better-ship 0.19.0 → 0.21.0

package/dist/posthog/client.d.ts

@@ -1,20 +1,21 @@
 import { PostHog, PostHogConfig } from "posthog-js";
 import { PostHogProvider, usePostHog } from "@posthog/react";
 //#region src/infrastructure/posthog/client.d.ts
+/** Application properties and native SDK options for browser initialization. */
+export interface PostHogClientOptionsConfig {
+  readonly environment: string;
+  readonly source: string;
+  readonly options?: Partial<PostHogConfig>;
+}
 /** The application controls enablement; disabled initialization needs no project key. */
 export type PostHogClientConfig = {
   readonly enabled: false;
-} | {
+} | (PostHogClientOptionsConfig & {
   readonly enabled: true;
   readonly apiKey: string;
-  readonly environment: string;
-  readonly source: string;
-  readonly options?: Partial<PostHogConfig>;
-};
+});
 /** Browser options from Typist and Porte; SDK option names and application overrides stay intact. */
-export declare function createPostHogClientOptions(config: Extract<PostHogClientConfig, {
-  enabled: true;
-}>): Partial<PostHogConfig>;
+export declare function createPostHogClientOptions(config: PostHogClientOptionsConfig): Partial<PostHogConfig>;
 /** Initialize once in the browser entrypoint; pass the returned SDK client to PostHogProvider. */
 export declare function initializePostHog(config: PostHogClientConfig): PostHog;
 //#endregion

package/dist/posthog/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","names":[],"sources":["../../src/infrastructure/posthog/client.ts"],"mappings":";;;;YAGY;WACG;;WAEA;WACA;WACA;WACA;WACA,UAAU,QAAQ;;;wBAIjB,2BACd,QAAQ,QAAQ;EAAuB;KACtC,QAAQ;;wBAkBK,kBAAkB,QAAQ,sBAAsB"}
+{"version":3,"file":"client.d.ts","names":[],"sources":["../../src/infrastructure/posthog/client.ts"],"mappings":";;;;iBAGiB;WACN;WACA;WACA,UAAU,QAAQ;;;YAIjB;WACG;KACV;WACU;WACA;;;wBAIC,2BACd,QAAQ,6BACP,QAAQ;;wBAkBK,kBAAkB,QAAQ,sBAAsB"}

package/dist/posthog/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","names":[],"sources":["../../src/infrastructure/posthog/client.ts"],"sourcesContent":["import posthog, { type PostHog, type PostHogConfig } from 'posthog-js'\n\n/** The application controls enablement; disabled initialization needs no project key. */\nexport type PostHogClientConfig =\n  | { readonly enabled: false }\n  | {\n      readonly enabled: true\n      readonly apiKey: string\n      readonly environment: string\n      readonly source: string\n      readonly options?: Partial<PostHogConfig>\n    }\n\n/** Browser options from Typist and Porte; SDK option names and application overrides stay intact. */\nexport function createPostHogClientOptions(\n  config: Extract<PostHogClientConfig, { enabled: true }>,\n): Partial<PostHogConfig> {\n  return {\n    api_host: '/relay',\n    ui_host: 'https://us.posthog.com',\n    person_profiles: 'identified_only',\n    defaults: '2026-08-29',\n    disable_surveys: true,\n    advanced_disable_feature_flags: true,\n    capture_performance: { web_vitals: false },\n    ...config.options,\n    loaded: (client) => {\n      client.register({ environment: config.environment, source: config.source })\n      config.options?.loaded?.(client)\n    },\n  }\n}\n\n/** Initialize once in the browser entrypoint; pass the returned SDK client to PostHogProvider. */\nexport function initializePostHog(config: PostHogClientConfig): PostHog {\n  if (!config.enabled) return posthog\n  posthog.init(config.apiKey, createPostHogClientOptions(config))\n  return posthog\n}\n\nexport { PostHogProvider, usePostHog } from '@posthog/react'\n"],"mappings":";;;;;AAcA,SAAgB,2BACd,QACwB;CACxB,OAAO;EACL,UAAU;EACV,SAAS;EACT,iBAAiB;EACjB,UAAU;EACV,iBAAiB;EACjB,gCAAgC;EAChC,qBAAqB,EAAE,YAAY,MAAM;EACzC,GAAG,OAAO;EACV,SAAS,WAAW;GAClB,OAAO,SAAS;IAAE,aAAa,OAAO;IAAa,QAAQ,OAAO;GAAO,CAAC;GAC1E,OAAO,SAAS,SAAS,MAAM;EACjC;CACF;AACF;;AAGA,SAAgB,kBAAkB,QAAsC;CACtE,IAAI,CAAC,OAAO,SAAS,OAAO;CAC5B,QAAQ,KAAK,OAAO,QAAQ,2BAA2B,MAAM,CAAC;CAC9D,OAAO;AACT"}
+{"version":3,"file":"client.js","names":[],"sources":["../../src/infrastructure/posthog/client.ts"],"sourcesContent":["import posthog, { type PostHog, type PostHogConfig } from 'posthog-js'\n\n/** Application properties and native SDK options for browser initialization. */\nexport interface PostHogClientOptionsConfig {\n  readonly environment: string\n  readonly source: string\n  readonly options?: Partial<PostHogConfig>\n}\n\n/** The application controls enablement; disabled initialization needs no project key. */\nexport type PostHogClientConfig =\n  | { readonly enabled: false }\n  | (PostHogClientOptionsConfig & {\n      readonly enabled: true\n      readonly apiKey: string\n    })\n\n/** Browser options from Typist and Porte; SDK option names and application overrides stay intact. */\nexport function createPostHogClientOptions(\n  config: PostHogClientOptionsConfig,\n): Partial<PostHogConfig> {\n  return {\n    api_host: '/relay',\n    ui_host: 'https://us.posthog.com',\n    person_profiles: 'identified_only',\n    defaults: '2026-08-29',\n    disable_surveys: true,\n    advanced_disable_feature_flags: true,\n    capture_performance: { web_vitals: false },\n    ...config.options,\n    loaded: (client) => {\n      client.register({ environment: config.environment, source: config.source })\n      config.options?.loaded?.(client)\n    },\n  }\n}\n\n/** Initialize once in the browser entrypoint; pass the returned SDK client to PostHogProvider. */\nexport function initializePostHog(config: PostHogClientConfig): PostHog {\n  if (!config.enabled) return posthog\n  posthog.init(config.apiKey, createPostHogClientOptions(config))\n  return posthog\n}\n\nexport { PostHogProvider, usePostHog } from '@posthog/react'\n"],"mappings":";;;;;AAkBA,SAAgB,2BACd,QACwB;CACxB,OAAO;EACL,UAAU;EACV,SAAS;EACT,iBAAiB;EACjB,UAAU;EACV,iBAAiB;EACjB,gCAAgC;EAChC,qBAAqB,EAAE,YAAY,MAAM;EACzC,GAAG,OAAO;EACV,SAAS,WAAW;GAClB,OAAO,SAAS;IAAE,aAAa,OAAO;IAAa,QAAQ,OAAO;GAAO,CAAC;GAC1E,OAAO,SAAS,SAAS,MAAM;EACjC;CACF;AACF;;AAGA,SAAgB,kBAAkB,QAAsC;CACtE,IAAI,CAAC,OAAO,SAAS,OAAO;CAC5B,QAAQ,KAAK,OAAO,QAAQ,2BAA2B,MAAM,CAAC;CAC9D,OAAO;AACT"}

package/dist/posthog/metrics.d.ts

@@ -1,4 +1,4 @@
-import { J as MetricsService, q as MetricOptions } from "../index-CYHXOH08.js";
+import { J as MetricOptions, Y as MetricsService } from "../index-tNZHSCpJ.js";
 import { PostHog } from "posthog-node";
 //#region src/infrastructure/posthog/metrics.d.ts
 /** PostHog Metrics with Worker lifetime management, ported from Typist's metrics-service.ts. */

package/dist/posthog/server.d.ts

@@ -1,5 +1,5 @@
 import { Gt as AnalyticsEventIdentity, Kt as AnalyticsEventInput, qt as AnalyticsProperties } from "../index-DUFS0SJ_.js";
-import { X as AnalyticsService } from "../index-CYHXOH08.js";
+import { Z as AnalyticsService } from "../index-tNZHSCpJ.js";
 import { PostHogMetricsService } from "./metrics.js";
 import { PostHog, PostHogOptions } from "posthog-node";
 //#region src/infrastructure/posthog/server.d.ts

package/dist/posthog/server.js

@@ -1,4 +1,4 @@
-import { tt as MissingConfigurationError } from "../core-BT1dSEQI.js";
+import { tt as MissingConfigurationError } from "../core-BIas38R0.js";
 import { PostHogMetricsService } from "./metrics.js";
 import { PostHog } from "posthog-node";
 

package/dist/resend.d.ts

@@ -1,26 +1,25 @@
 import { jt as BounceType } from "./index-DUFS0SJ_.js";
-import { B as OutboundEmail, I as EmailAccepted, R as IEmailService } from "./index-CYHXOH08.js";
+import { B as OutboundEmail, I as EmailAccepted, R as IEmailService, V as ReceivedEmail } from "./index-tNZHSCpJ.js";
 import { n as WebhookVerifier } from "./webhook-verification-D1c7BY4q.js";
-import { Resend } from "resend";
+import "resend";
 //#region src/infrastructure/resend/resend-email-service.d.ts
-/** The SDK operations required by the adapter; a test factory can return a plain object. */
-type ResendEmailClient = {
-  readonly emails: Pick<Resend['emails'], 'send'>;
-};
 /**
  * Send without package retries or logs. Ported from Suparelay's resend-email-service.ts.
  * The Resend SDK itself logs API errors outside production.
  */
 export declare class ResendEmailService implements IEmailService {
-  private readonly createClient;
+  private readonly apiKey;
   private readonly fromAddress;
-  /** Load the SDK on the first send. Constructing the service does not load it. */
+  /** Load the SDK on the first email operation. Constructing the service does not load it. */
   static create(apiKey: string, fromAddress: string): ResendEmailService;
   private client;
-  /** Supply an async factory. The service calls it once, on the first send, and keeps its promise. */
-  constructor(createClient: () => Promise<ResendEmailClient>, fromAddress: string);
+  /** Store configuration. Load the SDK and create its client on the first email operation. */
+  constructor(apiKey: string, fromAddress: string);
   /** Resolve after acceptance. Provider failures throw EmailServiceError; SDK defects retain their identity. */
   sendEmail(email: OutboundEmail): Promise<EmailAccepted>;
+  /** Retrieve headers by the received email's provider ID. Provider failures throw EmailServiceError. */
+  getReceivedEmail(emailId: string): Promise<ReceivedEmail>;
+  private getClient;
 }
 //#endregion
 //#region src/infrastructure/resend/email-event.d.ts
@@ -30,6 +29,7 @@ type EmailEventType = (typeof SIMPLE_EMAIL_TYPES)[number] | 'email.bounced' | 'e
 type EmailEventBase = {
   readonly id: string;
   readonly emailId: string;
+  readonly messageId: string;
   readonly recipients: readonly string[];
   readonly subject: string;
   readonly tags: Readonly<Record<string, string>>;
@@ -54,20 +54,18 @@ type EmailEvent = (EmailEventBase & {
 });
 //#endregion
 //#region src/infrastructure/resend/resend-webhook.d.ts
-/** The SDK's local signature verifier. It makes no API request. */
-type ResendWebhookClient = Pick<Resend['webhooks'], 'verify'>;
 /** Verify Svix signatures and map Resend email events. Ported from Typist's Resend route. */
 export declare class ResendWebhook implements WebhookVerifier<EmailEvent> {
   private readonly webhookSecret;
-  private readonly verifier;
   /** Load the SDK on the first verification. Only the webhook secret is required. */
   static create(webhookSecret: string): ResendWebhook;
   private client;
-  /** Inject the local SDK verifier when testing. */
-  constructor(webhookSecret: string, verifier: () => Promise<ResendWebhookClient>);
+  /** Store the webhook secret. Load the SDK on the first verification. */
+  constructor(webhookSecret: string);
   /** Verify the raw body and Svix headers. Invalid requests throw typed errors; other failures propagate. */
   verify(body: string, headers: Headers): Promise<EmailEvent | null>;
+  private getClient;
 }
 //#endregion
-export type { EmailEvent, EmailEventType, ResendEmailClient, ResendWebhookClient };
+export type { EmailEvent, EmailEventType };
 //# sourceMappingURL=resend.d.ts.map

package/dist/resend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resend.d.ts","names":[],"sources":["../src/infrastructure/resend/resend-email-service.ts","../src/infrastructure/resend/email-event.ts","../src/infrastructure/resend/resend-webhook.ts"],"mappings":";;;;;;KAsEY;WAA+B,QAAQ,KAAK;;;;;;qBAM3C,8BAA8B;mBAatB;mBACA;;SAZZ,OAAO,gBAAgB,sBAAsB;UAO5C;;EAGR,YACmB,oBAAoB,QAAQ,oBAC5B;;EAIb,UAAU,OAAO,gBAAgB,QAAQ;;;;cCzF3C;;KAYM,yBACA;KAgDP;WACM;WACA;WACA;WACA;WACA,MAAM,SAAS;WACf;;;KAIC,cACP;WACU;WACA;aACE,MAAM;aACN;aACA;;MAGZ;WAA4B;WAA+B;MAC3D;WAA4B;WAAgC;MAC5D;WAA4B,cAAc;;;;;KC3EnC,sBAAsB,KAAK;;qBAG1B,yBAAyB,gBAAgB;mBAcjC;mBACA;;SAbZ,OAAO,wBAAwB;UAQ9B;;EAGR,YACmB,uBACA,gBAAgB,QAAQ;;EAIrC,OAAO,cAAc,SAAS,UAAU,QAAQ"}
+{"version":3,"file":"resend.d.ts","names":[],"sources":["../src/infrastructure/resend/resend-email-service.ts","../src/infrastructure/resend/email-event.ts","../src/infrastructure/resend/resend-webhook.ts"],"mappings":";;;;;;;;;qBA+Ea,8BAA8B;mBAUtB;mBACA;;SATZ,OAAO,gBAAgB,sBAAsB;UAI5C;;EAGR,YACmB,gBACA;;EAIb,UAAU,OAAO,gBAAgB,QAAQ;;EA+BzC,iBAAiB,kBAAkB,QAAQ;UAgBnC;;;;cCxIV;;KAYM,yBACA;KAiDP;WACM;WACA;WACA;WACA;WACA;WACA,MAAM,SAAS;WACf;;;KAIC,cACP;WACU;WACA;aACE,MAAM;aACN;aACA;;MAGZ;WAA4B;WAA+B;MAC3D;WAA4B;WAAgC;MAC5D;WAA4B,cAAc;;;;;qBC7ElC,yBAAyB,gBAAgB;mBASvB;;SAPtB,OAAO,wBAAwB;UAI9B;;EAGR,YAA6B;;EAGvB,OAAO,cAAc,SAAS,UAAU,QAAQ;UA0BxC"}

package/dist/resend.js

@@ -1,5 +1,5 @@
-import { $ as EmailAddressSchema, J as parseBounceType, X as EmailServiceError } from "./core-BT1dSEQI.js";
-import { t as WebhookVerificationError } from "./webhook-verification-qSFXv5H3.js";
+import { $ as EmailAddressSchema, J as parseBounceType, X as EmailServiceError } from "./core-BIas38R0.js";
+import { t as WebhookVerificationError } from "./webhook-verification-CEUARY9X.js";
 import { z } from "zod";
 import { Buffer } from "node:buffer";
 
@@ -61,22 +61,21 @@ function toAttachment(attachment) {
 * The Resend SDK itself logs API errors outside production.
 */
 var ResendEmailService = class ResendEmailService {
-	createClient;
+	apiKey;
 	fromAddress;
-	/** Load the SDK on the first send. Constructing the service does not load it. */
+	/** Load the SDK on the first email operation. Constructing the service does not load it. */
 	static create(apiKey, fromAddress) {
-		return new ResendEmailService(() => import("resend").then(({ Resend }) => new Resend(apiKey)), fromAddress);
+		return new ResendEmailService(apiKey, fromAddress);
 	}
 	client;
-	/** Supply an async factory. The service calls it once, on the first send, and keeps its promise. */
-	constructor(createClient, fromAddress) {
-		this.createClient = createClient;
+	/** Store configuration. Load the SDK and create its client on the first email operation. */
+	constructor(apiKey, fromAddress) {
+		this.apiKey = apiKey;
 		this.fromAddress = fromAddress;
 	}
 	/** Resolve after acceptance. Provider failures throw EmailServiceError; SDK defects retain their identity. */
 	async sendEmail(email) {
-		if (this.client === void 0) this.client = Promise.resolve().then(this.createClient);
-		const client = await this.client;
+		const client = await this.getClient();
 		const payload = {
 			from: email.from ?? this.fromAddress,
 			to: [email.to].flat(),
@@ -101,6 +100,26 @@ var ResendEmailService = class ResendEmailService {
 		});
 		return { providerId: result.data.id };
 	}
+	/** Retrieve headers by the received email's provider ID. Provider failures throw EmailServiceError. */
+	async getReceivedEmail(emailId) {
+		const result = await (await this.getClient()).emails.receiving.get(emailId);
+		if (result.error !== null) throw new EmailServiceError({
+			reason: reasonFromResend(result.error),
+			provider: "resend",
+			providerCode: result.error.name,
+			statusCode: result.error.statusCode,
+			retryAfter: retryAfterSeconds(result.headers?.["retry-after"]),
+			cause: result.error
+		});
+		return { headers: result.data.headers ?? {} };
+	}
+	async getClient() {
+		if (this.client === void 0) {
+			const { Resend } = await import("resend");
+			this.client ??= new Resend(this.apiKey);
+		}
+		return this.client;
+	}
 };
 
 //#endregion
@@ -130,6 +149,7 @@ const EMAIL_TYPES = {
 };
 const BaseDataSchema = z.object({
 	email_id: z.string().min(1),
+	message_id: z.string().min(1),
 	to: z.array(EmailAddressSchema).min(1),
 	subject: z.string(),
 	tags: z.record(z.string(), z.string()).default({})
@@ -168,6 +188,7 @@ function parseEmailEvent(payload, id) {
 	const base = {
 		id,
 		emailId: event.data.email_id,
+		messageId: event.data.message_id,
 		recipients: event.data.to,
 		subject: event.data.subject,
 		tags: event.data.tags,
@@ -206,19 +227,14 @@ const SignatureErrorSchema = z.instanceof(Error).refine((error) => error.name ==
 /** Verify Svix signatures and map Resend email events. Ported from Typist's Resend route. */
 var ResendWebhook = class ResendWebhook {
 	webhookSecret;
-	verifier;
 	/** Load the SDK on the first verification. Only the webhook secret is required. */
 	static create(webhookSecret) {
-		return new ResendWebhook(webhookSecret, async () => {
-			const { Resend } = await import("resend");
-			return new Resend("re_webhook_verification_only").webhooks;
-		});
+		return new ResendWebhook(webhookSecret);
 	}
 	client;
-	/** Inject the local SDK verifier when testing. */
-	constructor(webhookSecret, verifier) {
+	/** Store the webhook secret. Load the SDK on the first verification. */
+	constructor(webhookSecret) {
 		this.webhookSecret = webhookSecret;
-		this.verifier = verifier;
 	}
 	/** Verify the raw body and Svix headers. Invalid requests throw typed errors; other failures propagate. */
 	async verify(body, headers) {
@@ -226,7 +242,7 @@ var ResendWebhook = class ResendWebhook {
 		const timestamp = headers.get("svix-timestamp");
 		const signature = headers.get("svix-signature");
 		if (!id || !timestamp || !signature) throw new WebhookVerificationError("missing_headers");
-		const client = await (this.client ??= this.verifier());
+		const client = await this.getClient();
 		let payload;
 		try {
 			payload = client.verify({
@@ -250,6 +266,13 @@ var ResendWebhook = class ResendWebhook {
 			throw cause;
 		}
 	}
+	async getClient() {
+		if (this.client === void 0) {
+			const { Resend } = await import("resend");
+			this.client ??= new Resend("re_webhook_verification_only").webhooks;
+		}
+		return this.client;
+	}
 };
 
 //#endregion

package/dist/resend.js.map

@@ -1 +1 @@
-{"version":3,"file":"resend.js","names":[],"sources":["../src/infrastructure/resend/resend-email-service.ts","../src/infrastructure/resend/email-event.ts","../src/infrastructure/resend/resend-webhook.ts"],"sourcesContent":["import { Buffer } from 'node:buffer'\n\nimport type { Attachment, CreateEmailOptions, ErrorResponse, Resend } from 'resend'\n\nimport type { EmailAccepted, EmailAttachment, IEmailService, OutboundEmail } from '@/application'\nimport { EmailServiceError, type EmailSendFailureReason } from '@/core'\n\n// SDK additions must receive an explicit classification before the package builds.\nconst SDK_REASONS = {\n  invalid_idempotency_key: 'invalid_request',\n  validation_error: 'invalid_request',\n  missing_api_key: 'configuration',\n  restricted_api_key: 'configuration',\n  invalid_api_key: 'configuration',\n  not_found: 'invalid_request',\n  method_not_allowed: 'invalid_request',\n  invalid_idempotent_request: 'invalid_request',\n  concurrent_idempotent_requests: 'idempotency_conflict',\n  invalid_attachment: 'invalid_request',\n  invalid_from_address: 'invalid_request',\n  invalid_access: 'configuration',\n  invalid_parameter: 'invalid_request',\n  invalid_region: 'invalid_request',\n  missing_required_field: 'invalid_request',\n  monthly_quota_exceeded: 'quota_exceeded',\n  daily_quota_exceeded: 'quota_exceeded',\n  rate_limit_exceeded: 'rate_limited',\n  security_error: 'configuration',\n  application_error: 'provider_error',\n  internal_server_error: 'provider_error',\n} satisfies Record<ErrorResponse['name'], EmailSendFailureReason>\n\n// Resend documents these codes before its SDK includes them in ErrorResponse.\nconst DOCUMENTED_REASONS = new Map<string, EmailSendFailureReason>([\n  ['email_above_quota', 'quota_exceeded'],\n  ['invalid_permission', 'configuration'],\n  ['suspended_api_key', 'configuration'],\n  ['resource_locked', 'idempotency_conflict'],\n  ['service_unavailable', 'provider_error'],\n  ['missing_required_parameter', 'invalid_request'],\n])\n\nfunction reasonFromResend(error: ErrorResponse): EmailSendFailureReason {\n  if (Object.hasOwn(SDK_REASONS, error.name)) return SDK_REASONS[error.name]\n  const reason = DOCUMENTED_REASONS.get(error.name)\n  if (reason !== undefined) return reason\n  if (error.statusCode === 429) return 'rate_limited'\n  if (error.statusCode !== null && error.statusCode >= 400 && error.statusCode < 500)\n    return 'invalid_request'\n  return 'provider_error'\n}\n\nfunction retryAfterSeconds(value: string | undefined): number | null {\n  if (value === undefined || !/^\\d+$/.test(value)) return null\n  const seconds = Number(value)\n  return Number.isSafeInteger(seconds) ? seconds : null\n}\n\nfunction toAttachment(attachment: EmailAttachment): Attachment {\n  const result: Attachment = {\n    filename: attachment.filename,\n    content: ArrayBuffer.isView(attachment.content)\n      ? Buffer.from(attachment.content)\n      : attachment.content,\n  }\n  if (attachment.contentType !== undefined) result.contentType = attachment.contentType\n  return result\n}\n\n/** The SDK operations required by the adapter; a test factory can return a plain object. */\nexport type ResendEmailClient = { readonly emails: Pick<Resend['emails'], 'send'> }\n\n/**\n * Send without package retries or logs. Ported from Suparelay's resend-email-service.ts.\n * The Resend SDK itself logs API errors outside production.\n */\nexport class ResendEmailService implements IEmailService {\n  /** Load the SDK on the first send. Constructing the service does not load it. */\n  static create(apiKey: string, fromAddress: string): ResendEmailService {\n    return new ResendEmailService(\n      () => import('resend').then(({ Resend }) => new Resend(apiKey)),\n      fromAddress,\n    )\n  }\n\n  private client: Promise<ResendEmailClient> | undefined\n\n  /** Supply an async factory. The service calls it once, on the first send, and keeps its promise. */\n  constructor(\n    private readonly createClient: () => Promise<ResendEmailClient>,\n    private readonly fromAddress: string,\n  ) {}\n\n  /** Resolve after acceptance. Provider failures throw EmailServiceError; SDK defects retain their identity. */\n  async sendEmail(email: OutboundEmail): Promise<EmailAccepted> {\n    if (this.client === undefined) {\n      // Cache synchronous factory throws as rejections too, so later sends cannot initialize again.\n      this.client = Promise.resolve().then(this.createClient)\n    }\n    const client = await this.client\n    const payload: CreateEmailOptions = {\n      from: email.from ?? this.fromAddress,\n      to: [email.to].flat(),\n      subject: email.subject,\n      html: email.html,\n    }\n    if (email.text !== undefined) payload.text = email.text\n    if (email.replyTo !== undefined) payload.replyTo = email.replyTo\n    if (email.tags !== undefined)\n      payload.tags = Object.entries(email.tags).map(([name, value]) => ({ name, value }))\n    if (email.attachments !== undefined) payload.attachments = email.attachments.map(toAttachment)\n    const result = await client.emails.send(\n      payload,\n      email.idempotencyKey === undefined ? undefined : { idempotencyKey: email.idempotencyKey },\n    )\n    if (result.error !== null) {\n      throw new EmailServiceError({\n        reason: reasonFromResend(result.error),\n        provider: 'resend',\n        providerCode: result.error.name,\n        statusCode: result.error.statusCode,\n        retryAfter: retryAfterSeconds(result.headers?.['retry-after']),\n        cause: result.error,\n      })\n    }\n    return { providerId: result.data.id }\n  }\n}\n","import type { WebhookEventPayload } from 'resend'\nimport { z } from 'zod'\n\nimport { EmailAddressSchema, parseBounceType, type BounceType } from '@/core'\n\nconst SIMPLE_EMAIL_TYPES = [\n  'email.sent',\n  'email.scheduled',\n  'email.delivered',\n  'email.delivery_delayed',\n  'email.complained',\n  'email.opened',\n  'email.received',\n  'email.suppressed',\n] as const\n\n/** Resend email event names supported by this module. */\nexport type EmailEventType =\n  | (typeof SIMPLE_EMAIL_TYPES)[number]\n  | 'email.bounced'\n  | 'email.failed'\n  | 'email.clicked'\n\nconst EMAIL_TYPES = {\n  'email.sent': true,\n  'email.scheduled': true,\n  'email.delivered': true,\n  'email.delivery_delayed': true,\n  'email.complained': true,\n  'email.opened': true,\n  'email.received': true,\n  'email.suppressed': true,\n  'email.bounced': true,\n  'email.failed': true,\n  'email.clicked': true,\n} satisfies Record<Extract<WebhookEventPayload['type'], `email.${string}`>, true>\n\nconst BaseDataSchema = z.object({\n  email_id: z.string().min(1),\n  to: z.array(EmailAddressSchema).min(1),\n  subject: z.string(),\n  tags: z.record(z.string(), z.string()).default({}),\n})\n\nconst EmailPayloadSchema = z.discriminatedUnion('type', [\n  z.object({ type: z.enum(SIMPLE_EMAIL_TYPES), data: BaseDataSchema }),\n  z.object({\n    type: z.literal('email.bounced'),\n    data: BaseDataSchema.extend({\n      bounce: z.object({\n        type: z.string().optional(),\n        subType: z.string().nullable().optional(),\n        message: z.string(),\n      }),\n    }),\n  }),\n  z.object({\n    type: z.literal('email.failed'),\n    data: BaseDataSchema.extend({ failed: z.object({ reason: z.string() }) }),\n  }),\n  z.object({\n    type: z.literal('email.clicked'),\n    data: BaseDataSchema.extend({ click: z.object({ link: z.string() }) }),\n  }),\n])\n\ntype EmailEventBase = {\n  readonly id: string\n  readonly emailId: string\n  readonly recipients: readonly string[]\n  readonly subject: string\n  readonly tags: Readonly<Record<string, string>>\n  readonly occurredAt: string\n}\n\n/** A verified event. `id` is the Svix identity; use `resend:event:${id}` as the command id. */\nexport type EmailEvent =\n  | (EmailEventBase & {\n      readonly type: 'email.bounced'\n      readonly bounce: {\n        readonly type: BounceType\n        readonly subType: string | null\n        readonly message: string\n      }\n    })\n  | (EmailEventBase & { readonly type: 'email.failed'; readonly reason: string })\n  | (EmailEventBase & { readonly type: 'email.clicked'; readonly link: string })\n  | (EmailEventBase & { readonly type: (typeof SIMPLE_EMAIL_TYPES)[number] })\n\nconst EventHeaderSchema = z.object({\n  type: z.string(),\n  created_at: z.iso.datetime({ offset: true }),\n})\n\n/** Validate signed provider data before projecting it into the public event contract. */\nexport function parseEmailEvent(payload: WebhookEventPayload, id: string): EmailEvent | null {\n  const header = EventHeaderSchema.parse(payload)\n  if (!Object.hasOwn(EMAIL_TYPES, header.type)) return null\n  const event = EmailPayloadSchema.parse(payload)\n  const base: EmailEventBase = {\n    id,\n    emailId: event.data.email_id,\n    recipients: event.data.to,\n    subject: event.data.subject,\n    tags: event.data.tags,\n    occurredAt: header.created_at,\n  }\n  switch (event.type) {\n    case 'email.bounced':\n      return {\n        ...base,\n        type: event.type,\n        bounce: {\n          type: parseBounceType(event.data.bounce.type),\n          subType: event.data.bounce.subType ?? null,\n          message: event.data.bounce.message,\n        },\n      }\n    case 'email.failed':\n      return { ...base, type: event.type, reason: event.data.failed.reason }\n    case 'email.clicked':\n      return { ...base, type: event.type, link: event.data.click.link }\n    default:\n      return { ...base, type: event.type }\n  }\n}\n","import type { Resend } from 'resend'\nimport { z } from 'zod'\n\nimport { WebhookVerificationError, type WebhookVerifier } from '../http/webhook-verification.ts'\nimport { parseEmailEvent, type EmailEvent } from './email-event.ts'\n\n// Separate standardwebhooks versions have different prototypes; its error name remains the same.\nconst SignatureErrorSchema = z\n  .instanceof(Error)\n  .refine((error) => error.name === 'WebhookVerificationError')\n\n/** The SDK's local signature verifier. It makes no API request. */\nexport type ResendWebhookClient = Pick<Resend['webhooks'], 'verify'>\n\n/** Verify Svix signatures and map Resend email events. Ported from Typist's Resend route. */\nexport class ResendWebhook implements WebhookVerifier<EmailEvent> {\n  /** Load the SDK on the first verification. Only the webhook secret is required. */\n  static create(webhookSecret: string): ResendWebhook {\n    return new ResendWebhook(webhookSecret, async () => {\n      const { Resend } = await import('resend')\n      // The SDK requires a nonempty key even though its local verifier never uses that key.\n      return new Resend('re_webhook_verification_only').webhooks\n    })\n  }\n\n  private client: Promise<ResendWebhookClient> | undefined\n\n  /** Inject the local SDK verifier when testing. */\n  constructor(\n    private readonly webhookSecret: string,\n    private readonly verifier: () => Promise<ResendWebhookClient>,\n  ) {}\n\n  /** Verify the raw body and Svix headers. Invalid requests throw typed errors; other failures propagate. */\n  async verify(body: string, headers: Headers): Promise<EmailEvent | null> {\n    const id = headers.get('svix-id')\n    const timestamp = headers.get('svix-timestamp')\n    const signature = headers.get('svix-signature')\n    if (!id || !timestamp || !signature) throw new WebhookVerificationError('missing_headers')\n    const client = await (this.client ??= this.verifier())\n    let payload: ReturnType<ResendWebhookClient['verify']>\n    try {\n      payload = client.verify({\n        payload: body,\n        headers: { id, timestamp, signature },\n        webhookSecret: this.webhookSecret,\n      })\n    } catch (cause) {\n      if (cause instanceof SyntaxError) throw new WebhookVerificationError('invalid_payload', cause)\n      if (!SignatureErrorSchema.safeParse(cause).success) throw cause\n      throw new WebhookVerificationError('invalid_signature', cause)\n    }\n    try {\n      return parseEmailEvent(payload, id)\n    } catch (cause) {\n      if (cause instanceof z.ZodError) throw new WebhookVerificationError('invalid_payload', cause)\n      throw cause\n    }\n  }\n}\n"],"mappings":";;;;;;AAQA,MAAM,cAAc;CAClB,yBAAyB;CACzB,kBAAkB;CAClB,iBAAiB;CACjB,oBAAoB;CACpB,iBAAiB;CACjB,WAAW;CACX,oBAAoB;CACpB,4BAA4B;CAC5B,gCAAgC;CAChC,oBAAoB;CACpB,sBAAsB;CACtB,gBAAgB;CAChB,mBAAmB;CACnB,gBAAgB;CAChB,wBAAwB;CACxB,wBAAwB;CACxB,sBAAsB;CACtB,qBAAqB;CACrB,gBAAgB;CAChB,mBAAmB;CACnB,uBAAuB;AACzB;AAGA,MAAM,qCAAqB,IAAI,IAAoC;CACjE,CAAC,qBAAqB,gBAAgB;CACtC,CAAC,sBAAsB,eAAe;CACtC,CAAC,qBAAqB,eAAe;CACrC,CAAC,mBAAmB,sBAAsB;CAC1C,CAAC,uBAAuB,gBAAgB;CACxC,CAAC,8BAA8B,iBAAiB;AAClD,CAAC;AAED,SAAS,iBAAiB,OAA8C;CACtE,IAAI,OAAO,OAAO,aAAa,MAAM,IAAI,GAAG,OAAO,YAAY,MAAM;CACrE,MAAM,SAAS,mBAAmB,IAAI,MAAM,IAAI;CAChD,IAAI,WAAW,QAAW,OAAO;CACjC,IAAI,MAAM,eAAe,KAAK,OAAO;CACrC,IAAI,MAAM,eAAe,QAAQ,MAAM,cAAc,OAAO,MAAM,aAAa,KAC7E,OAAO;CACT,OAAO;AACT;AAEA,SAAS,kBAAkB,OAA0C;CACnE,IAAI,UAAU,UAAa,CAAC,QAAQ,KAAK,KAAK,GAAG,OAAO;CACxD,MAAM,UAAU,OAAO,KAAK;CAC5B,OAAO,OAAO,cAAc,OAAO,IAAI,UAAU;AACnD;AAEA,SAAS,aAAa,YAAyC;CAC7D,MAAM,SAAqB;EACzB,UAAU,WAAW;EACrB,SAAS,YAAY,OAAO,WAAW,OAAO,IAC1C,OAAO,KAAK,WAAW,OAAO,IAC9B,WAAW;CACjB;CACA,IAAI,WAAW,gBAAgB,QAAW,OAAO,cAAc,WAAW;CAC1E,OAAO;AACT;;;;;AASA,IAAa,qBAAb,MAAa,mBAA4C;CAapC;CACA;;CAZnB,OAAO,OAAO,QAAgB,aAAyC;EACrE,OAAO,IAAI,yBACH,OAAO,SAAS,CAAC,MAAM,EAAE,aAAa,IAAI,OAAO,MAAM,CAAC,GAC9D,WACF;CACF;CAEA,AAAQ;;CAGR,YACE,AAAiB,cACjB,AAAiB,aACjB;EAFiB;EACA;CAChB;;CAGH,MAAM,UAAU,OAA8C;EAC5D,IAAI,KAAK,WAAW,QAElB,KAAK,SAAS,QAAQ,QAAQ,CAAC,CAAC,KAAK,KAAK,YAAY;EAExD,MAAM,SAAS,MAAM,KAAK;EAC1B,MAAM,UAA8B;GAClC,MAAM,MAAM,QAAQ,KAAK;GACzB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK;GACpB,SAAS,MAAM;GACf,MAAM,MAAM;EACd;EACA,IAAI,MAAM,SAAS,QAAW,QAAQ,OAAO,MAAM;EACnD,IAAI,MAAM,YAAY,QAAW,QAAQ,UAAU,MAAM;EACzD,IAAI,MAAM,SAAS,QACjB,QAAQ,OAAO,OAAO,QAAQ,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY;GAAE;GAAM;EAAM,EAAE;EACpF,IAAI,MAAM,gBAAgB,QAAW,QAAQ,cAAc,MAAM,YAAY,IAAI,YAAY;EAC7F,MAAM,SAAS,MAAM,OAAO,OAAO,KACjC,SACA,MAAM,mBAAmB,SAAY,SAAY,EAAE,gBAAgB,MAAM,eAAe,CAC1F;EACA,IAAI,OAAO,UAAU,MACnB,MAAM,IAAI,kBAAkB;GAC1B,QAAQ,iBAAiB,OAAO,KAAK;GACrC,UAAU;GACV,cAAc,OAAO,MAAM;GAC3B,YAAY,OAAO,MAAM;GACzB,YAAY,kBAAkB,OAAO,UAAU,cAAc;GAC7D,OAAO,OAAO;EAChB,CAAC;EAEH,OAAO,EAAE,YAAY,OAAO,KAAK,GAAG;CACtC;AACF;;;;AC1HA,MAAM,qBAAqB;CACzB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AASA,MAAM,cAAc;CAClB,cAAc;CACd,mBAAmB;CACnB,mBAAmB;CACnB,0BAA0B;CAC1B,oBAAoB;CACpB,gBAAgB;CAChB,kBAAkB;CAClB,oBAAoB;CACpB,iBAAiB;CACjB,gBAAgB;CAChB,iBAAiB;AACnB;AAEA,MAAM,iBAAiB,EAAE,OAAO;CAC9B,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC1B,IAAI,EAAE,MAAM,kBAAkB,CAAC,CAAC,IAAI,CAAC;CACrC,SAAS,EAAE,OAAO;CAClB,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,qBAAqB,EAAE,mBAAmB,QAAQ;CACtD,EAAE,OAAO;EAAE,MAAM,EAAE,KAAK,kBAAkB;EAAG,MAAM;CAAe,CAAC;CACnE,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,eAAe;EAC/B,MAAM,eAAe,OAAO,EAC1B,QAAQ,EAAE,OAAO;GACf,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;GAC1B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;GACxC,SAAS,EAAE,OAAO;EACpB,CAAC,EACH,CAAC;CACH,CAAC;CACD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,cAAc;EAC9B,MAAM,eAAe,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;CAC1E,CAAC;CACD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,eAAe;EAC/B,MAAM,eAAe,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;CACvE,CAAC;AACH,CAAC;AAyBD,MAAM,oBAAoB,EAAE,OAAO;CACjC,MAAM,EAAE,OAAO;CACf,YAAY,EAAE,IAAI,SAAS,EAAE,QAAQ,KAAK,CAAC;AAC7C,CAAC;;AAGD,SAAgB,gBAAgB,SAA8B,IAA+B;CAC3F,MAAM,SAAS,kBAAkB,MAAM,OAAO;CAC9C,IAAI,CAAC,OAAO,OAAO,aAAa,OAAO,IAAI,GAAG,OAAO;CACrD,MAAM,QAAQ,mBAAmB,MAAM,OAAO;CAC9C,MAAM,OAAuB;EAC3B;EACA,SAAS,MAAM,KAAK;EACpB,YAAY,MAAM,KAAK;EACvB,SAAS,MAAM,KAAK;EACpB,MAAM,MAAM,KAAK;EACjB,YAAY,OAAO;CACrB;CACA,QAAQ,MAAM,MAAd;EACE,KAAK,iBACH,OAAO;GACL,GAAG;GACH,MAAM,MAAM;GACZ,QAAQ;IACN,MAAM,gBAAgB,MAAM,KAAK,OAAO,IAAI;IAC5C,SAAS,MAAM,KAAK,OAAO,WAAW;IACtC,SAAS,MAAM,KAAK,OAAO;GAC7B;EACF;EACF,KAAK,gBACH,OAAO;GAAE,GAAG;GAAM,MAAM,MAAM;GAAM,QAAQ,MAAM,KAAK,OAAO;EAAO;EACvE,KAAK,iBACH,OAAO;GAAE,GAAG;GAAM,MAAM,MAAM;GAAM,MAAM,MAAM,KAAK,MAAM;EAAK;EAClE,SACE,OAAO;GAAE,GAAG;GAAM,MAAM,MAAM;EAAK;CACvC;AACF;;;;ACtHA,MAAM,uBAAuB,EAC1B,WAAW,KAAK,CAAC,CACjB,QAAQ,UAAU,MAAM,SAAS,0BAA0B;;AAM9D,IAAa,gBAAb,MAAa,cAAqD;CAc7C;CACA;;CAbnB,OAAO,OAAO,eAAsC;EAClD,OAAO,IAAI,cAAc,eAAe,YAAY;GAClD,MAAM,EAAE,WAAW,MAAM,OAAO;GAEhC,OAAO,IAAI,OAAO,8BAA8B,CAAC,CAAC;EACpD,CAAC;CACH;CAEA,AAAQ;;CAGR,YACE,AAAiB,eACjB,AAAiB,UACjB;EAFiB;EACA;CAChB;;CAGH,MAAM,OAAO,MAAc,SAA8C;EACvE,MAAM,KAAK,QAAQ,IAAI,SAAS;EAChC,MAAM,YAAY,QAAQ,IAAI,gBAAgB;EAC9C,MAAM,YAAY,QAAQ,IAAI,gBAAgB;EAC9C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,MAAM,IAAI,yBAAyB,iBAAiB;EACzF,MAAM,SAAS,OAAO,KAAK,WAAW,KAAK,SAAS;EACpD,IAAI;EACJ,IAAI;GACF,UAAU,OAAO,OAAO;IACtB,SAAS;IACT,SAAS;KAAE;KAAI;KAAW;IAAU;IACpC,eAAe,KAAK;GACtB,CAAC;EACH,SAAS,OAAO;GACd,IAAI,iBAAiB,aAAa,MAAM,IAAI,yBAAyB,mBAAmB,KAAK;GAC7F,IAAI,CAAC,qBAAqB,UAAU,KAAK,CAAC,CAAC,SAAS,MAAM;GAC1D,MAAM,IAAI,yBAAyB,qBAAqB,KAAK;EAC/D;EACA,IAAI;GACF,OAAO,gBAAgB,SAAS,EAAE;EACpC,SAAS,OAAO;GACd,IAAI,iBAAiB,EAAE,UAAU,MAAM,IAAI,yBAAyB,mBAAmB,KAAK;GAC5F,MAAM;EACR;CACF;AACF"}
+{"version":3,"file":"resend.js","names":[],"sources":["../src/infrastructure/resend/resend-email-service.ts","../src/infrastructure/resend/email-event.ts","../src/infrastructure/resend/resend-webhook.ts"],"sourcesContent":["import { Buffer } from 'node:buffer'\n\nimport type { Attachment, CreateEmailOptions, ErrorResponse, Resend } from 'resend'\n\nimport type {\n  EmailAccepted,\n  EmailAttachment,\n  IEmailService,\n  OutboundEmail,\n  ReceivedEmail,\n} from '@/application'\nimport { EmailServiceError, type EmailSendFailureReason } from '@/core'\n\n// SDK additions must receive an explicit classification before the package builds.\nconst SDK_REASONS = {\n  invalid_idempotency_key: 'invalid_request',\n  validation_error: 'invalid_request',\n  missing_api_key: 'configuration',\n  restricted_api_key: 'configuration',\n  invalid_api_key: 'configuration',\n  not_found: 'invalid_request',\n  method_not_allowed: 'invalid_request',\n  invalid_idempotent_request: 'invalid_request',\n  concurrent_idempotent_requests: 'idempotency_conflict',\n  invalid_attachment: 'invalid_request',\n  invalid_from_address: 'invalid_request',\n  invalid_access: 'configuration',\n  invalid_parameter: 'invalid_request',\n  invalid_region: 'invalid_request',\n  missing_required_field: 'invalid_request',\n  monthly_quota_exceeded: 'quota_exceeded',\n  daily_quota_exceeded: 'quota_exceeded',\n  rate_limit_exceeded: 'rate_limited',\n  security_error: 'configuration',\n  application_error: 'provider_error',\n  internal_server_error: 'provider_error',\n} satisfies Record<ErrorResponse['name'], EmailSendFailureReason>\n\n// Resend documents these codes before its SDK includes them in ErrorResponse.\nconst DOCUMENTED_REASONS = new Map<string, EmailSendFailureReason>([\n  ['email_above_quota', 'quota_exceeded'],\n  ['invalid_permission', 'configuration'],\n  ['suspended_api_key', 'configuration'],\n  ['resource_locked', 'idempotency_conflict'],\n  ['service_unavailable', 'provider_error'],\n  ['missing_required_parameter', 'invalid_request'],\n])\n\nfunction reasonFromResend(error: ErrorResponse): EmailSendFailureReason {\n  if (Object.hasOwn(SDK_REASONS, error.name)) return SDK_REASONS[error.name]\n  const reason = DOCUMENTED_REASONS.get(error.name)\n  if (reason !== undefined) return reason\n  if (error.statusCode === 429) return 'rate_limited'\n  if (error.statusCode !== null && error.statusCode >= 400 && error.statusCode < 500)\n    return 'invalid_request'\n  return 'provider_error'\n}\n\nfunction retryAfterSeconds(value: string | undefined): number | null {\n  if (value === undefined || !/^\\d+$/.test(value)) return null\n  const seconds = Number(value)\n  return Number.isSafeInteger(seconds) ? seconds : null\n}\n\nfunction toAttachment(attachment: EmailAttachment): Attachment {\n  const result: Attachment = {\n    filename: attachment.filename,\n    content: ArrayBuffer.isView(attachment.content)\n      ? Buffer.from(attachment.content)\n      : attachment.content,\n  }\n  if (attachment.contentType !== undefined) result.contentType = attachment.contentType\n  return result\n}\n\n/**\n * Send without package retries or logs. Ported from Suparelay's resend-email-service.ts.\n * The Resend SDK itself logs API errors outside production.\n */\nexport class ResendEmailService implements IEmailService {\n  /** Load the SDK on the first email operation. Constructing the service does not load it. */\n  static create(apiKey: string, fromAddress: string): ResendEmailService {\n    return new ResendEmailService(apiKey, fromAddress)\n  }\n\n  private client: Resend | undefined\n\n  /** Store configuration. Load the SDK and create its client on the first email operation. */\n  constructor(\n    private readonly apiKey: string,\n    private readonly fromAddress: string,\n  ) {}\n\n  /** Resolve after acceptance. Provider failures throw EmailServiceError; SDK defects retain their identity. */\n  async sendEmail(email: OutboundEmail): Promise<EmailAccepted> {\n    const client = await this.getClient()\n    const payload: CreateEmailOptions = {\n      from: email.from ?? this.fromAddress,\n      to: [email.to].flat(),\n      subject: email.subject,\n      html: email.html,\n    }\n    if (email.text !== undefined) payload.text = email.text\n    if (email.replyTo !== undefined) payload.replyTo = email.replyTo\n    if (email.tags !== undefined)\n      payload.tags = Object.entries(email.tags).map(([name, value]) => ({ name, value }))\n    if (email.attachments !== undefined) payload.attachments = email.attachments.map(toAttachment)\n    const result = await client.emails.send(\n      payload,\n      email.idempotencyKey === undefined ? undefined : { idempotencyKey: email.idempotencyKey },\n    )\n    if (result.error !== null) {\n      throw new EmailServiceError({\n        reason: reasonFromResend(result.error),\n        provider: 'resend',\n        providerCode: result.error.name,\n        statusCode: result.error.statusCode,\n        retryAfter: retryAfterSeconds(result.headers?.['retry-after']),\n        cause: result.error,\n      })\n    }\n    return { providerId: result.data.id }\n  }\n\n  /** Retrieve headers by the received email's provider ID. Provider failures throw EmailServiceError. */\n  async getReceivedEmail(emailId: string): Promise<ReceivedEmail> {\n    const client = await this.getClient()\n    const result = await client.emails.receiving.get(emailId)\n    if (result.error !== null) {\n      throw new EmailServiceError({\n        reason: reasonFromResend(result.error),\n        provider: 'resend',\n        providerCode: result.error.name,\n        statusCode: result.error.statusCode,\n        retryAfter: retryAfterSeconds(result.headers?.['retry-after']),\n        cause: result.error,\n      })\n    }\n    return { headers: result.data.headers ?? {} }\n  }\n\n  private async getClient(): Promise<Resend> {\n    if (this.client === undefined) {\n      const { Resend } = await import('resend')\n      // Recheck after the import so concurrent calls share one client.\n      this.client ??= new Resend(this.apiKey)\n    }\n    return this.client\n  }\n}\n","import type { WebhookEventPayload } from 'resend'\nimport { z } from 'zod'\n\nimport { EmailAddressSchema, parseBounceType, type BounceType } from '@/core'\n\nconst SIMPLE_EMAIL_TYPES = [\n  'email.sent',\n  'email.scheduled',\n  'email.delivered',\n  'email.delivery_delayed',\n  'email.complained',\n  'email.opened',\n  'email.received',\n  'email.suppressed',\n] as const\n\n/** Resend email event names supported by this module. */\nexport type EmailEventType =\n  | (typeof SIMPLE_EMAIL_TYPES)[number]\n  | 'email.bounced'\n  | 'email.failed'\n  | 'email.clicked'\n\nconst EMAIL_TYPES = {\n  'email.sent': true,\n  'email.scheduled': true,\n  'email.delivered': true,\n  'email.delivery_delayed': true,\n  'email.complained': true,\n  'email.opened': true,\n  'email.received': true,\n  'email.suppressed': true,\n  'email.bounced': true,\n  'email.failed': true,\n  'email.clicked': true,\n} satisfies Record<Extract<WebhookEventPayload['type'], `email.${string}`>, true>\n\nconst BaseDataSchema = z.object({\n  email_id: z.string().min(1),\n  message_id: z.string().min(1),\n  to: z.array(EmailAddressSchema).min(1),\n  subject: z.string(),\n  tags: z.record(z.string(), z.string()).default({}),\n})\n\nconst EmailPayloadSchema = z.discriminatedUnion('type', [\n  z.object({ type: z.enum(SIMPLE_EMAIL_TYPES), data: BaseDataSchema }),\n  z.object({\n    type: z.literal('email.bounced'),\n    data: BaseDataSchema.extend({\n      bounce: z.object({\n        type: z.string().optional(),\n        subType: z.string().nullable().optional(),\n        message: z.string(),\n      }),\n    }),\n  }),\n  z.object({\n    type: z.literal('email.failed'),\n    data: BaseDataSchema.extend({ failed: z.object({ reason: z.string() }) }),\n  }),\n  z.object({\n    type: z.literal('email.clicked'),\n    data: BaseDataSchema.extend({ click: z.object({ link: z.string() }) }),\n  }),\n])\n\ntype EmailEventBase = {\n  readonly id: string\n  readonly emailId: string\n  readonly messageId: string\n  readonly recipients: readonly string[]\n  readonly subject: string\n  readonly tags: Readonly<Record<string, string>>\n  readonly occurredAt: string\n}\n\n/** A verified event. `id` is the Svix identity; use `resend:event:${id}` as the command id. */\nexport type EmailEvent =\n  | (EmailEventBase & {\n      readonly type: 'email.bounced'\n      readonly bounce: {\n        readonly type: BounceType\n        readonly subType: string | null\n        readonly message: string\n      }\n    })\n  | (EmailEventBase & { readonly type: 'email.failed'; readonly reason: string })\n  | (EmailEventBase & { readonly type: 'email.clicked'; readonly link: string })\n  | (EmailEventBase & { readonly type: (typeof SIMPLE_EMAIL_TYPES)[number] })\n\nconst EventHeaderSchema = z.object({\n  type: z.string(),\n  created_at: z.iso.datetime({ offset: true }),\n})\n\n/** Validate signed provider data before projecting it into the public event contract. */\nexport function parseEmailEvent(payload: WebhookEventPayload, id: string): EmailEvent | null {\n  const header = EventHeaderSchema.parse(payload)\n  if (!Object.hasOwn(EMAIL_TYPES, header.type)) return null\n  const event = EmailPayloadSchema.parse(payload)\n  const base: EmailEventBase = {\n    id,\n    emailId: event.data.email_id,\n    messageId: event.data.message_id,\n    recipients: event.data.to,\n    subject: event.data.subject,\n    tags: event.data.tags,\n    occurredAt: header.created_at,\n  }\n  switch (event.type) {\n    case 'email.bounced':\n      return {\n        ...base,\n        type: event.type,\n        bounce: {\n          type: parseBounceType(event.data.bounce.type),\n          subType: event.data.bounce.subType ?? null,\n          message: event.data.bounce.message,\n        },\n      }\n    case 'email.failed':\n      return { ...base, type: event.type, reason: event.data.failed.reason }\n    case 'email.clicked':\n      return { ...base, type: event.type, link: event.data.click.link }\n    default:\n      return { ...base, type: event.type }\n  }\n}\n","import type { Resend } from 'resend'\nimport { z } from 'zod'\n\nimport { WebhookVerificationError, type WebhookVerifier } from '../http/webhook-verification.ts'\nimport { parseEmailEvent, type EmailEvent } from './email-event.ts'\n\n// Separate standardwebhooks versions have different prototypes; its error name remains the same.\nconst SignatureErrorSchema = z\n  .instanceof(Error)\n  .refine((error) => error.name === 'WebhookVerificationError')\n\n/** Verify Svix signatures and map Resend email events. Ported from Typist's Resend route. */\nexport class ResendWebhook implements WebhookVerifier<EmailEvent> {\n  /** Load the SDK on the first verification. Only the webhook secret is required. */\n  static create(webhookSecret: string): ResendWebhook {\n    return new ResendWebhook(webhookSecret)\n  }\n\n  private client: Resend['webhooks'] | undefined\n\n  /** Store the webhook secret. Load the SDK on the first verification. */\n  constructor(private readonly webhookSecret: string) {}\n\n  /** Verify the raw body and Svix headers. Invalid requests throw typed errors; other failures propagate. */\n  async verify(body: string, headers: Headers): Promise<EmailEvent | null> {\n    const id = headers.get('svix-id')\n    const timestamp = headers.get('svix-timestamp')\n    const signature = headers.get('svix-signature')\n    if (!id || !timestamp || !signature) throw new WebhookVerificationError('missing_headers')\n    const client = await this.getClient()\n    let payload: ReturnType<Resend['webhooks']['verify']>\n    try {\n      payload = client.verify({\n        payload: body,\n        headers: { id, timestamp, signature },\n        webhookSecret: this.webhookSecret,\n      })\n    } catch (cause) {\n      if (cause instanceof SyntaxError) throw new WebhookVerificationError('invalid_payload', cause)\n      if (!SignatureErrorSchema.safeParse(cause).success) throw cause\n      throw new WebhookVerificationError('invalid_signature', cause)\n    }\n    try {\n      return parseEmailEvent(payload, id)\n    } catch (cause) {\n      if (cause instanceof z.ZodError) throw new WebhookVerificationError('invalid_payload', cause)\n      throw cause\n    }\n  }\n\n  private async getClient(): Promise<Resend['webhooks']> {\n    if (this.client === undefined) {\n      const { Resend } = await import('resend')\n      // The SDK requires a nonempty key even though its local verifier never uses that key.\n      this.client ??= new Resend('re_webhook_verification_only').webhooks\n    }\n    return this.client\n  }\n}\n"],"mappings":";;;;;;AAcA,MAAM,cAAc;CAClB,yBAAyB;CACzB,kBAAkB;CAClB,iBAAiB;CACjB,oBAAoB;CACpB,iBAAiB;CACjB,WAAW;CACX,oBAAoB;CACpB,4BAA4B;CAC5B,gCAAgC;CAChC,oBAAoB;CACpB,sBAAsB;CACtB,gBAAgB;CAChB,mBAAmB;CACnB,gBAAgB;CAChB,wBAAwB;CACxB,wBAAwB;CACxB,sBAAsB;CACtB,qBAAqB;CACrB,gBAAgB;CAChB,mBAAmB;CACnB,uBAAuB;AACzB;AAGA,MAAM,qCAAqB,IAAI,IAAoC;CACjE,CAAC,qBAAqB,gBAAgB;CACtC,CAAC,sBAAsB,eAAe;CACtC,CAAC,qBAAqB,eAAe;CACrC,CAAC,mBAAmB,sBAAsB;CAC1C,CAAC,uBAAuB,gBAAgB;CACxC,CAAC,8BAA8B,iBAAiB;AAClD,CAAC;AAED,SAAS,iBAAiB,OAA8C;CACtE,IAAI,OAAO,OAAO,aAAa,MAAM,IAAI,GAAG,OAAO,YAAY,MAAM;CACrE,MAAM,SAAS,mBAAmB,IAAI,MAAM,IAAI;CAChD,IAAI,WAAW,QAAW,OAAO;CACjC,IAAI,MAAM,eAAe,KAAK,OAAO;CACrC,IAAI,MAAM,eAAe,QAAQ,MAAM,cAAc,OAAO,MAAM,aAAa,KAC7E,OAAO;CACT,OAAO;AACT;AAEA,SAAS,kBAAkB,OAA0C;CACnE,IAAI,UAAU,UAAa,CAAC,QAAQ,KAAK,KAAK,GAAG,OAAO;CACxD,MAAM,UAAU,OAAO,KAAK;CAC5B,OAAO,OAAO,cAAc,OAAO,IAAI,UAAU;AACnD;AAEA,SAAS,aAAa,YAAyC;CAC7D,MAAM,SAAqB;EACzB,UAAU,WAAW;EACrB,SAAS,YAAY,OAAO,WAAW,OAAO,IAC1C,OAAO,KAAK,WAAW,OAAO,IAC9B,WAAW;CACjB;CACA,IAAI,WAAW,gBAAgB,QAAW,OAAO,cAAc,WAAW;CAC1E,OAAO;AACT;;;;;AAMA,IAAa,qBAAb,MAAa,mBAA4C;CAUpC;CACA;;CATnB,OAAO,OAAO,QAAgB,aAAyC;EACrE,OAAO,IAAI,mBAAmB,QAAQ,WAAW;CACnD;CAEA,AAAQ;;CAGR,YACE,AAAiB,QACjB,AAAiB,aACjB;EAFiB;EACA;CAChB;;CAGH,MAAM,UAAU,OAA8C;EAC5D,MAAM,SAAS,MAAM,KAAK,UAAU;EACpC,MAAM,UAA8B;GAClC,MAAM,MAAM,QAAQ,KAAK;GACzB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK;GACpB,SAAS,MAAM;GACf,MAAM,MAAM;EACd;EACA,IAAI,MAAM,SAAS,QAAW,QAAQ,OAAO,MAAM;EACnD,IAAI,MAAM,YAAY,QAAW,QAAQ,UAAU,MAAM;EACzD,IAAI,MAAM,SAAS,QACjB,QAAQ,OAAO,OAAO,QAAQ,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY;GAAE;GAAM;EAAM,EAAE;EACpF,IAAI,MAAM,gBAAgB,QAAW,QAAQ,cAAc,MAAM,YAAY,IAAI,YAAY;EAC7F,MAAM,SAAS,MAAM,OAAO,OAAO,KACjC,SACA,MAAM,mBAAmB,SAAY,SAAY,EAAE,gBAAgB,MAAM,eAAe,CAC1F;EACA,IAAI,OAAO,UAAU,MACnB,MAAM,IAAI,kBAAkB;GAC1B,QAAQ,iBAAiB,OAAO,KAAK;GACrC,UAAU;GACV,cAAc,OAAO,MAAM;GAC3B,YAAY,OAAO,MAAM;GACzB,YAAY,kBAAkB,OAAO,UAAU,cAAc;GAC7D,OAAO,OAAO;EAChB,CAAC;EAEH,OAAO,EAAE,YAAY,OAAO,KAAK,GAAG;CACtC;;CAGA,MAAM,iBAAiB,SAAyC;EAE9D,MAAM,SAAS,OAAM,MADA,KAAK,UAAU,EACT,CAAC,OAAO,UAAU,IAAI,OAAO;EACxD,IAAI,OAAO,UAAU,MACnB,MAAM,IAAI,kBAAkB;GAC1B,QAAQ,iBAAiB,OAAO,KAAK;GACrC,UAAU;GACV,cAAc,OAAO,MAAM;GAC3B,YAAY,OAAO,MAAM;GACzB,YAAY,kBAAkB,OAAO,UAAU,cAAc;GAC7D,OAAO,OAAO;EAChB,CAAC;EAEH,OAAO,EAAE,SAAS,OAAO,KAAK,WAAW,CAAC,EAAE;CAC9C;CAEA,MAAc,YAA6B;EACzC,IAAI,KAAK,WAAW,QAAW;GAC7B,MAAM,EAAE,WAAW,MAAM,OAAO;GAEhC,KAAK,WAAW,IAAI,OAAO,KAAK,MAAM;EACxC;EACA,OAAO,KAAK;CACd;AACF;;;;AChJA,MAAM,qBAAqB;CACzB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AASA,MAAM,cAAc;CAClB,cAAc;CACd,mBAAmB;CACnB,mBAAmB;CACnB,0BAA0B;CAC1B,oBAAoB;CACpB,gBAAgB;CAChB,kBAAkB;CAClB,oBAAoB;CACpB,iBAAiB;CACjB,gBAAgB;CAChB,iBAAiB;AACnB;AAEA,MAAM,iBAAiB,EAAE,OAAO;CAC9B,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC1B,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC5B,IAAI,EAAE,MAAM,kBAAkB,CAAC,CAAC,IAAI,CAAC;CACrC,SAAS,EAAE,OAAO;CAClB,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,qBAAqB,EAAE,mBAAmB,QAAQ;CACtD,EAAE,OAAO;EAAE,MAAM,EAAE,KAAK,kBAAkB;EAAG,MAAM;CAAe,CAAC;CACnE,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,eAAe;EAC/B,MAAM,eAAe,OAAO,EAC1B,QAAQ,EAAE,OAAO;GACf,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;GAC1B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;GACxC,SAAS,EAAE,OAAO;EACpB,CAAC,EACH,CAAC;CACH,CAAC;CACD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,cAAc;EAC9B,MAAM,eAAe,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;CAC1E,CAAC;CACD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,eAAe;EAC/B,MAAM,eAAe,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;CACvE,CAAC;AACH,CAAC;AA0BD,MAAM,oBAAoB,EAAE,OAAO;CACjC,MAAM,EAAE,OAAO;CACf,YAAY,EAAE,IAAI,SAAS,EAAE,QAAQ,KAAK,CAAC;AAC7C,CAAC;;AAGD,SAAgB,gBAAgB,SAA8B,IAA+B;CAC3F,MAAM,SAAS,kBAAkB,MAAM,OAAO;CAC9C,IAAI,CAAC,OAAO,OAAO,aAAa,OAAO,IAAI,GAAG,OAAO;CACrD,MAAM,QAAQ,mBAAmB,MAAM,OAAO;CAC9C,MAAM,OAAuB;EAC3B;EACA,SAAS,MAAM,KAAK;EACpB,WAAW,MAAM,KAAK;EACtB,YAAY,MAAM,KAAK;EACvB,SAAS,MAAM,KAAK;EACpB,MAAM,MAAM,KAAK;EACjB,YAAY,OAAO;CACrB;CACA,QAAQ,MAAM,MAAd;EACE,KAAK,iBACH,OAAO;GACL,GAAG;GACH,MAAM,MAAM;GACZ,QAAQ;IACN,MAAM,gBAAgB,MAAM,KAAK,OAAO,IAAI;IAC5C,SAAS,MAAM,KAAK,OAAO,WAAW;IACtC,SAAS,MAAM,KAAK,OAAO;GAC7B;EACF;EACF,KAAK,gBACH,OAAO;GAAE,GAAG;GAAM,MAAM,MAAM;GAAM,QAAQ,MAAM,KAAK,OAAO;EAAO;EACvE,KAAK,iBACH,OAAO;GAAE,GAAG;GAAM,MAAM,MAAM;GAAM,MAAM,MAAM,KAAK,MAAM;EAAK;EAClE,SACE,OAAO;GAAE,GAAG;GAAM,MAAM,MAAM;EAAK;CACvC;AACF;;;;ACzHA,MAAM,uBAAuB,EAC1B,WAAW,KAAK,CAAC,CACjB,QAAQ,UAAU,MAAM,SAAS,0BAA0B;;AAG9D,IAAa,gBAAb,MAAa,cAAqD;CASnC;;CAP7B,OAAO,OAAO,eAAsC;EAClD,OAAO,IAAI,cAAc,aAAa;CACxC;CAEA,AAAQ;;CAGR,YAAY,AAAiB,eAAuB;EAAvB;CAAwB;;CAGrD,MAAM,OAAO,MAAc,SAA8C;EACvE,MAAM,KAAK,QAAQ,IAAI,SAAS;EAChC,MAAM,YAAY,QAAQ,IAAI,gBAAgB;EAC9C,MAAM,YAAY,QAAQ,IAAI,gBAAgB;EAC9C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,MAAM,IAAI,yBAAyB,iBAAiB;EACzF,MAAM,SAAS,MAAM,KAAK,UAAU;EACpC,IAAI;EACJ,IAAI;GACF,UAAU,OAAO,OAAO;IACtB,SAAS;IACT,SAAS;KAAE;KAAI;KAAW;IAAU;IACpC,eAAe,KAAK;GACtB,CAAC;EACH,SAAS,OAAO;GACd,IAAI,iBAAiB,aAAa,MAAM,IAAI,yBAAyB,mBAAmB,KAAK;GAC7F,IAAI,CAAC,qBAAqB,UAAU,KAAK,CAAC,CAAC,SAAS,MAAM;GAC1D,MAAM,IAAI,yBAAyB,qBAAqB,KAAK;EAC/D;EACA,IAAI;GACF,OAAO,gBAAgB,SAAS,EAAE;EACpC,SAAS,OAAO;GACd,IAAI,iBAAiB,EAAE,UAAU,MAAM,IAAI,yBAAyB,mBAAmB,KAAK;GAC5F,MAAM;EACR;CACF;CAEA,MAAc,YAAyC;EACrD,IAAI,KAAK,WAAW,QAAW;GAC7B,MAAM,EAAE,WAAW,MAAM,OAAO;GAEhC,KAAK,WAAW,IAAI,OAAO,8BAA8B,CAAC,CAAC;EAC7D;EACA,OAAO,KAAK;CACd;AACF"}

package/dist/sentry/client.js

@@ -1,4 +1,4 @@
-import { a as setLoggerErrorHook } from "../core-BT1dSEQI.js";
+import { a as setLoggerErrorHook } from "../core-BIas38R0.js";
 import * as Sentry from "@sentry/tanstackstart-react";
 import { isNotFound, isRedirect } from "@tanstack/react-router";
 

package/dist/sentry/server.d.ts

@@ -1,5 +1,5 @@
 import { u as LoggerErrorHook } from "../index-DUFS0SJ_.js";
-import { H as ObservabilityScope, U as ObservabilityService, W as ObservabilityUser } from "../index-CYHXOH08.js";
+import { G as ObservabilityUser, U as ObservabilityScope, W as ObservabilityService } from "../index-tNZHSCpJ.js";
 import * as Sentry from "@sentry/cloudflare";
 //#region src/infrastructure/sentry/server.d.ts
 /** Application-owned deployment settings with the full Cloudflare SDK option contract. */

package/dist/stripe/payment-service.error.js

@@ -1,4 +1,4 @@
-import { nt as AppError } from "../core-BT1dSEQI.js";
+import { nt as AppError } from "../core-BIas38R0.js";
 import Stripe from "stripe";
 
 //#region src/infrastructure/stripe/payment-service.error.ts

package/dist/stripe/payment-webhook.js

@@ -1,4 +1,4 @@
-import { t as WebhookVerificationError } from "../webhook-verification-qSFXv5H3.js";
+import { t as WebhookVerificationError } from "../webhook-verification-CEUARY9X.js";
 import Stripe from "stripe";
 
 //#region src/infrastructure/stripe/payment-webhook.ts

package/dist/tanstack.js

@@ -1,4 +1,4 @@
-import { H as StaleSessionError, R as ValidationError, W as AuthenticationError, nt as AppError, r as createLogger } from "./core-BT1dSEQI.js";
+import { H as StaleSessionError, R as ValidationError, W as AuthenticationError, nt as AppError, r as createLogger } from "./core-BIas38R0.js";
 import { z } from "zod";
 import { getReasonPhrase } from "http-status-codes";
 import { isNotFound, isRedirect, redirect } from "@tanstack/react-router";

package/dist/testing/outbox-repository.d.ts

@@ -1,5 +1,5 @@
 import { W as DomainEvent } from "../index-DUFS0SJ_.js";
-import { A as IOutboxRepository } from "../index-CYHXOH08.js";
+import { A as IOutboxRepository } from "../index-tNZHSCpJ.js";
 //#region src/infrastructure/testing/outbox-repository-contract.d.ts
 /** Stored fields observed by the adapter contract, independent of a database library. */
 export type OutboxContractRow = {

package/dist/{webhook-verification-qSFXv5H3.js → webhook-verification-CEUARY9X.js}

@@ -1,4 +1,4 @@
-import { nt as AppError } from "./core-BT1dSEQI.js";
+import { nt as AppError } from "./core-BIas38R0.js";
 
 //#region src/infrastructure/http/webhook-verification.ts
 /** A webhook cannot be trusted or parsed. The HTTP handler logs the rejection once. */
@@ -15,4 +15,4 @@ var WebhookVerificationError = class extends AppError {
 
 //#endregion
 export { WebhookVerificationError as t };
-//# sourceMappingURL=webhook-verification-qSFXv5H3.js.map
+//# sourceMappingURL=webhook-verification-CEUARY9X.js.map

package/dist/{webhook-verification-qSFXv5H3.js.map → webhook-verification-CEUARY9X.js.map}

@@ -1 +1 @@
-{"version":3,"file":"webhook-verification-qSFXv5H3.js","names":[],"sources":["../src/infrastructure/http/webhook-verification.ts"],"sourcesContent":["import { AppError } from '@/core'\n\n/** A webhook cannot be trusted or parsed. The HTTP handler logs the rejection once. */\nexport class WebhookVerificationError extends AppError {\n  readonly _tag = 'WebhookVerificationError'\n  readonly classification = 'terminal'\n\n  /** Keep secrets and payload details out of the public message. */\n  constructor(\n    readonly reason: 'missing_headers' | 'invalid_signature' | 'invalid_payload',\n    cause?: unknown,\n  ) {\n    super(`Webhook rejected: ${reason}`, { cause })\n  }\n}\n\n/** The provider owns signature verification, timestamp tolerance, and payload parsing. */\nexport interface WebhookVerifier<Verified> {\n  /**\n   * Verify the exact body before parsing it. Return null for an ignored webhook.\n   * @throws WebhookVerificationError when the request cannot be trusted or parsed.\n   */\n  verify(body: string, headers: Headers): Promise<Verified | null>\n}\n"],"mappings":";;;;AAGA,IAAa,2BAAb,cAA8C,SAAS;CAM1C;CALX,AAAS,OAAO;CAChB,AAAS,iBAAiB;;CAG1B,YACE,AAAS,QACT,OACA;EACA,MAAM,qBAAqB,UAAU,EAAE,MAAM,CAAC;EAHrC;CAIX;AACF"}
+{"version":3,"file":"webhook-verification-CEUARY9X.js","names":[],"sources":["../src/infrastructure/http/webhook-verification.ts"],"sourcesContent":["import { AppError } from '@/core'\n\n/** A webhook cannot be trusted or parsed. The HTTP handler logs the rejection once. */\nexport class WebhookVerificationError extends AppError {\n  readonly _tag = 'WebhookVerificationError'\n  readonly classification = 'terminal'\n\n  /** Keep secrets and payload details out of the public message. */\n  constructor(\n    readonly reason: 'missing_headers' | 'invalid_signature' | 'invalid_payload',\n    cause?: unknown,\n  ) {\n    super(`Webhook rejected: ${reason}`, { cause })\n  }\n}\n\n/** The provider owns signature verification, timestamp tolerance, and payload parsing. */\nexport interface WebhookVerifier<Verified> {\n  /**\n   * Verify the exact body before parsing it. Return null for an ignored webhook.\n   * @throws WebhookVerificationError when the request cannot be trusted or parsed.\n   */\n  verify(body: string, headers: Headers): Promise<Verified | null>\n}\n"],"mappings":";;;;AAGA,IAAa,2BAAb,cAA8C,SAAS;CAM1C;CALX,AAAS,OAAO;CAChB,AAAS,iBAAiB;;CAG1B,YACE,AAAS,QACT,OACA;EACA,MAAM,qBAAqB,UAAU,EAAE,MAAM,CAAC;EAHrC;CAIX;AACF"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://www.schemastore.org/package.json",
   "name": "better-ship",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "Foundation for applications on Cloudflare Workers: logger, errors, message bus, infrastructure adapters, and UI primitives",
   "license": "Apache-2.0",
   "repository": {

package/src/application/email-service.ts

@@ -32,6 +32,9 @@ export type OutboundEmail = {
   readonly attachments?: readonly EmailAttachment[]
 }
 
+/** Received email headers, without the body or attachments. */
+export type ReceivedEmail = { readonly headers: Readonly<Record<string, string>> }
+
 /** The provider accepted the email and assigned its id. */
 export type EmailAccepted = { readonly providerId: string }
 

package/src/application/index.ts

@@ -19,6 +19,7 @@ export {
   type EmailAttachment,
   type MimeType,
   type EmailAccepted,
+  type ReceivedEmail,
 } from './email-service.ts'
 export {
   recordEmailEvent,

package/src/core/email-service.error.ts

@@ -40,7 +40,7 @@ export class EmailServiceError extends AppError {
     readonly retryAfter: number | null
     readonly cause: unknown
   }) {
-    super(`Email send failed: ${args.provider} ${args.providerCode}`, { cause: args.cause })
+    super(`Email request failed: ${args.provider} ${args.providerCode}`, { cause: args.cause })
     this.reason = args.reason
     this.classification = CLASSIFICATION_BY_REASON[args.reason]
     this.provider = args.provider

package/src/infrastructure/posthog/client.ts

@@ -1,19 +1,23 @@
 import posthog, { type PostHog, type PostHogConfig } from 'posthog-js'
 
+/** Application properties and native SDK options for browser initialization. */
+export interface PostHogClientOptionsConfig {
+  readonly environment: string
+  readonly source: string
+  readonly options?: Partial<PostHogConfig>
+}
+
 /** The application controls enablement; disabled initialization needs no project key. */
 export type PostHogClientConfig =
   | { readonly enabled: false }
-  | {
+  | (PostHogClientOptionsConfig & {
       readonly enabled: true
       readonly apiKey: string
-      readonly environment: string
-      readonly source: string
-      readonly options?: Partial<PostHogConfig>
-    }
+    })
 
 /** Browser options from Typist and Porte; SDK option names and application overrides stay intact. */
 export function createPostHogClientOptions(
-  config: Extract<PostHogClientConfig, { enabled: true }>,
+  config: PostHogClientOptionsConfig,
 ): Partial<PostHogConfig> {
   return {
     api_host: '/relay',

package/src/infrastructure/resend/email-event.ts

@@ -37,6 +37,7 @@ const EMAIL_TYPES = {
 
 const BaseDataSchema = z.object({
   email_id: z.string().min(1),
+  message_id: z.string().min(1),
   to: z.array(EmailAddressSchema).min(1),
   subject: z.string(),
   tags: z.record(z.string(), z.string()).default({}),
@@ -67,6 +68,7 @@ const EmailPayloadSchema = z.discriminatedUnion('type', [
 type EmailEventBase = {
   readonly id: string
   readonly emailId: string
+  readonly messageId: string
   readonly recipients: readonly string[]
   readonly subject: string
   readonly tags: Readonly<Record<string, string>>
@@ -100,6 +102,7 @@ export function parseEmailEvent(payload: WebhookEventPayload, id: string): Email
   const base: EmailEventBase = {
     id,
     emailId: event.data.email_id,
+    messageId: event.data.message_id,
     recipients: event.data.to,
     subject: event.data.subject,
     tags: event.data.tags,

package/src/infrastructure/resend/index.ts

@@ -1,3 +1,3 @@
-export { ResendEmailService, type ResendEmailClient } from './resend-email-service.ts'
-export { ResendWebhook, type ResendWebhookClient } from './resend-webhook.ts'
+export { ResendEmailService } from './resend-email-service.ts'
+export { ResendWebhook } from './resend-webhook.ts'
 export type { EmailEvent, EmailEventType } from './email-event.ts'

package/src/infrastructure/resend/resend-email-service.ts

@@ -2,7 +2,13 @@ import { Buffer } from 'node:buffer'
 
 import type { Attachment, CreateEmailOptions, ErrorResponse, Resend } from 'resend'
 
-import type { EmailAccepted, EmailAttachment, IEmailService, OutboundEmail } from '@/application'
+import type {
+  EmailAccepted,
+  EmailAttachment,
+  IEmailService,
+  OutboundEmail,
+  ReceivedEmail,
+} from '@/application'
 import { EmailServiceError, type EmailSendFailureReason } from '@/core'
 
 // SDK additions must receive an explicit classification before the package builds.
@@ -67,37 +73,27 @@ function toAttachment(attachment: EmailAttachment): Attachment {
   return result
 }
 
-/** The SDK operations required by the adapter; a test factory can return a plain object. */
-export type ResendEmailClient = { readonly emails: Pick<Resend['emails'], 'send'> }
-
 /**
  * Send without package retries or logs. Ported from Suparelay's resend-email-service.ts.
  * The Resend SDK itself logs API errors outside production.
  */
 export class ResendEmailService implements IEmailService {
-  /** Load the SDK on the first send. Constructing the service does not load it. */
+  /** Load the SDK on the first email operation. Constructing the service does not load it. */
   static create(apiKey: string, fromAddress: string): ResendEmailService {
-    return new ResendEmailService(
-      () => import('resend').then(({ Resend }) => new Resend(apiKey)),
-      fromAddress,
-    )
+    return new ResendEmailService(apiKey, fromAddress)
   }
 
-  private client: Promise<ResendEmailClient> | undefined
+  private client: Resend | undefined
 
-  /** Supply an async factory. The service calls it once, on the first send, and keeps its promise. */
+  /** Store configuration. Load the SDK and create its client on the first email operation. */
   constructor(
-    private readonly createClient: () => Promise<ResendEmailClient>,
+    private readonly apiKey: string,
     private readonly fromAddress: string,
   ) {}
 
   /** Resolve after acceptance. Provider failures throw EmailServiceError; SDK defects retain their identity. */
   async sendEmail(email: OutboundEmail): Promise<EmailAccepted> {
-    if (this.client === undefined) {
-      // Cache synchronous factory throws as rejections too, so later sends cannot initialize again.
-      this.client = Promise.resolve().then(this.createClient)
-    }
-    const client = await this.client
+    const client = await this.getClient()
     const payload: CreateEmailOptions = {
       from: email.from ?? this.fromAddress,
       to: [email.to].flat(),
@@ -125,4 +121,30 @@ export class ResendEmailService implements IEmailService {
     }
     return { providerId: result.data.id }
   }
+
+  /** Retrieve headers by the received email's provider ID. Provider failures throw EmailServiceError. */
+  async getReceivedEmail(emailId: string): Promise<ReceivedEmail> {
+    const client = await this.getClient()
+    const result = await client.emails.receiving.get(emailId)
+    if (result.error !== null) {
+      throw new EmailServiceError({
+        reason: reasonFromResend(result.error),
+        provider: 'resend',
+        providerCode: result.error.name,
+        statusCode: result.error.statusCode,
+        retryAfter: retryAfterSeconds(result.headers?.['retry-after']),
+        cause: result.error,
+      })
+    }
+    return { headers: result.data.headers ?? {} }
+  }
+
+  private async getClient(): Promise<Resend> {
+    if (this.client === undefined) {
+      const { Resend } = await import('resend')
+      // Recheck after the import so concurrent calls share one client.
+      this.client ??= new Resend(this.apiKey)
+    }
+    return this.client
+  }
 }