const validation = validateMail(mail, options);
+    if (!validation.ok) {
+        logFailure(provider, "mailing.invalid_input", { fields: validation.fields });
+        return err("mailing.invalid_input");
+    }
+    const { idempotencyKey, kind, ...content } = validation.value;
+    let message = content;
+    if (kind !== TRANSACTIONAL_KIND) {
+        const listMail = await prepareListMail(context, validation.value);
+        if (!listMail.ok) {
+            logFailure(provider, listMail.error, { cause: listMail.cause });
+            return err(listMail.error);
+        }
+        message = listMail.value;
+    }
+    const outcome = await callProvider(provider, { ...message, from, replyTo: replyTo ?? null, idempotencyKey }, timeoutMs);
+    if (outcome.status === "sent") {
+        return ok({ id: outcome.id, provider: provider.name });
+    }
+    const code = `mailing.${outcome.status}`;
+    logFailure(provider, code, { status: outcome.httpStatus });
+    return err(code);
+}
+/**
+ * A list mail with its footer and headers, or why it must not go out. Fails closed: without the
+ * secret, or when the suppression list cannot be read, nothing is sent.
+ */
+async function prepareListMail(context, mail) {
+    if (context.db === undefined) {
+        throw new Error("@softure-ai/mailing: list mail needs the database handle; call sendMail({ config, db }, ...)");
+    }
+    const secret = readUnsubscribeSecrets().current;
+    if (secret === null) {
+        console.error(`mailing: list mail needs ${UNSUBSCRIBE_SECRET_ENV} (at least ${String(MIN_UNSUBSCRIBE_SECRET_LENGTH)} characters) to sign unsubscribe links`);
+        return { ok: false, error: "mailing.unavailable", cause: "no_unsubscribe_secret" };
+    }
+    let suppressed;
+    try {
+        suppressed = await isSuppressed({ db: context.db }, mail.to);
+    }
+    catch {
+        // The error text can carry the query parameters, the recipient key among them.
+        return { ok: false, error: "mailing.unavailable", cause: "suppressions_unreadable" };
+    }
+    if (suppressed)
+        return { ok: false, error: "mailing.suppressed", cause: "unsubscribed" };
+    const links = buildUnsubscribeLinks(context.config, mail.to, secret);
+    // The module factory merged the dictionaries; their shape is the module's own.
+    const copy = getMailingModule(context.config).messages[context.config.locale].footer;
+    return {
+        ok: true,
+        value: {
+            to: mail.to,
+            subject: mail.subject,
+            text: addTextFooter(mail.text, links, copy),
+            html: mail.html === null ? null : addHtmlFooter(mail.html, links, copy),
+            headers: { ...mail.headers, ...getListUnsubscribeHeaders(links) },
+        },
+    };
+}
+/**
+ * The provider's outcome, `unavailable` when it throws, answers something else or outlives the
+ * timeout. The timer races the provider, so one that ignores its signal cannot hang the caller.
+ */
+async function callProvider(provider, message, timeoutMs) {
+    const controller = new AbortController();
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => {
+            controller.abort(new DOMException("mailing: the provider did not answer in time", "TimeoutError"));
+            resolve({ status: "unavailable" });
+        }, timeoutMs);
+    });
+    const sending = provider
+        .send(message, { signal: controller.signal })
+        .then(readOutcome, () => ({ status: "unavailable" }));
+    try {
+        return await Promise.race([sending, timeout]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** A provider's answer, narrowed: anything that is not a known outcome reads as `unavailable`. */
+function readOutcome(outcome) {
+    if (typeof outcome !== "object" || outcome === null)
+        return { status: "unavailable" };
+    const { status, id, httpStatus } = outcome;
+    if (status === "sent") {
+        return typeof id === "string" && id !== "" ? { status, id } : { status: "unavailable" };
+    }
+    if (status === "rejected" || status === "unavailable") {
+        return typeof httpStatus === "number" ? { status, httpStatus } : { status };
+    }
+    return { status: "unavailable" };
+}
+/**
+ * The module's only log line. Deliberately takes nothing but the provider, the code, a status,
+ * field names and a fixed cause: anything added "for diagnosis" is where an address leaks first.
+ */
+function logFailure(provider, code, details) {
+    const parts = [`provider=${provider.name}`, `reason=${code.slice("mailing.".length)}`, `status=${details.status === undefined ? "none" : String(details.status)}`];
+    if (details.fields !== undefined)
+        parts.push(`fields=${details.fields.join(",")}`);
+    if (details.cause !== undefined)
+        parts.push(`cause=${details.cause}`);
+    console.error(`mailing: send failed ${parts.join(" ")}`);
+}
+//# sourceMappingURL=send-mail.js.map

package/dist/server/send-mail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"send-mail.js","sourceRoot":"","sources":["../../src/server/send-mail.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,iGAAiG;AACjG,mGAAmG;AACnG,kGAAkG;AAClG,8FAA8F;AAC9F,OAAO,EAAE,GAAG,EAAE,EAAE,EAAsB,MAAM,kBAAkB,CAAC;AAE/D,OAAO,EAAE,kBAAkB,EAAsJ,MAAM,gBAAgB,CAAC;AAExM,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC7I,OAAO,EAAE,YAAY,EAAkB,MAAM,oBAAoB,CAAC;AAalE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAoB,EAAE,IAAkB,EAAE,UAA2B,EAAE;IACpG,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAEjF,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,UAAU,CAAC,QAAQ,EAAE,uBAAuB,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,OAAO,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC;IAC9D,IAAI,OAAO,GAAgB,OAAO,CAAC;IACnC,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YAChE,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,cAAc,EAAE,EAAE,SAAS,CAAC,CAAC;IACxH,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAqB,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC;IAC3D,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAMD;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,OAAoB,EAAE,IAAe;IAClE,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,EAAE,CAAC,OAAO,CAAC;IAChD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,4BAA4B,sBAAsB,cAAc,MAAM,CAAC,6BAA6B,CAAC,wCAAwC,CAAC,CAAC;QAC7J,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,YAAY,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;QAC/E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,UAAU;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IAEzF,MAAM,KAAK,GAAG,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACrE,+EAA+E;IAC/E,MAAM,IAAI,GAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAqB,CAAC,MAAM,CAAC;IAC1G,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC;YAC3C,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC;YACvE,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,yBAAyB,CAAC,KAAK,CAAC,EAAE;SAClE;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAC,QAAsB,EAAE,OAA4C,EAAE,SAAiB;IACjH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAgD,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,EAAE;QACvD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,UAAU,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,8CAA8C,EAAE,cAAc,CAAC,CAAC,CAAC;YACnG,OAAO,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QACrC,CAAC,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ;SACrB,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;SAC5C,IAAI,CAAC,WAAW,EAAE,GAAoB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,SAAS,WAAW,CAAC,OAAgB;IACnC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtF,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,OAAmE,CAAC;IACvG,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QACtD,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CACjB,QAAsB,EACtB,IAAsB,EACtB,OAAmG;IAEnG,MAAM,KAAK,GAAG,CAAC,YAAY,QAAQ,CAAC,IAAI,EAAE,EAAE,UAAU,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnK,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACtE,OAAO,CAAC,KAAK,CAAC,wBAAwB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC3D,CAAC"}

package/dist/server/suppressions.d.ts

@@ -0,0 +1,27 @@
+import { type ModuleContext, type Result } from "@softure-ai/core";
+import type { Queryable } from "@softure-ai/db";
+import type { SuppressionSource, UnsubscribeErrorCode } from "../contract.js";
+import { type Env, type UnsubscribeToken } from "./unsubscribe-link.js";
+export type SuppressionContext = ModuleContext<Queryable>;
+/** Whether `address` unsubscribed. Throws on a database failure: callers decide how to fail. */
+export declare function isSuppressed(ctx: Pick<SuppressionContext, "db">, address: string): Promise<boolean>;
+/**
+ * Unsubscribes `address` from list mail, for an operator's script or another module (a bounce or
+ * complaint handler). Throws on a database failure.
+ */
+export declare function suppressRecipient(ctx: SuppressionContext, address: string, source?: SuppressionSource): Promise<void>;
+/**
+ * Lifts the opt-out of `address` when the recipient made it themselves (`page`, `one-click`), for a
+ * module that just recorded their new explicit consent, in that consent's transaction. An
+ * `operator` row (a bounce, a complaint, a script) stays. Returns whether a row was lifted.
+ * Throws on a database failure.
+ */
+export declare function liftSuppression(ctx: Pick<SuppressionContext, "db">, address: string): Promise<boolean>;
+/**
+ * Unsubscribes the recipient of a signed link and runs `onUnsubscribed` in the same transaction,
+ * also when the recipient had already unsubscribed (a retried one-click heals a missed hook). The
+ * signature is checked before the database is touched; a link that does not verify is
+ * `mailing.invalid_link`. Throws on a database failure or when the hook throws (nothing is stored).
+ */
+export declare function unsubscribe(ctx: SuppressionContext, token: UnsubscribeToken | null, source: Exclude<SuppressionSource, "operator">, env?: Env): Promise<Result<undefined, UnsubscribeErrorCode>>;
+//# sourceMappingURL=suppressions.d.ts.map

package/dist/server/suppressions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/server/suppressions.ts"],"names":[],"mappings":"AAKA,OAAO,EAAW,KAAK,aAAa,EAAE,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAmE,KAAK,GAAG,EAAE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzI,MAAM,MAAM,kBAAkB,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;AAE1D,gGAAgG;AAChG,wBAAsB,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOzG;AAOD;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAE,iBAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvI;AAKD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAM5G;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE,gBAAgB,GAAG,IAAI,EAC9B,MAAM,EAAE,OAAO,CAAC,iBAAiB,EAAE,UAAU,CAAC,EAC9C,GAAG,GAAE,GAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,CAUlD"}

package/dist/server/suppressions.js

@@ -0,0 +1,64 @@
+// The suppression list: who unsubscribed from list mail. Rows hold the recipient key, never the
+// address. Writes are idempotent (a second opt-out keeps the first row), so a mail client that
+// retries its one-click POST, or a person who clicks twice, changes nothing. A verified unsubscribe
+// also runs the app's `onUnsubscribed` hook in the same transaction; a new explicit consent lifts
+// the recipient's own opt-out (`liftSuppression`).
+import { err, ok } from "@softure-ai/core";
+import { and, eq, inArray } from "drizzle-orm";
+import { suppressions } from "../schema.js";
+import { getMailingOptions } from "./options.js";
+import { getRecipientKey, readUnsubscribeSecrets, verifyUnsubscribeToken } from "./unsubscribe-link.js";
+/** Whether `address` unsubscribed. Throws on a database failure: callers decide how to fail. */
+export async function isSuppressed(ctx, address) {
+    const rows = await ctx.db
+        .select({ recipientKey: suppressions.recipientKey })
+        .from(suppressions)
+        .where(eq(suppressions.recipientKey, getRecipientKey(address)))
+        .limit(1);
+    return rows.length > 0;
+}
+/** Records an opt-out by recipient key. Throws on a database failure. */
+async function recordSuppression(ctx, recipientKey, source) {
+    await ctx.db.insert(suppressions).values({ recipientKey, source, createdAt: ctx.clock.now() }).onConflictDoNothing();
+}
+/**
+ * Unsubscribes `address` from list mail, for an operator's script or another module (a bounce or
+ * complaint handler). Throws on a database failure.
+ */
+export async function suppressRecipient(ctx, address, source = "operator") {
+    await recordSuppression(ctx, getRecipientKey(address), source);
+}
+/** The opt-outs a recipient made themselves; only these can be lifted by a new consent. */
+const OWN_SOURCES = ["one-click", "page"];
+/**
+ * Lifts the opt-out of `address` when the recipient made it themselves (`page`, `one-click`), for a
+ * module that just recorded their new explicit consent, in that consent's transaction. An
+ * `operator` row (a bounce, a complaint, a script) stays. Returns whether a row was lifted.
+ * Throws on a database failure.
+ */
+export async function liftSuppression(ctx, address) {
+    const lifted = await ctx.db
+        .delete(suppressions)
+        .where(and(eq(suppressions.recipientKey, getRecipientKey(address)), inArray(suppressions.source, [...OWN_SOURCES])))
+        .returning();
+    return lifted.length > 0;
+}
+/**
+ * Unsubscribes the recipient of a signed link and runs `onUnsubscribed` in the same transaction,
+ * also when the recipient had already unsubscribed (a retried one-click heals a missed hook). The
+ * signature is checked before the database is touched; a link that does not verify is
+ * `mailing.invalid_link`. Throws on a database failure or when the hook throws (nothing is stored).
+ */
+export async function unsubscribe(ctx, token, source, env = process.env) {
+    if (token === null || !verifyUnsubscribeToken(token, readUnsubscribeSecrets(env)))
+        return err("mailing.invalid_link");
+    const { onUnsubscribed } = getMailingOptions(ctx.config);
+    const { recipientKey } = token;
+    await ctx.db.transaction(async (tx) => {
+        const txCtx = { ...ctx, db: tx };
+        await recordSuppression(txCtx, recipientKey, source);
+        await onUnsubscribed?.({ recipientKey, source }, txCtx);
+    });
+    return ok();
+}
+//# sourceMappingURL=suppressions.js.map

package/dist/server/suppressions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppressions.js","sourceRoot":"","sources":["../../src/server/suppressions.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,+FAA+F;AAC/F,oGAAoG;AACpG,kGAAkG;AAClG,mDAAmD;AACnD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAmC,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,sBAAsB,EAAmC,MAAM,uBAAuB,CAAC;AAIzI,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAmC,EAAE,OAAe;IACrF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE;SACtB,MAAM,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC,YAAY,EAAE,CAAC;SACnD,IAAI,CAAC,YAAY,CAAC;SAClB,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;SAC9D,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,iBAAiB,CAAC,GAAuB,EAAE,YAAoB,EAAE,MAAyB;IACvG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,mBAAmB,EAAE,CAAC;AACvH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAuB,EAAE,OAAe,EAAE,SAA4B,UAAU;IACtH,MAAM,iBAAiB,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,2FAA2F;AAC3F,MAAM,WAAW,GAAiC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAExE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAmC,EAAE,OAAe;IACxF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,EAAE;SACxB,MAAM,CAAC,YAAY,CAAC;SACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;SACnH,SAAS,EAAE,CAAC;IACf,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAuB,EACvB,KAA8B,EAC9B,MAA8C,EAC9C,MAAW,OAAO,CAAC,GAAG;IAEtB,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACtH,MAAM,EAAE,cAAc,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACpC,MAAM,KAAK,GAAuB,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QACrD,MAAM,iBAAiB,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QACrD,MAAM,cAAc,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,CAAC;AACd,CAAC"}

package/dist/server/unsubscribe-link.d.ts

@@ -0,0 +1,51 @@
+import type { SoftureConfig } from "@softure-ai/core";
+/** Signs every new link and verifies. */
+export declare const UNSUBSCRIBE_SECRET_ENV = "MAILING_UNSUBSCRIBE_SECRET";
+/** Optional: verifies links signed before a rotation, never signs. */
+export declare const UNSUBSCRIBE_PREVIOUS_SECRET_ENV = "MAILING_UNSUBSCRIBE_SECRET_PREVIOUS";
+/** A shorter secret counts as missing: a guessable key lets anyone mint links. */
+export declare const MIN_UNSUBSCRIBE_SECRET_LENGTH = 32;
+/** The query parameters of both links. */
+export declare const RECIPIENT_PARAM = "r";
+export declare const SIGNATURE_PARAM = "t";
+export type Env = Readonly<Record<string, string | undefined>>;
+/** The key pair a link carries: the recipient key and its signature. */
+export interface UnsubscribeToken {
+    readonly recipientKey: string;
+    readonly signature: string;
+}
+/** Both links of one mail: the same token, two targets. */
+export interface UnsubscribeLinks {
+    /** The page with a button, for the mail's footer (opening it changes nothing). */
+    readonly page: string;
+    /** The RFC 8058 one-click target, for the `List-Unsubscribe` header. */
+    readonly oneClick: string;
+}
+/** The secrets in use: `current` signs, both verify. `current` is null when it is not set. */
+export interface UnsubscribeSecrets {
+    readonly current: string | null;
+    readonly previous: string | null;
+}
+/**
+ * The stored and linked identity of an address: base64url SHA-256 of the trimmed, lowercased
+ * address. Lowercasing the local part merges `Ada@` and `ada@`, which errs on the side of not
+ * mailing someone who opted out.
+ */
+export declare function getRecipientKey(address: string): string;
+/** The signature of a recipient key. */
+export declare function signRecipientKey(recipientKey: string, secret: string): string;
+/** The secrets from the environment; one shorter than 32 characters reads as not set. */
+export declare function readUnsubscribeSecrets(env?: Env): UnsubscribeSecrets;
+/**
+ * Whether the token was signed by the current or the previous secret. Never throws: the shape is
+ * checked first (`timingSafeEqual` throws on buffers of different lengths, and a throw would be a
+ * second, faster answer), then every secret is compared in constant time.
+ */
+export declare function verifyUnsubscribeToken(token: UnsubscribeToken, secrets: UnsubscribeSecrets): boolean;
+/** The two links for `address`, on the app's origin and the module's routes. */
+export declare function buildUnsubscribeLinks(config: SoftureConfig, address: string, secret: string): UnsubscribeLinks;
+/** The token in a link's query (or a form), when both parameters are present once. */
+export declare function readUnsubscribeToken(params: {
+    get(name: string): unknown;
+}): UnsubscribeToken | null;
+//# sourceMappingURL=unsubscribe-link.d.ts.map

package/dist/server/unsubscribe-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsubscribe-link.d.ts","sourceRoot":"","sources":["../../src/server/unsubscribe-link.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD,yCAAyC;AACzC,eAAO,MAAM,sBAAsB,+BAA+B,CAAC;AACnE,sEAAsE;AACtE,eAAO,MAAM,+BAA+B,wCAAwC,CAAC;AACrF,kFAAkF;AAClF,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD,0CAA0C;AAC1C,eAAO,MAAM,eAAe,MAAM,CAAC;AACnC,eAAO,MAAM,eAAe,MAAM,CAAC;AAWnC,MAAM,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAE/D,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,8FAA8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,wCAAwC;AACxC,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,yFAAyF;AACzF,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,GAAiB,GAAG,kBAAkB,CAEjF;AAMD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAWpG;AAED,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAQ9G;AAED,sFAAsF;AACtF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GAAG,gBAAgB,GAAG,IAAI,CAIpG"}

package/dist/server/unsubscribe-link.js

@@ -0,0 +1,78 @@
+// Signed unsubscribe links. Ported from FIRE_TRACKER `src/lib/unsubscribe-link.ts`, with two
+// changes: the link carries a hash of the address instead of a waitlist row id (the module has no
+// recipient table, and the address never appears in a URL), and a previous secret keeps verifying
+// during a rotation. The whole link is a credential: whoever has it can unsubscribe that address,
+// so it never reaches a log, an error or a result.
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { getMailingRoutes } from "./options.js";
+/** Signs every new link and verifies. */
+export const UNSUBSCRIBE_SECRET_ENV = "MAILING_UNSUBSCRIBE_SECRET";
+/** Optional: verifies links signed before a rotation, never signs. */
+export const UNSUBSCRIBE_PREVIOUS_SECRET_ENV = "MAILING_UNSUBSCRIBE_SECRET_PREVIOUS";
+/** A shorter secret counts as missing: a guessable key lets anyone mint links. */
+export const MIN_UNSUBSCRIBE_SECRET_LENGTH = 32;
+/** The query parameters of both links. */
+export const RECIPIENT_PARAM = "r";
+export const SIGNATURE_PARAM = "t";
+/**
+ * Domain separation: the same key signing anything else can never produce a valid unsubscribe
+ * signature. Changing it voids every link already sent, exactly like changing the key.
+ */
+const SIGNED_PREFIX = "softure.mailing.unsubscribe.v1:";
+/** 32 bytes in unpadded base64url. */
+const TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+/**
+ * The stored and linked identity of an address: base64url SHA-256 of the trimmed, lowercased
+ * address. Lowercasing the local part merges `Ada@` and `ada@`, which errs on the side of not
+ * mailing someone who opted out.
+ */
+export function getRecipientKey(address) {
+    return createHash("sha256").update(address.trim().toLowerCase()).digest("base64url");
+}
+/** The signature of a recipient key. */
+export function signRecipientKey(recipientKey, secret) {
+    return createHmac("sha256", secret).update(`${SIGNED_PREFIX}${recipientKey}`).digest("base64url");
+}
+/** The secrets from the environment; one shorter than 32 characters reads as not set. */
+export function readUnsubscribeSecrets(env = process.env) {
+    return { current: readSecret(env[UNSUBSCRIBE_SECRET_ENV]), previous: readSecret(env[UNSUBSCRIBE_PREVIOUS_SECRET_ENV]) };
+}
+function readSecret(value) {
+    return value !== undefined && value.length >= MIN_UNSUBSCRIBE_SECRET_LENGTH ? value : null;
+}
+/**
+ * Whether the token was signed by the current or the previous secret. Never throws: the shape is
+ * checked first (`timingSafeEqual` throws on buffers of different lengths, and a throw would be a
+ * second, faster answer), then every secret is compared in constant time.
+ */
+export function verifyUnsubscribeToken(token, secrets) {
+    if (!TOKEN_PATTERN.test(token.recipientKey) || !TOKEN_PATTERN.test(token.signature))
+        return false;
+    const candidate = Buffer.from(token.signature, "base64url");
+    let isValid = false;
+    for (const secret of [secrets.current, secrets.previous]) {
+        if (secret === null)
+            continue;
+        const expected = Buffer.from(signRecipientKey(token.recipientKey, secret), "base64url");
+        // No early exit: both comparisons run whichever matches.
+        isValid = timingSafeEqual(candidate, expected) || isValid;
+    }
+    return isValid;
+}
+/** The two links for `address`, on the app's origin and the module's routes. */
+export function buildUnsubscribeLinks(config, address, secret) {
+    const recipientKey = getRecipientKey(address);
+    const query = new URLSearchParams({ [RECIPIENT_PARAM]: recipientKey, [SIGNATURE_PARAM]: signRecipientKey(recipientKey, secret) });
+    const routes = getMailingRoutes(config);
+    return {
+        page: `${config.appOrigin}${routes.unsubscribe}?${query.toString()}`,
+        oneClick: `${config.appOrigin}${routes.oneClick}?${query.toString()}`,
+    };
+}
+/** The token in a link's query (or a form), when both parameters are present once. */
+export function readUnsubscribeToken(params) {
+    const recipientKey = params.get(RECIPIENT_PARAM);
+    const signature = params.get(SIGNATURE_PARAM);
+    return typeof recipientKey === "string" && typeof signature === "string" ? { recipientKey, signature } : null;
+}
+//# sourceMappingURL=unsubscribe-link.js.map

package/dist/server/unsubscribe-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unsubscribe-link.js","sourceRoot":"","sources":["../../src/server/unsubscribe-link.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,kGAAkG;AAClG,kGAAkG;AAClG,kGAAkG;AAClG,mDAAmD;AACnD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,yCAAyC;AACzC,MAAM,CAAC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AACnE,sEAAsE;AACtE,MAAM,CAAC,MAAM,+BAA+B,GAAG,qCAAqC,CAAC;AACrF,kFAAkF;AAClF,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD,0CAA0C;AAC1C,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AACnC,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AAEnC;;;GAGG;AACH,MAAM,aAAa,GAAG,iCAAiC,CAAC;AAExD,sCAAsC;AACtC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAwB5C;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACvF,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,gBAAgB,CAAC,YAAoB,EAAE,MAAc;IACnE,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,aAAa,GAAG,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACpG,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,sBAAsB,CAAC,MAAW,OAAO,CAAC,GAAG;IAC3D,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC,EAAE,CAAC;AAC1H,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,6BAA6B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAuB,EAAE,OAA2B;IACzF,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAClG,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC5D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,IAAI,MAAM,KAAK,IAAI;YAAE,SAAS;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;QACxF,yDAAyD;QACzD,OAAO,GAAG,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,OAAO,CAAC;IAC5D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,MAAqB,EAAE,OAAe,EAAE,MAAc;IAC1F,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,CAAC,eAAe,CAAC,EAAE,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAClI,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,IAAI,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE;QACpE,QAAQ,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE;KACtE,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAAC,MAAsC;IACzE,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC9C,OAAO,OAAO,YAAY,KAAK,QAAQ,IAAI,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChH,CAAC"}

package/dist/server/validate-mail.d.ts

@@ -0,0 +1,23 @@
+export interface ValidMail {
+    readonly to: string;
+    readonly subject: string;
+    readonly text: string;
+    readonly html: string | null;
+    readonly headers: Readonly<Record<string, string>>;
+    /** `transactional` or a list kind. */
+    readonly kind: string;
+    readonly idempotencyKey: string | null;
+}
+export type MailValidation = {
+    readonly ok: true;
+    readonly value: ValidMail;
+} | {
+    readonly ok: false;
+    readonly fields: readonly string[];
+};
+/**
+ * Checks one mail and its send options. `fields` lists what failed (`to`, `subject`, `text`,
+ * `html`, `headers`, `kind`, `idempotencyKey`, or `mail` when the input is not an object).
+ */
+export declare function validateMail(mail: unknown, options?: unknown): MailValidation;
+//# sourceMappingURL=validate-mail.d.ts.map

package/dist/server/validate-mail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-mail.d.ts","sourceRoot":"","sources":["../../src/server/validate-mail.ts"],"names":[],"mappings":"AAqCA,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAE3I;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,GAAE,OAAY,GAAG,cAAc,CAajF"}

package/dist/server/validate-mail.js

@@ -0,0 +1,52 @@
+// The boundary check of `sendMail`: a mail and its options are parsed before anything leaves the
+// process. Failures name the fields, never their values (an address is personal data).
+import { z } from "zod";
+import { hasLineBreak, isHeaderName, isIdempotencyKey, isListMailHeader, isMailKind, isReservedHeader, isSingleAddress, MAX_SUBJECT_LENGTH } from "../address.js";
+import { TRANSACTIONAL_KIND } from "../contract.js";
+const headersSchema = z.record(z.string(), z.string()).superRefine((headers, context) => {
+    for (const [name, value] of Object.entries(headers)) {
+        if (!isHeaderName(name) || isReservedHeader(name) || hasLineBreak(value)) {
+            context.addIssue({ code: "custom", message: "invalid or reserved header" });
+        }
+    }
+});
+const mailSchema = z.object({
+    to: z.string().trim().refine(isSingleAddress),
+    subject: z
+        .string()
+        .refine((subject) => subject.trim() !== "" && subject.length <= MAX_SUBJECT_LENGTH && !hasLineBreak(subject)),
+    text: z.string().refine((text) => text.trim() !== ""),
+    html: z
+        .string()
+        .refine((html) => html.trim() !== "")
+        .optional(),
+    headers: headersSchema.optional(),
+    kind: z.string().refine(isMailKind).default(TRANSACTIONAL_KIND),
+}).superRefine((mail, context) => {
+    // The module writes these two on list mail; a second, unsigned copy would confuse clients.
+    if (mail.kind !== TRANSACTIONAL_KIND && Object.keys(mail.headers ?? {}).some(isListMailHeader)) {
+        context.addIssue({ code: "custom", path: ["headers"], message: "list mail gets its unsubscribe headers from the module" });
+    }
+});
+const optionsSchema = z.object({
+    idempotencyKey: z.string().refine(isIdempotencyKey).optional(),
+});
+/**
+ * Checks one mail and its send options. `fields` lists what failed (`to`, `subject`, `text`,
+ * `html`, `headers`, `kind`, `idempotencyKey`, or `mail` when the input is not an object).
+ */
+export function validateMail(mail, options = {}) {
+    const parsedMail = mailSchema.safeParse(mail);
+    const parsedOptions = optionsSchema.safeParse(options ?? {});
+    if (!parsedMail.success || !parsedOptions.success) {
+        const issues = [...(parsedMail.error?.issues ?? []), ...(parsedOptions.error?.issues ?? [])];
+        const fields = new Set(issues.map((issue) => (issue.path.length === 0 ? "mail" : String(issue.path[0]))));
+        return { ok: false, fields: [...fields] };
+    }
+    const { to, subject, text, html, headers, kind } = parsedMail.data;
+    return {
+        ok: true,
+        value: { to, subject, text, html: html ?? null, headers: headers ?? {}, kind, idempotencyKey: parsedOptions.data.idempotencyKey ?? null },
+    };
+}
+//# sourceMappingURL=validate-mail.js.map

package/dist/server/validate-mail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-mail.js","sourceRoot":"","sources":["../../src/server/validate-mail.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,uFAAuF;AACvF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAClK,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IACtF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACzE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC;IAC7C,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,MAAM,IAAI,kBAAkB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/G,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACrD,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;SACpC,QAAQ,EAAE;IACb,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;CAChE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC/B,2FAA2F;IAC3F,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/F,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC,CAAC;IAC7H,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;CAC/D,CAAC,CAAC;AAeH;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAa,EAAE,UAAmB,EAAE;IAC/D,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1G,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC;IACnE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,EAAE;KAC1I,CAAC;AACJ,CAAC"}

package/dist/testing/fake-provider.d.ts

@@ -0,0 +1,24 @@
+import type { MailProvider, ProviderMessage, ProviderOutcome } from "../contract.js";
+/** A captured mail: what the provider received, with the id it answered. */
+export interface CapturedMail extends ProviderMessage {
+    readonly id: string;
+}
+export interface FakeMailProviderOptions {
+    /** A file to append each captured mail to, as one JSON line (`readMailOutbox` reads it). */
+    readonly outboxFile?: string;
+    /**
+     * Decides the outcome per mail, to test failure handling. Return `undefined` (or omit the
+     * option) to accept the mail.
+     */
+    readonly respond?: (message: ProviderMessage) => Exclude<ProviderOutcome, {
+        status: "sent";
+    }> | undefined;
+}
+export interface FakeMailProvider extends MailProvider {
+    /** Every mail accepted so far, oldest first. */
+    readonly sent: readonly CapturedMail[];
+    /** Forgets the captured mail and the idempotency keys. */
+    clear(): void;
+}
+export declare function fakeMailProvider(options?: FakeMailProviderOptions): FakeMailProvider;
+//# sourceMappingURL=fake-provider.d.ts.map

package/dist/testing/fake-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-provider.d.ts","sourceRoot":"","sources":["../../src/testing/fake-provider.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAErF,4EAA4E;AAC5E,MAAM,WAAW,YAAa,SAAQ,eAAe;IACnD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,4FAA4F;IAC5F,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,eAAe,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;CAC3G;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,CAAC;IACvC,0DAA0D;IAC1D,KAAK,IAAI,IAAI,CAAC;CACf;AAED,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,GAAG,gBAAgB,CAoCxF"}

package/dist/testing/fake-provider.js

@@ -0,0 +1,43 @@
+// A provider that sends nothing: it captures mail in memory (`provider.sent`) and, with an outbox
+// file, appends each mail as one JSON line for a test in another process (an e2e against
+// `next start`). It honours idempotency keys like a real provider: a repeated key answers the
+// first id and captures nothing new.
+import { appendFile } from "node:fs/promises";
+export function fakeMailProvider(options = {}) {
+    const sent = [];
+    const idsByKey = new Map();
+    let counter = 0;
+    return {
+        name: "fake",
+        get sent() {
+            return [...sent];
+        },
+        clear() {
+            sent.length = 0;
+            idsByKey.clear();
+        },
+        async send(message) {
+            if (options.outboxFile === undefined && process.env.NODE_ENV === "production") {
+                // In memory, production mail would vanish without a trace.
+                console.error("mailing: fakeMailProvider() refuses to run in production without an outboxFile; configure a real provider");
+                return { status: "unavailable" };
+            }
+            const refusal = options.respond?.(message);
+            if (refusal !== undefined)
+                return refusal;
+            const knownId = message.idempotencyKey === null ? undefined : idsByKey.get(message.idempotencyKey);
+            if (knownId !== undefined)
+                return { status: "sent", id: knownId };
+            counter += 1;
+            const captured = { ...message, headers: { ...message.headers }, id: `fake-${String(counter)}-${crypto.randomUUID()}` };
+            if (options.outboxFile !== undefined) {
+                await appendFile(options.outboxFile, `${JSON.stringify(captured)}\n`, "utf8");
+            }
+            sent.push(captured);
+            if (message.idempotencyKey !== null)
+                idsByKey.set(message.idempotencyKey, captured.id);
+            return { status: "sent", id: captured.id };
+        },
+    };
+}
+//# sourceMappingURL=fake-provider.js.map

package/dist/testing/fake-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-provider.js","sourceRoot":"","sources":["../../src/testing/fake-provider.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,yFAAyF;AACzF,8FAA8F;AAC9F,qCAAqC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAyB9C,MAAM,UAAU,gBAAgB,CAAC,UAAmC,EAAE;IACpE,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,IAAI;YACN,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,KAAK;YACH,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;YAChB,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;gBAC9E,2DAA2D;gBAC3D,OAAO,CAAC,KAAK,CAAC,2GAA2G,CAAC,CAAC;gBAC3H,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACnC,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;YAE1C,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACnG,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;YAElE,OAAO,IAAI,CAAC,CAAC;YACb,MAAM,QAAQ,GAAiB,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC;YACrI,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACrC,MAAM,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACpB,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI;gBAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YACvF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC7C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/testing/index.d.ts

@@ -0,0 +1,3 @@
+export { fakeMailProvider, type CapturedMail, type FakeMailProvider, type FakeMailProviderOptions } from "./fake-provider.js";
+export { readMailOutbox } from "./outbox.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/testing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,KAAK,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC9H,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC"}

package/dist/testing/index.js

@@ -0,0 +1,5 @@
+// Test helpers of @softure-ai/mailing: a provider that captures mail instead of sending it, and a
+// reader for its outbox file. Server-only (it writes files).
+export { fakeMailProvider } from "./fake-provider.js";
+export { readMailOutbox } from "./outbox.js";
+//# sourceMappingURL=index.js.map