@vibesdotdev/integrations-resend 0.0.0-stage → 1.0.0-rc.3

package/dist/resend/resend-events.impls.js

@@ -0,0 +1,115 @@
+/**
+ * Runtime implementations for the Resend `tools/webhook-event-definition`
+ * descriptors. Each impl extracts a normalized payload from Resend's raw
+ * webhook body, builds a marshal task spec, and (for `email.received`) builds
+ * the `update_lead` outbox entry.
+ *
+ * The received parser accepts both the provider envelope and an enriched
+ * received-email resource. RFC reply identity stays distinct from the API id.
+ */
+import { normalizeReceived } from "./resend-normalize.js";
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { identityValueSchema, receivedPayloadSchema, receivedWebhookSchema, webhookPayloadSchema } from "../schemas/resend.js";
+import { resendEmailBouncedDescriptor, resendEmailComplainedDescriptor, resendEmailDeliveredDescriptor, resendEmailReceivedDescriptor } from "./resend-events.descriptors.js";
+function generateId() {
+    return crypto.randomUUID();
+}
+function nowIso() {
+    return new Date().toISOString();
+}
+class ResendEmailReceived {
+    descriptor = resendEmailReceivedDescriptor;
+    idempotencyKey(parsed) {
+        const value = identityValueSchema.safeParse(parsed.email_id);
+        const emailId = value.success ? value.data : '';
+        return emailId ? `resend:email.received:${encodeURIComponent(emailId)}` : null;
+    }
+    parse(raw) {
+        if ('data' in raw || 'type' in raw) {
+            if (!receivedWebhookSchema.safeParse(raw).success)
+                throw new CapabilityError('Invalid Resend received event.', 'INVALID_INPUT', { reason: 'resend-webhook-invalid' });
+        }
+        return normalizeReceived(raw);
+    }
+    buildTask(parsed) {
+        return {
+            title: `Inbound: ${receivedPayloadSchema.parse(parsed).subject || '(no subject)'}`,
+            lane: 'webhook',
+            description: `New email from ${parsed.from} to ${parsed.to}`,
+            priority: 'medium',
+            assigned_to: 'marshal-webhook'
+        };
+    }
+    buildOutbox(parsed) {
+        return [
+            {
+                id: generateId(),
+                source: 'resend',
+                webhook_request_id: '',
+                action: 'update_lead',
+                payload: {
+                    contact_email: parsed.from,
+                    subject: parsed.subject,
+                    direction: 'inbound',
+                    message_id: parsed.message_id
+                },
+                status: 'pending',
+                created_at: nowIso()
+            }
+        ];
+    }
+}
+function deliveryPayload(raw, type) {
+    if ('data' in raw || 'type' in raw) {
+        const event = webhookPayloadSchema.safeParse(raw);
+        if (!event.success || event.data.type !== type)
+            throw new CapabilityError('Invalid Resend delivery event.', 'INVALID_INPUT', { reason: 'resend-webhook-invalid' });
+    }
+    const payload = receivedPayloadSchema.parse('data' in raw ? raw.data : raw);
+    return {
+        message_id: payload.email_id || payload.id, from: payload.from, to: payload.to[0] ?? '',
+        subject: payload.subject, bounce_reason: payload.bounce?.message || payload.reason,
+        created_at: payload.created_at || nowIso()
+    };
+}
+class ResendEmailBounced {
+    descriptor = resendEmailBouncedDescriptor;
+    parse(raw) { return deliveryPayload(raw, 'email.bounced'); }
+    buildTask(parsed) {
+        return {
+            title: `Bounce: ${receivedPayloadSchema.parse(parsed).subject || '(no subject)'}`,
+            lane: 'webhook',
+            description: `Email to ${parsed.to} bounced: ${parsed.bounce_reason}`,
+            priority: 'low',
+            assigned_to: 'marshal-webhook'
+        };
+    }
+}
+class ResendEmailDelivered {
+    descriptor = resendEmailDeliveredDescriptor;
+    parse(raw) { return deliveryPayload(raw, 'email.delivered'); }
+    buildTask(parsed) {
+        return {
+            title: `Delivered: ${receivedPayloadSchema.parse(parsed).subject || '(no subject)'}`,
+            lane: 'webhook',
+            description: `Email delivered to ${parsed.to}`,
+            priority: 'low',
+            assigned_to: 'marshal-webhook'
+        };
+    }
+}
+class ResendEmailComplained {
+    descriptor = resendEmailComplainedDescriptor;
+    parse(raw) { return deliveryPayload(raw, 'email.complained'); }
+    buildTask(parsed) {
+        return {
+            title: `Spam complaint: ${parsed.subject}`,
+            lane: 'webhook',
+            description: `Spam complaint from ${parsed.to}`,
+            priority: 'high',
+            assigned_to: 'marshal-webhook'
+        };
+    }
+}
+export { ResendEmailReceived, ResendEmailBounced, ResendEmailDelivered, ResendEmailComplained };
+//# sourceMappingURL=resend-events.impls.js.map

package/dist/resend/resend-events.impls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-events.impls.js","sourceRoot":"","sources":["../../src/resend/resend-events.impls.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAQ/H,OAAO,EACN,4BAA4B,EAC5B,+BAA+B,EAC/B,8BAA8B,EAC9B,6BAA6B,EAC7B,MAAM,gCAAgC,CAAC;AAExC,SAAS,UAAU;IAClB,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,MAAM;IACd,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,mBAAmB;IACf,UAAU,GAAqC,6BAA6B,CAAC;IAEtF,cAAc,CAAC,MAAkB;QAChC,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,OAAO,OAAO,CAAC,CAAC,CAAC,yBAAyB,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,GAAe;QACpB,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO;gBAAE,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACvK,CAAC;QACD,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,SAAS,CAAC,MAAkB;QAC3B,OAAO;YACN,KAAK,EAAE,YAAY,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,IAAI,cAAc,EAAE;YAClF,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,kBAAkB,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,EAAE,EAAE;YAC5D,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,iBAAiB;SAC9B,CAAC;IACH,CAAC;IAED,WAAW,CAAC,MAAkB;QAC7B,OAAO;YACN;gBACC,EAAE,EAAE,UAAU,EAAE;gBAChB,MAAM,EAAE,QAAQ;gBAChB,kBAAkB,EAAE,EAAE;gBACtB,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE;oBACR,aAAa,EAAE,MAAM,CAAC,IAAI;oBAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,SAAS;oBACpB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC7B;gBACD,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,MAAM,EAAE;aACpB;SACD,CAAC;IACH,CAAC;CACD;AAED,SAAS,eAAe,CAAC,GAAe,EAAE,IAAY;IACrD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,oBAAoB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACpK,CAAC;IACD,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5E,OAAO;QACN,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QACvF,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC,MAAM;QAClF,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,MAAM,EAAE;KAC1C,CAAC;AACH,CAAC;AAED,MAAM,kBAAkB;IACd,UAAU,GAAqC,4BAA4B,CAAC;IAErF,KAAK,CAAC,GAAe,IAAgB,OAAO,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IAEpF,SAAS,CAAC,MAAkB;QAC3B,OAAO;YACN,KAAK,EAAE,WAAW,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,IAAI,cAAc,EAAE;YACjF,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,YAAY,MAAM,CAAC,EAAE,aAAa,MAAM,CAAC,aAAa,EAAE;YACrE,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,iBAAiB;SAC9B,CAAC;IACH,CAAC;CACD;AAED,MAAM,oBAAoB;IAChB,UAAU,GAAqC,8BAA8B,CAAC;IAEvF,KAAK,CAAC,GAAe,IAAgB,OAAO,eAAe,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAEtF,SAAS,CAAC,MAAkB;QAC3B,OAAO;YACN,KAAK,EAAE,cAAc,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,IAAI,cAAc,EAAE;YACpF,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,sBAAsB,MAAM,CAAC,EAAE,EAAE;YAC9C,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,iBAAiB;SAC9B,CAAC;IACH,CAAC;CACD;AAED,MAAM,qBAAqB;IACjB,UAAU,GAAqC,+BAA+B,CAAC;IAExF,KAAK,CAAC,GAAe,IAAgB,OAAO,eAAe,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAEvF,SAAS,CAAC,MAAkB;QAC3B,OAAO;YACN,KAAK,EAAE,mBAAmB,MAAM,CAAC,OAAO,EAAE;YAC1C,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,uBAAuB,MAAM,CAAC,EAAE,EAAE;YAC/C,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,iBAAiB;SAC9B,CAAC;IACH,CAAC;CACD;AAED,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,CAAC"}

package/dist/resend/resend-message-source.descriptor.d.ts

@@ -0,0 +1,30 @@
+declare const _default: {
+    id: string;
+    kind: "agent/event-source";
+    name: string;
+    sourceType: "webhook" | "schedule" | "system" | "channel" | "integration";
+    status: "error" | "active" | "paused" | "disconnected";
+    agentIds: string[];
+    config: Record<string, unknown>;
+    enabled: boolean;
+    description?: string | undefined;
+    filters?: {
+        eventTypes?: string[] | undefined;
+        channels?: string[] | undefined;
+        guilds?: string[] | undefined;
+        keywords?: string[] | undefined;
+        minPriority?: number | undefined;
+    } | undefined;
+    integrationId?: string | undefined;
+    schedule?: {
+        cron?: string | undefined;
+        intervalMs?: number | undefined;
+    } | undefined;
+    userId?: string | undefined;
+    projectId?: string | undefined;
+    organizationId?: string | undefined;
+    hardware?: ("consumer" | "cloud")[] | undefined;
+    tags?: string[] | undefined;
+};
+export default _default;
+//# sourceMappingURL=resend-message-source.descriptor.d.ts.map

package/dist/resend/resend-message-source.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-message-source.descriptor.d.ts","sourceRoot":"","sources":["../../src/resend/resend-message-source.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,wBAqBG"}

package/dist/resend/resend-message-source.descriptor.js

@@ -0,0 +1,24 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel/factory';
+export default createRuntimeAsset({
+    kind: 'agent/event-source',
+    id: 'message.email.resend',
+    name: 'Resend Email',
+    description: 'Inbound Resend email. Agent deployments select the connected account and receiving mailbox.',
+    sourceType: 'integration',
+    status: 'disconnected',
+    agentIds: [],
+    integrationId: 'integration.email.resend',
+    config: {
+        provider: 'resend',
+        category: 'email',
+        eventTypes: ['email.received'],
+        operations: ['send', 'check'],
+        credentialKeys: ['apiKey', 'webhookSecret'],
+        inbound: { type: 'webhook', source: 'resend' }
+    },
+    filters: { eventTypes: ['email.received'] },
+    enabled: true,
+    hardware: ['cloud', 'consumer'],
+    tags: ['messaging', 'email', 'resend', 'agent-event-source']
+});
+//# sourceMappingURL=resend-message-source.descriptor.js.map

package/dist/resend/resend-message-source.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-message-source.descriptor.js","sourceRoot":"","sources":["../../src/resend/resend-message-source.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGjE,eAAe,kBAAkB,CAA6B;IAC7D,IAAI,EAAE,oBAAoB;IAC1B,EAAE,EAAE,sBAAsB;IAC1B,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,6FAA6F;IAC1G,UAAU,EAAE,aAAa;IACzB,MAAM,EAAE,cAAc;IACtB,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE,0BAA0B;IACzC,MAAM,EAAE;QACP,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,OAAO;QACjB,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAC7B,cAAc,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;QAC3C,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;KAC9C;IACD,OAAO,EAAE,EAAE,UAAU,EAAE,CAAC,gBAAgB,CAAC,EAAE;IAC3C,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;IAC/B,IAAI,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,oBAAoB,CAAC;CAC5D,CAAC,CAAC"}

package/dist/resend/resend-normalize.d.ts

@@ -0,0 +1,24 @@
+import type { JsonObject } from '@vibesdotdev/kernel/schemas/json';
+/** Pure shared normalization for verified events and selected-account hydration. */
+export declare function normalizeReceived(raw: JsonObject): {
+    message_id: string;
+    email_id: string;
+    from: string;
+    to: string;
+    to_addresses: string[];
+    cc: string[];
+    bcc: string[];
+    received_for: string[];
+    subject: string;
+    body_text: string;
+    body_html: string;
+    reply_to: string;
+    reply_to_addresses: string[];
+    in_reply_to: string;
+    references: string | string[];
+    headers: Record<string, string>;
+    thread_id: string;
+    attachments: import("@vibesdotdev/kernel/bootstrap").JsonValue[];
+    created_at: string;
+};
+//# sourceMappingURL=resend-normalize.d.ts.map

package/dist/resend/resend-normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-normalize.d.ts","sourceRoot":"","sources":["../../src/resend/resend-normalize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAGnE,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,UAAU;;;;;;;;;;;;;;;;;;;;EAkBhD"}

package/dist/resend/resend-normalize.js

@@ -0,0 +1,22 @@
+import { receivedEnvelopeSchema, receivedPayloadSchema, normalizedReceivedSchema } from "../schemas/resend.js";
+/** Pure shared normalization for verified events and selected-account hydration. */
+export function normalizeReceived(raw) {
+    const envelope = 'data' in raw ? { success: true, data: receivedEnvelopeSchema.parse(raw) } : undefined;
+    const payload = envelope ? envelope.data.data : receivedPayloadSchema.parse(raw);
+    const headers = payload.headers;
+    const header = (name) => Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1] ?? '';
+    const replyTo = payload.reply_to.length ? payload.reply_to : [header('reply-to')].filter(Boolean);
+    return normalizedReceivedSchema.parse({
+        message_id: header('message-id') || payload.message_id || payload.messageId || payload.id,
+        email_id: payload.email_id || payload.id, from: payload.from,
+        to: payload.to[0] ?? '', to_addresses: payload.to, cc: payload.cc, bcc: payload.bcc,
+        received_for: payload.received_for, subject: payload.subject,
+        body_text: payload.text || payload.body_text, body_html: payload.html || payload.body_html,
+        reply_to: replyTo[0] ?? '', reply_to_addresses: replyTo,
+        in_reply_to: payload.in_reply_to || header('in-reply-to'),
+        references: payload.references.length ? payload.references : header('references'),
+        headers, thread_id: payload.thread_id || payload.threadId, attachments: payload.attachments,
+        created_at: payload.created_at || (envelope ? envelope.data.created_at : '') || new Date().toISOString()
+    });
+}
+//# sourceMappingURL=resend-normalize.js.map

package/dist/resend/resend-normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-normalize.js","sourceRoot":"","sources":["../../src/resend/resend-normalize.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAE/G,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,GAAe;IAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxG,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChH,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClG,OAAO,wBAAwB,CAAC,KAAK,CAAC;QACrC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,EAAE;QACzF,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI;QAC5D,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG;QACnF,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;QAC5D,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS;QAC1F,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,OAAO;QACvD,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC,aAAa,CAAC;QACzD,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QACjF,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;QAC3F,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACxG,CAAC,CAAC;AACJ,CAAC"}

package/dist/resend/resend-received.d.ts

@@ -0,0 +1,26 @@
+import { type RuntimeHttpFetch } from '@vibesdotdev/kernel';
+import { type ResendReceivedEmailInput } from '../schemas/resend.ts';
+export type { ResendReceivedEmailInput } from '../schemas/resend.ts';
+/** Retrieve the selected resource before normalizing complete content. */
+export declare function retrieveResendReceivedEmail(httpFetch: RuntimeHttpFetch, input: ResendReceivedEmailInput): Promise<{
+    message_id: string;
+    email_id: string;
+    from: string;
+    to: string;
+    to_addresses: string[];
+    cc: string[];
+    bcc: string[];
+    received_for: string[];
+    subject: string;
+    body_text: string;
+    body_html: string;
+    reply_to: string;
+    reply_to_addresses: string[];
+    in_reply_to: string;
+    references: string | string[];
+    headers: Record<string, string>;
+    thread_id: string;
+    attachments: import("@vibesdotdev/kernel/bootstrap").JsonValue[];
+    created_at: string;
+}>;
+//# sourceMappingURL=resend-received.d.ts.map

package/dist/resend/resend-received.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-received.d.ts","sourceRoot":"","sources":["../../src/resend/resend-received.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,EAAgD,KAAK,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEnH,YAAY,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAErE,0EAA0E;AAC1E,wBAAsB,2BAA2B,CAAC,SAAS,EAAE,gBAAgB,EAAE,KAAK,EAAE,wBAAwB;;;;;;;;;;;;;;;;;;;;GAc7G"}

package/dist/resend/resend-received.js

@@ -0,0 +1,26 @@
+import { readResendResponse } from "./resend-response.js";
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { JsonObjectSchema } from '@vibesdotdev/kernel/schemas/json';
+import { receivedResourceSchema, retrievalInputSchema } from "../schemas/resend.js";
+import { normalizeReceived } from "./resend-normalize.js";
+/** Retrieve the selected resource before normalizing complete content. */
+export async function retrieveResendReceivedEmail(httpFetch, input) {
+    const admittedInput = retrievalInputSchema.safeParse(input);
+    if (!admittedInput.success)
+        throw new CapabilityError('Resend received email requires emailId, selected apiKey and baseUrl.', 'INVALID_INPUT', { reason: 'resend-received-input-invalid' });
+    input = admittedInput.data;
+    const response = await httpFetch(`${input.baseUrl.replace(/\/$/, '')}/emails/receiving/${encodeURIComponent(input.emailId)}`, {
+        method: 'GET', headers: { authorization: `Bearer ${input.apiKey}`, accept: 'application/json' },
+        redirect: 'error', signal: input.signal ?? AbortSignal.timeout(15_000)
+    });
+    if (!response.ok)
+        throw new CapabilityError(`Resend received-email retrieval failed (${response.status}).`, 'UNAVAILABLE', { reason: 'resend-upstream-refused', details: { status: response.status } });
+    const body = await readResendResponse(response);
+    const admitted = receivedResourceSchema.safeParse(body);
+    if (!admitted.success)
+        throw new CapabilityError('Resend received-email response is missing full content, headers or message identity.', 'UNAVAILABLE', { reason: 'resend-received-invalid' });
+    if (admitted.data.id !== input.emailId)
+        throw new CapabilityError('Resend received-email response identity does not match the requested email.', 'UNAVAILABLE', { reason: 'resend-received-invalid' });
+    return normalizeReceived(JsonObjectSchema.parse(body));
+}
+//# sourceMappingURL=resend-received.js.map

package/dist/resend/resend-received.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-received.js","sourceRoot":"","sources":["../../src/resend/resend-received.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAyB,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAiC,MAAM,sBAAsB,CAAC;AACnH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG1D,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,SAA2B,EAAE,KAA+B;IAC7G,MAAM,aAAa,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,CAAC,aAAa,CAAC,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,sEAAsE,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC,CAAC;IAC5L,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE;QAC7H,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC/F,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACtE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,2CAA2C,QAAQ,CAAC,MAAM,IAAI,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxM,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,sFAAsF,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC/L,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,6EAA6E,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACvM,OAAO,iBAAiB,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/resend/resend-response.d.ts

@@ -0,0 +1,3 @@
+/** Upstream parse failures retain value-free facts, never response fragments. */
+export declare function readResendResponse(response: Response): Promise<import("@vibesdotdev/kernel/bootstrap").JsonValue>;
+//# sourceMappingURL=resend-response.d.ts.map

package/dist/resend/resend-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-response.d.ts","sourceRoot":"","sources":["../../src/resend/resend-response.ts"],"names":[],"mappings":"AAGA,iFAAiF;AACjF,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,8DAQ1D"}

package/dist/resend/resend-response.js

@@ -0,0 +1,14 @@
+import { CapabilityError, CaughtFailureSchema, valueFreeFailure } from '@vibesdotdev/kernel';
+import { JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+/** Upstream parse failures retain value-free facts, never response fragments. */
+export async function readResendResponse(response) {
+    try {
+        return JsonValueSchema.parse(await response.json());
+    }
+    catch (cause) {
+        throw new CapabilityError('Resend returned an invalid JSON response.', 'UNAVAILABLE', {
+            reason: 'resend-result-invalid', details: { status: response.status, failure: valueFreeFailure(CaughtFailureSchema.parse(cause)) }
+        });
+    }
+}
+//# sourceMappingURL=resend-response.js.map

package/dist/resend/resend-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-response.js","sourceRoot":"","sources":["../../src/resend/resend-response.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEnE,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAkB;IAC1D,IAAI,CAAC;QACJ,OAAO,eAAe,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,eAAe,CAAC,2CAA2C,EAAE,aAAa,EAAE;YACrF,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE;SAClI,CAAC,CAAC;IACJ,CAAC;AACF,CAAC"}

package/dist/resend/resend-signature-verifier.descriptor.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `tools/signature-verifier` descriptor for Resend (Svix) webhook signatures.
+ *
+ * Consumed by `processWebhook` in `@vibesdotdev/tools/webhooks/router` to
+ * verify incoming Resend webhook deliveries against the `RESEND_WEBHOOK_SECRET`
+ * env-resolved secret. The descriptor id is referenced by source name; the
+ * router filters `tools/signature-verifier` descriptors by `source === 'resend'`.
+ */
+declare const _default: {
+    id: string;
+    kind: "tools/signature-verifier";
+    name: string;
+    source: string;
+    description?: string | undefined;
+    headerName?: string | undefined;
+    signingSecretEnv?: string | undefined;
+    tags?: string[] | undefined;
+};
+export default _default;
+//# sourceMappingURL=resend-signature-verifier.descriptor.d.ts.map

package/dist/resend/resend-signature-verifier.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-signature-verifier.descriptor.d.ts","sourceRoot":"","sources":["../../src/resend/resend-signature-verifier.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;;;;;;;;;;;AAKH,wBASG"}

package/dist/resend/resend-signature-verifier.descriptor.js

@@ -0,0 +1,20 @@
+/**
+ * `tools/signature-verifier` descriptor for Resend (Svix) webhook signatures.
+ *
+ * Consumed by `processWebhook` in `@vibesdotdev/tools/webhooks/router` to
+ * verify incoming Resend webhook deliveries against the `RESEND_WEBHOOK_SECRET`
+ * env-resolved secret. The descriptor id is referenced by source name; the
+ * router filters `tools/signature-verifier` descriptors by `source === 'resend'`.
+ */
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export default createRuntimeAsset({
+    kind: 'tools/signature-verifier',
+    id: 'signature-verifier.resend',
+    name: 'Resend Webhook Signature Verifier',
+    description: 'Verifies Svix-signed Resend webhook deliveries (HMAC-SHA256 over svix-id.svix-timestamp.rawBody).',
+    source: 'resend',
+    headerName: 'svix-signature',
+    signingSecretEnv: 'RESEND_WEBHOOK_SECRET',
+    tags: ['email', 'resend', 'svix', 'webhook']
+});
+//# sourceMappingURL=resend-signature-verifier.descriptor.js.map

package/dist/resend/resend-signature-verifier.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-signature-verifier.descriptor.js","sourceRoot":"","sources":["../../src/resend/resend-signature-verifier.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGzD,eAAe,kBAAkB,CAA8B;IAC9D,IAAI,EAAE,0BAA0B;IAChC,EAAE,EAAE,2BAA2B;IAC/B,IAAI,EAAE,mCAAmC;IACzC,WAAW,EAAE,mGAAmG;IAChH,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,gBAAgB;IAC5B,gBAAgB,EAAE,uBAAuB;IACzC,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC;CAC5C,CAAC,CAAC"}

package/dist/resend/resend-signature-verifier.impl.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Runtime implementation for the Resend `tools/signature-verifier` descriptor.
+ *
+ * Returned by the plugin loader and called from
+ * `@vibesdotdev/tools/webhooks/router#processWebhook` after the router resolves
+ * the verifier for `source === 'resend'`. The router supplies the resolved
+ * secret (read from `RESEND_WEBHOOK_SECRET` per the descriptor); the impl
+ * does pure Svix HMAC verification with no I/O.
+ */
+import type { SignatureVerifierDescriptor, SignatureVerifierImplementation } from '@vibesdotdev/tools/webhooks/schemas';
+export declare class ResendSignatureVerifier implements SignatureVerifierImplementation {
+    readonly descriptor: SignatureVerifierDescriptor;
+    verify(rawBody: string, headers: Record<string, string>, secret: string): Promise<boolean>;
+}
+export default ResendSignatureVerifier;
+//# sourceMappingURL=resend-signature-verifier.impl.d.ts.map

package/dist/resend/resend-signature-verifier.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-signature-verifier.impl.d.ts","sourceRoot":"","sources":["../../src/resend/resend-signature-verifier.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACX,2BAA2B,EAC3B,+BAA+B,EAC/B,MAAM,qCAAqC,CAAC;AAI7C,qBAAa,uBAAwB,YAAW,+BAA+B;IAC9E,QAAQ,CAAC,UAAU,EAAE,2BAA2B,CAAc;IAE9D,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAG1F;AAED,eAAe,uBAAuB,CAAC"}

package/dist/resend/resend-signature-verifier.impl.js

@@ -0,0 +1,19 @@
+/**
+ * Runtime implementation for the Resend `tools/signature-verifier` descriptor.
+ *
+ * Returned by the plugin loader and called from
+ * `@vibesdotdev/tools/webhooks/router#processWebhook` after the router resolves
+ * the verifier for `source === 'resend'`. The router supplies the resolved
+ * secret (read from `RESEND_WEBHOOK_SECRET` per the descriptor); the impl
+ * does pure Svix HMAC verification with no I/O.
+ */
+import descriptor from "./resend-signature-verifier.descriptor.js";
+import { verifyResendSignature } from "./resend-signature.js";
+export class ResendSignatureVerifier {
+    descriptor = descriptor;
+    verify(rawBody, headers, secret) {
+        return verifyResendSignature(rawBody, headers, secret);
+    }
+}
+export default ResendSignatureVerifier;
+//# sourceMappingURL=resend-signature-verifier.impl.js.map

package/dist/resend/resend-signature-verifier.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-signature-verifier.impl.js","sourceRoot":"","sources":["../../src/resend/resend-signature-verifier.impl.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,UAAU,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,MAAM,OAAO,uBAAuB;IAC1B,UAAU,GAAgC,UAAU,CAAC;IAE9D,MAAM,CAAC,OAAe,EAAE,OAA+B,EAAE,MAAc;QACtE,OAAO,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;CACD;AAED,eAAe,uBAAuB,CAAC"}

package/dist/resend/resend-signature.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Svix-style signature verification for Resend webhooks.
+ *
+ * Resend delivers webhooks via Svix, which signs requests as
+ *   `v1,base64(HMAC-SHA256(decoded_secret, "{svix-id}.{svix-timestamp}.{rawBody}"))`
+ * The `svix-signature` header may carry multiple space-separated `v1,<sig>`
+ * pairs during key rotation; any matching value counts as valid.
+ *
+ * Secrets are issued as `whsec_<base64>` — strip the prefix and base64-decode
+ * to recover the HMAC key bytes. Timestamps older than 5 minutes are rejected
+ * to prevent replay attacks.
+ *
+ * This is the one Svix implementation in the pack. It uses the Web Crypto API
+ * only (no `node:*`, no `Buffer`), so the root export stays universal; both the
+ * `tools/signature-verifier` impl and the `email/webhook-handler` build on it.
+ */
+/** Maximum allowed clock skew between the webhook timestamp and now (Svix default). */
+export declare const SVIX_REPLAY_WINDOW_SEC = 300;
+/**
+ * Decode a `whsec_<base64>` secret into HMAC key bytes. Accepts standard and
+ * URL-safe base64 and ignores characters outside the alphabet, matching how
+ * the secret has always been decoded.
+ */
+export declare function decodeSvixSecret(secret: string): Uint8Array<ArrayBuffer>;
+/** `base64(HMAC-SHA256(key, "{svixId}.{svixTimestamp}.{rawBody}"))`. */
+export declare function computeSvixSignature(secret: string, svixId: string, svixTimestamp: string, rawBody: string): Promise<string>;
+/** The `v1` signatures carried by a `svix-signature` header value. */
+export declare function svixSignatureCandidates(header: string): string[];
+/** True when any `v1` candidate in `header` matches `expected`, compared in constant time. */
+export declare function svixSignatureMatches(header: string, expected: string): boolean;
+export declare function verifyResendSignature(rawBody: string, headers: Record<string, string>, secret: string): Promise<boolean>;
+//# sourceMappingURL=resend-signature.d.ts.map

package/dist/resend/resend-signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-signature.d.ts","sourceRoot":"","sources":["../../src/resend/resend-signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,uFAAuF;AACvF,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CASxE;AASD,wEAAwE;AACxE,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAMhE;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI9E;AAED,wBAAsB,qBAAqB,CAC1C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAalB"}

package/dist/resend/resend-signature.js

@@ -0,0 +1,77 @@
+/**
+ * Svix-style signature verification for Resend webhooks.
+ *
+ * Resend delivers webhooks via Svix, which signs requests as
+ *   `v1,base64(HMAC-SHA256(decoded_secret, "{svix-id}.{svix-timestamp}.{rawBody}"))`
+ * The `svix-signature` header may carry multiple space-separated `v1,<sig>`
+ * pairs during key rotation; any matching value counts as valid.
+ *
+ * Secrets are issued as `whsec_<base64>` — strip the prefix and base64-decode
+ * to recover the HMAC key bytes. Timestamps older than 5 minutes are rejected
+ * to prevent replay attacks.
+ *
+ * This is the one Svix implementation in the pack. It uses the Web Crypto API
+ * only (no `node:*`, no `Buffer`), so the root export stays universal; both the
+ * `tools/signature-verifier` impl and the `email/webhook-handler` build on it.
+ */
+import { constantTimeEqual } from '@vibesdotdev/security';
+/** Maximum allowed clock skew between the webhook timestamp and now (Svix default). */
+export const SVIX_REPLAY_WINDOW_SEC = 300;
+/**
+ * Decode a `whsec_<base64>` secret into HMAC key bytes. Accepts standard and
+ * URL-safe base64 and ignores characters outside the alphabet, matching how
+ * the secret has always been decoded.
+ */
+export function decodeSvixSecret(secret) {
+    const stripped = secret.startsWith('whsec_') ? secret.slice('whsec_'.length) : secret;
+    const alphabet = stripped.replace(/-/g, '+').replace(/_/g, '/').replace(/[^A-Za-z0-9+/]/g, '');
+    // A single dangling character carries no whole byte; lenient decoders drop it.
+    const normalized = alphabet.length % 4 === 1 ? alphabet.slice(0, -1) : alphabet;
+    const binary = atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '='));
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes;
+}
+function base64Encode(bytes) {
+    const view = new Uint8Array(bytes);
+    let out = '';
+    for (let i = 0; i < view.byteLength; i++)
+        out += String.fromCharCode(view[i]);
+    return btoa(out);
+}
+/** `base64(HMAC-SHA256(key, "{svixId}.{svixTimestamp}.{rawBody}"))`. */
+export async function computeSvixSignature(secret, svixId, svixTimestamp, rawBody) {
+    const key = await crypto.subtle.importKey('raw', decodeSvixSecret(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const signature = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(`${svixId}.${svixTimestamp}.${rawBody}`));
+    return base64Encode(signature);
+}
+/** The `v1` signatures carried by a `svix-signature` header value. */
+export function svixSignatureCandidates(header) {
+    return header
+        .split(' ')
+        .map((candidate) => candidate.trim())
+        .filter((candidate) => candidate.startsWith('v1,'))
+        .map((candidate) => candidate.slice('v1,'.length));
+}
+/** True when any `v1` candidate in `header` matches `expected`, compared in constant time. */
+export function svixSignatureMatches(header, expected) {
+    return svixSignatureCandidates(header).some((candidate) => candidate.length > 0 && constantTimeEqual(candidate, expected));
+}
+export async function verifyResendSignature(rawBody, headers, secret) {
+    if (!secret)
+        return false;
+    const svixId = headers['svix-id'] || '';
+    const svixTimestamp = headers['svix-timestamp'] || '';
+    const svixSignature = headers['svix-signature'] || '';
+    if (!svixId || !svixTimestamp || !svixSignature)
+        return false;
+    const ts = Number.parseInt(svixTimestamp, 10);
+    if (!Number.isFinite(ts))
+        return false;
+    if (Math.abs(Math.floor(Date.now() / 1000) - ts) > SVIX_REPLAY_WINDOW_SEC)
+        return false;
+    const expected = await computeSvixSignature(secret, svixId, svixTimestamp, rawBody);
+    return svixSignatureMatches(svixSignature, expected);
+}
+//# sourceMappingURL=resend-signature.js.map

package/dist/resend/resend-signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-signature.js","sourceRoot":"","sources":["../../src/resend/resend-signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,uFAAuF;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACtF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC/F,+EAA+E;IAC/E,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAAkB;IACvC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,MAAc,EACd,MAAc,EACd,aAAqB,EACrB,OAAe;IAEf,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,gBAAgB,CAAC,MAAM,CAAC,EACxB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACR,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACzC,MAAM,EACN,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,aAAa,IAAI,OAAO,EAAE,CAAC,CACjE,CAAC;IACF,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;AAChC,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACrD,OAAO,MAAM;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;SACpC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;SAClD,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,QAAgB;IACpE,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC,IAAI,CAC1C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAC7E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAC1C,OAAe,EACf,OAA+B,EAC/B,MAAc;IAEd,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAE9D,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,sBAAsB;QAAE,OAAO,KAAK,CAAC;IAExF,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACpF,OAAO,oBAAoB,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC"}

package/dist/resend/resend-webhook.descriptor.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Resend `email/webhook-handler` descriptor.
+ *
+ * Resend signs webhook deliveries using Svix conventions: three headers
+ * (`svix-id`, `svix-timestamp`, `svix-signature`) and an HMAC-SHA256 of
+ * `<id>.<timestamp>.<rawBody>` against the configured signing secret.
+ *
+ * The substrate's app-owned `+server.ts` adapter route looks up this
+ * descriptor by integration provider id (`'resend'`), invokes
+ * `verify({headers, rawBody})` for signature checking + normalization,
+ * then writes the resulting events through `recordInboundEmail`.
+ */
+declare const _default: {
+    id: string;
+    kind: "email/webhook-handler";
+    provider: string;
+    signatureHeader: string;
+    enabled: boolean;
+    name?: string | undefined;
+    description?: string | undefined;
+    hardware?: string[] | undefined;
+    priority?: number | undefined;
+    capabilityId?: string | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    config?: unknown;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+    tags?: string[] | undefined;
+};
+export default _default;
+//# sourceMappingURL=resend-webhook.descriptor.d.ts.map

package/dist/resend/resend-webhook.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resend-webhook.descriptor.d.ts","sourceRoot":"","sources":["../../src/resend/resend-webhook.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;;;;;;;;;;;;;;AAKH,wBAUG"}

package/dist/resend/resend-webhook.descriptor.js

@@ -0,0 +1,24 @@
+/**
+ * Resend `email/webhook-handler` descriptor.
+ *
+ * Resend signs webhook deliveries using Svix conventions: three headers
+ * (`svix-id`, `svix-timestamp`, `svix-signature`) and an HMAC-SHA256 of
+ * `<id>.<timestamp>.<rawBody>` against the configured signing secret.
+ *
+ * The substrate's app-owned `+server.ts` adapter route looks up this
+ * descriptor by integration provider id (`'resend'`), invokes
+ * `verify({headers, rawBody})` for signature checking + normalization,
+ * then writes the resulting events through `recordInboundEmail`.
+ */
+import { createRuntimeAsset } from '@vibesdotdev/kernel/factory';
+export default createRuntimeAsset({
+    kind: 'email/webhook-handler',
+    id: 'integration.email.resend',
+    name: 'Resend Webhook Handler',
+    description: 'Verifies Svix-signed Resend webhooks and normalizes them to EmailWebhookEvent[].',
+    provider: 'resend',
+    signatureHeader: 'svix-signature',
+    enabled: true,
+    tags: ['email', 'resend', 'webhook', 'svix']
+});
+//# sourceMappingURL=resend-webhook.descriptor.js.map