@voltro/plugin-mail 0.81.0 → 0.82.0

package/dist/index.js

@@ -11,36 +11,39 @@ var b = class extends u.TaggedError()("MailError", {
 	message: u.String,
 	transient: u.Boolean,
 	status: u.optional(u.Number)
-}) {}, x = (e) => ({
+}) {}, x = class extends u.TaggedError()("MailWebhookError", {
+	provider: u.String,
+	message: u.String
+}) {}, S = (e) => ({
 	name: e.name,
 	props: e.props,
 	subject: e.subject,
 	render: e.render,
 	...e.locale === void 0 ? {} : { locale: e.locale },
 	...e.preview === void 0 ? {} : { preview: e.preview }
-}), S = class extends t.Tag("@voltro/plugin-mail/MailService")() {}, C = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, ee = (e) => {
+}), C = class extends t.Tag("@voltro/plugin-mail/MailService")() {}, w = (e) => e === void 0 ? [] : typeof e == "string" ? [e] : e, T = (e) => {
 	try {
 		let t = s.ArrayFormatter.formatErrorSync(e);
 		return t.length === 0 ? String(e) : t.map((e) => `${e.path.length > 0 ? e.path.join(".") : "(root)"}: ${e.message}`).join("; ");
 	} catch {
 		return String(e);
 	}
-}, w = null, T = async () => {
-	if (!w) {
+}, E = null, D = async () => {
+	if (!E) {
 		let e = await import("@react-email/render");
-		if (w = e.render ?? e.default?.render ?? null, !w) throw Error("@react-email/render: `render` export not found (install @react-email/render + react + react-dom)");
+		if (E = e.render ?? e.default?.render ?? null, !E) throw Error("@react-email/render: `render` export not found (install @react-email/render + react + react-dom)");
 	}
-	return w;
-}, E = (e, t) => r.gen(function* () {
+	return E;
+}, O = (e, t) => r.gen(function* () {
 	let n = e, i = yield* u.decodeUnknown(n.props)(t).pipe(r.mapError((t) => new b({
 		provider: "template",
-		message: `invalid props for '${e.name}': ${ee(t)}`.slice(0, 500),
+		message: `invalid props for '${e.name}': ${T(t)}`.slice(0, 500),
 		transient: !1
 	}))), a = n.subject(i), o = n.render(i);
 	return {
 		subject: a,
 		html: yield* r.tryPromise({
-			try: async () => (await T())(o, { plainText: !1 }),
+			try: async () => (await D())(o, { plainText: !1 }),
 			catch: (t) => new b({
 				provider: "template",
 				message: `render failed for '${e.name}': ${String(t)}`.slice(0, 500),
@@ -48,7 +51,7 @@ var b = class extends u.TaggedError()("MailError", {
 			})
 		}),
 		text: yield* r.tryPromise({
-			try: async () => (await T())(o, { plainText: !0 }),
+			try: async () => (await D())(o, { plainText: !0 }),
 			catch: (t) => new b({
 				provider: "template",
 				message: `render(text) failed for '${e.name}': ${String(t)}`.slice(0, 500),
@@ -56,23 +59,23 @@ var b = class extends u.TaggedError()("MailError", {
 			})
 		})
 	};
-}), D = /* @__PURE__ */ new Map(), te = (e) => e.locale ? `${e.name}:${e.locale}` : e.name, ne = (e) => {
-	for (let t of e) D.set(te(t), t);
-}, O = (e, t) => (t ? D.get(`${e}:${t}`) : void 0) ?? D.get(e), re = () => D.size, k = () => [...D.values()].map((e) => e.locale ? {
+}), k = /* @__PURE__ */ new Map(), ee = (e) => e.locale ? `${e.name}:${e.locale}` : e.name, te = (e) => {
+	for (let t of e) k.set(ee(t), t);
+}, A = (e, t) => (t ? k.get(`${e}:${t}`) : void 0) ?? k.get(e), ne = () => k.size, re = () => [...k.values()].map((e) => e.locale ? {
 	name: e.name,
 	locale: e.locale
-} : { name: e.name }), ie = () => D.clear(), ae = (e) => {
+} : { name: e.name }), ie = () => k.clear(), ae = (e) => {
 	if (typeof e != "object" || !e) return !1;
 	let t = e;
 	return typeof t.name == "string" && typeof t.subject == "function" && typeof t.render == "function" && t.props !== void 0;
-}, oe = m({ scope: "@voltro/plugin-mail" }), A = (e) => e.trim().toLowerCase(), se = "*", j = (e) => e ?? se, M = () => {
-	let e = /* @__PURE__ */ new Set(), t = (e, t) => `${j(e)}\u0000${A(t)}`;
+}, oe = m({ scope: "@voltro/plugin-mail" }), j = (e) => e.trim().toLowerCase(), M = "*", N = (e) => e ?? M, P = () => {
+	let e = /* @__PURE__ */ new Set(), t = (e, t) => `${N(e)}\u0000${j(t)}`;
 	return {
 		isSuppressed: (n, i) => r.sync(() => e.has(t(n, i)) || e.has(t(null, i))),
 		suppress: (n, i) => r.sync(() => void e.add(t(n, i))),
 		unsuppress: (n, i) => r.sync(() => void e.delete(t(n, i)))
 	};
-}, ce = (e) => {
+}, se = (e) => {
 	let t = e.DB_URL ?? e.DB_PRIMARY_URL;
 	if (t) {
 		let e = new URL(t);
@@ -91,7 +94,7 @@ var b = class extends u.TaggedError()("MailError", {
 		password: e.DB_PASSWORD ?? e.PG_PASSWORD ?? "app",
 		database: e.DB_DATABASE ?? e.PG_DATABASE ?? "app"
 	};
-}, le = (t = {}) => {
+}, ce = (t = {}) => {
 	let n = t.table ?? "_voltro_mail_suppression", i = null, a = (n) => g.layerConfig({
 		host: e.succeed(n.host),
 		port: e.succeed(n.port),
@@ -108,7 +111,7 @@ var b = class extends u.TaggedError()("MailError", {
 				let r = yield* h.SqlClient;
 				return (yield* r`
           SELECT 1 AS one FROM ${r(n)}
-          WHERE email = ${A(t)} AND tenant IN (${j(e)}, ${se}) LIMIT 1`).length > 0;
+          WHERE email = ${j(t)} AND tenant IN (${N(e)}, ${M}) LIMIT 1`).length > 0;
 			});
 			return r.tryPromise(() => a.runPromise(o)).pipe(r.catchAll(() => r.succeed(!1)));
 		},
@@ -119,11 +122,11 @@ var b = class extends u.TaggedError()("MailError", {
 				let r = yield* h.SqlClient;
 				yield* r`
           INSERT INTO ${r(n)} (tenant, email, reason, created_at)
-          VALUES (${j(e)}, ${A(t)}, ${a}, ${Date.now()})
+          VALUES (${N(e)}, ${j(t)}, ${a}, ${Date.now()})
           ON CONFLICT (tenant, email) DO UPDATE SET reason = ${a}, created_at = ${Date.now()}`;
 			});
 			return r.tryPromise(() => o.runPromise(s)).pipe(r.catchAll((e) => r.sync(() => oe.warn("suppress write failed", {
-				email: A(t),
+				email: j(t),
 				message: String(e)
 			}))));
 		},
@@ -132,12 +135,12 @@ var b = class extends u.TaggedError()("MailError", {
 			if (!a) return r.void;
 			let o = r.gen(function* () {
 				let r = yield* h.SqlClient;
-				yield* r`DELETE FROM ${r(n)} WHERE tenant = ${j(e)} AND email = ${A(t)}`;
+				yield* r`DELETE FROM ${r(n)} WHERE tenant = ${N(e)} AND email = ${j(t)}`;
 			});
 			return r.tryPromise(() => a.runPromise(o)).pipe(r.catchAll(() => r.void));
 		},
 		activate: async (e) => {
-			let t = o.make(a(ce(e)));
+			let t = o.make(a(se(e)));
 			await t.runPromise(r.gen(function* () {
 				let e = yield* h.SqlClient;
 				yield* e`
@@ -155,8 +158,8 @@ var b = class extends u.TaggedError()("MailError", {
 			i = null, e && await e.dispose();
 		}
 	};
-}, ue = m({ scope: "@voltro/plugin-mail" }), N = (e) => e ?? "*", P = () => {
-	let e = /* @__PURE__ */ new Map(), t = (e, t) => `${N(e)} ${t}`;
+}, le = m({ scope: "@voltro/plugin-mail" }), F = (e) => e ?? "*", I = () => {
+	let e = /* @__PURE__ */ new Map(), t = (e, t) => `${F(e)} ${t}`;
 	return {
 		reserve: (n, i) => r.sync(() => {
 			let r = t(n, i);
@@ -171,7 +174,7 @@ var b = class extends u.TaggedError()("MailError", {
 		}),
 		record: (n, i, a) => r.sync(() => void e.set(t(n, i), a))
 	};
-}, de = (e) => {
+}, ue = (e) => {
 	let t = e.DB_URL ?? e.DB_PRIMARY_URL;
 	if (t) {
 		let e = new URL(t);
@@ -190,7 +193,7 @@ var b = class extends u.TaggedError()("MailError", {
 		password: e.DB_PASSWORD ?? e.PG_PASSWORD ?? "app",
 		database: e.DB_DATABASE ?? e.PG_DATABASE ?? "app"
 	};
-}, F = (t = {}) => {
+}, de = (t = {}) => {
 	let n = t.table ?? "_voltro_mail_idempotency", i = null, a = (n) => g.layerConfig({
 		host: e.succeed(n.host),
 		port: e.succeed(n.port),
@@ -207,12 +210,12 @@ var b = class extends u.TaggedError()("MailError", {
 				let r = yield* h.SqlClient;
 				if ((yield* r`
           INSERT INTO ${r(n)} (tenant, key, created_at)
-          VALUES (${N(e)}, ${t}, ${Date.now()})
+          VALUES (${F(e)}, ${t}, ${Date.now()})
           ON CONFLICT (tenant, key) DO NOTHING
           RETURNING key`).length > 0) return { won: !0 };
 				let i = (yield* r`
           SELECT result_id, result_provider FROM ${r(n)}
-          WHERE tenant = ${N(e)} AND key = ${t} LIMIT 1`)[0];
+          WHERE tenant = ${F(e)} AND key = ${t} LIMIT 1`)[0];
 				return i && i.result_id && i.result_provider ? {
 					won: !1,
 					prior: {
@@ -221,7 +224,7 @@ var b = class extends u.TaggedError()("MailError", {
 					}
 				} : { won: !1 };
 			});
-			return r.tryPromise(() => a.runPromise(o)).pipe(r.catchAll((e) => r.sync(() => (ue.warn("idempotency reserve failed — skipping send to avoid a double", {
+			return r.tryPromise(() => a.runPromise(o)).pipe(r.catchAll((e) => r.sync(() => (le.warn("idempotency reserve failed — skipping send to avoid a double", {
 				key: t,
 				message: String(e)
 			}), { won: !1 }))));
@@ -233,15 +236,15 @@ var b = class extends u.TaggedError()("MailError", {
 				let r = yield* h.SqlClient;
 				yield* r`
           UPDATE ${r(n)} SET result_id = ${a.id}, result_provider = ${a.provider}
-          WHERE tenant = ${N(e)} AND key = ${t}`;
+          WHERE tenant = ${F(e)} AND key = ${t}`;
 			});
-			return r.tryPromise(() => o.runPromise(s)).pipe(r.catchAll((e) => r.sync(() => ue.warn("idempotency record failed", {
+			return r.tryPromise(() => o.runPromise(s)).pipe(r.catchAll((e) => r.sync(() => le.warn("idempotency record failed", {
 				key: t,
 				message: String(e)
 			}))));
 		},
 		activate: async (e) => {
-			let t = o.make(a(de(e)));
+			let t = o.make(a(ue(e)));
 			await t.runPromise(r.gen(function* () {
 				let e = yield* h.SqlClient;
 				yield* e`
@@ -260,7 +263,7 @@ var b = class extends u.TaggedError()("MailError", {
 			i = null, e && await e.dispose();
 		}
 	};
-}, fe = m({ scope: "@voltro/plugin-mail" }), I = () => {
+}, fe = m({ scope: "@voltro/plugin-mail" }), L = () => {
 	let e = /* @__PURE__ */ new Map();
 	return {
 		hold: (t) => r.sync(() => void e.set(t.id, t)),
@@ -271,12 +274,12 @@ var b = class extends u.TaggedError()("MailError", {
 		}),
 		size: () => r.sync(() => e.size)
 	};
-}, pe = 0, L = (e) => e.idempotencyKey ?? `held-${pe += 1}`, R = (e) => ({
+}, pe = 0, R = (e) => e.idempotencyKey ?? `held-${pe += 1}`, z = (e) => ({
 	shouldHold: (t) => !e.providerSchedules && t !== void 0 && t.getTime() > Date.now(),
 	hold: (t) => {
 		let { scheduledAt: n, ...r } = t;
 		return e.store.hold({
-			id: L(t),
+			id: R(t),
 			dueAt: t.scheduledAt?.getTime() ?? Date.now(),
 			message: r
 		});
@@ -290,7 +293,7 @@ var b = class extends u.TaggedError()("MailError", {
 		return n.length;
 	}),
 	pending: () => e.store.size()
-}), me = 0, z = (e) => `${e}-${me += 1}`, he = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, B = (e, t) => {
+}), me = 0, B = (e) => `${e}-${me += 1}`, he = (e) => e === void 0 || e === 408 || e === 429 || e >= 500, V = (e, t) => {
 	let n = t.status;
 	return new b({
 		provider: e,
@@ -298,7 +301,7 @@ var b = class extends u.TaggedError()("MailError", {
 		transient: e === "smtp" ? n === void 0 || n >= 400 && n < 500 : he(n),
 		...n === void 0 ? {} : { status: n }
 	});
-}, V = (e, t, n, i, a) => r.tryPromise({
+}, H = (e, t, n, i, a) => r.tryPromise({
 	try: async () => {
 		let e = await fetch(t, {
 			method: "POST",
@@ -319,20 +322,97 @@ var b = class extends u.TaggedError()("MailError", {
 	},
 	catch: (t) => {
 		let n = t;
-		return B(e, {
+		return V(e, {
 			...typeof n.status == "number" ? { status: n.status } : {},
 			message: n.message ?? t?.message ?? String(t)
 		});
 	}
-}), H = (e) => ({
+}), U = 500, ge = (e, t) => {
+	let n = e.stream === "broadcast" ? t?.broadcast ?? "broadcast" : t?.transactional;
+	return {
+		...n === void 0 ? {} : { route: n },
+		from: e.from,
+		to: w(e.to),
+		...e.cc ? { cc: w(e.cc) } : {},
+		...e.bcc ? { bcc: w(e.bcc) } : {},
+		...e.replyTo ? { reply_to: [e.replyTo] } : {},
+		subject: e.subject,
+		...e.html === void 0 ? {} : { html: e.html },
+		...e.text === void 0 ? {} : { text: e.text },
+		...e.headers ? { headers: e.headers } : {},
+		...e.metadata ? { metadata: e.metadata } : {},
+		...e.tags && e.tags.length > 0 ? { tags: e.tags.map((e) => ({
+			name: e,
+			value: "1"
+		})) } : {},
+		...e.scheduledAt ? { scheduled_at: e.scheduledAt.toISOString() } : {},
+		...e.attachments ? { attachments: e.attachments.map((e) => ({
+			filename: e.filename,
+			content: e.content,
+			...e.contentType ? { content_type: e.contentType } : {}
+		})) } : {}
+	};
+}, _e = (e, t, n, i = Math.floor(Date.now() / 1e3), a = 300) => r.tryPromise({
+	try: async () => {
+		let r = (e) => {
+			throw new x({
+				provider: "lettermint",
+				message: e
+			});
+		}, o = (t) => Object.entries(e).find(([e]) => e.toLowerCase() === t)?.[1];
+		n === "" && r("no webhook secret configured"), t === "" && r("empty body");
+		let s = o("x-lettermint-signature") ?? r("missing x-lettermint-signature"), c = o("x-lettermint-delivery") ?? r("missing x-lettermint-delivery"), l, u = [];
+		for (let e of s.split(",")) {
+			let [t, n] = e.trim().split("=", 2);
+			t === "t" && n !== void 0 && /^\d+$/.test(n) ? l = n : t === "v1" && n !== void 0 && /^[a-fA-F0-9]{64}$/.test(n) && u.push(n.toLowerCase());
+		}
+		(l === void 0 || u.length === 0) && r("malformed signature header"), c !== l && r("signature and delivery timestamps differ"), Math.abs(i - Number(l)) > a && r("signature timestamp outside the tolerance");
+		let { createHmac: d, timingSafeEqual: f } = await import("node:crypto"), p = d("sha256", n).update(`${l}.`).update(t).digest();
+		u.some((e) => f(Buffer.from(e, "hex"), p)) || r("signature does not match");
+		try {
+			return JSON.parse(t);
+		} catch {
+			return r("body is not JSON");
+		}
+	},
+	catch: (e) => e instanceof x ? e : new x({
+		provider: "lettermint",
+		message: e?.message ?? String(e)
+	})
+}), ve = (e) => {
+	let t = (e.baseUrl ?? "https://api.lettermint.co/v1").replace(/\/+$/, ""), n = {
+		"x-lettermint-token": e.projectToken,
+		accept: "application/json"
+	};
+	return {
+		name: "lettermint",
+		supportsScheduling: !0,
+		managesUnsubscribe: !0,
+		send: (r) => H("lettermint", `${t}/send`, {
+			...n,
+			...r.idempotencyKey === void 0 ? {} : { "idempotency-key": r.idempotencyKey }
+		}, ge(r, e.routes), async (e) => ({
+			id: (await e.json()).message_id ?? "lettermint",
+			provider: "lettermint"
+		})),
+		sendBatch: (i) => r.forEach(Array.from({ length: Math.ceil(i.length / U) }, (e, t) => i.slice(t * U, (t + 1) * U)), (r) => H("lettermint", `${t}/send/batch`, n, r.map((t) => ge(t, e.routes)), async (e) => {
+			let t = await e.json();
+			return r.map((e, n) => ({
+				id: t[n]?.message_id ?? "lettermint",
+				provider: "lettermint"
+			}));
+		})).pipe(r.map((e) => e.flat())),
+		webhook: { verify: _e }
+	};
+}, ye = (e) => ({
 	from: e.from,
-	to: C(e.to),
+	to: w(e.to),
 	subject: e.subject,
 	html: e.html,
 	text: e.text,
 	reply_to: e.replyTo,
-	cc: e.cc ? C(e.cc) : void 0,
-	bcc: e.bcc ? C(e.bcc) : void 0,
+	cc: e.cc ? w(e.cc) : void 0,
+	bcc: e.bcc ? w(e.bcc) : void 0,
 	headers: e.headers,
 	tags: e.tags?.map((e) => ({
 		name: e,
@@ -344,34 +424,40 @@ var b = class extends u.TaggedError()("MailError", {
 		content: e.content,
 		...e.contentType ? { content_type: e.contentType } : {}
 	}))
-}), U = (e) => ({
+}), be = (e) => ({
 	name: "resend",
 	supportsScheduling: !0,
-	send: (t) => V("resend", "https://api.resend.com/emails", { authorization: `Bearer ${e.apiKey}` }, H(t), async (e) => ({
+	send: (t) => H("resend", "https://api.resend.com/emails", { authorization: `Bearer ${e.apiKey}` }, ye(t), async (e) => ({
 		id: (await e.json()).id ?? "resend",
 		provider: "resend"
 	})),
-	sendBatch: (t) => V("resend", "https://api.resend.com/emails/batch", { authorization: `Bearer ${e.apiKey}` }, t.map(H), async (e) => {
+	sendBatch: (t) => H("resend", "https://api.resend.com/emails/batch", { authorization: `Bearer ${e.apiKey}` }, t.map(ye), async (e) => {
 		let n = (await e.json()).data ?? [];
 		return t.map((e, t) => ({
 			id: n[t]?.id ?? "resend",
 			provider: "resend"
 		}));
 	})
-}), W = (e) => ({
+}), xe = (e) => ({
 	name: "postmark",
-	send: (t) => V("postmark", "https://api.postmarkapp.com/email", {
+	send: (t) => H("postmark", "https://api.postmarkapp.com/email", {
 		"x-postmark-server-token": e.serverToken,
 		accept: "application/json"
 	}, {
 		From: t.from,
-		To: C(t.to).join(","),
+		To: w(t.to).join(","),
 		Subject: t.subject,
 		HtmlBody: t.html,
 		TextBody: t.text,
 		ReplyTo: t.replyTo,
-		Cc: t.cc ? C(t.cc).join(",") : void 0,
-		Bcc: t.bcc ? C(t.bcc).join(",") : void 0,
+		Cc: t.cc ? w(t.cc).join(",") : void 0,
+		Bcc: t.bcc ? w(t.bcc).join(",") : void 0,
+		MessageStream: t.stream === "broadcast" ? e.streams?.broadcast ?? "broadcast" : e.streams?.transactional ?? "outbound",
+		Headers: t.headers ? Object.entries(t.headers).map(([e, t]) => ({
+			Name: e,
+			Value: t
+		})) : void 0,
+		Metadata: t.metadata,
 		Attachments: t.attachments?.map((e) => ({
 			Name: e.filename,
 			Content: e.content,
@@ -381,44 +467,44 @@ var b = class extends u.TaggedError()("MailError", {
 		id: (await e.json()).MessageID ?? "postmark",
 		provider: "postmark"
 	}))
-}), G = (e) => [...e.text ? [{
+}), Se = (e) => [...e.text ? [{
 	type: "text/plain",
 	value: e.text
 }] : [], ...e.html ? [{
 	type: "text/html",
 	value: e.html
-}] : []], K = (e) => ({
-	to: C(e.to).map((e) => ({ email: e })),
-	cc: e.cc ? C(e.cc).map((e) => ({ email: e })) : void 0,
-	bcc: e.bcc ? C(e.bcc).map((e) => ({ email: e })) : void 0,
+}] : []], Ce = (e) => ({
+	to: w(e.to).map((e) => ({ email: e })),
+	cc: e.cc ? w(e.cc).map((e) => ({ email: e })) : void 0,
+	bcc: e.bcc ? w(e.bcc).map((e) => ({ email: e })) : void 0,
 	subject: e.subject,
 	...e.scheduledAt ? { send_at: Math.floor(e.scheduledAt.getTime() / 1e3) } : {}
-}), ge = (e) => e.attachments?.map((e) => ({
+}), we = (e) => e.attachments?.map((e) => ({
 	filename: e.filename,
 	content: e.content,
 	type: e.contentType ?? "application/octet-stream",
 	disposition: "attachment"
-})), _e = (e) => {
+})), Te = (e) => {
 	let t = (e) => ({
-		personalizations: [K(e)],
+		personalizations: [Ce(e)],
 		from: { email: e.from },
 		reply_to: e.replyTo ? { email: e.replyTo } : void 0,
 		subject: e.subject,
-		content: G(e),
-		attachments: ge(e)
+		content: Se(e),
+		attachments: we(e)
 	});
 	return {
 		name: "sendgrid",
 		supportsScheduling: !0,
-		send: (n) => V("sendgrid", "https://api.sendgrid.com/v3/mail/send", { authorization: `Bearer ${e.apiKey}` }, t(n), async (e) => ({
+		send: (n) => H("sendgrid", "https://api.sendgrid.com/v3/mail/send", { authorization: `Bearer ${e.apiKey}` }, t(n), async (e) => ({
 			id: e.headers.get("x-message-id") ?? "sendgrid",
 			provider: "sendgrid"
 		})),
-		sendBatch: (t) => V("sendgrid", "https://api.sendgrid.com/v3/mail/send", { authorization: `Bearer ${e.apiKey}` }, {
-			personalizations: t.map(K),
+		sendBatch: (t) => H("sendgrid", "https://api.sendgrid.com/v3/mail/send", { authorization: `Bearer ${e.apiKey}` }, {
+			personalizations: t.map(Ce),
 			from: { email: t[0]?.from },
 			subject: t[0]?.subject,
-			content: G(t[0] ?? {})
+			content: Se(t[0] ?? {})
 		}, async (e) => {
 			let n = e.headers.get("x-message-id") ?? "sendgrid";
 			return t.map((e, t) => ({
@@ -427,35 +513,35 @@ var b = class extends u.TaggedError()("MailError", {
 			}));
 		})
 	};
-}, ve = (e, t) => {
+}, Ee = (e, t) => {
 	let n = t, r = n.response?.status;
-	return B(e, {
+	return V(e, {
 		...typeof r == "number" ? { status: r } : {},
 		message: n.message ?? String(t)
 	});
-}, ye = (e, t, n) => r.gen(function* () {
+}, De = (e, t, n) => r.gen(function* () {
 	let i = yield* (yield* v.HttpClient).execute(t);
 	if (i.status < 200 || i.status >= 300) {
 		let t = yield* i.text.pipe(r.catchAll(() => r.succeed("")));
-		return yield* r.fail(B(e, {
+		return yield* r.fail(V(e, {
 			status: i.status,
 			message: t || `HTTP ${i.status}`
 		}));
 	}
 	return yield* n(i);
-}).pipe(r.catchAll((t) => t instanceof b ? r.fail(t) : r.fail(ve(e, t))), r.provide(_.layer)), be = (e) => ({ sign: async (t, n, r) => {
+}).pipe(r.catchAll((t) => t instanceof b ? r.fail(t) : r.fail(Ee(e, t))), r.provide(_.layer)), Oe = (e) => ({ sign: async (t, n, r) => {
 	let { createHash: i, createHmac: a } = await import("node:crypto"), o = (e) => i("sha256").update(e).digest("hex"), s = (e, t) => a("sha256", e).update(t).digest(), c = (/* @__PURE__ */ new Date()).toISOString().replace(/[:-]|\.\d{3}/g, ""), l = c.slice(0, 8), u = `host:${new URL(t).host}\nx-amz-date:${c}\n` + (e.sessionToken ? `x-amz-security-token:${e.sessionToken}\n` : ""), d = e.sessionToken ? "host;x-amz-date;x-amz-security-token" : "host;x-amz-date", f = `POST\n${n}\n\n${u}\n${d}\n${o(r)}`, p = `${l}/${e.region}/ses/aws4_request`, m = `AWS4-HMAC-SHA256\n${c}\n${p}\n${o(f)}`, h = a("sha256", s(s(s(s(`AWS4${e.secretAccessKey}`, l), e.region), "ses"), "aws4_request")).update(m).digest("hex");
 	return {
 		authorization: `AWS4-HMAC-SHA256 Credential=${e.accessKeyId}/${p}, SignedHeaders=${d}, Signature=${h}`,
 		"x-amz-date": c,
 		...e.sessionToken ? { "x-amz-security-token": e.sessionToken } : {}
 	};
-} }), xe = (e) => JSON.stringify({
+} }), ke = (e) => JSON.stringify({
 	FromEmailAddress: e.from,
 	Destination: {
-		ToAddresses: C(e.to),
-		...e.cc ? { CcAddresses: C(e.cc) } : {},
-		...e.bcc ? { BccAddresses: C(e.bcc) } : {}
+		ToAddresses: w(e.to),
+		...e.cc ? { CcAddresses: w(e.cc) } : {},
+		...e.bcc ? { BccAddresses: w(e.bcc) } : {}
 	},
 	...e.replyTo ? { ReplyToAddresses: [e.replyTo] } : {},
 	Content: { Simple: {
@@ -474,16 +560,16 @@ var b = class extends u.TaggedError()("MailError", {
 			} } : {}
 		}
 	} }
-}), Se = (e) => {
-	let t = be(e), n = `https://email.${e.region}.amazonaws.com`, i = "/v2/email/outbound-emails";
+}), Ae = (e) => {
+	let t = Oe(e), n = `https://email.${e.region}.amazonaws.com`, i = "/v2/email/outbound-emails";
 	return {
 		name: "ses",
 		send: (e) => r.gen(function* () {
-			let a = xe(e), o = yield* r.tryPromise({
+			let a = ke(e), o = yield* r.tryPromise({
 				try: () => t.sign(n, i, a),
-				catch: (e) => B("ses", { message: e?.message ?? String(e) })
+				catch: (e) => V("ses", { message: e?.message ?? String(e) })
 			});
-			return yield* ye("ses", y.post(`${n}${i}`).pipe(y.setHeaders({
+			return yield* De("ses", y.post(`${n}${i}`).pipe(y.setHeaders({
 				"content-type": "application/json",
 				...o
 			}), y.bodyUnsafeJson(JSON.parse(a))), (e) => e.json.pipe(r.map((e) => ({
@@ -492,29 +578,29 @@ var b = class extends u.TaggedError()("MailError", {
 			}))));
 		})
 	};
-}, Ce = (e) => {
+}, je = (e) => {
 	let t = [["from", e.from], ["subject", e.subject]];
-	for (let n of C(e.to)) t.push(["to", n]);
-	if (e.cc) for (let n of C(e.cc)) t.push(["cc", n]);
-	if (e.bcc) for (let n of C(e.bcc)) t.push(["bcc", n]);
+	for (let n of w(e.to)) t.push(["to", n]);
+	if (e.cc) for (let n of w(e.cc)) t.push(["cc", n]);
+	if (e.bcc) for (let n of w(e.bcc)) t.push(["bcc", n]);
 	if (e.replyTo && t.push(["h:Reply-To", e.replyTo]), e.html && t.push(["html", e.html]), e.text && t.push(["text", e.text]), e.headers) for (let [n, r] of Object.entries(e.headers)) t.push([`h:${n}`, r]);
 	if (e.tags) for (let n of e.tags) t.push(["o:tag", n]);
 	return e.scheduledAt && t.push(["o:deliverytime", e.scheduledAt.toUTCString()]), t;
-}, we = (e) => {
+}, Me = (e) => {
 	let t = `${e.baseUrl ?? "https://api.mailgun.net"}/v3/${e.domain}/messages`;
 	return {
 		name: "mailgun",
 		supportsScheduling: !0,
 		send: (n) => {
 			let i = new URLSearchParams();
-			for (let [e, t] of Ce(n)) i.append(e, t);
-			return ye("mailgun", y.post(t).pipe(y.setHeader("authorization", `Basic ${Buffer.from(`api:${e.apiKey}`).toString("base64")}`), y.bodyText(i.toString(), "application/x-www-form-urlencoded")), (e) => e.json.pipe(r.map((e) => ({
+			for (let [e, t] of je(n)) i.append(e, t);
+			return De("mailgun", y.post(t).pipe(y.setHeader("authorization", `Basic ${Buffer.from(`api:${e.apiKey}`).toString("base64")}`), y.bodyText(i.toString(), "application/x-www-form-urlencoded")), (e) => e.json.pipe(r.map((e) => ({
 				id: e.id ?? "mailgun",
 				provider: "mailgun"
 			}))));
 		}
 	};
-}, q = (e) => {
+}, W = (e) => {
 	let t = null;
 	return {
 		name: "smtp",
@@ -533,9 +619,9 @@ var b = class extends u.TaggedError()("MailError", {
 				return {
 					id: (await t.sendMail({
 						from: n.from,
-						to: C(n.to),
-						cc: n.cc ? C(n.cc) : void 0,
-						bcc: n.bcc ? C(n.bcc) : void 0,
+						to: w(n.to),
+						cc: n.cc ? w(n.cc) : void 0,
+						bcc: n.bcc ? w(n.bcc) : void 0,
 						replyTo: n.replyTo,
 						subject: n.subject,
 						html: n.html,
@@ -553,52 +639,53 @@ var b = class extends u.TaggedError()("MailError", {
 			},
 			catch: (e) => {
 				let t = e;
-				return B("smtp", {
+				return V("smtp", {
 					...typeof t.responseCode == "number" ? { status: t.responseCode } : {},
 					message: t.message ?? String(e)
 				});
 			}
 		})
 	};
-}, Te = (e) => ({
+}, Ne = (e) => ({
 	name: "console",
 	send: (t) => r.sync(() => {
-		let n = `✉  to=${C(t.to).join(",")} subject=${JSON.stringify(t.subject)}`;
+		let n = `✉  to=${w(t.to).join(",")} subject=${JSON.stringify(t.subject)}`;
 		return e ? e(n, { from: t.from }) : process.stdout.write(`[mail:console] ${n}\n`), {
-			id: z("console"),
+			id: B("console"),
 			provider: "console"
 		};
 	})
-}), J = [], Ee = () => [...J], De = () => {
-	J.length = 0;
-}, Oe = () => ({
+}), G = [], Pe = () => [...G], Fe = () => {
+	G.length = 0;
+}, Ie = () => ({
 	name: "memory",
-	send: (e) => r.sync(() => (J.push(e), {
-		id: z("mem"),
+	send: (e) => r.sync(() => (G.push(e), {
+		id: B("mem"),
 		provider: "memory"
 	}))
-}), Y = m({ scope: "@voltro/plugin-mail" }), ke = (e) => {
+}), K = m({ scope: "@voltro/plugin-mail" }), Le = (e) => {
 	if (e.provider !== void 0 && typeof e.provider != "string") return e.provider;
 	let t = e.env ?? {}, n = e.provider ?? t.MAIL_PROVIDER ?? "console", r = (e, t) => {
 		if (!t) throw Error(`@voltro/plugin-mail: provider '${n}' needs apiKey or ${e}`);
 		return t;
 	};
 	switch (n) {
-		case "resend": return U({ apiKey: r("RESEND_API_KEY", e.apiKey ?? t.RESEND_API_KEY) });
-		case "postmark": return W({ serverToken: r("POSTMARK_SERVER_TOKEN", e.apiKey ?? t.POSTMARK_SERVER_TOKEN) });
-		case "sendgrid": return _e({ apiKey: r("SENDGRID_API_KEY", e.apiKey ?? t.SENDGRID_API_KEY) });
-		case "ses": return Se({
+		case "lettermint": return ve({ projectToken: r("LETTERMINT_PROJECT_TOKEN", e.apiKey ?? t.LETTERMINT_PROJECT_TOKEN) });
+		case "resend": return be({ apiKey: r("RESEND_API_KEY", e.apiKey ?? t.RESEND_API_KEY) });
+		case "postmark": return xe({ serverToken: r("POSTMARK_SERVER_TOKEN", e.apiKey ?? t.POSTMARK_SERVER_TOKEN) });
+		case "sendgrid": return Te({ apiKey: r("SENDGRID_API_KEY", e.apiKey ?? t.SENDGRID_API_KEY) });
+		case "ses": return Ae({
 			region: r("AWS_REGION", t.AWS_REGION),
 			accessKeyId: r("AWS_ACCESS_KEY_ID", t.AWS_ACCESS_KEY_ID),
 			secretAccessKey: r("AWS_SECRET_ACCESS_KEY", t.AWS_SECRET_ACCESS_KEY),
 			...t.AWS_SESSION_TOKEN ? { sessionToken: t.AWS_SESSION_TOKEN } : {}
 		});
-		case "mailgun": return we({
+		case "mailgun": return Me({
 			apiKey: r("MAILGUN_API_KEY", e.apiKey ?? t.MAILGUN_API_KEY),
 			domain: r("MAILGUN_DOMAIN", t.MAILGUN_DOMAIN),
 			...t.MAILGUN_BASE_URL ? { baseUrl: t.MAILGUN_BASE_URL } : {}
 		});
-		case "smtp": return t.SMTP_URL ? q({ url: t.SMTP_URL }) : q({
+		case "smtp": return t.SMTP_URL ? W({ url: t.SMTP_URL }) : W({
 			host: r("SMTP_URL/SMTP_HOST", t.SMTP_HOST),
 			...t.SMTP_PORT ? { port: Number(t.SMTP_PORT) } : {},
 			secure: t.SMTP_SECURE === "true",
@@ -607,32 +694,45 @@ var b = class extends u.TaggedError()("MailError", {
 				pass: t.SMTP_PASS
 			} } : {}
 		});
-		case "memory": return Oe();
-		default: return Te((e, t) => Y.info(e, t));
+		case "memory": return Ie();
+		default: return Ne((e, t) => K.info(e, t));
 	}
-}, X = (e) => {
-	let t = e.attempts ?? 3, n = e.suppression ?? M(), i = e.allowlist, a = e.production !== !0 && i !== void 0 && i.length > 0, o = (e) => i.some((t) => t.toLowerCase() === e.toLowerCase()), s = l.recurs(t).pipe(l.whileInput((e) => e.transient)), c = /* @__PURE__ */ new Map();
+}, q = (e) => {
+	let t = e.attempts ?? 3, n = e.suppression ?? P(), i = e.allowlist, a = e.production !== !0 && i !== void 0 && i.length > 0, o = (e) => i.some((t) => t.toLowerCase() === e.toLowerCase()), s = l.recurs(t).pipe(l.whileInput((e) => e.transient)), c = /* @__PURE__ */ new Map();
 	for (let t of e.templates ?? []) c.set(t.locale ? `${t.name}:${t.locale}` : t.name, t);
-	let u = (e, t) => (t ? c.get(`${e}:${t}`) : void 0) ?? c.get(e) ?? O(e, t), d = /* @__PURE__ */ new Map(), f = (e, t) => `${e.name}|${e.locale ?? ""}|${JSON.stringify(t ?? null)}`, p = (e, t) => {
+	let u = (e, t) => (t ? c.get(`${e}:${t}`) : void 0) ?? c.get(e) ?? A(e, t), d = /* @__PURE__ */ new Map(), f = (e, t) => `${e.name}|${e.locale ?? ""}|${JSON.stringify(t ?? null)}`, p = (e, t) => {
 		if (d.set(e, t), d.size > 500) {
 			let e = d.keys().next().value;
 			e !== void 0 && d.delete(e);
 		}
-	}, m = e.idempotency ?? P(), h = R({
-		store: e.schedule ?? I(),
+	}, m = e.idempotency ?? I(), h = z({
+		store: e.schedule ?? L(),
 		providerSchedules: e.provider.supportsScheduling === !0,
-		flush: (e) => v(e)
-	}), g = (t) => r.gen(function* () {
+		flush: (e) => y(e)
+	}), g = (t) => {
+		if (t.stream !== "broadcast" || e.provider.managesUnsubscribe === !0) return r.succeed(void 0);
+		let n = t.unsubscribe;
+		if (n === void 0 || !n.oneClickUrl.startsWith("https://")) return r.fail(new b({
+			provider: e.provider.name,
+			message: `a broadcast needs \`unsubscribe: { oneClickUrl }\` (an https URL) — '${e.provider.name}' does not unsubscribe recipients itself`,
+			transient: !1
+		}));
+		let i = [`<${n.oneClickUrl}>`, ...n.mailto === void 0 ? [] : [`<mailto:${n.mailto.replace(/^mailto:/, "")}>`]];
+		return r.succeed({
+			"List-Unsubscribe": i.join(", "),
+			"List-Unsubscribe-Post": "List-Unsubscribe=One-Click"
+		});
+	}, _ = (t) => r.gen(function* () {
 		let i = t.from ?? e.from;
 		if (!i) return yield* r.fail(new b({
 			provider: e.provider.name,
 			message: "no `from` — set mailPlugin({ from }) or pass message.from",
 			transient: !1
 		}));
-		let s = C(t.to);
+		let s = w(t.to);
 		if (a) {
 			let n = s.filter(o);
-			if (n.length === 0) return Y.warn("mail skipped — no recipient in allowlist (non-production)", {
+			if (n.length === 0) return K.warn("mail skipped — no recipient in allowlist (non-production)", {
 				to: s.join(","),
 				subject: t.subject
 			}), e.onSent?.({
@@ -654,7 +754,7 @@ var b = class extends u.TaggedError()("MailError", {
 		}
 		let c = t.tenantId ?? null, l = [];
 		for (let e of s) (yield* n.isSuppressed(c, e)) || l.push(e);
-		if (l.length === 0) return Y.warn("mail skipped — all recipients suppressed", {
+		if (l.length === 0) return K.warn("mail skipped — all recipients suppressed", {
 			to: s.join(","),
 			subject: t.subject
 		}), e.onSent?.({
@@ -673,20 +773,24 @@ var b = class extends u.TaggedError()("MailError", {
 			}
 		};
 		s = l;
-		let u = t.replyTo ?? e.replyTo;
+		let u = t.replyTo ?? e.replyTo, d = yield* g(t), f = d === void 0 ? t.headers : {
+			...t.headers,
+			...d
+		};
 		return {
 			kind: "send",
 			message: {
 				...t,
 				from: i,
 				to: s,
-				...u === void 0 ? {} : { replyTo: u }
+				...u === void 0 ? {} : { replyTo: u },
+				...f === void 0 ? {} : { headers: f }
 			}
 		};
-	}), _ = (t) => {
-		let n = C(t.to);
+	}), v = (t) => {
+		let n = w(t.to);
 		return e.provider.send(t).pipe(r.retry(s), r.tap((i) => r.sync(() => {
-			Y.info("mail sent", {
+			K.info("mail sent", {
 				provider: i.provider,
 				id: i.id,
 				to: n.join(",")
@@ -700,7 +804,7 @@ var b = class extends u.TaggedError()("MailError", {
 				ts: Date.now()
 			});
 		})), r.tapError((i) => r.sync(() => {
-			Y.warn("mail failed", {
+			K.warn("mail failed", {
 				provider: i.provider,
 				status: i.status,
 				message: i.message
@@ -715,14 +819,14 @@ var b = class extends u.TaggedError()("MailError", {
 				ts: Date.now()
 			});
 		})));
-	}, v = (t) => r.gen(function* () {
-		let n = yield* g(t);
-		return n.kind === "skip" ? n.result : h.shouldHold(t.scheduledAt) ? (yield* h.hold(n.message), Y.info("mail scheduled (held for later flush)", {
+	}, y = (t) => r.gen(function* () {
+		let n = yield* _(t);
+		return n.kind === "skip" ? n.result : h.shouldHold(t.scheduledAt) ? (yield* h.hold(n.message), K.info("mail scheduled (held for later flush)", {
 			subject: n.message.subject,
 			dueAt: t.scheduledAt?.toISOString()
 		}), e.onSent?.({
 			id: "scheduled",
-			to: C(n.message.to),
+			to: w(n.message.to),
 			from: n.message.from,
 			subject: n.message.subject,
 			provider: "scheduled",
@@ -731,16 +835,16 @@ var b = class extends u.TaggedError()("MailError", {
 		}), {
 			id: "scheduled",
 			provider: "scheduled"
-		}) : yield* _(n.message);
-	}), y = (e, t, n) => t === void 0 ? n : r.gen(function* () {
+		}) : yield* v(n.message);
+	}), x = (e, t, n) => t === void 0 ? n : r.gen(function* () {
 		let r = yield* m.reserve(e, t);
-		if (!r.won) return Y.info("mail idempotent replay — skipped", { key: t }), r.prior ?? {
+		if (!r.won) return K.info("mail idempotent replay — skipped", { key: t }), r.prior ?? {
 			id: "idempotent-replay",
 			provider: "idempotent"
 		};
 		let i = yield* n;
 		return yield* m.record(e, t, i), i;
-	}), x = (e) => r.suspend(() => {
+	}), S = (e) => r.suspend(() => {
 		let t = u(e.template, e.locale);
 		if (!t) return r.fail(new b({
 			provider: "template",
@@ -748,7 +852,7 @@ var b = class extends u.TaggedError()("MailError", {
 			transient: !1
 		}));
 		let n = f(t, e.props), i = d.get(n);
-		return (i ? r.succeed(i) : E(t, e.props).pipe(r.tap((e) => r.sync(() => p(n, e))))).pipe(r.map((t) => ({
+		return (i ? r.succeed(i) : O(t, e.props).pipe(r.tap((e) => r.sync(() => p(n, e))))).pipe(r.map((t) => ({
 			to: e.to,
 			subject: t.subject,
 			html: t.html,
@@ -762,33 +866,36 @@ var b = class extends u.TaggedError()("MailError", {
 			...e.attachments === void 0 ? {} : { attachments: e.attachments },
 			...e.tenantId === void 0 ? {} : { tenantId: e.tenantId },
 			...e.scheduledAt === void 0 ? {} : { scheduledAt: e.scheduledAt },
-			...e.idempotencyKey === void 0 ? {} : { idempotencyKey: e.idempotencyKey }
+			...e.idempotencyKey === void 0 ? {} : { idempotencyKey: e.idempotencyKey },
+			...e.stream === void 0 ? {} : { stream: e.stream },
+			...e.unsubscribe === void 0 ? {} : { unsubscribe: e.unsubscribe },
+			...e.metadata === void 0 ? {} : { metadata: e.metadata }
 		})));
-	}), S = (e) => "template" in e ? x(e) : r.succeed(e);
+	}), C = (e) => "template" in e ? S(e) : r.succeed(e);
 	return {
 		service: {
 			send: (e) => r.gen(function* () {
-				let t = yield* S(e);
-				return yield* y(t.tenantId ?? null, t.idempotencyKey, v(t));
+				let t = yield* C(e);
+				return yield* x(t.tenantId ?? null, t.idempotencyKey, y(t));
 			}),
 			sendBatch: (t) => r.gen(function* () {
-				let n = yield* r.forEach(t, S), i = n.some((e) => e.idempotencyKey !== void 0 || h.shouldHold(e.scheduledAt));
+				let n = yield* r.forEach(t, C), i = n.some((e) => e.idempotencyKey !== void 0 || h.shouldHold(e.scheduledAt));
 				if (e.provider.sendBatch && !i) {
 					let t = [], i = [];
 					for (let e of n) {
-						let n = yield* g(e);
+						let n = yield* _(e);
 						n.kind === "skip" ? i.push(n.result) : (i.push(t.length), t.push(n.message));
 					}
 					let a = t.length > 0 ? yield* e.provider.sendBatch(t).pipe(r.retry(s), r.tap((n) => r.sync(() => {
 						t.forEach((t, r) => {
 							let i = n[r];
-							i && (Y.info("mail sent (batch)", {
+							i && (K.info("mail sent (batch)", {
 								provider: i.provider,
 								id: i.id,
-								to: C(t.to).join(",")
+								to: w(t.to).join(",")
 							}), e.onSent?.({
 								id: i.id,
-								to: C(t.to),
+								to: w(t.to),
 								from: t.from,
 								subject: t.subject,
 								provider: i.provider,
@@ -796,7 +903,7 @@ var b = class extends u.TaggedError()("MailError", {
 								ts: Date.now()
 							}));
 						});
-					})), r.tapError((e) => r.sync(() => Y.warn("mail batch failed", {
+					})), r.tapError((e) => r.sync(() => K.warn("mail batch failed", {
 						provider: e.provider,
 						status: e.status,
 						message: e.message
@@ -806,15 +913,60 @@ var b = class extends u.TaggedError()("MailError", {
 						provider: e.provider.name
 					} : t);
 				}
-				return yield* r.forEach(n, (e) => y(e.tenantId ?? null, e.idempotencyKey, v(e)));
+				return yield* r.forEach(n, (e) => x(e.tenantId ?? null, e.idempotencyKey, y(e)));
 			}),
 			suppress: n.suppress,
 			unsuppress: n.unsuppress,
-			isSuppressed: n.isSuppressed
+			isSuppressed: n.isSuppressed,
+			provider: {
+				name: e.provider.name,
+				managesUnsubscribe: e.provider.managesUnsubscribe === !0
+			}
 		},
 		scheduler: h
 	};
-}, Z = (e) => X(e).service, Ae = (e) => a.succeed(S, Z(e)), je = (e = 200) => {
+}, Re = (e) => q(e).service, ze = (e) => a.succeed(C, Re(e)), J = (e, t, n, r, i, a = {}) => {
+	if (!t) return null;
+	let o = a.metadata !== null && typeof a.metadata == "object" ? Object.fromEntries(Object.entries(a.metadata).filter(([, e]) => typeof e == "string")) : void 0;
+	return {
+		type: e,
+		email: t,
+		provider: n,
+		raw: i,
+		...r === void 0 ? {} : { messageId: r },
+		...a.eventId === void 0 ? {} : { eventId: a.eventId },
+		...o === void 0 ? {} : { metadata: o }
+	};
+}, Be = (e) => e === "message.hard_bounced" ? "bounced" : e === "message.spam_complaint" ? "complained" : e === "message.unsubscribed" ? "unsubscribed" : e === "message.delivered" ? "delivered" : e === "message.opened" ? "opened" : e === "message.clicked" ? "clicked" : "unknown", Ve = (e) => e === "hard_bounce" ? "bounced" : e === "spam_complaint" ? "complained" : e === "unsubscribe" ? "unsubscribed" : "unknown", He = (e) => e === "email.bounced" ? "bounced" : e === "email.complained" ? "complained" : e === "email.delivered" ? "delivered" : e === "email.opened" ? "opened" : e === "email.clicked" ? "clicked" : "unknown", Ue = (e) => e === "Bounce" ? "bounced" : e === "SpamComplaint" ? "complained" : e === "Delivery" ? "delivered" : e === "Open" ? "opened" : e === "Click" ? "clicked" : "unknown", We = (e) => e === "bounce" || e === "dropped" ? "bounced" : e === "spamreport" ? "complained" : e === "delivered" ? "delivered" : e === "open" ? "opened" : e === "click" ? "clicked" : "unknown", Y = (e, t) => {
+	let n = [], r = (e) => {
+		e && n.push(e);
+	};
+	if (e === "sendgrid" && Array.isArray(t)) {
+		for (let e of t) r(J(We(String(e.event)), e.email, "sendgrid", e.sg_message_id, e));
+		return n;
+	}
+	let i = t ?? {};
+	if (e === "lettermint") {
+		let e = String(i.event), a = i.data ?? {}, o = typeof i.id == "string" ? i.id : void 0;
+		return e === "suppression.added" ? (a.type === "email" && r(J(Ve(String(a.reason)), a.value, "lettermint", void 0, t, { eventId: o })), n) : e === "suppression.removed" ? (a.type === "email" && r(J("unsuppressed", a.value, "lettermint", void 0, t, { eventId: o })), n) : (e.startsWith("message.") && r(J(Be(e), a.recipient, "lettermint", a.message_id, t, {
+			eventId: o,
+			metadata: a.metadata
+		})), n);
+	}
+	if (e === "resend") {
+		let e = i.data ?? {}, a = Array.isArray(e.to) ? e.to[0] : e.to ?? e.email;
+		return r(J(He(String(i.type)), a, "resend", e.email_id, t)), n;
+	}
+	if (e === "postmark") {
+		let e = i.Email ?? i.Recipient;
+		return r(J(Ue(String(i.RecordType)), e, "postmark", i.MessageID, t, { metadata: i.Metadata })), n;
+	}
+	return n;
+}, Ge = (e, t, n, i = null) => r.gen(function* () {
+	let r = Y(e, t);
+	for (let e of r) e.type === "bounced" || e.type === "complained" ? yield* n.suppress(i, e.email, e.type) : e.type === "unsuppressed" && (yield* n.unsuppress(i, e.email));
+	return r;
+}), Ke = (e = 200) => {
 	let t = [];
 	return {
 		record: (n) => {
@@ -825,7 +977,37 @@ var b = class extends u.TaggedError()("MailError", {
 			t.length = 0;
 		}
 	};
-}, Q = (e, t) => {
+}, qe = {
+	lettermint: "api.lettermint.co",
+	resend: "api.resend.com",
+	postmark: "api.postmarkapp.com",
+	sendgrid: "api.sendgrid.com"
+}, Je = (e) => {
+	try {
+		return new URL(e).host || void 0;
+	} catch {
+		return;
+	}
+}, Ye = (e) => {
+	let t = e.env ?? {}, n = (e) => [{
+		destination: e,
+		purpose: "outgoing email: recipients, subject and body",
+		data: ["personal", "content"],
+		disable: "MAIL_PROVIDER=console (or memory) logs mail instead of sending it — none leaves"
+	}];
+	if (e.provider !== void 0 && typeof e.provider != "string") {
+		let t = e.provider.name;
+		return t === "console" || t === "memory" ? [] : n(`runtime:the '${t}' mail provider`);
+	}
+	let r = e.provider ?? t.MAIL_PROVIDER ?? "console", i = qe[r];
+	if (i !== void 0) return n(i);
+	switch (r) {
+		case "ses": return n(t.AWS_REGION ? `email.${t.AWS_REGION}.amazonaws.com` : "runtime:email.<AWS_REGION>.amazonaws.com");
+		case "mailgun": return n((t.MAILGUN_BASE_URL ? Je(t.MAILGUN_BASE_URL) : void 0) ?? "api.mailgun.net");
+		case "smtp": return n((t.SMTP_URL ? Je(t.SMTP_URL) : void 0) ?? (t.SMTP_HOST ? `${t.SMTP_HOST}${t.SMTP_PORT ? `:${t.SMTP_PORT}` : ""}` : void 0) ?? "runtime:SMTP_URL or SMTP_HOST");
+		default: return [];
+	}
+}, X = (e, t) => {
 	if (t > 6) return null;
 	switch (e._tag) {
 		case "StringKeyword": return "";
@@ -835,50 +1017,34 @@ var b = class extends u.TaggedError()("MailError", {
 		case "Enums": return e.enums.length > 0 ? e.enums[0][1] : null;
 		case "TypeLiteral": {
 			let n = {};
-			for (let r of e.propertySignatures) typeof r.name == "string" && (n[r.name] = Q(r.type, t + 1));
+			for (let r of e.propertySignatures) typeof r.name == "string" && (n[r.name] = X(r.type, t + 1));
 			return n;
 		}
 		case "TupleType": return [];
-		case "Union": return e.types.length > 0 ? Q(e.types[0], t + 1) : null;
-		case "Refinement": return Q(e.from, t + 1);
-		case "Transformation": return Q(e.from, t + 1);
-		case "Suspend": return Q(e.f(), t + 1);
+		case "Union": return e.types.length > 0 ? X(e.types[0], t + 1) : null;
+		case "Refinement": return X(e.from, t + 1);
+		case "Transformation": return X(e.from, t + 1);
+		case "Suspend": return X(e.f(), t + 1);
 		default: return null;
 	}
-}, Me = (e) => Q(e.ast, 0), $ = (e, t, n, r, i) => t ? {
-	type: e,
-	email: t,
-	provider: n,
-	raw: i,
-	...r === void 0 ? {} : { messageId: r }
-} : null, Ne = (e) => e === "email.bounced" ? "bounced" : e === "email.complained" ? "complained" : e === "email.delivered" ? "delivered" : e === "email.opened" ? "opened" : e === "email.clicked" ? "clicked" : "unknown", Pe = (e) => e === "Bounce" ? "bounced" : e === "SpamComplaint" ? "complained" : e === "Delivery" ? "delivered" : e === "Open" ? "opened" : e === "Click" ? "clicked" : "unknown", Fe = (e) => e === "bounce" || e === "dropped" ? "bounced" : e === "spamreport" ? "complained" : e === "delivered" ? "delivered" : e === "open" ? "opened" : e === "click" ? "clicked" : "unknown", Ie = (e, t) => {
-	let n = [], r = (e) => {
-		e && n.push(e);
-	};
-	if (e === "sendgrid" && Array.isArray(t)) {
-		for (let e of t) r($(Fe(String(e.event)), e.email, "sendgrid", e.sg_message_id, e));
-		return n;
-	}
-	let i = t ?? {};
-	if (e === "resend") {
-		let e = i.data ?? {}, a = Array.isArray(e.to) ? e.to[0] : e.to ?? e.email;
-		return r($(Ne(String(i.type)), a, "resend", e.email_id, t)), n;
-	}
-	if (e === "postmark") {
-		let e = i.Email ?? i.Recipient;
-		return r($(Pe(String(i.RecordType)), e, "postmark", i.MessageID, t)), n;
-	}
-	return n;
-}, Le = (e, t, n, i = null) => r.gen(function* () {
-	let r = Ie(e, t);
-	for (let e of r) (e.type === "bounced" || e.type === "complained") && (yield* n.suppress(i, e.email, e.type));
-	return r;
-}), Re = p([
+}, Xe = (e) => X(e.ast, 0), Z = p([
 	{
 		name: "MAIL_PROVIDER",
 		required: !1,
 		secret: !1,
-		description: "Provider to build from env: resend | postmark | sendgrid | ses | mailgun | smtp | console | memory. Default: console."
+		description: "Provider to build from env: lettermint | resend | postmark | sendgrid | ses | mailgun | smtp | console | memory. Default: console."
+	},
+	{
+		name: "LETTERMINT_PROJECT_TOKEN",
+		required: !1,
+		secret: !0,
+		description: "Lettermint project API token (lm_…) — needed only when the provider resolves to lettermint (or pass options.apiKey)."
+	},
+	{
+		name: "MAIL_WEBHOOK_SECRET",
+		required: !1,
+		secret: !0,
+		description: "Signing secret of the provider delivery-event webhook mounted by mailPlugin({ webhook })."
 	},
 	{
 		name: "RESEND_API_KEY",
@@ -1054,12 +1220,44 @@ var b = class extends u.TaggedError()("MailError", {
 		secret: !1,
 		description: "Fallback Postgres database name for the postgres suppression store."
 	}
-]), ze = "@voltro/plugin-mail", Be = (e = {}) => {
-	let t = process.env, o = ke({
+]), Q = "@voltro/plugin-mail", $ = (e, t) => ({
+	status: e,
+	contentType: "application/json",
+	body: JSON.stringify(t)
+}), Ze = (e, t, n, i) => {
+	let a = e.webhook;
+	if (a === void 0) throw Error(`@voltro/plugin-mail: provider '${e.name}' has no webhook verifier — mailPlugin({ webhook }) needs one (lettermint)`);
+	let o = n.secret ?? Z.read("MAIL_WEBHOOK_SECRET");
+	if (!o && i) throw Error("@voltro/plugin-mail: mailPlugin({ webhook }) needs a signing secret in production — set MAIL_WEBHOOK_SECRET");
+	return {
+		method: "POST",
+		path: n.path ?? "/webhooks/mail",
+		handle: async (i) => {
+			if (!o) return $(503, { error: "mail webhook secret not configured" });
+			let s = await r.runPromise(r.either(a.verify(i.headers, new TextDecoder().decode(i.rawBody), o)));
+			if (s._tag === "Left") return $(401, { error: s.left.message });
+			let c = Y(e.name, s.right);
+			try {
+				for (let e of c) {
+					e.type === "bounced" || e.type === "complained" ? await r.runPromise(t.suppress(null, e.email, e.type)) : e.type === "unsuppressed" && await r.runPromise(t.unsuppress(null, e.email));
+					let a = n.onEvent?.(e, { store: i.store });
+					r.isEffect(a) ? await r.runPromise(a) : await a;
+				}
+			} catch (e) {
+				return {
+					...$(500, { error: "mail event handling failed" }),
+					cause: e
+				};
+			}
+			return $(200, { received: c.length });
+		}
+	};
+}, Qe = (e = {}) => {
+	let t = process.env, o = Le({
 		...e.provider === void 0 ? {} : { provider: e.provider },
 		...e.apiKey === void 0 ? {} : { apiKey: e.apiKey },
 		env: t
-	}), s = Re.read("MAIL_ALLOWLIST"), c = e.allowlist ?? (s ? s.split(",").map((e) => e.trim()).filter(Boolean) : void 0), u = t.NODE_ENV === "production", p = e.suppression === void 0 || e.suppression === "memory" ? M() : e.suppression === "postgres" ? le() : e.suppression, m = e.idempotency === void 0 || e.idempotency === "memory" ? P() : e.idempotency === "postgres" ? F() : e.idempotency, h = e.schedule ?? I(), g = je(), _ = X({
+	}), s = Z.read("MAIL_ALLOWLIST"), c = e.allowlist ?? (s ? s.split(",").map((e) => e.trim()).filter(Boolean) : void 0), u = t.NODE_ENV === "production", p = e.suppression === void 0 || e.suppression === "memory" ? P() : e.suppression === "postgres" ? ce() : e.suppression, m = e.idempotency === void 0 || e.idempotency === "memory" ? I() : e.idempotency === "postgres" ? de() : e.idempotency, h = e.schedule ?? L(), g = Ke(), _ = q({
 		provider: o,
 		suppression: p,
 		idempotency: m,
@@ -1071,112 +1269,120 @@ var b = class extends u.TaggedError()("MailError", {
 		...e.attempts === void 0 ? {} : { attempts: e.attempts },
 		...e.templates === void 0 ? {} : { templates: e.templates },
 		production: u
-	}), v = a.succeed(S, _.service), y = o.supportsScheduling !== !0, b = e.scheduleTickMs ?? 1e3, x, C = /* @__PURE__ */ new Map();
-	for (let t of e.templates ?? []) C.set(t.locale ? `${t.name}:${t.locale}` : t.name, t);
-	let ee = (e, t) => (t ? C.get(`${e}:${t}`) : void 0) ?? C.get(e) ?? O(e, t), w = (e) => ({
+	}), v = a.succeed(C, _.service), y = o.supportsScheduling !== !0, b = e.scheduleTickMs ?? 1e3, x, S = /* @__PURE__ */ new Map();
+	for (let t of e.templates ?? []) S.set(t.locale ? `${t.name}:${t.locale}` : t.name, t);
+	let w = (e, t) => (t ? S.get(`${e}:${t}`) : void 0) ?? S.get(e) ?? A(e, t), T = (e) => ({
 		name: e.name,
 		...e.locale ? { locale: e.locale } : {},
-		props: e.preview ?? Me(e.props)
-	}), T = () => {
+		props: e.preview ?? Xe(e.props)
+	}), E = () => {
 		let t = /* @__PURE__ */ new Map();
-		for (let n of e.templates ?? []) t.set(n.locale ? `${n.name}:${n.locale}` : n.name, w(n));
-		for (let e of k()) {
-			let n = O(e.name, e.locale);
-			n && t.set(e.locale ? `${e.name}:${e.locale}` : e.name, w(n));
+		for (let n of e.templates ?? []) t.set(n.locale ? `${n.name}:${n.locale}` : n.name, T(n));
+		for (let e of re()) {
+			let n = A(e.name, e.locale);
+			n && t.set(e.locale ? `${e.name}:${e.locale}` : e.name, T(n));
 		}
 		return [...t.values()];
-	};
-	return d({
-		name: f({
-			base: ze,
-			alias: e.alias,
-			instance: e.name
-		}),
-		baseName: ze,
-		description: "Transactional email — MailService over Resend / Postmark / SendGrid / SMTP (+ console/memory), with default-from, transient retry and a dev allowlist.",
-		permissions: [
-			"network:outbound:*",
-			"inspect:read",
-			"inspect:write"
-		],
-		declaredEnv: Re.declared,
-		services: v,
-		inspectEndpoints: [
-			{
-				method: "GET",
-				path: "/outbox",
-				scope: "process",
-				description: "Recent sent mail (dev capture buffer), newest first",
-				handler: () => r.succeed({
-					kind: "json",
-					data: { sends: g.list() }
-				})
-			},
-			{
-				method: "GET",
-				path: "/templates",
-				scope: "declaration",
-				description: "Discovered + registered email templates",
-				handler: () => r.succeed({
-					kind: "json",
-					data: { templates: T() }
-				})
-			},
-			{
-				method: "POST",
-				path: "/preview",
-				description: "Render a template to html + text without sending — body { template, props, locale? }",
-				handler: (e) => r.gen(function* () {
-					let t = {};
-					try {
-						t = JSON.parse(e.body || "{}");
-					} catch {
-						return {
-							kind: "json",
-							status: 400,
-							data: { error: "invalid JSON body" }
-						};
-					}
-					if (!t.template) return {
-						kind: "json",
-						status: 400,
-						data: { error: "missing \"template\"" }
-					};
-					let n = ee(t.template, t.locale);
-					return n ? yield* E(n, t.props).pipe(r.map((e) => ({
-						kind: "json",
-						data: e
-					})), r.catchAll((e) => r.succeed({
+	}, D = e.webhook === void 0 ? [] : [Ze(o, p, e.webhook, u)], k = [
+		{
+			method: "GET",
+			path: "/outbox",
+			scope: "process",
+			description: "Recent sent mail (dev capture buffer), newest first",
+			handler: () => r.succeed({
+				kind: "json",
+				data: { sends: g.list() }
+			})
+		},
+		{
+			method: "GET",
+			path: "/templates",
+			scope: "declaration",
+			description: "Discovered + registered email templates",
+			handler: () => r.succeed({
+				kind: "json",
+				data: { templates: E() }
+			})
+		},
+		{
+			method: "POST",
+			path: "/preview",
+			description: "Render a template to html + text without sending — body { template, props, locale? }",
+			handler: (e) => r.gen(function* () {
+				let t = {};
+				try {
+					t = JSON.parse(e.body || "{}");
+				} catch {
+					return {
 						kind: "json",
 						status: 400,
-						data: { error: e.message }
-					}))) : {
-						kind: "json",
-						status: 404,
-						data: { error: `unknown template '${t.template}'` }
+						data: { error: "invalid JSON body" }
 					};
-				})
-			}
-		],
-		onActivate: (t) => r.gen(function* () {
-			if (p.activate && (yield* r.promise(() => p.activate(t.env))), m.activate && (yield* r.promise(() => m.activate(t.env))), y) {
-				let e = _.scheduler.tick().pipe(r.repeat(l.spaced(n.millis(Math.max(50, b)))));
-				x = r.runFork(e);
-			}
-			t.logger.info("mail active", {
-				provider: o.name,
-				from: e.from ?? null,
-				allowlist: c?.length ?? 0,
-				suppression: typeof e.suppression == "string" ? e.suppression : e.suppression ? "custom" : "memory",
-				idempotency: typeof e.idempotency == "string" ? e.idempotency : e.idempotency ? "custom" : "memory",
-				scheduling: o.supportsScheduling === !0 ? "native" : "held",
-				production: u
-			});
+				}
+				if (!t.template) return {
+					kind: "json",
+					status: 400,
+					data: { error: "missing \"template\"" }
+				};
+				let n = w(t.template, t.locale);
+				return n ? yield* O(n, t.props).pipe(r.map((e) => ({
+					kind: "json",
+					data: e
+				})), r.catchAll((e) => r.succeed({
+					kind: "json",
+					status: 400,
+					data: { error: e.message }
+				}))) : {
+					kind: "json",
+					status: 404,
+					data: { error: `unknown template '${t.template}'` }
+				};
+			})
+		}
+	];
+	return {
+		...d({
+			name: f({
+				base: Q,
+				alias: e.alias,
+				instance: e.name
+			}),
+			baseName: Q,
+			description: "Transactional and broadcast email — MailService over Lettermint / Resend / Postmark / SendGrid / SES / Mailgun / SMTP (+ console/memory), with default-from, transient retry, suppression and a dev allowlist.",
+			permissions: [
+				"network:outbound:*",
+				"inspect:read",
+				"inspect:write"
+			],
+			declaredEnv: Z.declared,
+			egress: Ye({
+				...e.provider === void 0 ? {} : { provider: e.provider },
+				env: t
+			}),
+			services: v,
+			inspectEndpoints: k,
+			...D.length > 0 ? { httpRoutes: D } : {},
+			onActivate: (t) => r.gen(function* () {
+				if (p.activate && (yield* r.promise(() => p.activate(t.env))), m.activate && (yield* r.promise(() => m.activate(t.env))), y) {
+					let e = _.scheduler.tick().pipe(r.repeat(l.spaced(n.millis(Math.max(50, b)))));
+					x = r.runFork(e);
+				}
+				t.logger.info("mail active", {
+					provider: o.name,
+					from: e.from ?? null,
+					allowlist: c?.length ?? 0,
+					suppression: typeof e.suppression == "string" ? e.suppression : e.suppression ? "custom" : "memory",
+					idempotency: typeof e.idempotency == "string" ? e.idempotency : e.idempotency ? "custom" : "memory",
+					scheduling: o.supportsScheduling === !0 ? "native" : "held",
+					production: u
+				});
+			}),
+			onDeactivate: () => r.gen(function* () {
+				x !== void 0 && (yield* i.interrupt(x), x = void 0), p.deactivate && (yield* r.promise(() => p.deactivate())), m.deactivate && (yield* r.promise(() => m.deactivate()));
+			})
 		}),
-		onDeactivate: () => r.gen(function* () {
-			x !== void 0 && (yield* i.interrupt(x), x = void 0), p.deactivate && (yield* r.promise(() => p.deactivate())), m.deactivate && (yield* r.promise(() => m.deactivate()));
-		})
-	});
+		service: _.service
+	};
 };
 //#endregion
-export { b as MailError, S as MailService, Z as buildMailService, X as buildMailServiceWithScheduler, ie as clearGlobalTemplates, De as clearMailBuffer, Te as consoleProvider, je as createOutbox, x as defineEmail, re as globalTemplateCount, Le as handleMailEvents, L as heldId, ae as isEmailTemplate, k as listGlobalTemplates, O as lookupGlobalTemplate, Be as mailPlugin, Ae as mailServiceLayer, we as mailgunProvider, R as makeScheduler, P as memoryIdempotencyStore, Oe as memoryProvider, I as memoryScheduleStore, M as memorySuppressionStore, Ie as parseMailEvent, F as postgresIdempotencyStore, le as postgresSuppressionStore, W as postmarkProvider, Ee as readMailBuffer, ne as registerEmailTemplates, E as renderTemplate, U as resendProvider, ke as resolveProvider, _e as sendgridProvider, Se as sesProvider, q as smtpProvider };
+export { b as MailError, C as MailService, x as MailWebhookError, Re as buildMailService, q as buildMailServiceWithScheduler, ie as clearGlobalTemplates, Fe as clearMailBuffer, Ne as consoleProvider, Ke as createOutbox, S as defineEmail, ne as globalTemplateCount, Ge as handleMailEvents, R as heldId, ae as isEmailTemplate, ve as lettermintProvider, re as listGlobalTemplates, A as lookupGlobalTemplate, Ye as mailEgressOf, Qe as mailPlugin, ze as mailServiceLayer, Me as mailgunProvider, z as makeScheduler, I as memoryIdempotencyStore, Ie as memoryProvider, L as memoryScheduleStore, P as memorySuppressionStore, Y as parseMailEvent, de as postgresIdempotencyStore, ce as postgresSuppressionStore, xe as postmarkProvider, Pe as readMailBuffer, te as registerEmailTemplates, O as renderTemplate, be as resendProvider, Le as resolveProvider, Te as sendgridProvider, Ae as sesProvider, W as smtpProvider, _e as verifyLettermintSignature };