@stacksjs/email 0.70.87 → 0.70.88

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/email",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.87",
+  "version": "0.70.88",
   "description": "The Stacks Email integration. Painlessly create & manage your inboxes, templates, and send emails.",
   "author": "Chris Breuer",
   "contributors": [
@@ -58,10 +58,10 @@
     "@stacksjs/ts-cloud": "^0.7.17"
   },
   "devDependencies": {
-    "@stacksjs/cli": "0.70.87",
-    "@stacksjs/config": "0.70.87",
+    "@stacksjs/cli": "0.70.88",
+    "@stacksjs/config": "0.70.88",
     "better-dx": "^0.2.16",
-    "@stacksjs/error-handling": "0.70.87",
-    "@stacksjs/types": "0.70.87"
+    "@stacksjs/error-handling": "0.70.88",
+    "@stacksjs/types": "0.70.88"
   }
 }

package/dist/css-inliner.d.ts

@@ -1,26 +0,0 @@
-/**
- * Inline `<style>` blocks into per-element `style=""` attributes.
- *
- * Simple selectors (class `.x`, id `#x`, tag `p`, and chains like
- * `p.foo` or `.a.b`) are inlined and removed from the source block.
- * Rules that can't be safely inlined (`@media`, pseudo-classes,
- * descendant / sibling combinators) stay in a slimmed-down `<style>`
- * block so clients that DO honour styles can still apply them.
- *
- * Returns the HTML unchanged when `inline: false`. `<style
- * data-inline="false">` blocks are passed through verbatim regardless
- * of `inline`.
- */
-export declare function inlineCss(html: string, options?: InlineCssOptions): string;
-/**
- * Honour the global production-default. Apps that want explicit
- * control should pass `inline` through {@link inlineCss} directly.
- */
-export declare function shouldInlineByDefault(): boolean;
-/**
- * Options accepted by {@link inlineCss}.
- */
-export declare interface InlineCssOptions {
-  inline?: boolean
-  important?: boolean
-}

package/dist/drivers/base.d.ts

@@ -1,14 +0,0 @@
-import type { EmailAddress, EmailDriver, EmailDriverConfig, EmailMessage, EmailResult } from '@stacksjs/types';
-import type { TemplateOptions } from '../template';
-export declare abstract class BaseEmailDriver implements EmailDriver {
-  abstract name: string;
-  protected config: Required<EmailDriverConfig>;
-  constructor(config?: EmailDriverConfig);
-  configure(config: EmailDriverConfig): void;
-  abstract send(message: EmailMessage, options?: TemplateOptions): Promise<EmailResult>;
-  protected validateMessage(message: EmailMessage): boolean;
-  protected formatAddresses(addresses: string | string[] | EmailAddress[] | undefined): string[];
-  protected formatAddressList(value: string | string[] | EmailAddress | EmailAddress[] | undefined): string[];
-  protected handleError(error: unknown, message: EmailMessage): Promise<EmailResult>;
-  protected handleSuccess(message: EmailMessage, messageId?: string): Promise<EmailResult>;
-}

package/dist/drivers/capture.d.ts

@@ -1,55 +0,0 @@
-import { BaseEmailDriver } from './base';
-import type { EmailMessage, EmailResult } from '@stacksjs/types';
-import type { TemplateOptions } from '../template';
-/**
- * Test-only capture driver (stacksjs/stacks#1871 M-12).
- *
- * Records every `mail.send(...)` payload in memory without opening
- * a network socket or writing to disk. Lighter-weight than the `log`
- * driver (which writes inspection files to `storage/logs/mail/` and
- * does template rendering) — chosen by tests that just need to
- * assert "this flow sent that email" without any I/O side effect.
- *
- * Pick this driver when:
- *   - running fast unit tests that shouldn't touch the filesystem
- *   - asserting on the exact message shape (subject/body/headers)
- *     before any driver-specific transformation
- *   - writing tests that mutate captured state and need
- *     `CaptureEmailDriver.clear()` between cases
- *
- * The `log` driver remains the better fit for local dev (because
- * the disk dump makes inspection easy) and for CI smoke tests that
- * want to surface a render failure visibly. Capture is for unit
- * tests.
- *
- * @example
- * ```ts
- * // bunfig.toml or test setup
- * config.email.default = 'capture'
- *
- * // in tests
- * import { CaptureEmailDriver } from '@stacksjs/email/drivers/capture'
- *
- * beforeEach(() => CaptureEmailDriver.clear())
- *
- * test('signup sends welcome', async () => {
- *   await POST('/api/signup', { email: 'a@b.com' })
- *   const sent = CaptureEmailDriver.all()
- *   expect(sent).toHaveLength(1)
- *   expect(sent[0].subject).toContain('Welcome')
- *   expect(CaptureEmailDriver.last()?.to).toBe('a@b.com')
- * })
- * ```
- */
-export declare interface CapturedMessage extends EmailMessage {
-  sentAt: Date
-  messageId: string
-}
-export declare class CaptureEmailDriver extends BaseEmailDriver {
-  name: string;
-  send(message: EmailMessage, _options?: TemplateOptions): Promise<EmailResult>;
-  static all(): readonly CapturedMessage[];
-  static last(): CapturedMessage | undefined;
-  static count(): number;
-  static clear(): void;
-}

package/dist/drivers/index.d.ts

@@ -1,10 +0,0 @@
-export * as capture from './capture';
-export * as log from './log';
-export * as mailgun from './mailgun';
-export * as mailtrap from './mailtrap';
-// `nodemailer` driver removed — it was a throwing stub that surfaced as a
-// runtime crash on `mail.send()` only after a user had already wired it
-// into config. Use the SMTP driver (`smtp` in MAIL_MAILER) for SMTP-based
-// providers; see stacksjs/stacks#1871 M-7.
-export * as sendgrid from './sendgrid';
-export * as ses from './ses';

package/dist/drivers/log.d.ts

@@ -1,30 +0,0 @@
-import { BaseEmailDriver } from './base';
-import type { EmailMessage, EmailResult } from '@stacksjs/types';
-import type { TemplateOptions } from '../template';
-declare const captured: CapturedEmail[];
-/**
- * Local-only email driver that never opens a network socket. Renders
- * the message to disk so devs can inspect it (and tests can read it),
- * and remembers the last N sends in-memory so tests can assert against
- * them without scraping log output.
- *
- * Pick this driver when:
- *   - running tests (no SMTP credentials, deterministic output)
- *   - local development (no AWS/SendGrid setup, no mailbox spam)
- *   - CI smoke tests where we want to assert "an email was sent"
- *
- * In production, use `ses` / `sendgrid` / `mailgun` / `smtp` instead.
- */
-declare interface CapturedEmail extends EmailMessage {
-  sentAt: Date
-  rendered?: { html?: string, text?: string }
-}
-export declare class LogEmailDriver extends BaseEmailDriver {
-  name: string;
-  send(message: EmailMessage, options?: TemplateOptions): Promise<EmailResult>;
-  static captured(): readonly CapturedEmail[];
-  static reset(): void;
-}
-// Convenience export to mirror the other drivers' module shape — the
-// drivers/index.ts re-exports each driver namespace (`export * as log`).
-export default LogEmailDriver;

package/dist/drivers/mailgun.d.ts

@@ -1,8 +0,0 @@
-import { BaseEmailDriver } from './base';
-import type { EmailMessage, EmailResult } from '@stacksjs/types';
-import type { TemplateOptions } from '../template';
-export declare class MailgunDriver extends BaseEmailDriver {
-  name: string;
-  send(message: EmailMessage, options?: TemplateOptions): Promise<EmailResult>;
-}
-export default MailgunDriver;

package/dist/drivers/mailtrap.d.ts

@@ -1,8 +0,0 @@
-import { BaseEmailDriver } from './base';
-import type { EmailMessage, EmailResult } from '@stacksjs/types';
-import type { TemplateOptions } from '../template';
-export declare class MailtrapDriver extends BaseEmailDriver {
-  name: string;
-  send(message: EmailMessage, options?: TemplateOptions): Promise<EmailResult>;
-}
-export default MailtrapDriver;

package/dist/drivers/sendgrid.d.ts

@@ -1,8 +0,0 @@
-import { BaseEmailDriver } from './base';
-import type { EmailMessage, EmailResult } from '@stacksjs/types';
-import type { TemplateOptions } from '../template';
-export declare class SendGridDriver extends BaseEmailDriver {
-  name: string;
-  send(message: EmailMessage, options?: TemplateOptions): Promise<EmailResult>;
-}
-export default SendGridDriver;

package/dist/drivers/ses.d.ts

@@ -1,8 +0,0 @@
-import { BaseEmailDriver } from './base';
-import type { EmailMessage, EmailResult } from '@stacksjs/types';
-import type { TemplateOptions } from '../template';
-export declare class SESDriver extends BaseEmailDriver {
-  name: string;
-  send(message: EmailMessage, options?: TemplateOptions): Promise<EmailResult>;
-}
-export default SESDriver;

package/dist/drivers/smtp.d.ts

@@ -1,14 +0,0 @@
-import { BaseEmailDriver } from './base';
-import type { EmailAddress, EmailMessage, EmailResult } from '@stacksjs/types';
-import type { TemplateOptions } from '../template';
-/**
- * SMTP Driver for email sending
- * Works with any SMTP server: Mailtrap, Mailgun, SendGrid, SES, etc.
- * Supports STARTTLS (port 587) and direct TLS (port 465)
- */
-export declare class SMTPDriver extends BaseEmailDriver {
-  name: string;
-  send(message: EmailMessage, options?: TemplateOptions): Promise<EmailResult>;
-  protected formatAddresses(addresses: string | string[] | EmailAddress[] | undefined): string[];
-}
-export default SMTPDriver;

package/dist/email.d.ts

@@ -1,39 +0,0 @@
-import type { EmailMessage, EmailResult } from '@stacksjs/types';
-import type { Message } from './types';
-export declare const mail: Mail;
-/** Result returned by email handler callbacks */
-declare interface EmailHandlerResult {
-  message: string
-}
-/** Configuration for the sender address */
-declare interface EmailFromAddress {
-  name: string
-  address: string
-}
-/** Configuration for the Mail singleton */
-declare interface MailConfig {
-  defaultDriver?: string
-}
-/**
- * Email notification class for defining email notifications
- */
-export declare class Email {
-  name: string;
-  subject: string;
-  to: string | string[];
-  from?: EmailFromAddress;
-  template: string;
-  handle?: () => Promise<EmailHandlerResult>;
-  onError?: (error: Error) => Promise<EmailHandlerResult>;
-  onSuccess?: () => void;
-  constructor(options: Message);
-  send(to?: string | string[]): Promise<EmailHandlerResult>;
-}
-export declare class Mail {
-  constructor(options?: MailConfig);
-  send(message: EmailMessage): Promise<EmailResult>;
-  use(driver: string): Mail;
-  queue(message: EmailMessage): Promise<void>;
-  later(delaySeconds: number, message: EmailMessage): Promise<void>;
-  queueOn(queueName: string, message: EmailMessage): Promise<void>;
-}

package/dist/idempotency.d.ts

@@ -1,20 +0,0 @@
-import type { EmailMessage, EmailResult } from '@stacksjs/types';
-/**
- * Look up a cached EmailResult by idempotency key. Returns the
- * reconstructed result when this key has been seen before, `null`
- * when it hasn't. Degrades to "always null" with a startup warn
- * when the `email_idempotency` dedup table isn't migrated yet.
- */
-export declare function findEmailByIdempotencyKey(key: string): Promise<EmailResult | null>;
-/**
- * Record a successful send under its idempotency key. No-op when
- * the table doesn't exist (warn-once already fired from the lookup
- * path) and when the result reports failure (failed sends shouldn't
- * lock out retries).
- *
- * Collision (same key inserted concurrently) is intentionally
- * swallowed: the row already exists, which is exactly what the
- * lookup will return next time. Throwing here would mask an
- * otherwise successful send.
- */
-export declare function recordEmailIdempotency(key: string, message: EmailMessage, result: EmailResult): Promise<void>;

package/dist/index.d.ts

@@ -1,22 +0,0 @@
-export type { InlineCssOptions } from './css-inliner';
-export type { DiscoveredMailable, MailablePreview } from './preview';
-export * from './drivers/index';
-export * from './email';
-export * from './idempotency';
-export * from './suppression';
-export * from './unsubscribe';
-export * from './webhook-dedup';
-export * from './webhook-events';
-export * from './webhook-handlers';
-export * from './webhook-signatures';
-export * from './mailable';
-export * from './template';
-export * from './types';
-export { inlineCss, shouldInlineByDefault } from './css-inliner';
-// Dev-only Mailable preview server (stacksjs/stacks#1900 A3).
-export {
-  discoverMailables,
-  loadSampleProps,
-  renderMailablePreview,
-} from './preview';
-export { renderIndexHtml, renderPreviewHtml } from './preview-ui';

package/dist/index.js

@@ -1,28 +0,0 @@
-// @bun
-var MY=Object.defineProperty;var wY=(J)=>J;function EY(J,Y){this[J]=wY.bind(null,Y)}var y=(J,Y)=>{for(var Z in Y)MY(J,Z,{get:Y[Z],enumerable:!0,configurable:!0,set:EY.bind(Y,Z)})};var S=import.meta.require;var xJ={};y(xJ,{CaptureEmailDriver:()=>a});import{config as CY}from"@stacksjs/config";import{log as SY}from"@stacksjs/logging";var GJ=/^[^\s<>"\\\r\n\t]+@[^\s<>"\\\r\n\t]+$/;function AJ(J,Y){if(typeof J!=="string"||!GJ.test(J))throw Error(`Email ${Y} address is malformed or contains forbidden characters: ${JSON.stringify(J)}`)}function TJ(J){if(/[\r\n]/.test(J))throw Error("Email subject contains forbidden line break characters (CR/LF)")}function A(J){if(!J)return;let Y={};for(let[Z,X]of Object.entries(J)){if(typeof X!=="string")continue;if(/[\r\n]/.test(Z)||/[\r\n]/.test(X))continue;Y[Z]=X}return Object.keys(Y).length>0?Y:void 0}class N{config;constructor(J){this.config={maxRetries:J?.maxRetries||3,retryTimeout:J?.retryTimeout||1000,...J}}configure(J){this.config={...this.config,...J}}validateMessage(J){if(!J.from?.address&&!CY.email.from?.address)throw Error("Email sender address is required either in message or config");if(!J.to||Array.isArray(J.to)&&J.to.length===0)throw Error("At least one recipient is required");if(!J.subject)throw Error("Email subject is required");TJ(J.subject);let Y=(X,$)=>{if(!X)return;AJ(X,$)},Z=(X)=>{if(!X)return[];if(typeof X==="string")return[X];if(Array.isArray(X))return X.flatMap((G)=>typeof G==="string"?[G]:G?.address?[G.address]:[]);let $=X;return $.address?[$.address]:[]};if(J.from)Y(J.from.address,"from");for(let X of Z(J.to))Y(X,"to");for(let X of Z(J.cc))Y(X,"cc");for(let X of Z(J.bcc))Y(X,"bcc");return!0}formatAddresses(J){if(!J)return[];if(typeof J==="string")return[J];return J.map((Y)=>{if(typeof Y==="string")return Y;if(!Y.name)return Y.address;return`${/[",()<>[\]:;@\\]/.test(Y.name)?`"${Y.name.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`:Y.name} <${Y.address}>`})}formatAddressList(J){if(!J)return[];if(Array.isArray(J))return this.formatAddresses(J);if(typeof J==="string")return this.formatAddresses(J);return this.formatAddresses([J])}async handleError(J,Y){let Z=J instanceof Error?J:Error(String(J));SY.error(`[${this.name}] Email sending failed`,{error:Z.message,stack:Z.stack,to:Y.to,subject:Y.subject});let X={message:`Email sending failed: ${Z.message}`,success:!1,provider:this.name};if(Y.onError){let $=Y.onError(Z),G=$ instanceof Promise?await $:$;X={...X,...G,success:!1,provider:this.name}}return X}async handleSuccess(J,Y){let Z={message:"Email sent successfully",success:!0,provider:this.name,messageId:Y};try{if(J.handle){let X=J.handle(),$=X instanceof Promise?await X:X;Z={...Z,...$,success:!0,provider:this.name,messageId:Y}}if(J.onSuccess){let X=J.onSuccess(),$=X instanceof Promise?await X:X;Z={...Z,...$,success:!0,provider:this.name,messageId:Y}}}catch(X){return this.handleError(X,J)}return Z}}var v=[],DJ=1;class a extends N{name="capture";async send(J,Y){try{this.validateMessage(J);let Z=new Date,X=`capture-${Z.getTime()}-${DJ++}`;return v.push({...J,sentAt:Z,messageId:X}),this.handleSuccess(J,X)}catch(Z){return this.handleError(Z,J)}}static all(){return v}static last(){return v[v.length-1]}static count(){return v.length}static clear(){v.length=0,DJ=1}}var gJ={};y(gJ,{default:()=>tY,LogEmailDriver:()=>c});import{mkdir as nY,writeFile as oY}from"fs/promises";import{join as fJ,resolve as uJ}from"path";import{log as pJ}from"@stacksjs/logging";import{config as WJ}from"@stacksjs/config";import{log as uY}from"@stacksjs/logging";import{fs as P}from"@stacksjs/storage";import{defaultsResourcesPath as SJ,resourcesPath as kJ}from"@stacksjs/path";import{join as QJ}from"path";function KJ(J,Y={}){let{inline:Z=!0,important:X=!0}=Y;if(!Z)return J;let $=J,G=[];$=$.replace(/<style\b[^>]*\bdata-inline=["']false["'][^>]*>[\s\S]*?<\/style>/gi,(W)=>{return G.push(W),`\x00STX_PASSTHROUGH_${G.length-1}\x00`});let K=[];if($=$.replace(/<style\b[^>]*>([\s\S]*?)<\/style>/gi,(W,z)=>{return K.push(z),""}),K.length===0)return MJ($,G);let Q=[],F=[];for(let W of K)for(let z of kY(W)){let{selector:V,declarations:q}=z;if(!V||!q)continue;if(wJ(V))Q.push({selector:V,decls:q});else F.push(`${V} { ${q.map((_)=>`${_.prop}: ${_.value};`).join(" ")} }`)}for(let{selector:W,decls:z}of Q)$=EJ($,W,z,X);if(F.length>0){let W=`<style>
-${F.join(`
-`)}
-</style>`;$=/<\/head>/i.test($)?$.replace(/<\/head>/i,`${W}
-</head>`):`${W}
-${$}`}return MJ($,G)}function MJ(J,Y){if(Y.length===0)return J;return J.replace(/\u0000STX_PASSTHROUGH_(\d+)\u0000/g,(Z,X)=>{return Y[Number.parseInt(X,10)]??""})}function kY(J){let Y=J.replace(/\/\*[\s\S]*?\*\//g,""),Z=[],X=0;while(X<Y.length){let $=Y.indexOf("{",X);if($===-1)break;let G=Y.slice(X,$).trim(),K=1,Q=$+1;while(Q<Y.length&&K>0){let W=Y[Q];if(W==="{")K++;else if(W==="}")K--;Q++}let F=Y.slice($+1,Q-1);if(G.startsWith("@")||F.includes("{"))Z.push({selector:G||"@unknown",declarations:yY(F)});else Z.push({selector:G,declarations:bY(F)});X=Q}return Z}function bY(J){return J.split(";").map((Y)=>Y.trim()).filter(Boolean).map((Y)=>{let Z=Y.indexOf(":");if(Z===-1)return null;return{prop:Y.slice(0,Z).trim(),value:Y.slice(Z+1).trim()}}).filter((Y)=>Y!==null)}function yY(J){return[{prop:"",value:J.trim()}]}function wJ(J){if(!J)return!1;if(J.includes(","))return J.split(",").every((Y)=>wJ(Y.trim()));if(J.startsWith("@"))return!1;if(/[\s>+~:[]/.test(J))return!1;return/^[a-z][a-z0-9-]*?$|^([a-z][a-z0-9-]*)?([.#][a-z][\w-]*)+$/i.test(J)}function EJ(J,Y,Z,X){if(Y.includes(",")){let z=J;for(let V of Y.split(","))z=EJ(z,V.trim(),Z,X);return z}let{tag:$,classes:G,ids:K}=vY(Y),F=new RegExp(`<(${$??"[a-z][a-z0-9-]*"})\\b([^>]*?)(/?)>`,"gi"),W=Z.map((z)=>`${z.prop}:${z.value}${X&&!/!important\b/i.test(z.value)?" !important":""};`).join("");return J.replace(F,(z,V,q)=>{if(!hY(q,G,K))return z;return fY(z,q,W)})}function vY(J){let Y=null,Z=[],X=[],$=0;while($<J.length&&/[a-z0-9-]/i.test(J[$]))Y=(Y??"")+J[$],$++;if(Y==="")Y=null;while($<J.length){let G=J[$];if(G!=="."&&G!=="#")break;let K=$+1;while(K<J.length&&/[\w-]/.test(J[K]))K++;let Q=J.slice($+1,K);if(G===".")Z.push(Q);else X.push(Q);$=K}return{tag:Y,classes:Z,ids:X}}function hY(J,Y,Z){if(Y.length>0){let X=J.match(/\bclass\s*=\s*["']([^"']*)["']/i);if(!X)return!1;let $=X[1].split(/\s+/).filter(Boolean);if(!Y.every((G)=>$.includes(G)))return!1}if(Z.length>0){let X=J.match(/\bid\s*=\s*["']([^"']+)["']/i);if(!X)return!1;if(!Z.every(($)=>X[1]===$))return!1}return!0}function fY(J,Y,Z){let X=Y.match(/\bstyle\s*=\s*["']([^"']*)["']/i);if(X){let G=X[1].trim(),K=`${Z}${G}${G.endsWith(";")||G===""?"":";"}`,Q=Y.replace(X[0],`style="${K}"`);return J.replace(Y,Q)}let $=` style="${Z}"`;return J.replace(/(\s*\/?)>$/,`${$}$1>`)}function CJ(){return(globalThis.process?.env?.APP_ENV??globalThis.process?.env?.NODE_ENV??"").toLowerCase()==="production"}class zJ{value;__safeHtml=!0;constructor(J){this.value=J}}function pY(J){return new zJ(J)}function bJ(){let J=WJ.app.primaryColor||"#3b82f6";return{appName:WJ.app.name||"Stacks",appUrl:WJ.app.url||"https://localhost",primaryColor:J,primaryColorDark:cY(J,15),year:new Date().getFullYear()}}function cY(J,Y){let Z=Number.parseInt(J.replace("#",""),16),X=Math.round(2.55*Y),$=Math.max(0,(Z>>16)-X),G=Math.max(0,(Z>>8&255)-X),K=Math.max(0,(Z&255)-X);return`#${(16777216+$*65536+G*256+K).toString(16).slice(1)}`}function gY(J){return J.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}function FJ(J,Y){let Z=J;for(let[X,$]of Object.entries(Y)){let G=X.replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),K=new RegExp(`\\{\\{\\s*${G}\\s*\\}\\}`,"g");Z=Z.replace(K,dY($))}return Z}function dY(J){if(J===null||J===void 0)return"";if(J instanceof zJ)return J.value;return gY(String(J))}var yJ=[(J)=>kJ(QJ("emails",J)),(J)=>SJ(QJ("emails",J))];function vJ(J){for(let Y of yJ){if(J.endsWith(".stx")){let $=Y(J);if(P.existsSync($))return{path:$,type:"stx"};continue}if(J.endsWith(".html")){let $=Y(J);if(P.existsSync($))return{path:$,type:"html"};continue}let Z=Y(`${J}.stx`);if(P.existsSync(Z))return{path:Z,type:"stx"};let X=Y(`${J}.html`);if(P.existsSync(X))return{path:X,type:"html"}}return null}function lY(J){let Y=J.endsWith(".html")?J:`${J}.html`;for(let Z of yJ){let X=Z(Y);if(P.existsSync(X))return P.readFileSync(X,"utf-8")}return null}function mY(J){return lY(`layouts/${J}`)}function hJ(J){return J.replace(/<br\s*\/?>/gi,`
-`).replace(/<\/(p|div|h[1-6]|li|tr)>/gi,`
-`).replace(/<\/td>/gi,"\t").replace(/<[^>]*>/g,"").replace(/&nbsp;/g," ").replace(/&amp;/g,"&").replace(/&lt;/g,"<").replace(/&gt;/g,">").replace(/&quot;/g,'"').replace(/&#39;/g,"'").replace(/&copy;/g,"(c)").replace(/\n\s*\n\s*\n/g,`
-
-`).trim()}async function I(J,Y={}){let{variables:Z={},layout:X="base",subject:$="",inline:G=CJ()}=Y,K={...bJ(),subject:$,...Z},Q=vJ(J);if(!Q)return console.warn(`[Email Template] Template "${J}" not found`),{html:"",text:""};if(Q.type==="stx")try{let{renderEmail:V}=await import("@stacksjs/stx"),q=await V(Q.path,K,{componentsDir:SJ("components/Email")});return{...q,html:KJ(q.html,{inline:G})}}catch(V){return uY.warn(`[email] STX template rendering failed for ${J}: ${V instanceof Error?V.message:String(V)}`),{html:"",text:""}}let F=P.readFileSync(Q.path,"utf-8");F=FJ(F,K);let W;if(X!==!1){let V=mY(X);if(!V)console.warn(`[Email Template] Layout "${X}" not found, using content only`),W=F;else K.content=pY(F),W=FJ(V,K)}else W=F;W=KJ(W,{inline:G});let z=hJ(W);return{html:W,text:z}}function oZ(J,Y={}){let Z={...bJ(),...Y},X=FJ(J,Z),$=hJ(X);return{html:X,text:$}}function iZ(J){return vJ(J)!==null}function rZ(){let J=kJ("emails");if(!P.existsSync(J))return[];let Y=[];function Z(X,$=""){let G=P.readdirSync(X,{withFileTypes:!0});for(let K of G)if(K.isDirectory()&&K.name!=="layouts")Z(QJ(X,K.name),`${$}${K.name}/`);else if(K.isFile()&&(K.name.endsWith(".html")||K.name.endsWith(".stx"))){let Q=K.name.replace(/\.(html|stx)$/,"");if(!Y.includes(`${$}${Q}`))Y.push(`${$}${Q}`)}}return Z(J),Y}var cJ=100,h=[];class c extends N{name="log";resolveDir(){let J=process.env.LOG_MAIL_DIR;if(J)return uJ(J);return uJ(fJ(import.meta.dir,"..","..","..","..","..","logs","mail"))}async send(J,Y){try{this.validateMessage(J);let Z;if(J.template){let z=await I(J.template,Y);if(z)Z={html:z.html,text:z.text}}let X=Z?.html??J.html,$=Z?.text??J.text,G=new Date,K=(J.subject||"no-subject").replace(/[^\w.-]+/g,"-").slice(0,60),Q=`${G.toISOString().replace(/[:.]/g,"-")}-${K}.html`,F=this.resolveDir();try{await nY(F,{recursive:!0});let z=fJ(F,Q),V=X?X:$?`<pre>${rY($)}</pre>`:"<em>(empty body)</em>",q=iY({stamp:G,message:J});await oY(z,`${q}
-${V}
-`)}catch(z){pJ.warn(`[email:log] could not write inspection file: ${z.message}`)}let W=Array.isArray(J.to)?J.to.map((z)=>typeof z==="string"?z:z.address).join(", "):typeof J.to==="string"?J.to:J.to.address;if(pJ.info(`[email:log] would send \u2192 ${W} :: ${J.subject}`),h.push({...J,sentAt:G,rendered:Z}),h.length>cJ)h.splice(0,h.length-cJ);return this.handleSuccess(J,`log-${G.getTime()}`)}catch(Z){return this.handleError(Z,J)}}static captured(){return h}static reset(){h.length=0}}function iY({stamp:J,message:Y}){return["<!--",`  Captured by @stacksjs/email log driver at ${J.toISOString()}`,`  From:    ${qJ(Y.from)}`,`  To:      ${VJ(Y.to)}`,Y.cc?`  Cc:      ${VJ(Y.cc)}`:null,Y.bcc?`  Bcc:     ${VJ(Y.bcc)}`:null,`  Subject: ${Y.subject}`,"-->"].filter(Boolean).join(`
-`)}function qJ(J){if(!J)return"";if(typeof J==="string")return J;let Y=J;return Y.name?`${Y.name} <${Y.address??""}>`:Y.address??""}function VJ(J){if(Array.isArray(J))return J.map(qJ).join(", ");return qJ(J)}function rY(J){return J.replace(/[&<>"']/g,(Y)=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[Y])}var tY=c;var lJ={};y(lJ,{default:()=>aY,MailgunDriver:()=>g});import{Buffer as dJ}from"buffer";import{config as T}from"@stacksjs/config";import{log as LJ}from"@stacksjs/logging";class g extends N{name="mailgun";apiKey=null;domain=null;endpoint=null;getConfig(){if(!this.apiKey||!this.domain||!this.endpoint)this.apiKey=T.services.mailgun?.apiKey??"",this.domain=T.services.mailgun?.domain??"",this.endpoint=T.services.mailgun?.endpoint??"api.mailgun.net";return{apiKey:this.apiKey,domain:this.domain,endpoint:this.endpoint}}async send(J,Y){let{domain:Z}=this.getConfig(),X={provider:this.name,to:J.to,subject:J.subject,domain:Z};LJ.info("Sending email via Mailgun...",X);try{this.validateMessage(J);let $;if(J.template){let W=await I(J.template,Y);if(W&&"html"in W)$=W.html}let G=$||J.html,K=new FormData,Q={address:J.from?.address||T.email.from?.address||"",name:J.from?.name||T.email.from?.name};if(K.append("from",this.formatMailgunAddress(Q)),this.formatMailgunAddresses(J.to).forEach((W)=>K.append("to",W)),J.cc)this.formatMailgunAddresses(J.cc).forEach((W)=>K.append("cc",W));if(J.bcc)this.formatMailgunAddresses(J.bcc).forEach((W)=>K.append("bcc",W));if(K.append("subject",J.subject),J.replyTo){let W=this.formatMailgunAddresses(Array.isArray(J.replyTo)||typeof J.replyTo==="string"?J.replyTo:[J.replyTo]);if(W.length>0)K.append("h:Reply-To",W.join(", "))}if(J.headers){for(let[W,z]of Object.entries(J.headers))if(typeof z==="string")K.append(`h:${W}`,z)}if(G)K.append("html",G);if(J.text)K.append("text",J.text);if(J.attachments)J.attachments.forEach((W)=>{let z=typeof W.content==="string"?W.content:this.arrayBufferToBase64(W.content);K.append("attachment",new Blob([z],{type:W.contentType}),W.filename)});let F=await this.sendWithRetry(K);return this.handleSuccess(J,F.id)}catch($){return this.handleError($,J)}}formatMailgunAddress(J){return J.name?`${J.name} <${J.address}>`:J.address}formatMailgunAddresses(J){if(!J)return[];if(typeof J==="string")return[J];return J.map((Y)=>{if(typeof Y==="string")return Y;if(!Y.name)return Y.address;return`${/[",()<>[\]:;@\\]/.test(Y.name)?`"${Y.name.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`:Y.name} <${Y.address}>`})}arrayBufferToBase64(J){let Y="",Z=new Uint8Array(J),X=Z.byteLength;for(let $=0;$<X;$++)Y+=String.fromCharCode(Z[$]??0);return typeof btoa==="function"?btoa(Y):dJ.from(Y).toString("base64")}async sendWithRetry(J,Y=1){let{apiKey:Z,domain:X,endpoint:$}=this.getConfig(),G=`https://${$}/v3/${X}/messages`,K=dJ.from(`api:${Z}`).toString("base64");try{let Q=await fetch(G,{method:"POST",headers:{Authorization:`Basic ${K}`},body:J});if(!Q.ok){let W=await Q.json();throw Error(`Mailgun API error: ${Q.status} - ${JSON.stringify(W)}`)}let F=await Q.json();return LJ.info(`[${this.name}] Email sent successfully`,{attempt:Y,messageId:F.id}),F}catch(Q){if(Y<(T.services.mailgun?.maxRetries??3)){let F=T.services.mailgun?.retryTimeout??1000;return LJ.warn(`[${this.name}] Email send failed, retrying (${Y}/${T.services.mailgun?.maxRetries??3})`),await new Promise((W)=>setTimeout(W,F)),this.sendWithRetry(J,Y+1)}throw Q}}}var aY=g;var mJ={};y(mJ,{default:()=>eY,MailtrapDriver:()=>d});import{Buffer as sY}from"buffer";import{config as B}from"@stacksjs/config";import{log as OJ}from"@stacksjs/logging";class d extends N{name="mailtrap";host=null;token=null;inboxId=null;getConfig(){if(this.host===null||this.token===null||this.inboxId===null)this.host=B.services.mailtrap?.host??"https://sandbox.api.mailtrap.io/api/send",this.token=B.services.mailtrap?.token??"",this.inboxId=B.services.mailtrap?.inboxId?Number(B.services.mailtrap.inboxId):void 0;return{host:this.host,token:this.token,inboxId:this.inboxId}}async send(J,Y){let{inboxId:Z}=this.getConfig(),X={provider:this.name,to:J.to,subject:J.subject,inboxId:Z};OJ.info("Sending email via Mailtrap...",X);try{this.validateMessage(J);let $;if(J.template)$=await I(J.template,Y);let G=$?.html||J.html,K=this.firstMailtrapAddress(J.replyTo),Q=A(J.headers),F={from:{email:J.from?.address||B.email.from?.address||"",name:J.from?.name||B.email.from?.name},to:this.formatMailtrapAddresses(J.to),...J.cc&&{cc:this.formatMailtrapAddresses(J.cc)},...J.bcc&&{bcc:this.formatMailtrapAddresses(J.bcc)},...K?{reply_to:K}:{},...Q?{headers:Q}:{},subject:J.subject,...G&&{html:G},...J.text&&{text:J.text},...J.attachments&&{attachments:J.attachments.map((z)=>({filename:z.filename,content:typeof z.content==="string"?z.content:this.arrayBufferToBase64(z.content),type:z.contentType||"application/octet-stream"}))}},W=await this.sendWithRetry(F);return this.handleSuccess(J,W.message_ids?.[0])}catch($){return this.handleError($,J)}}formatMailtrapAddresses(J){if(!J)return[];if(typeof J==="string")return[{email:J}];return J.map((Y)=>{if(typeof Y==="string")return{email:Y};return{email:Y.address,...Y.name&&{name:Y.name}}})}firstMailtrapAddress(J){if(!J)return;if(typeof J==="string")return{email:J};if(Array.isArray(J)){let Y=J[0];if(Y===void 0)return;if(typeof Y==="string")return{email:Y};return{email:Y.address,...Y.name&&{name:Y.name}}}return{email:J.address,...J.name&&{name:J.name}}}arrayBufferToBase64(J){let Y="",Z=new Uint8Array(J),X=Z.byteLength;for(let $=0;$<X;$++)Y+=String.fromCharCode(Z[$]??0);return typeof btoa==="function"?btoa(Y):sY.from(Y).toString("base64")}async sendWithRetry(J,Y=1){let{host:Z,token:X,inboxId:$}=this.getConfig();if(!$)throw Error("Mailtrap inbox ID is required but not provided. Please set MAILTRAP_INBOX_ID in your environment variables.");let G=`${Z}/${$}`;try{let K=await fetch(G,{method:"POST",headers:{Authorization:`Bearer ${X}`,"Content-Type":"application/json"},body:JSON.stringify(J)});if(!K.ok){let F=await K.json();throw Error(`Mailtrap API error: ${K.status} - ${JSON.stringify(F)}`)}let Q=await K.json();return OJ.info(`[${this.name}] Email sent successfully`,{attempt:Y,messageId:Q.message_ids?.[0]}),Q}catch(K){if(Y<(B.services.mailtrap?.maxRetries??3)){let Q=B.services.mailtrap?.retryTimeout??1000;return OJ.warn(`[${this.name}] Email send failed, retrying (${Y}/${B.services.mailtrap?.maxRetries??3})`),await new Promise((F)=>setTimeout(F,Q)),this.sendWithRetry(J,Y+1)}throw K}}}var eY=d;var nJ={};y(nJ,{default:()=>YZ,SendGridDriver:()=>l});import{Buffer as JZ}from"buffer";import{config as k}from"@stacksjs/config";import{log as UJ}from"@stacksjs/logging";class l extends N{name="sendgrid";apiKey=null;getApiKey(){if(!this.apiKey)this.apiKey=k.services.sendgrid?.apiKey??"";return this.apiKey}async send(J,Y){let Z={provider:this.name,to:J.to,subject:J.subject};UJ.info("Sending email via SendGrid...",Z);try{this.validateMessage(J);let X;if(J.template){let z=await I(J.template,Y);if(z&&"html"in z)X=z.html}let $=X||J.html,G=[];if($)G.push({type:"text/html",value:$});if(J.text)G.push({type:"text/plain",value:J.text});if(G.length===0)throw Error("Email must have either HTML or text content");let K=this.firstSendGridAddress(J.replyTo),Q=A(J.headers),F={personalizations:[{to:this.formatSendGridAddresses(J.to),...J.cc&&{cc:this.formatSendGridAddresses(J.cc)},...J.bcc&&{bcc:this.formatSendGridAddresses(J.bcc)},subject:J.subject}],from:{email:J.from?.address||k.email.from?.address||"",name:J.from?.name||k.email.from?.name},...K?{reply_to:K}:{},...Q?{headers:Q}:{},content:G,...J.attachments&&{attachments:J.attachments.map((z)=>({filename:z.filename,content:typeof z.content==="string"?z.content:this.arrayBufferToBase64(z.content),type:z.contentType,disposition:"attachment"}))}},W=await this.sendWithRetry(F);return this.handleSuccess(J,W.headers?.get("x-message-id")??void 0)}catch(X){return this.handleError(X,J)}}formatSendGridAddresses(J){if(!J)return[];if(typeof J==="string")return[{email:J}];return J.map((Y)=>{if(typeof Y==="string")return{email:Y};return{email:Y.address,...Y.name&&{name:Y.name}}})}firstSendGridAddress(J){if(!J)return;if(typeof J==="string")return{email:J};if(Array.isArray(J)){let Y=J[0];if(Y===void 0)return;if(typeof Y==="string")return{email:Y};return{email:Y.address,...Y.name&&{name:Y.name}}}return{email:J.address,...J.name&&{name:J.name}}}arrayBufferToBase64(J){let Y="",Z=new Uint8Array(J),X=Z.byteLength;for(let $=0;$<X;$++)Y+=String.fromCharCode(Z[$]??0);return typeof btoa==="function"?btoa(Y):JZ.from(Y).toString("base64")}async sendWithRetry(J,Y=1){try{let Z=await fetch("https://api.sendgrid.com/v3/mail/send",{method:"POST",headers:{Authorization:`Bearer ${this.getApiKey()}`,"Content-Type":"application/json"},body:JSON.stringify(J)});if(!Z.ok){let X=await Z.json(),$=Error(`SendGrid API error: ${Z.status} - ${JSON.stringify(X)}`);throw $.status=Z.status,$}return UJ.info(`[${this.name}] Email sent successfully`,{attempt:Y}),Z}catch(Z){let X=Z?.status;if(!(typeof X==="number"&&X>=400&&X<500&&X!==429)&&Y<(k.services.sendgrid?.maxRetries??3)){let G=k.services.sendgrid?.retryTimeout??1000;return UJ.warn(`[${this.name}] Email send failed, retrying (${Y}/${k.services.sendgrid?.maxRetries??3})`),await new Promise((K)=>setTimeout(K,G)),this.sendWithRetry(J,Y+1)}throw Z}}}var YZ=l;var rJ={};y(rJ,{default:()=>$Z,SESDriver:()=>m});import{config as D}from"@stacksjs/config";import{SESClient as XZ}from"@stacksjs/ts-cloud";import{Buffer as NJ}from"buffer";function iJ(J){if(/^[\x00-\x7F]*$/.test(J))return J;return`=?UTF-8?B?${NJ.from(J,"utf-8").toString("base64")}?=`}function s(J){let{from:Y,to:Z,cc:X,replyTo:$,subject:G,text:K,html:Q,attachments:F,messageIdDomain:W,customHeaders:z}=J,V=[],q=!!(F&&F.length>0),_=`----=_Part_${Date.now()}_${Math.random().toString(36).substring(2)}`;if(V.push(`From: ${Y}`),V.push(`To: ${Z}`),X)V.push(`Cc: ${X}`);if($)V.push(`Reply-To: ${$}`);if(V.push(`Subject: ${iJ(G)}`),V.push("MIME-Version: 1.0"),V.push(`Date: ${new Date().toUTCString()}`),V.push(`Message-ID: <${Date.now()}.${Math.random().toString(36).substring(2)}@${W||"localhost"}>`),z)for(let[U,E]of Object.entries(z))V.push(`${U}: ${E}`);if(q){let U=_,E=`${_}_alt`;V.push(`Content-Type: multipart/mixed; boundary="${U}"`),V.push(""),V.push(`--${U}`),oJ(V,{text:K,html:Q,altBoundary:E});for(let H of F)V.push(`--${U}`),ZZ(V,H);V.push(`--${U}--`)}else oJ(V,{text:K,html:Q,altBoundary:_});return V.join(`\r
-`)}function oJ(J,Y){let{text:Z,html:X,altBoundary:$}=Y;if(X&&Z)J.push(`Content-Type: multipart/alternative; boundary="${$}"`),J.push(""),J.push(`--${$}`),J.push("Content-Type: text/plain; charset=UTF-8"),J.push("Content-Transfer-Encoding: 7bit"),J.push(""),J.push(Z),J.push(""),J.push(`--${$}`),J.push("Content-Type: text/html; charset=UTF-8"),J.push("Content-Transfer-Encoding: 7bit"),J.push(""),J.push(X),J.push(""),J.push(`--${$}--`);else if(X)J.push("Content-Type: text/html; charset=UTF-8"),J.push("Content-Transfer-Encoding: 7bit"),J.push(""),J.push(X);else if(Z)J.push("Content-Type: text/plain; charset=UTF-8"),J.push("Content-Transfer-Encoding: 7bit"),J.push(""),J.push(Z)}function ZZ(J,Y){let Z=Y.contentType||"application/octet-stream",X=iJ(Y.filename.replace(/\\/g,"\\\\").replace(/"/g,"\\\""));J.push(`Content-Type: ${Z}; name="${X}"`),J.push(`Content-Disposition: attachment; filename="${X}"`),J.push("Content-Transfer-Encoding: base64"),J.push("");let $=typeof Y.content==="string"?NJ.from(Y.content,"utf-8").toString("base64"):NJ.from(Y.content).toString("base64"),G=$.match(/.{1,76}/g)?.join(`\r
-`)??$;J.push(G),J.push("")}class m extends N{name="ses";client=null;getClient(){if(!this.client){let J=D?.services?.ses,Y=J?.credentials,Z=!!(Y?.accessKeyId&&Y?.secretAccessKey);this.client=new XZ(J?.region||"us-east-1",Z?{accessKeyId:Y.accessKeyId,secretAccessKey:Y.secretAccessKey,sessionToken:Y.sessionToken}:void 0)}return this.client}async send(J,Y){try{this.validateMessage(J);let Z;if(J.template){let U=await I(J.template,Y);if(U&&"html"in U)Z=U.html}let X=Z||J.html;if(!X&&!J.text)throw Error("Email must have either HTML or text content");let $=this.formatSourceAddress({address:J.from?.address||D.email.from?.address||"",name:J.from?.name||D.email.from?.name}),G=this.formatAddresses(J.to),K=this.formatAddresses(J.cc),Q=this.formatAddresses(J.bcc),F=J.replyTo?this.formatAddressList(J.replyTo):[],W=A(J.headers);if(!!(J.attachments&&J.attachments.length>0)||!!W){let U=s({from:$,to:G.join(", "),cc:K.length>0?K.join(", "):void 0,replyTo:F.length>0?F.join(", "):void 0,customHeaders:W,subject:J.subject,text:J.text,html:X,attachments:J.attachments,messageIdDomain:D.email.domain}),E=await this.getClient().sendRawEmail({source:$,destinations:[...G,...K,...Q],rawMessage:U});return this.handleSuccess(J,E.MessageId)}let q={};if(X)q.Html={Charset:D.email.charset||"UTF-8",Data:X};if(J.text)q.Text={Charset:D.email.charset||"UTF-8",Data:J.text};let _=await this.getClient().sendEmail({FromEmailAddress:$,Destination:{ToAddresses:G,CcAddresses:K,BccAddresses:Q},...F.length>0?{ReplyToAddresses:F}:{},Content:{Simple:{Subject:{Charset:D.email.charset||"UTF-8",Data:J.subject},Body:q}}});return this.handleSuccess(J,_.MessageId)}catch(Z){return this.handleError(this.enrichSesError(Z),J)}}formatSourceAddress(J){if(!J.name)return J.address;return`${/[",()<>[\]:;@\\]/.test(J.name)?`"${J.name.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`:J.name} <${J.address}>`}enrichSesError(J){let Y=J instanceof Error?J:Error(String(J)),Z=`${Y.message} ${Y.name??""}`.toLowerCase(),X=D?.services?.ses?.region||"us-east-1";if(Z.includes("email address is not verified")||Z.includes("not authorized to send")||Z.includes("messagerejected")&&Z.includes("verified"))return Y.message=`${Y.message}
-
-SES sandbox restriction: the From and (in sandbox) every To address must be verified. Verify identities in the SES console under "Verified identities" (region: ${X}), or request production access to lift the recipient restriction.`,Y;if(Z.includes("signaturedoesnotmatch")||Z.includes("invalidclienttokenid")||Z.includes("unable to locate credentials")||Z.includes("the security token included in the request is invalid"))return Y.message=`${Y.message}
-
-SES authentication failed. Check AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (or services.ses.credentials), and confirm the IAM principal has \`ses:SendEmail\` permission for the From identity.`,Y;if(Z.includes("could not be reached")||Z.includes("econnrefused")||Z.includes("enotfound"))return Y.message=`${Y.message}
-
-SES endpoint unreachable. The configured region (\`${X}\`) must match the region where the From identity is verified.`,Y;return Y}}var $Z=m;import{config as f}from"@stacksjs/config";import{log as FZ}from"@stacksjs/logging";import{Buffer as tJ}from"buffer";import GZ from"process";import*as n from"tls";import*as sJ from"net";import{config as x}from"@stacksjs/config";import{log as R}from"@stacksjs/logging";function aJ(J,Y){if(typeof J!=="string"||!GJ.test(J))throw Error(`[smtp] Refusing to send: ${Y} envelope address contains forbidden characters or is malformed: ${JSON.stringify(J)}`)}class b extends N{static SMTP_TIMEOUT=30000;name="smtp";getConfig(){let J=x.services?.smtp,Y=GZ.env,Z=J?.host||Y.MAIL_HOST||"127.0.0.1",X=J?.port||(Y.MAIL_PORT?Number(Y.MAIL_PORT):void 0)||587,$=typeof x.email?.from?.address==="string"?x.email.from.address:"",G=J?.username||Y.MAIL_USERNAME||$||"",K=(G.includes("@")?G.split("@")[0]:G).toUpperCase().replace(/[^A-Z0-9]/g,"_"),Q=J?.password||Y.MAIL_PASSWORD||(K?Y[`MAIL_PASSWORD_${K}`]:void 0)||"",F=J?.encryption??Y.MAIL_ENCRYPTION??null;return{host:Z,port:X,username:G,password:Q,encryption:F==="tls"?"starttls":F||null}}async send(J,Y){let Z=this.getConfig();if(!Z.host||Z.host==="")throw Error("[SMTP] Host is not configured. Set MAIL_HOST in your .env file.");let X={provider:this.name,to:J.to,subject:J.subject,host:Z.host,port:Z.port};R.info("Sending email via SMTP...",X);try{this.validateMessage(J);let $;if(J.template){let q=await I(J.template,Y);if(q&&"html"in q)$=q.html}let G=$||J.html,K=J.from?.address||x.email.from?.address||"",Q=J.from?.name||x.email.from?.name||"",F=this.formatAddresses(J.to),W=this.formatAddressList(J.replyTo),z=s({from:Q?`${Q} <${K}>`:K,to:F.join(", "),cc:J.cc?this.formatAddresses(J.cc).join(", "):void 0,replyTo:W.length>0?W.join(", "):void 0,customHeaders:A(J.headers),subject:J.subject,text:J.text,html:G,attachments:J.attachments,messageIdDomain:x.email.domain}),V=await this.sendViaSMTP(Z,K,F,z);return this.handleSuccess(J,V)}catch($){return this.handleError($,J)}}async sendViaSMTP(J,Y,Z,X){return new Promise(($,G)=>{let K=setTimeout(()=>{G(Error(`SMTP connection timed out after ${b.SMTP_TIMEOUT}ms`))},b.SMTP_TIMEOUT),Q=$,F=G;$=(L)=>{clearTimeout(K),Q(L)},G=(L)=>{clearTimeout(K),F(L)};let W,z="",V="",q=[],_=!1,U=!1,E=(L)=>{if(R.debug(`[SMTP] Server: ${L.trim()}`),parseInt(L.substring(0,3),10)>=400){let O=Error(`SMTP Error: ${L.trim()}`);if(q.length>0)q.shift()?.reject(O);return}if(q.length>0)q.shift()?.resolve(L)},H=(L)=>{return new Promise((j,O)=>{q.push({cmd:L,resolve:j,reject:O}),R.debug(`[SMTP] Client: ${L}`),W.write(`${L}\r
-`)})},BJ=(L)=>{z+=L.toString();let j=z.split(`\r
-`);z=j.pop()||"";for(let O of j)if(O.length>=3){if(O.length===3||O[3]===" ")E(O)}},jJ=async()=>{try{await new Promise((O,C)=>{q.push({cmd:"GREETING",resolve:O,reject:C})});let L=await H(`EHLO ${x.email.domain||"localhost"}`);if(J.encryption==="starttls"&&!(W instanceof n.TLSSocket)){await H("STARTTLS");let O=W;O.removeAllListeners("data"),W=await new Promise((C,xY)=>{let r=n.connect({socket:O,host:J.host,servername:J.host},()=>{R.debug("[SMTP] TLS connection established"),C(r)});r.on("error",(t)=>{R.error("[SMTP] TLS socket error:",t),xY(t)}),r.on("data",BJ),r.on("close",(t)=>{R.debug(`[SMTP] TLS socket closed (hadError: ${t})`);while(q.length>0)q.shift()?.reject(Error("TLS connection closed unexpectedly"))})}),await H(`EHLO ${x.email.domain||"localhost"}`)}if(J.username&&J.password)await H("AUTH LOGIN"),await H(tJ.from(J.username).toString("base64")),await H(tJ.from(J.password).toString("base64"));aJ(Y,"MAIL FROM");for(let O of Z)aJ(O,"RCPT TO");await H(`MAIL FROM:<${Y}>`);for(let O of Z)await H(`RCPT TO:<${O}>`);await H("DATA"),W.write(`${X}\r
-.\r
-`),await new Promise((O,C)=>{q.push({cmd:"DATA_END",resolve:O,reject:C})}),U=!0;let j=`${Date.now()}.${Math.random().toString(36).substring(2)}@${J.host}`;try{W.write(`QUIT\r
-`)}catch{}W.end(),$(j)}catch(L){if(U){W.end();return}W.end(),G(L)}};if(J.encryption==="ssl")W=n.connect({host:J.host,port:J.port,servername:J.host},()=>{R.debug(`[SMTP] TLS connected to ${J.host}:${J.port}`),jJ()});else W=sJ.connect({host:J.host,port:J.port},()=>{R.debug(`[SMTP] Connected to ${J.host}:${J.port}`),jJ()});W.on("data",BJ),W.setTimeout(b.SMTP_TIMEOUT),W.on("timeout",()=>{W.destroy(Error(`SMTP socket timed out after ${b.SMTP_TIMEOUT}ms`))}),W.on("error",(L)=>{if(U)return;R.error(`[SMTP] Connection error to ${J.host}:${J.port}:`,L),G(L)}),W.on("close",(L)=>{if(R.debug(`[SMTP] Connection closed (hadError: ${L})`),U)return;while(q.length>0)q.shift()?.reject(Error("Connection closed unexpectedly"))})})}formatAddresses(J){if(!J)return[];if(typeof J==="string")return[J];return J.map((Y)=>{if(typeof Y==="string")return Y;return Y.address})}}import{db as JY}from"@stacksjs/database";var eJ=!1;function YY(){if(eJ)return;eJ=!0,console.warn("[email/idempotency] email_idempotency table missing \u2014 idempotency keys are accepted but NOT enforced. "+"Run migrations to enable dedup.")}function ZY(J){let Y=(J?.message??"").toLowerCase();return Y.includes("no such table")||Y.includes("doesn't exist")||Y.includes("connection closed")||Y.includes("unable to open database")||Y.includes("econnrefused")||Y.includes("connection terminated")||Y.includes("no database")||Y.includes("database connection")}async function XY(J){try{let Y=await JY.selectFrom("email_idempotency").where("idempotency_key","=",J).selectAll().executeTakeFirst();if(!Y)return null;return{success:Boolean(Y.success),message:`Idempotent replay \u2014 original send recorded ${Y.created_at}`,provider:String(Y.provider??"cache"),messageId:Y.message_id??void 0}}catch(Y){if(ZY(Y))return YY(),null;throw Y}}async function $Y(J,Y,Z){if(!Z.success)return;let X=Array.isArray(Y.to)?Y.to.map(($)=>typeof $==="string"?$:$.address).join(", "):typeof Y.to==="string"?Y.to:Y.to.address;try{await JY.insertInto("email_idempotency").values({idempotency_key:J,message_id:Z.messageId??null,recipient:X,subject:Y.subject,provider:Z.provider,success:1,created_at:new Date().toISOString().slice(0,19).replace("T"," ")}).execute()}catch($){if(ZY($)){YY();return}let G=$?.message??"";if(G.includes("UNIQUE constraint")||G.includes("Duplicate entry"))return;throw $}}import{db as o}from"@stacksjs/database";var GY=!1;function e(){if(GY)return;GY=!0,console.warn("[email/suppression] email_suppressions table missing \u2014 suppression checks accepted but NOT enforced. "+"Run migrations to enable enforcement.")}function KZ(J){let Y=J,Z=Y?.message??"";return Y?.code==="42P01"||Z.includes("no such table")||Z.includes("doesn't exist")||/relation "[^"]*" does not exist/i.test(Z)}function JJ(J){if(KZ(J))return!0;let Y=(J?.message??"").toLowerCase();return Y.includes("connection closed")||Y.includes("unable to open database")||Y.includes("econnrefused")||Y.includes("connection terminated")||Y.includes("no database")||Y.includes("database connection")}function YJ(J){return String(J).trim().toLowerCase()}async function cX(J,Y){let Z=YJ(J);try{let X=o.selectFrom("email_suppressions").where("email","=",Z).select(["email"]);if(Y)X=X.where("type","=",Y);let $=await X.executeTakeFirst();return Boolean($)}catch(X){if(JJ(X))return e(),!1;throw X}}async function WZ(J){let Y=YJ(J);try{return await o.selectFrom("email_suppressions").where("email","=",Y).selectAll().execute()??[]}catch(Z){if(JJ(Z))return e(),[];throw Z}}async function KY(J,Y,Z){let X=YJ(J),$=new Date().toISOString().slice(0,19).replace("T"," ");try{await o.insertInto("email_suppressions").values({email:X,type:Y,reason:Z??null,created_at:$}).execute()}catch(G){if(JJ(G)){e();return}let K=G?.message??"";if(K.includes("UNIQUE constraint")||K.includes("Duplicate entry"))return;throw G}}async function gX(J,Y){let Z=YJ(J);try{await o.deleteFrom("email_suppressions").where("email","=",Z).where("type","=",Y).execute()}catch(X){if(JJ(X)){e();return}throw X}}async function QZ(){try{let{config:J}=await import("@stacksjs/config"),Y=J?.email?.suppressionPolicy;if(Y==="strict"||Y==="transactional-allowed"||Y==="off")return Y}catch{}return"strict"}async function WY(J,Y){let Z=await QZ();if(Z==="off")return null;if(Z==="transactional-allowed"&&Y==="transactional")return null;let X=await WZ(J);if(X.length===0)return null;let $=["unsubscribe","complaint","bounce","manual"];for(let G of $)if(X.some((K)=>K.type===G))return G;return X[0].type}class zZ{name;subject;to;from;template;handle;onError;onSuccess;constructor(J){this.name=J.name,this.subject=J.subject,this.to=J.to,this.from=J.from,this.template=J.template,this.handle=J.handle,this.onError=J.onError,this.onSuccess=J.onSuccess}async renderTemplate(){if(!this.template)return"";try{let{path:J}=await import("@stacksjs/path"),Y=J.resourcesPath(`views/emails/${this.template}.html`),Z=Bun.file(Y);if(await Z.exists())return await Z.text()}catch{}if(this.template.includes("<"))return this.template;return`<p>${this.template}</p>`}async send(J){let Y=J??this.to,Z=Array.isArray(Y)?Y:Y?[Y]:[];if(Z.length===0)throw Error("No recipient specified for email");try{if(await ZJ.send({to:Z,from:this.from||{name:f.email.from?.name||"Stacks",address:f.email.from?.address||"no-reply@stacksjs.com"},subject:this.subject,html:await this.renderTemplate()}),this.onSuccess)this.onSuccess();if(this.handle)return this.handle();return{message:"Email sent"}}catch(X){if(this.onError)return this.onError(X instanceof Error?X:Error(String(X)));throw X}}}class HJ{drivers=new Map;defaultDriver;constructor(J={}){this.defaultDriver=J.defaultDriver||f.email.default||"ses",this.registerDefaultDrivers()}registerDefaultDrivers(){this.drivers.set("log",new c),this.drivers.set("ses",new m),this.drivers.set("sendgrid",new l),this.drivers.set("mailgun",new g),this.drivers.set("mailtrap",new d),this.drivers.set("smtp",new b),this.drivers.set("capture",new a)}async send(J){let Y=this.drivers.get(this.defaultDriver);if(!Y){let G=[...this.drivers.keys()].sort().join(", ");throw Error(`Email driver '${this.defaultDriver}' is not registered. Available drivers: [${G}]. Check config.email.default or the MAIL_MAILER environment variable.`)}if(J.idempotencyKey){let G=await XY(J.idempotencyKey);if(G)return G}let Z=await VZ(J);if(Z)return{success:!1,message:`suppressed:${Z}`,provider:"suppression"};let X={name:f.email.from?.name||"Stacks",address:f.email.from?.address||"no-reply@stacksjs.com"},$=await Y.send({...J,from:J.from||X});if(J.idempotencyKey)await $Y(J.idempotencyKey,J,$);return $}use(J){if(!this.drivers.has(J))throw Error(`Email driver '${J}' is not available`);return new HJ({defaultDriver:J})}async queue(J){await this.dispatchOrFallback(J,async()=>{let{job:Y}=await import("@stacksjs/queue");await Y("SendEmail",{message:J,driver:this.defaultDriver}).onQueue("emails").dispatch()},{context:"queue"})}async later(J,Y){await this.dispatchOrFallback(Y,async()=>{let{job:Z}=await import("@stacksjs/queue");await Z("SendEmail",{message:Y,driver:this.defaultDriver}).onQueue("emails").delay(J).dispatch()},{context:"later",delaySeconds:J})}async queueOn(J,Y){await this.dispatchOrFallback(Y,async()=>{let{job:Z}=await import("@stacksjs/queue");await Z("SendEmail",{message:Y,driver:this.defaultDriver}).onQueue(J).dispatch()},{context:"queueOn",queueName:J})}async dispatchOrFallback(J,Y,Z){try{await Y();return}catch(X){let $=X instanceof Error?X.message:String(X);FZ.warn("[email] Queue dispatch failed; falling back to synchronous send. "+"Background email pipeline is degraded \u2014 check the queue worker / broker.",{...Z,reason:$})}await this.send(J)}}async function VZ(J){let Y=qZ(J);if(Y.length===0)return null;for(let Z of Y){let X=await WY(Z,J.tag);if(X)return X}return null}function qZ(J){let Y=[],Z=(X)=>{if(typeof X==="string"){Y.push(X);return}if(X&&typeof X==="object"&&"address"in X&&typeof X.address==="string")Y.push(X.address)};for(let X of["to","cc","bcc"]){let $=J[X];if(!$)continue;if(Array.isArray($))for(let G of $)Z(G);else Z($)}return Y}var IJ;function QY(){if(!IJ){let J=f?.email?.default||process.env.MAIL_MAILER||"ses";IJ=new HJ({defaultDriver:J})}return IJ}var ZJ=new Proxy({},{get(J,Y){return QY()[Y]},set(J,Y,Z){return QY()[Y]=Z,!0}});import{createHmac as VY,timingSafeEqual as LZ}from"crypto";import XJ from"process";import{Buffer as qY}from"buffer";var OZ=2592000,UZ="/_stacks/email/unsubscribe";function LY(){let J=XJ.env.APP_KEY;if(!J||J.length<16){if(XJ.env.APP_ENV==="production"||XJ.env.NODE_ENV==="production")throw Error("[email/unsubscribe] APP_KEY is missing or too short (need \u226516 chars). Cannot sign unsubscribe URL.")}return J||"stacks-default-key-dev-only-do-not-use-prod"}function FY(J){return J.toString("base64url")}function zY(J){return qY.from(J,"base64url")}function NZ(J,Y=OZ){if(!J)throw Error("[email/unsubscribe] email is required");let Z=Math.floor(Date.now()/1000)+Math.floor(Y),X={email:String(J).trim().toLowerCase(),exp:Z,iss:"stacks"},$=FY(qY.from(JSON.stringify(X))),G=FY(VY("sha256",LY()).update($).digest());return`${$}.${G}`}function G9(J){if(typeof J!=="string")return{valid:!1,reason:"malformed"};let Y=J.split(".");if(Y.length!==2)return{valid:!1,reason:"malformed"};let[Z,X]=Y,$=VY("sha256",LY()).update(Z).digest(),G;try{G=zY(X)}catch{return{valid:!1,reason:"malformed"}}if(G.length!==$.length||!LZ(G,$))return{valid:!1,reason:"bad_signature"};let K;try{K=JSON.parse(zY(Z).toString("utf8"))}catch{return{valid:!1,reason:"malformed"}}if(typeof K.exp!=="number"||Math.floor(Date.now()/1000)>=K.exp)return{valid:!1,reason:"expired"};if(!K.email||typeof K.email!=="string")return{valid:!1,reason:"malformed"};return{valid:!0,email:K.email}}function IZ(J,Y,Z={}){let X=NZ(J,Y),$=(Z.baseUrl||XJ.env.APP_URL||"http://localhost").replace(/\/$/,""),G=(Z.routePrefix||UZ).replace(/\/$/,"");return`${$}${G}/${X}`}function K9(J,Y,Z){return{"List-Unsubscribe":`<${IZ(J,Y,Z)}>`,"List-Unsubscribe-Post":"List-Unsubscribe=One-Click"}}import{db as HZ}from"@stacksjs/database";var OY=!1;function RZ(){if(OY)return;OY=!0,console.warn("[email/webhook-dedup] email_webhook_events table missing \u2014 webhook idempotency NOT enforced. "+"Providers may double-deliver retries; run migrations to enable dedup.")}function _Z(J){let Y=J?.message??"";return Y.includes("no such table")||Y.includes("doesn't exist")}async function i(J,Y){if(!Y)return!0;try{return await HZ.insertInto("email_webhook_events").values({provider:J,event_id:Y,processed_at:new Date().toISOString().slice(0,19).replace("T"," ")}).execute(),!0}catch(Z){if(_Z(Z))return RZ(),!0;let X=Z?.message??"";if(X.includes("UNIQUE constraint")||X.includes("Duplicate entry"))return!1;throw Z}}async function u(J,Y){try{let Z=await import("@stacksjs/events").catch(()=>null);if(!Z)return;let X=Z.dispatch;if(typeof X!=="function")return;X(J,Y)}catch{}}async function UY(J){await u("email:bounce-hard",J),await u("email:bounce",J)}async function NY(J){await u("email:bounce-soft",J),await u("email:bounce",J)}async function IY(J){await u("email:complaint",J)}async function HY(J){await u("email:unsubscribe",J)}function RY(J){switch(J){case"bounce-hard":return"bounce";case"complaint":return"complaint";case"unsubscribe":return"unsubscribe";default:return null}}import{createHmac as PZ,createVerify as PY,timingSafeEqual as RJ}from"crypto";import{Buffer as M}from"buffer";function BY(J){if(!J.signingKey)return{ok:!1,reason:"missing-config"};if(!J.timestamp||!J.token||!J.signature)return{ok:!1,reason:"missing-signature"};let Y=J.toleranceSeconds??300,Z=Number(J.timestamp);if(!Number.isFinite(Z))return{ok:!1,reason:"bad-signature"};let X=Math.floor(Date.now()/1000);if(Math.abs(X-Z)>Y)return{ok:!1,reason:"expired"};let $=PZ("sha256",J.signingKey).update(`${J.timestamp}${J.token}`).digest("hex"),G;try{G=M.from(J.signature,"hex")}catch{return{ok:!1,reason:"bad-signature"}}let K=M.from($,"hex");if(G.length!==K.length)return{ok:!1,reason:"bad-signature"};if(!RJ(G,K))return{ok:!1,reason:"bad-signature"};return{ok:!0}}function jY(J){if(!J.expectedUsername||!J.expectedPassword)return{ok:!1,reason:"missing-config"};if(!J.authorizationHeader||!J.authorizationHeader.startsWith("Basic "))return{ok:!1,reason:"missing-signature"};let Y;try{Y=M.from(J.authorizationHeader.slice(6),"base64").toString("utf8")}catch{return{ok:!1,reason:"bad-signature"}}let[Z,X]=Y.split(":");if(!Z||X===void 0)return{ok:!1,reason:"bad-signature"};let $=_Y(Z,J.expectedUsername),G=_Y(X,J.expectedPassword);if(!$||!G)return{ok:!1,reason:"bad-signature"};if(J.ipAllowlist&&J.ipAllowlist.length>0){if(!J.sourceIp||!J.ipAllowlist.includes(J.sourceIp))return{ok:!1,reason:"bad-signature"}}return{ok:!0}}function _Y(J,Y){let Z=M.from(J,"utf8"),X=M.from(Y,"utf8");if(Z.length!==X.length){let $=M.alloc(Math.max(Z.length,X.length));return RJ($,$),!1}return RJ(Z,X)}var BZ=/^sns\.[a-z0-9-]+\.amazonaws\.com$/;async function jZ(J){let Y=await fetch(J,{redirect:"error"});if(!Y.ok)throw Error(`SNS cert fetch returned ${Y.status}`);return await Y.text()}async function AY(J){let Y=J.message;if(!Y||!Y.Signature||!Y.SigningCertURL)return{ok:!1,reason:"missing-signature"};let Z=J.certUrlHostAllowlist??BZ,X;try{X=new URL(Y.SigningCertURL)}catch{return{ok:!1,reason:"untrusted-cert-url"}}if(X.protocol!=="https:")return{ok:!1,reason:"untrusted-cert-url"};if(!Z.test(X.host))return{ok:!1,reason:"untrusted-cert-url"};let $;try{$=await(J.fetchCert??jZ)(Y.SigningCertURL)}catch{return{ok:!1,reason:"cert-fetch-failed"}}let G=AZ(Y);if(!G)return{ok:!1,reason:"bad-signature"};let K;try{K=M.from(Y.Signature,"base64")}catch{return{ok:!1,reason:"bad-signature"}}let Q=Y.SignatureVersion==="2"?"SHA256":"SHA1",F=PY(`RSA-${Q}`);return F.update(G,"utf8"),F.verify($,K)?{ok:!0}:{ok:!1,reason:"bad-signature"}}function AZ(J){let Y=[];if(J.Type==="Notification"){if(Y.push("Message",J.Message),Y.push("MessageId",J.MessageId),J.Subject!==void 0)Y.push("Subject",J.Subject);Y.push("Timestamp",J.Timestamp),Y.push("TopicArn",J.TopicArn),Y.push("Type",J.Type)}else if(J.Type==="SubscriptionConfirmation"||J.Type==="UnsubscribeConfirmation"){if(Y.push("Message",J.Message),Y.push("MessageId",J.MessageId),!J.SubscribeURL||!J.Token)return null;Y.push("SubscribeURL",J.SubscribeURL),Y.push("Timestamp",J.Timestamp),Y.push("Token",J.Token),Y.push("TopicArn",J.TopicArn),Y.push("Type",J.Type)}else return null;let Z="";for(let X of Y)Z+=`${X}
-`;return Z}function TY(J){if(!J.publicKeyPem)return{ok:!1,reason:"missing-config"};if(!J.signature||!J.timestamp)return{ok:!1,reason:"missing-signature"};let Y=J.toleranceSeconds??300,Z=Number(J.timestamp);if(!Number.isFinite(Z))return{ok:!1,reason:"bad-signature"};if(Math.abs(Math.floor(Date.now()/1000)-Z)>Y)return{ok:!1,reason:"expired"};let X;try{X=M.from(J.signature,"base64")}catch{return{ok:!1,reason:"bad-signature"}}let $=PY("SHA256");return $.update(`${J.timestamp}${J.body}`,"utf8"),$.verify(J.publicKeyPem,X)?{ok:!0}:{ok:!1,reason:"bad-signature"}}var _J={status:200,body:{ok:!0,processed:!1,reason:"duplicate"}};function $J(J){return{status:401,body:{ok:!1,reason:J}}}function w(J){return{status:400,body:{ok:!1,reason:J}}}async function p(J,Y){let Z=RY(J);if(Z)await KY(Y.email,Z,Y.reason);switch(J){case"bounce-hard":await UY(Y);break;case"bounce-soft":await NY(Y);break;case"complaint":await IY(Y);break;case"unsubscribe":await HY(Y);break;case"delivered":break}}async function H9(J,Y){let Z;try{Z=JSON.parse(J)}catch{return w("invalid-json")}let X=Z.signature,$=Z["event-data"];if(!X||!$)return w("missing-fields");let G=BY({timestamp:X.timestamp,token:X.token,signature:X.signature,signingKey:Y.signingKey,toleranceSeconds:Y.toleranceSeconds});if(!G.ok)return $J(G.reason);if(!await i("mailgun",$.id))return _J;let Q=TZ($.event,$.severity);if(!Q)return{status:200,body:{ok:!0,processed:!1,reason:"unhandled-event"}};return await p(Q,{email:$.recipient,provider:"mailgun",reason:$.reason,raw:$}),{status:200,body:{ok:!0,processed:!0,classification:Q}}}function TZ(J,Y){switch(J){case"failed":return Y==="temporary"?"bounce-soft":"bounce-hard";case"complained":return"complaint";case"unsubscribed":return"unsubscribe";case"delivered":return"delivered";default:return null}}async function R9(J,Y,Z,X){let $=jY({authorizationHeader:Y,expectedUsername:X.username,expectedPassword:X.password,sourceIp:Z,ipAllowlist:X.ipAllowlist});if(!$.ok)return $J($.reason);let G;try{G=JSON.parse(J)}catch{return w("invalid-json")}let K=String(G.ID??G.MessageID??""),Q=String(G.Email??G.Recipient??"");if(!Q)return w("missing-recipient");if(!await i("postmark",K))return _J;let W=DZ(G);if(!W)return{status:200,body:{ok:!0,processed:!1,reason:"unhandled-event"}};return await p(W,{email:Q,provider:"postmark",reason:G.Description,raw:G}),{status:200,body:{ok:!0,processed:!0,classification:W}}}function DZ(J){switch(J.RecordType){case"Bounce":return J.TypeCode===1?"bounce-hard":"bounce-soft";case"SpamComplaint":return"complaint";case"SubscriptionChange":return J.SuppressSending?"unsubscribe":null;case"Delivery":return"delivered";default:return null}}async function _9(J,Y={}){let Z;try{Z=JSON.parse(J)}catch{return w("invalid-json")}let X=await AY({message:Z,certUrlHostAllowlist:Y.certUrlHostAllowlist,fetchCert:Y.fetchCert});if(!X.ok)return $J(X.reason);if(Z.Type==="SubscriptionConfirmation"){if(Y.autoConfirmSubscriptions!==!1&&Z.SubscribeURL)try{await fetch(Z.SubscribeURL)}catch{}return{status:200,body:{ok:!0,processed:!0,reason:"subscription-confirmed"}}}if(Z.Type==="UnsubscribeConfirmation")return{status:200,body:{ok:!0,processed:!0,reason:"subscription-removed"}};let $;try{$=JSON.parse(Z.Message)}catch{return w("invalid-inner-json")}if(!await i("ses",Z.MessageId))return _J;let K=[];if($.notificationType==="Bounce"&&$.bounce){let Q=$.bounce.bounceType==="Permanent"?"bounce-hard":"bounce-soft";for(let F of $.bounce.bouncedRecipients)await p(Q,{email:F.emailAddress,provider:"ses",reason:F.diagnosticCode,raw:$}),K.push(Q)}else if($.notificationType==="Complaint"&&$.complaint)for(let Q of $.complaint.complainedRecipients)await p("complaint",{email:Q.emailAddress,provider:"ses",reason:$.complaint.complaintFeedbackType,raw:$}),K.push("complaint");else if($.notificationType==="Delivery"&&$.delivery)for(let Q of $.delivery.recipients)await p("delivered",{email:Q,provider:"ses",raw:$}),K.push("delivered");return{status:200,body:{ok:!0,processed:K.length>0,classification:K[0]}}}async function P9(J,Y,Z,X){let $=TY({body:J,signature:Y,timestamp:Z,publicKeyPem:X.publicKeyPem,toleranceSeconds:X.toleranceSeconds});if(!$.ok)return $J($.reason);let G;try{G=JSON.parse(J)}catch{return w("invalid-json")}if(!Array.isArray(G))return w("expected-array");let K=0,Q=[];for(let F of G){if(!F.email)continue;let W=F.sg_event_id??`${F.event}:${F.email}:${Date.now()}`;if(!await i("sendgrid",W))continue;let V=xZ(F.event,F.type);if(!V)continue;await p(V,{email:F.email,provider:"sendgrid",reason:F.reason,raw:F}),K++,Q.push(V)}return{status:200,body:{ok:!0,processed:K>0,classification:Q[0]}}}function xZ(J,Y){switch(J){case"bounce":return Y==="blocked"?"bounce-soft":"bounce-hard";case"dropped":return"bounce-hard";case"spamreport":return"complaint";case"unsubscribe":return"unsubscribe";case"group_unsubscribe":return"unsubscribe";case"delivered":return"delivered";default:return null}}import{config as DY}from"@stacksjs/config";class MZ{_to=[];_cc=[];_bcc=[];_replyTo;_from;_subject;_text;_html;_template;_attachments=[];to(J){return this._to=PJ(J),this}cc(J){return this._cc=PJ(J),this}bcc(J){return this._bcc=PJ(J),this}replyTo(J){return this._replyTo=typeof J==="string"?{address:J}:J,this}from(J){return this._from=J,this}subject(J){return this._subject=J,this}text(J){return this._text=J,this}html(J){return this._html=J,this}template(J,...Y){let Z=Y[0]??{};return this._template={name:J,props:Z},this}inspect(){return{to:this._to,cc:this._cc,bcc:this._bcc,from:this._from,replyTo:this._replyTo,subject:this._subject,text:this._text,html:this._html,template:this._template,attachments:this._attachments}}attach(J,Y){return this._attachments.push({filename:Y||EZ(J),content:`__file__:${J}`,encoding:"binary"}),this}attachData(J,Y,Z){return this._attachments.push({filename:Y,content:J,contentType:Z,encoding:typeof J==="string"?"utf8":"binary"}),this}async send(J={}){if(await Promise.resolve(this.build()),this._to.length===0)throw Error("[Mailable] no recipients \u2014 call this.to(...) inside build()");if(!this._subject)throw Error("[Mailable] no subject \u2014 call this.subject(...) inside build()");let Y=this._html,Z=this._text;if(this._template){let G=await I(this._template.name,{variables:this._template.props,subject:this._subject});if(!Y)Y=G.html;if(!Z)Z=G.text}let X={to:this._to,subject:this._subject,from:this._from||wZ(),...this._cc.length?{cc:this._cc}:{},...this._bcc.length?{bcc:this._bcc}:{},...Y?{html:Y}:{},...Z?{text:Z}:{},...this._attachments.length?{attachments:await CZ(this._attachments)}:{}};if(this._replyTo)X.replyTo=this._replyTo;return(J.driver?ZJ.use(J.driver):ZJ).send(X)}}function PJ(J){let Y=Array.isArray(J)?J:[J];if(Y.some((X)=>typeof X==="object"&&X!==null))return Y.map((X)=>typeof X==="string"?{address:X}:X);return Y}function wZ(){return{name:DY.email.from?.name||"Stacks",address:DY.email.from?.address||"no-reply@stacksjs.com"}}function EZ(J){let Y=Math.max(J.lastIndexOf("/"),J.lastIndexOf("\\"));return Y===-1?J:J.slice(Y+1)}async function CZ(J){return Promise.all(J.map(async(Y)=>{if(typeof Y.content==="string"&&Y.content.startsWith("__file__:")){let Z=Y.content.slice(9),X=Bun.file(Z),$=new Uint8Array(await X.arrayBuffer());return{...Y,content:$,contentType:Y.contentType||X.type||void 0,encoding:"binary"}}return Y}))}export{G9 as verifyUnsubscribeToken,AY as verifySesSnsSignature,TY as verifySendgridSignature,jY as verifyPostmarkAuth,BY as verifyMailgunSignature,gX as unsuppress,iZ as templateExists,I as template,RY as suppressionTypeFor,KY as suppress,g9 as shouldInlineByDefault,rJ as ses,nJ as sendgrid,pY as safe,r9 as renderPreviewHtml,n9 as renderMailablePreview,i9 as renderIndexHtml,oZ as renderHtml,i as recordWebhookEventOrSkip,$Y as recordEmailIdempotency,mJ as mailtrap,lJ as mailgun,ZJ as mail,gJ as log,m9 as loadSampleProps,rZ as listTemplates,cX as isSuppressed,KZ as isMissingTableError,c9 as inlineCss,_9 as handleSesWebhook,P9 as handleSendgridWebhook,R9 as handlePostmarkWebhook,H9 as handleMailgunWebhook,WZ as getSuppressions,QZ as getSuppressionPolicy,XY as findEmailByIdempotencyKey,HY as emitEmailUnsubscribe,IY as emitEmailComplaint,NY as emitEmailBounceSoft,UY as emitEmailBounceHard,l9 as discoverMailables,NZ as createUnsubscribeToken,WY as checkSuppressionFor,xJ as capture,IZ as buildUnsubscribeUrl,K9 as buildListUnsubscribeHeaders,zJ as SafeHtml,MZ as Mailable,HJ as Mail,zZ as Email};

package/dist/mailable.d.ts

@@ -1,116 +0,0 @@
-import type { EmailAddress, EmailAttachment, EmailResult } from '@stacksjs/types';
-/**
- * Options accepted by {@link Mailable.send} — currently allows scoping
- * the send to a specific driver registered on the Mail singleton (e.g.
- * `'log'` to swallow the email in a test, `'ses'` to force production
- * delivery during a one-off backfill).
- */
-export declare interface MailableSendOptions {
-  driver?: string
-}
-/**
- * Internal stash for template rendering — populated by {@link Mailable.template}
- * and consumed in {@link Mailable.send} after `build()` resolves.
- */
-/**
- * Read-only snapshot of a Mailable's build state — produced by
- * {@link Mailable.inspect}. Used by the preview server (#1900) so the
- * UI can render what the email WOULD look like without dispatching.
- *
- * Generic over `TProps` so typed Mailables expose typed template
- * props (stacksjs/stacks#1903). Defaults to `Record<string, unknown>`
- * so untyped usages keep working without changes.
- */
-export declare interface MailableInspection<TProps extends Record<string, unknown> = Record<string, unknown>> {
-  to: string[] | EmailAddress[]
-  cc: string[] | EmailAddress[]
-  bcc: string[] | EmailAddress[]
-  from?: EmailAddress
-  replyTo?: EmailAddress
-  subject?: string
-  text?: string
-  html?: string
-  template?: { name: string, props: TProps }
-  attachments: EmailAttachment[]
-}
-declare interface TemplateRef<TProps extends Record<string, unknown> = Record<string, unknown>> {
-  name: string
-  props: TProps
-}
-/**
- * Allowed recipient input — accepts a single address, an array of addresses,
- * or already-shaped {@link EmailAddress} objects. Strings are treated as
- * `address` only (no display name).
- */
-export type MailableAddressInput = string | string[] | EmailAddress | EmailAddress[];
-/**
- * `true` iff `T` is the loose default (`Record<string, unknown>`),
- * i.e. the caller didn't specialize the generic. Used to make
- * `Mailable#template(name)` props-optional in the loose case and
- * props-required when a concrete `TProps` is supplied.
- */
-declare type IsLooseProps<T> = Record<string, unknown> extends T ? true : false;
-/**
- * Builds the variadic tail of {@link Mailable.template}'s parameter list.
- * Untyped Mailable accepts `.template('name')`; typed `Mailable<P>` must
- * pass props matching `P`.
- */
-declare type TemplateArgs<T extends Record<string, unknown>> = IsLooseProps<T> extends true ? [props?: T] : [props: T];
-/**
- * Laravel-style class-based email definition. Subclass `Mailable`,
- * implement `build()`, and call `.send()` to dispatch.
- *
- * Compared to the existing function-form `Email` / direct `mail.send()`
- * APIs this gives you:
- *  - encapsulation of recipient/subject/body building per email type
- *  - chainable, immutable-feeling fluent setters
- *  - a single hook (`build`) where view-model -> message translation happens
- *  - automatic STX template rendering via the existing `template()` helper
- *
- * The class still ultimately routes through the same `mail` singleton, so
- * configured drivers, queueing, and `from` defaults all behave identically.
- *
- * @example
- * ```ts
- * import { Mailable } from '@stacksjs/email'
- *
- * export default class WelcomeMail extends Mailable {
- *   constructor(private user: { name: string, email: string }) { super() }
- *
- *   build() {
- *     return this
- *       .to(this.user.email)
- *       .subject('Welcome!')
- *       .template('welcome', { name: this.user.name })
- *   }
- * }
- *
- * await new WelcomeMail(user).send()
- * ```
- */
-export declare abstract class Mailable<TProps extends Record<string, unknown> = Record<string, unknown>> {
-  protected _to: string[] | EmailAddress[];
-  protected _cc: string[] | EmailAddress[];
-  protected _bcc: string[] | EmailAddress[];
-  protected _replyTo?: EmailAddress;
-  protected _from?: EmailAddress;
-  protected _subject?: string;
-  protected _text?: string;
-  protected _html?: string;
-  protected _template?: TemplateRef<TProps>;
-  protected _attachments: EmailAttachment[];
-  abstract build(): this | Promise<this>;
-  to(address: MailableAddressInput): this;
-  cc(address: MailableAddressInput): this;
-  bcc(address: MailableAddressInput): this;
-  replyTo(address: string | EmailAddress): this;
-  from(addr: EmailAddress): this;
-  subject(s: string): this;
-  text(body: string): this;
-  html(body: string): this;
-  template(name: string, ...rest: TemplateArgs<TProps>): this;
-  inspect(): MailableInspection<TProps>;
-  attach(path: string, name?: string): this;
-  attachData(buffer: Uint8Array | string, name: string, mime?: string): this;
-  send(options?: MailableSendOptions): Promise<EmailResult>;
-}

package/dist/mime.d.ts

@@ -1,37 +0,0 @@
-import type { EmailAttachment } from '@stacksjs/types';
-/**
- * Encode an SMTP header value with RFC 2047 base64 encoding when it
- * contains non-ASCII characters. Without this, subjects like
- * "Encore d'idées" or "你好" produce headers that violate RFC 5322
- * (which mandates 7-bit ASCII for headers) and get mangled or rejected
- * by downstream relays.
- */
-export declare function encodeRfc2047IfNeeded(value: string): string;
-/**
- * Build the full raw bytes for an RFC 5322 / 2045 email message.
- *
- * Returns a single string with CRLF line endings — both SMTP DATA and
- * SES `SendRawEmail.RawMessage.Data` consume this shape directly.
- *
- * Shape decision tree:
- *
- *   no attachments:
- *     - both html+text → multipart/alternative
- *     - one of either   → single-part
- *   with attachments:
- *     - multipart/mixed envelope wrapping the body (alternative or
- *       single-part) + one part per attachment
- */
-export declare function buildMimeMessage(options: MimeMessageOptions): string;
-export declare interface MimeMessageOptions {
-  from: string
-  to: string
-  cc?: string
-  replyTo?: string
-  subject: string
-  text?: string
-  html?: string
-  attachments?: EmailAttachment[]
-  messageIdDomain?: string
-  customHeaders?: Record<string, string>
-}

package/dist/preview-ui.d.ts

@@ -1,11 +0,0 @@
-import type { DiscoveredMailable, MailablePreview } from './preview';
-/**
- * Render the index page listing every discovered Mailable.
- */
-export declare function renderIndexHtml(mailables: DiscoveredMailable[]): string;
-/**
- * Render the preview page for a single Mailable. `view` controls the
- * iframe width: 'desktop' (default) / 'mobile' / 'text' (renders the
- * plain-text version instead of HTML).
- */
-export declare function renderPreviewHtml(mailable: DiscoveredMailable, preview: MailablePreview, view?: 'desktop' | 'mobile' | 'text'): string;

package/dist/preview.d.ts

@@ -1,50 +0,0 @@
-import type { MailableInspection } from './mailable';
-/*.ts` and return the discovered Mailables. Non-`.ts`
- * files (test files, `.d.ts`, etc.) are skipped.
- *
- * Filesystem scan is synchronous + cheap (one directory, no recursion)
- * — fine for a dev-only preview surface; not a hot path.
- */
-export declare function discoverMailables(): DiscoveredMailable[];
-/**
- * Look up sample props for a Mailable. Convention:
- *
- *   resources/emails/_previews/<slug>.ts
- *     → default export is the props object passed to `new Mailable(props)`
- *
- * Returns `null` when no sample file is present — the caller falls back
- * to instantiating with `{}` so apps without samples still render
- * (defaulted props in the Mailable's build() show their fallback values).
- */
-export declare function loadSampleProps(slug: string): Promise<Record<string, unknown> | null>;
-/**
- * Render a Mailable to its preview payload. Imports the source file,
- * picks the first exported subclass of `Mailable`, instantiates with
- * sample props (or `{}` when none exist), runs `build()`, and resolves
- * the bound template through `template()` from this same package.
- *
- * Errors at any step (import failure, no Mailable export, build()
- * throws, template not found) are returned as `error` on the preview
- * payload rather than thrown — the route layer renders them as part
- * of the UI so the user sees what broke.
- */
-export declare function renderMailablePreview(mailable: DiscoveredMailable): Promise<MailablePreview>;
-/**
- * One Mailable discovered under `app/Mail/`.
- */
-export declare interface DiscoveredMailable {
-  name: string
-  path: string
-  slug: string
-}
-/**
- * The fully-rendered preview of one Mailable. Returned by
- * {@link renderMailablePreview} and consumed by the preview HTML.
- */
-export declare interface MailablePreview {
-  inspection: MailableInspection
-  html: string
-  text: string
-  sampleProps: Record<string, unknown> | null
-  error?: string
-}

package/dist/suppression.d.ts

@@ -1,82 +0,0 @@
-/**
- * Does this error mean the backing table simply hasn't been migrated yet?
- * Exported for direct unit coverage across dialects.
- *
- * Each supported database phrases "missing table" differently, and the
- * suppression layer is fail-open — so a matcher that only knows sqlite/mysql
- * would let Postgres's wording slip through and hard-fail every send on an
- * un-migrated Postgres DB (stacksjs/stacks#1976). We scope the Postgres check
- * to `undefined_table` specifically (SQLSTATE 42P01 / `relation "..." does not
- * exist`) rather than a bare `does not exist`, so a genuine `column ... does
- * not exist` schema bug still surfaces instead of being silently swallowed.
- */
-export declare function isMissingTableError(err: unknown): boolean;
-/**
- * Is the address suppressed? Pass a specific `type` to check only
- * one kind (e.g. unsubscribe-only — bounces from the same address
- * don't count). Omit to match any suppression.
- *
- * Returns `false` when the table doesn't exist yet — apps that
- * haven't run the migration aren't broken by the new behavior, and
- * a one-shot warn lets the operator know the table is missing.
- */
-export declare function isSuppressed(email: string, type?: SuppressionType): Promise<boolean>;
-/**
- * Look up the full suppression record(s) for an address — useful
- * for admin tools that want to show the reason/timestamp alongside
- * the suppression status. Returns an empty array on missing-table
- * (same warn-once degrade).
- */
-export declare function getSuppressions(email: string): Promise<SuppressionRecord[]>;
-/**
- * Record a suppression. Idempotent — a duplicate (email, type)
- * pair silently no-ops (the unique constraint catches it).
- *
- * Called by:
- *   - the framework's bounce/complaint webhook handlers (#1881)
- *   - the unsubscribe route handler (this PR)
- *   - admin tooling (`SuppressionType: 'manual'`)
- */
-export declare function suppress(email: string, type: SuppressionType, reason?: string): Promise<void>;
-/**
- * Remove a suppression record (admin recovery, user-initiated
- * resubscribe). Idempotent — removing something that isn't there
- * is a no-op.
- */
-export declare function unsuppress(email: string, type: SuppressionType): Promise<void>;
-export declare function getSuppressionPolicy(): Promise<SuppressionPolicy>;
-/**
- * Decide whether a `mail.send()` should proceed for a given
- * recipient. Returns `null` to indicate "allowed"; otherwise
- * returns the matched suppression type so the caller can surface
- * it in the error message.
- *
- * Called from `Mail.send()` after idempotency lookup, before the
- * driver dispatch.
- */
-export declare function checkSuppressionFor(email: string, tag: 'transactional' | 'broadcast' | undefined): Promise<SuppressionType | null>;
-export declare interface SuppressionRecord {
-  email: string
-  type: SuppressionType
-  reason: string | null
-  created_at: string
-}
-export type SuppressionType = 'bounce' | 'complaint' | 'unsubscribe' | 'manual';
-/**
- * Suppression-policy resolution for `mail.send()` (stacksjs/stacks#1880).
- *
- * Reads the policy from `config.email.suppressionPolicy` with a
- * sensible default and decides whether the message should be
- * allowed through given its tag.
- *
- * Policy semantics:
- *   - `'strict'`                  — block all sends to suppressed addresses
- *   - `'transactional-allowed'`   — block broadcasts; allow `tag: 'transactional'`
- *   - `'off'`                     — never block (table is only used for tracking)
- *
- * Default is `'strict'` — the safest behavior for compliance, and
- * apps that don't run the migration are unaffected because the
- * lookup falls through to "not suppressed" when the table is
- * missing.
- */
-export type SuppressionPolicy = 'strict' | 'transactional-allowed' | 'off';

package/dist/template.d.ts

@@ -1,99 +0,0 @@
-/**
- * Mark a string as pre-rendered HTML so {@link replaceVariables} splices
- * it in verbatim instead of escaping. Use ONLY for content that you
- * authored (or that came from a trusted renderer like the framework's
- * own layout-slot resolution) — never for user input.
- *
- * @example
- * ```ts
- * mail.send({
- *   template: 'invoice',
- *   variables: {
- *     // User-supplied — escaped automatically (good)
- *     userName: req.input('name'),
- *     // Pre-rendered HTML you built yourself — opt out of escaping
- *     invoiceTable: safe(renderInvoiceTable(rows)),
- *   },
- * })
- * ```
- */
-export declare function safe(html: string): SafeHtml;
-/**
- * Render an email template with optional layout
- *
- * Supports both .stx and .html templates. When a .stx template
- * is found, it uses the STX engine for rendering (with directives,
- * server scripts, etc.). When an .html template is found, it uses
- * simple {{ variable }} replacement with layout wrapping.
- *
- * Templates resolve from userland `resources/emails/` first, then
- * fall back to the framework-shipped defaults in
- * `storage/framework/defaults/resources/emails/` — so the prebaked
- * mailers (password-reset, password-changed, email-verification)
- * work out of the box on a default install while any userland file
- * with the same name always wins (stacksjs/stacks#1944).
- *
- * Within each directory, .stx templates are preferred over .html
- * when both exist.
- *
- * @example
- * ```typescript
- * // STX template (resources/emails/welcome.stx)
- * const { html, text } = await template('welcome', {
- *   variables: { userName: 'John' }
- * })
- *
- * // HTML template with layout
- * const { html, text } = await template('notification', {
- *   layout: 'base',
- *   variables: { message: 'Hello' }
- * })
- *
- * // Without layout (HTML templates only)
- * const { html, text } = await template('simple', {
- *   layout: false
- * })
- * ```
- */
-export declare function template(templateName: string, options?: TemplateOptions): Promise<TemplateResult>;
-/**
- * Render a raw HTML string with variables (no file loading)
- */
-export declare function renderHtml(htmlContent: string, variables?: TemplateVariables): TemplateResult;
-/**
- * Check if a template exists (.stx or .html)
- */
-export declare function templateExists(templateName: string): boolean;
-/**
- * List available templates (.stx and .html)
- */
-export declare function listTemplates(): string[];
-export declare interface TemplateResult {
-  html: string
-  text: string
-}
-export declare interface TemplateOptions {
-  variables?: TemplateVariables
-  layout?: string | false
-  subject?: string
-  inline?: boolean
-}
-/** Allowed types for email template variable values */
-export type TemplateVariableValue = string | number | boolean | undefined | null | SafeHtml;
-/** Map of variable names to their values for template replacement */
-export type TemplateVariables = Record<string, TemplateVariableValue>;
-/**
- * Marker wrapper for variable values that contain pre-rendered HTML and
- * should NOT be escaped during {@link replaceVariables}. Constructed via
- * the {@link safe} helper.
- *
- * Anything that isn't a `SafeHtml` instance (or `safe`-marked) is treated
- * as untrusted text and runs through HTML escaping — this is the M-1
- * fix for stacksjs/stacks#1871 (template XSS via unescaped variable
- * interpolation).
- */
-export declare class SafeHtml {
-  readonly __safeHtml: true;
-  public readonly value: string;
-  constructor(value: string);
-}

package/dist/types.d.ts

@@ -1,37 +0,0 @@
-export declare interface Message {
-  name: string
-  subject: string
-  to: string | string[]
-  from?: {
-    name: string
-    address: string
-  }
-  template: string
-  handle?: () => Promise<{ message: string }>
-  onError?: (error: Error) => Promise<{ message: string }>
-  onSuccess?: () => void
-}
-export declare interface SendEmailParams {
-  Source: string
-  Destination: {
-    ToAddresses: string[]
-  }
-  Message: {
-    Body: {
-      Html: {
-        Charset: 'UTF-8'
-        Data: string
-      }
-    }
-    Subject: {
-      Charset: 'UTF-8'
-      Data: string
-    }
-  }
-}
-export declare interface EmailParams {
-  to: string
-  from: string
-  subject: string
-  html: string
-}

package/dist/unsubscribe.d.ts

@@ -1,39 +0,0 @@
-/**
- * Mint a signed unsubscribe token for `email`. Default expiry is
- * 30 days — long enough that the link in an archived email still
- * works months later, short enough that a leaked URL doesn't grant
- * indefinite control. Tighter caps available via `ttlSeconds`.
- */
-export declare function createUnsubscribeToken(email: string, ttlSeconds?: number): string;
-/**
- * Verify a signed unsubscribe token. Returns the email + a
- * discriminated outcome — callers map invalid results to a 400/410
- * response and the success case writes the suppression record.
- */
-export declare function verifyUnsubscribeToken(token: string): UnsubscribeVerification;
-/**
- * Build the full opt-out URL for `email`. Combines the configured
- * route prefix (`email.unsubscribeRoute`, defaults to
- * `/_stacks/email/unsubscribe`) with the app's public URL (`APP_URL`
- * env var) and the signed token.
- *
- * Pass the result into email bodies / `List-Unsubscribe` headers —
- * see {@link buildListUnsubscribeHeaders} for RFC 8058
- * (one-click) compatibility.
- */
-export declare function buildUnsubscribeUrl(email: string, ttlSeconds?: number, options?: { baseUrl?: string, routePrefix?: string }): string;
-/**
- * Build a `List-Unsubscribe` / `List-Unsubscribe-Post` header
- * pair (RFC 8058). Gmail/Apple Mail use these for the native
- * "Unsubscribe" button — without them the user has to find your
- * footer link.
- *
- * Returns a map suitable for passing into `EmailMessage.headers`
- * (or merging with existing headers).
- */
-export declare function buildListUnsubscribeHeaders(email: string, ttlSeconds?: number, options?: { baseUrl?: string, routePrefix?: string }): Record<string, string>;
-export declare interface UnsubscribeVerification {
-  valid: boolean
-  reason?: 'malformed' | 'bad_signature' | 'expired'
-  email?: string
-}

package/dist/validation.d.ts

@@ -1,48 +0,0 @@
-/**
- * Throw if `addr` isn't a clean envelope address. The error message
- * includes the role (`to` / `cc` / etc.) so log scrapers can grep for
- * the offending slot without parsing the rest.
- */
-export declare function assertEnvelopeAddress(addr: unknown, role: string): void;
-/**
- * Reject subject lines containing CR or LF — they become header
- * fields on the wire, and a newline in the value lets an attacker
- * inject additional headers (BCC leak, Reply-To override).
- *
- * Centralized here so the check applies uniformly across drivers
- * (stacksjs/stacks#1871 M-6).
- */
-export declare function assertHeaderSafeSubject(subject: string): void;
-/**
- * Filter a `message.headers` map down to entries whose value is a
- * string and whose name/value contain no CR/LF (header injection
- * vector). Returns undefined when nothing usable remains so caller-
- * sites can spread the result without sending an empty `headers: {}`
- * payload field.
- *
- * Used by every driver that consumes {@link EmailMessage.headers}
- * (stacksjs/stacks#1871 M-5). Centralizing the CR/LF guard ensures
- * the SES `Headers` slot, the SendGrid `headers` field, and the
- * Mailtrap `headers` map all reject the same injection-shaped values.
- */
-export declare function filterStringHeaders(headers: Record<string, string> | undefined): Record<string, string> | undefined;
-/**
- * Email validation primitives shared by every driver + the base
- * driver class. Pulled into a module so the `ENVELOPE_ADDRESS` regex
- * lives in exactly one place — the audit (stacksjs/stacks#1871 M-6)
- * called out a copy in `drivers/base.ts` and a copy in `drivers/smtp.ts`,
- * and they were already starting to drift.
- */
-/**
- * RFC 5321-ish envelope-address shape. Intentionally tighter than the
- * full RFC because the broader form (display names, comments, source
- * routes) has no business in the envelope slots that hit the wire as
- * raw header values: `to` / `cc` / `bcc` / `from` / `replyTo`.
- *
- * Rejects:
- *   - whitespace, including CR / LF / tab (header-injection vectors)
- *   - angle brackets / quotes / backslashes (header parser confusion)
- *
- * Requires a single `@` separating local part and domain.
- */
-export declare const ENVELOPE_ADDRESS: unknown;

package/dist/webhook-dedup.d.ts

@@ -1,10 +0,0 @@
-/**
- * Record an event-id as processed. Returns `true` if this is the
- * first time we've seen the id (caller should process), `false`
- * if it's a duplicate (caller should ack-and-skip).
- *
- * When the table doesn't exist, falls through to "always first" +
- * warn-once — apps without the migration still work; they just
- * double-process if the provider retries.
- */
-export declare function recordWebhookEventOrSkip(provider: 'mailgun' | 'postmark' | 'ses' | 'sendgrid', eventId: string): Promise<boolean>;

package/dist/webhook-events.d.ts

@@ -1,34 +0,0 @@
-import type { SuppressionType } from './suppression';
-/** Fired when a provider reports a hard bounce. */
-export declare function emitEmailBounceHard(payload: EmailEventPayload): Promise<void>;
-/** Fired when a provider reports a soft bounce (transient). */
-export declare function emitEmailBounceSoft(payload: EmailEventPayload): Promise<void>;
-/** Fired when a provider reports a complaint (user marked spam). */
-export declare function emitEmailComplaint(payload: EmailEventPayload): Promise<void>;
-/**
- * Fired when the user clicks the framework's signed unsubscribe URL
- * AND when a provider's "unsubscribed" webhook event arrives. Both
- * sources land in the same listener so apps only have to wire up
- * one code path.
- */
-export declare function emitEmailUnsubscribe(payload: EmailEventPayload): Promise<void>;
-/**
- * Map a classified event to the suppression type that should be
- * recorded. Soft bounces are intentionally NOT auto-suppressed —
- * they're transient and the next send is likely to succeed.
- */
-export declare function suppressionTypeFor(classification: EmailEventClassification): SuppressionType | null;
-/**
- * Payload shape every email-event listener receives. Always
- * includes the recipient + provider + the provider's raw event
- * payload so listeners can branch on provider-specific fields
- * without re-parsing.
- */
-export declare interface EmailEventPayload {
-  email: string
-  provider: 'mailgun' | 'postmark' | 'ses' | 'sendgrid'
-  reason?: string
-  raw: unknown
-}
-export type EmailBounceType = 'hard' | 'soft';
-export type EmailEventClassification = 'bounce-hard' | 'bounce-soft' | 'complaint' | 'unsubscribe' | 'delivered';

package/dist/webhook-handlers.d.ts

@@ -1,27 +0,0 @@
-import type { EmailEventClassification } from './webhook-events';
-export declare function handleMailgunWebhook(rawBody: string, config: MailgunWebhookConfig): Promise<WebhookResult>;
-export declare function handlePostmarkWebhook(rawBody: string, authorizationHeader: string | null, sourceIp: string | undefined, config: PostmarkWebhookConfig): Promise<WebhookResult>;
-export declare function handleSesWebhook(rawBody: string, config?: SesWebhookConfig): Promise<WebhookResult>;
-export declare function handleSendgridWebhook(rawBody: string, signatureHeader: string | null, timestampHeader: string | null, config: SendgridWebhookConfig): Promise<WebhookResult>;
-export declare interface WebhookResult {
-  status: number
-  body: { ok: boolean, reason?: string, processed?: boolean, classification?: EmailEventClassification }
-}
-export declare interface MailgunWebhookConfig {
-  signingKey: string
-  toleranceSeconds?: number
-}
-export declare interface PostmarkWebhookConfig {
-  username: string
-  password: string
-  ipAllowlist?: ReadonlyArray<string>
-}
-export declare interface SesWebhookConfig {
-  certUrlHostAllowlist?: RegExp
-  fetchCert?: (url: string) => Promise<string>
-  autoConfirmSubscriptions?: boolean
-}
-export declare interface SendgridWebhookConfig {
-  publicKeyPem: string
-  toleranceSeconds?: number
-}

package/dist/webhook-signatures.d.ts

@@ -1,91 +0,0 @@
-/**
- * Verify a Mailgun webhook signature. Mailgun signs
- * `${timestamp}${token}` with HMAC-SHA256; the hex digest is
- * compared in constant time against the `signature` field.
- *
- * The timestamp is checked against wall clock with a configurable
- * tolerance (default 5 minutes) to reject replays. Constant-time
- * compare prevents signature-timing oracles.
- */
-export declare function verifyMailgunSignature(input: MailgunSignatureInput): SignatureVerification;
-/**
- * Verify a Postmark webhook. Postmark uses HTTP Basic Auth (the app
- * configures the username + password when registering the webhook in
- * the Postmark dashboard); they don't sign the body. The auth check
- * is constant-time. Optional IP-allowlist check rejects requests
- * from outside Postmark's published source IPs.
- */
-export declare function verifyPostmarkAuth(input: PostmarkAuthInput): SignatureVerification;
-/**
- * Verify an SNS message signature (SES uses SNS for delivery). The
- * cert URL host MUST match `sns.<region>.amazonaws.com` — any other
- * host is treated as untrusted (defense against SSRF via crafted
- * SigningCertURL).
- *
- * Note: this function intentionally only does the structural +
- * cert-URL check + signature verify. SubscriptionConfirmation
- * handling (responding to `SubscribeURL` to complete the topic
- * binding) is the route handler's job since it's a one-time setup
- * action distinct from per-event verification.
- */
-export declare function verifySesSnsSignature(input: SesSnsSignatureInput): Promise<SignatureVerification>;
-/**
- * Verify a SendGrid Event Webhook signature. SendGrid signs
- * `${timestamp}${body}` with ECDSA-SHA256 using the public key from
- * their signed-webhook setup page. Signature is base64 in the
- * `X-Twilio-Email-Event-Webhook-Signature` header.
- */
-export declare function verifySendgridSignature(input: SendgridSignatureInput): SignatureVerification;
-// =============================================================================
-// Mailgun
-// =============================================================================
-export declare interface MailgunSignatureInput {
-  timestamp: string
-  token: string
-  signature: string
-  signingKey: string
-  toleranceSeconds?: number
-}
-// =============================================================================
-// Postmark
-// =============================================================================
-export declare interface PostmarkAuthInput {
-  authorizationHeader: string | null | undefined
-  expectedUsername: string
-  expectedPassword: string
-  sourceIp?: string
-  ipAllowlist?: ReadonlyArray<string>
-}
-// =============================================================================
-// SES (via SNS)
-// =============================================================================
-export declare interface SesSnsSignatureInput {
-  message: {
-    Type: 'Notification' | 'SubscriptionConfirmation' | 'UnsubscribeConfirmation'
-    MessageId: string
-    TopicArn: string
-    Subject?: string
-    Message: string
-    Timestamp: string
-    SignatureVersion: string
-    Signature: string
-    SigningCertURL: string
-    Token?: string
-    SubscribeURL?: string
-    [key: string]: unknown
-  }
-  fetchCert?: (url: string) => Promise<string>
-  certUrlHostAllowlist?: RegExp
-}
-// =============================================================================
-// SendGrid
-// =============================================================================
-export declare interface SendgridSignatureInput {
-  body: string
-  signature: string | null | undefined
-  timestamp: string | null | undefined
-  publicKeyPem: string
-  toleranceSeconds?: number
-}
-export type SignatureVerification = | { ok: true }
-  | { ok: false, reason: 'missing-config' | 'missing-signature' | 'bad-signature' | 'expired' | 'untrusted-cert-url' | 'cert-fetch-failed' }