rcf-lite 0.26.0 → 0.28.0

package/blueprints/email-smtp-resend/blueprint.json

@@ -1,23 +1,126 @@
 {
   "slug": "email-smtp-resend",
-  "version": "1.0.0",
+  "version": "1.1.7",
   "category": "email",
+  "elicits": [
+    {
+      "id": "smtp-host-ref",
+      "prompt": "Placeholder reference name the send adapter resolves at boot for the Resend SMTP host (per REQ-002). Recommended default RESEND_SMTP_HOST; the value itself is never literal in source.",
+      "kind": "string",
+      "default": "RESEND_SMTP_HOST"
+    },
+    {
+      "id": "smtp-username-ref",
+      "prompt": "Placeholder reference name for the SMTP username (per REQ-002). Recommended default RESEND_SMTP_USERNAME.",
+      "kind": "string",
+      "default": "RESEND_SMTP_USERNAME"
+    },
+    {
+      "id": "smtp-password-ref",
+      "prompt": "Placeholder reference name for the SMTP password (per REQ-002). Recommended default RESEND_SMTP_PASSWORD.",
+      "kind": "string",
+      "default": "RESEND_SMTP_PASSWORD"
+    },
+    {
+      "id": "verified-sender-ref",
+      "prompt": "Placeholder reference name for the verified sender address (per REQ-002). Recommended default RESEND_VERIFIED_SENDER_ADDRESS.",
+      "kind": "string",
+      "default": "RESEND_VERIFIED_SENDER_ADDRESS"
+    },
+    {
+      "id": "webhook-signing-secret-ref",
+      "prompt": "Placeholder reference name the webhook verifier resolves at boot for the Resend delivery-webhook signing secret (per REQ-005). Owned by TAC-402, not TAC-401. Recommended default RESEND_WEBHOOK_SIGNING_SECRET.",
+      "kind": "string",
+      "default": "RESEND_WEBHOOK_SIGNING_SECRET"
+    },
+    {
+      "id": "replay-tolerance-ms",
+      "prompt": "Replay tolerance window in milliseconds for webhook event id de-duplication (per REQ-006). Recommended default 300000 (5 minutes).",
+      "kind": "string",
+      "default": "300000"
+    }
+  ],
   "contributions": [
-    { "id": "email-smtp-resend-REQ-001", "kind": "req", "path": "requirements/email-smtp-resend-req-001.json" },
-    { "id": "email-smtp-resend-REQ-002", "kind": "req", "path": "requirements/email-smtp-resend-req-002.json" },
-    { "id": "email-smtp-resend-REQ-003", "kind": "req", "path": "requirements/email-smtp-resend-req-003.json" },
-    { "id": "email-smtp-resend-REQ-004", "kind": "req", "path": "requirements/email-smtp-resend-req-004.json" },
-    { "id": "email-smtp-resend-REQ-005", "kind": "req", "path": "requirements/email-smtp-resend-req-005.json" },
-    { "id": "email-smtp-resend-REQ-006", "kind": "req", "path": "requirements/email-smtp-resend-req-006.json" },
-    { "id": "email-smtp-resend-US-4101", "kind": "us", "path": "user-stories/email-smtp-resend-us-4101.json" },
-    { "id": "email-smtp-resend-US-4102", "kind": "us", "path": "user-stories/email-smtp-resend-us-4102.json" },
-    { "id": "email-smtp-resend-US-4103", "kind": "us", "path": "user-stories/email-smtp-resend-us-4103.json" },
-    { "id": "email-smtp-resend-US-4104", "kind": "us", "path": "user-stories/email-smtp-resend-us-4104.json" },
-    { "id": "email-smtp-resend-US-4105", "kind": "us", "path": "user-stories/email-smtp-resend-us-4105.json" },
-    { "id": "email-smtp-resend-US-4106", "kind": "us", "path": "user-stories/email-smtp-resend-us-4106.json" },
-    { "id": "TAC-401-email-smtp-resend-send-adapter", "kind": "tac", "path": "tacs/tac-401-email-smtp-resend-send-adapter.json" },
-    { "id": "TAC-402-email-smtp-resend-webhook-verifier", "kind": "tac", "path": "tacs/tac-402-email-smtp-resend-webhook-verifier.json" },
-    { "id": "ADR-401-email-smtp-resend-transport-choice", "kind": "adr", "path": "adrs/adr-401-email-smtp-resend-transport-choice.json" },
-    { "id": "ADR-402-email-smtp-resend-retry-and-backoff-posture", "kind": "adr", "path": "adrs/adr-402-email-smtp-resend-retry-and-backoff-posture.json" }
-  ]
+    {
+      "id": "email-smtp-resend-REQ-001",
+      "kind": "req",
+      "path": "requirements/email-smtp-resend-req-001.json"
+    },
+    {
+      "id": "email-smtp-resend-REQ-002",
+      "kind": "req",
+      "path": "requirements/email-smtp-resend-req-002.json"
+    },
+    {
+      "id": "email-smtp-resend-REQ-003",
+      "kind": "req",
+      "path": "requirements/email-smtp-resend-req-003.json"
+    },
+    {
+      "id": "email-smtp-resend-REQ-004",
+      "kind": "req",
+      "path": "requirements/email-smtp-resend-req-004.json"
+    },
+    {
+      "id": "email-smtp-resend-REQ-005",
+      "kind": "req",
+      "path": "requirements/email-smtp-resend-req-005.json"
+    },
+    {
+      "id": "email-smtp-resend-REQ-006",
+      "kind": "req",
+      "path": "requirements/email-smtp-resend-req-006.json"
+    },
+    {
+      "id": "email-smtp-resend-US-4101",
+      "kind": "us",
+      "path": "user-stories/email-smtp-resend-us-4101.json"
+    },
+    {
+      "id": "email-smtp-resend-US-4102",
+      "kind": "us",
+      "path": "user-stories/email-smtp-resend-us-4102.json"
+    },
+    {
+      "id": "email-smtp-resend-US-4103",
+      "kind": "us",
+      "path": "user-stories/email-smtp-resend-us-4103.json"
+    },
+    {
+      "id": "email-smtp-resend-US-4104",
+      "kind": "us",
+      "path": "user-stories/email-smtp-resend-us-4104.json"
+    },
+    {
+      "id": "email-smtp-resend-US-4105",
+      "kind": "us",
+      "path": "user-stories/email-smtp-resend-us-4105.json"
+    },
+    {
+      "id": "email-smtp-resend-US-4106",
+      "kind": "us",
+      "path": "user-stories/email-smtp-resend-us-4106.json"
+    },
+    {
+      "id": "TAC-401-email-smtp-resend-send-adapter",
+      "kind": "tac",
+      "path": "tacs/tac-401-email-smtp-resend-send-adapter.json"
+    },
+    {
+      "id": "TAC-402-email-smtp-resend-webhook-verifier",
+      "kind": "tac",
+      "path": "tacs/tac-402-email-smtp-resend-webhook-verifier.json"
+    },
+    {
+      "id": "ADR-401-email-smtp-resend-transport-choice",
+      "kind": "adr",
+      "path": "adrs/adr-401-email-smtp-resend-transport-choice.json"
+    },
+    {
+      "id": "ADR-402-email-smtp-resend-retry-and-backoff-posture",
+      "kind": "adr",
+      "path": "adrs/adr-402-email-smtp-resend-retry-and-backoff-posture.json"
+    }
+  ],
+  "updatedAt": "2026-09-11"
 }

package/blueprints/email-smtp-resend/contributions/probes/probe-utils.mjs

@@ -0,0 +1,50 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-email-smtp-resend');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/email-smtp-resend');
+export const DECLARED_ENV = new Set(['RCF_FIXTURE_SMTP_PORT', 'CI_HAS_RESEND_ACCOUNT', 'RESEND_API_KEY']);
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+export function isSkipped(results) { return Array.isArray(results) && results.length > 0 && results.every((r) => r.accountBoundSkipped === true); }
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const normalised = (Array.isArray(results) && results.length > 0)
+    ? results
+    : [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: 'no checks ran', evidence: { reason: 'no checks ran', probeName, runAt: new Date().toISOString(), engine } }];
+  const raw = aggregate(normalised); const aggregateVerdict = isSkipped(normalised) ? 'pass' : raw;
+  const report = { slug: 'email-smtp-resend', probeName, runAt: new Date().toISOString(), engine, results: normalised, aggregateVerdict, ...(extra ?? {}) };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: `probe threw: ${err?.message ?? err}`, evidence: { thrown: true, message: err?.message ?? String(err), name: err?.name ?? 'Error', probeName, runAt: new Date().toISOString(), engine } }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err?.stack ?? err}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+function portFrom(v) { if (v === undefined || v === '') return 0; const n = Number(v); return Number.isInteger(n) && n >= 0 && n <= 65535 ? n : 0; }
+export function envPort(name) {
+  if (name === 'RCF_FIXTURE_SMTP_PORT') return portFrom(process.env.RCF_FIXTURE_SMTP_PORT);
+  return 0;
+}

package/blueprints/email-smtp-resend/contributions/probes/real-account-resend-send.mjs

@@ -0,0 +1,50 @@
+// Real-account Resend send probe for email-smtp-resend.
+//
+// Routes the send through the fixture email-delivery adapter (which
+// realises TAC-401.interfaces.send) with Resend REST as the provider
+// seam behind it. The probe observes the adapter's outcome record
+// (ok, providerStatus, providerMessageId) and asserts AC-4101-2's
+// success shape, including that providerStatus is a positive integer
+// in the accepted 200-299 range (per TAC-401's accepted status
+// contract) alongside a non-empty providerMessageId.
+import { createSendAdapter, createResendRestProvider } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-email-smtp-resend/src/send-adapter.mjs';
+
+export const anchorAcId = 'AC-4101-2';
+export const accountBound = true;
+const AC2 = 'A successful send resolves the outcome record owned';
+
+function skipResult(reason, detail) {
+  return {
+    results: [{ anchorAcId: null, accountBoundSkipped: true, reason, verdict: 'pass', detail, evidence: { reason, declared: 'gate variable' } }],
+    extra: {
+      accountBoundSkipped: true, reason,
+      envDeclared: ['CI_HAS_RESEND_ACCOUNT', 'RESEND_API_KEY'],
+      vendorFact: { url: 'https://resend.com/docs/dashboard/emails/send-test-emails', verifiedOn: '2026-09-11' },
+    },
+  };
+}
+
+export default async function runProbe() {
+  if (process.env.CI_HAS_RESEND_ACCOUNT !== 'true') return skipResult('CI_HAS_RESEND_ACCOUNT', `accountBoundSkipped: CI_HAS_RESEND_ACCOUNT is not set to true; the adapter did not dispatch.`);
+  if (!process.env.RESEND_API_KEY) return skipResult('RESEND_API_KEY', `accountBoundSkipped: RESEND_API_KEY unset; the adapter did not dispatch.`);
+  const results = [];
+  const provider = createResendRestProvider({ apiKey: process.env.RESEND_API_KEY, from: 'onboarding@resend.dev' });
+  const adapter = createSendAdapter({ provider });
+  const outcome = await adapter.send({ to: 'delivered@resend.dev', subject: 'rcf-lite criterion e probe', textBody: 'criterion e probe send at ' + new Date().toISOString(), htmlBody: null });
+  const statusIsAccepted = typeof outcome.providerStatus === 'number' && Number.isInteger(outcome.providerStatus) && outcome.providerStatus >= 200 && outcome.providerStatus < 300;
+  results.push({
+    anchorAcId: 'AC-4101-2',
+    verdict: outcome.ok === true && statusIsAccepted && typeof outcome.providerMessageId === 'string' && outcome.providerMessageId.length > 0 && outcome.error === null ? 'pass' : 'fail',
+    detail: `${AC2} on TAC-401.interfaces.send  -  observed adapter.send() returned { ok: ${outcome.ok}, providerStatus: ${outcome.providerStatus}, providerMessageId: '${outcome.providerMessageId}', error: ${outcome.error === null ? 'null' : `'${outcome.error}'`} }; providerStatus is an integer in the accepted 200-299 range: ${statusIsAccepted}; the adapter dispatched through Resend REST as the provider seam.`,
+    evidence: { ok: outcome.ok, providerStatus: outcome.providerStatus, providerMessageId: outcome.providerMessageId, error: outcome.error, statusIsAccepted },
+  });
+  return {
+    results,
+    extra: {
+      envDeclared: ['CI_HAS_RESEND_ACCOUNT', 'RESEND_API_KEY'],
+      sentTo: 'delivered@resend.dev', sentFrom: 'onboarding@resend.dev',
+      adapterOutcome: outcome,
+      vendorFact: { url: 'https://resend.com/docs/dashboard/emails/send-test-emails', verifiedOn: '2026-09-11' },
+    },
+  };
+}

package/blueprints/email-smtp-resend/contributions/probes/run-real-account-resend-send.mjs

@@ -0,0 +1,3 @@
+import runProbe from './real-account-resend-send.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('real-account-resend-send', { kind: 'https', driver: 'Resend REST API (live)', healthy: true }, runProbe);

package/blueprints/email-smtp-resend/contributions/probes/run-smtp-round-trip.mjs

@@ -0,0 +1,3 @@
+import runProbe from './smtp-round-trip.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('smtp-round-trip', { kind: 'smtp', driver: 'node:net catch-all SMTP on 127.0.0.1', healthy: true }, runProbe);

package/blueprints/email-smtp-resend/contributions/probes/run-unverified-sender-refusal.mjs

@@ -0,0 +1,3 @@
+import runProbe from './unverified-sender-refusal.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('unverified-sender-refusal', { kind: 'smtp', driver: 'node:net catch-all SMTP on 127.0.0.1', healthy: true }, runProbe);

package/blueprints/email-smtp-resend/contributions/probes/smtp-round-trip.mjs

@@ -0,0 +1,43 @@
+// SMTP round-trip probe for email-smtp-resend.
+//
+// Boots the fixture SMTP catch-all on 127.0.0.1 and dials it via the
+// fixture's sendViaSmtp helper. Asserts the transcript reports 250 Ok
+// on MAIL/RCPT/DATA and that the server's recorded envelope carries
+// the sender, recipient and body bytes.
+//
+// The nearest shipped AC is AC-4101-3 ("Exactly one SMTP submission
+// is dispatched per adapter call on the successful path"). This row
+// observes a local catch-all SMTP dispatch, not Resend's SMTP endpoint,
+// and does not go through the send adapter. Row de-claimed
+// (conformanceOnly, anchorAcId=null) with the limitation naming
+// AC-4101-3.
+import { createCatchAllSmtp, sendViaSmtp } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-email-smtp-resend/src/smtp-catch-all.mjs';
+import { envPort } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-4101-3';
+export const accountBound = false;
+const LIM_4101_3 = `AC-4101-3: requires exactly one SMTP submission per adapter call on the successful path. This row observes a local catch-all SMTP dispatch via a helper (sendViaSmtp), not a call through the send adapter, and the transport is not the Resend SMTP endpoint.`;
+
+export default async function runProbe() {
+  const srv = createCatchAllSmtp();
+  const { port } = await srv.listen(envPort('RCF_FIXTURE_SMTP_PORT'));
+  const results = [];
+  let outcome;
+  try {
+    outcome = await sendViaSmtp({ host: '127.0.0.1', port, from: 'probe@verified.example', to: 'x@example.com', subject: 'probe', body: 'hi\n' });
+    const queuedLine = outcome.transcript.find((l) => l.startsWith('250') && l.includes('queued as '));
+    const idFromServer = queuedLine ? queuedLine.split('queued as ')[1] : null;
+    const recorded = srv.messages[0];
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_4101_3,
+      verdict: outcome.ok && queuedLine && recorded && recorded.from === 'probe@verified.example' && recorded.to[0] === 'x@example.com' ? 'pass' : 'fail',
+      detail: `observed local SMTP round-trip via sendViaSmtp ok=${outcome.ok}; queuedId=${idFromServer}; server recorded envelope from=${recorded?.from} to=${recorded?.to?.[0]}. Not the Resend endpoint; not through the send adapter.`,
+      evidence: { queuedLine, messageId: idFromServer, envelope: recorded ? { from: recorded.from, to: recorded.to, dataExcerpt: recorded.dataText?.slice(0, 200) } : null },
+    });
+  } finally {
+    await srv.close();
+  }
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_SMTP_PORT'], port, transcript: outcome?.transcript } };
+}

package/blueprints/email-smtp-resend/contributions/probes/unverified-sender-refusal.mjs

@@ -0,0 +1,99 @@
+// Unverified-sender-refusal probe for email-smtp-resend.
+//
+// Routes an offline unverified-sender send through the fixture
+// email-delivery adapter (which realises TAC-401.interfaces.send)
+// with a catch-all SMTP provider seam behind it. The catch-all
+// fixture is booted in unverified-sender mode, so the underlying
+// SMTP reply is 550 5.7.1; the provider seam classifies that to
+// RESEND_SENDER_UNVERIFIED, and the ADAPTER returns the refusal
+// outcome record { ok:false, providerStatus, providerMessageId:null,
+// error: 'RESEND_SENDER_UNVERIFIED: ...' }.
+//
+// AC-4102-1: the adapter's `error` begins with 'RESEND_SENDER_UNVERIFIED'
+// (adapter refusal outcome).
+// AC-4102-2: recipient, subject, textBody do not appear on the
+// adapter's returned `error`, on any line emitted to the adapter's
+// injected log sink during the call, or on any exception the adapter
+// throws.
+// Every detail line begins with the first eight words of the AC text.
+import { createCatchAllSmtp } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-email-smtp-resend/src/smtp-catch-all.mjs';
+import { createSendAdapter, createCatchAllSmtpProvider } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-email-smtp-resend/src/send-adapter.mjs';
+import { envPort } from './probe-utils.mjs';
+
+// the strict-evidence contract tightening: the refusal is driven by a local catch-all
+// SMTP fixture, which is a fixture-as-engine substitute for the
+// Resend provider; the outcome record carries no Resend-returned
+// message id or request id (providerMessageId is required to be
+// null on the refusal). Both rows are de-claimed to conformanceOnly
+// naming AC-4102-1 and AC-4102-2. The Resend API is not driven for
+// this refusal because there is no way to elicit an unverified-sender
+// refusal on Resend without an unverified sender identity available
+// to the harness.
+// The module anchor names the AC this probe observes as a property;
+// individual rows may still de-claim (conformanceOnly) when the
+// evidence shape does not carry an engine-returned identifier.
+export const anchorAcId = 'AC-4102-1';
+export const accountBound = false;
+const AC1 = 'When the provider refuses the submission because the';
+const AC2 = 'On any adapter refusal, the recipient address, subject,';
+const LIM_4102_1 = `AC-4102-1: requires the refusal outcome shape returned by the Resend send interface when the provider refuses the submission. This probe drives a local catch-all SMTP fixture (fixture-as-engine), not the Resend API, and the adapter's error string is derived content rather than a Resend-returned identifier; the identifier half of the strict-evidence contract is not satisfied here.`;
+const LIM_4102_2 = `AC-4102-2: requires the refusal outcome from the same Resend send interface to hold no recipient/subject/body echo across the returned error, adapter log lines, and thrown exception. This probe observes the property against the local catch-all SMTP fixture; the row is de-claimed because the observation is fixture-as-engine and carries no Resend-returned identifier.`;
+
+export default async function runProbe() {
+  const srv = createCatchAllSmtp();
+  srv.setUnverifiedSenderMode(true);
+  const { port } = await srv.listen(envPort('RCF_FIXTURE_SMTP_PORT'));
+  const results = [];
+  const distinctiveRecipient = 'distinct-recipient@example.test';
+  const distinctiveSubject = 'DISTINCT-SUBJECT-LINE-XYZ';
+  const distinctiveBody = 'DISTINCT-BODY-BYTES-ABC123-DO-NOT-LEAK';
+  const emittedLines = [];
+  let outcome;
+  let thrownMessage = null;
+  try {
+    const provider = createCatchAllSmtpProvider({ host: '127.0.0.1', port, from: 'unverified@somewhere.example' });
+    const adapter = createSendAdapter({ provider, logSink: (l) => emittedLines.push(l) });
+    try {
+      outcome = await adapter.send({ to: distinctiveRecipient, subject: distinctiveSubject, textBody: distinctiveBody, htmlBody: null });
+    } catch (e) {
+      thrownMessage = e?.message ?? String(e);
+    }
+    const errorString = outcome?.error ?? '';
+    const startsWithClass = errorString.startsWith('RESEND_SENDER_UNVERIFIED');
+    const recipientInError = errorString.toLowerCase().includes(distinctiveRecipient.toLowerCase());
+    const subjectInError = errorString.includes(distinctiveSubject);
+    const bodyInError = errorString.includes(distinctiveBody);
+    const recipientInLogs = emittedLines.some((l) => l.toLowerCase().includes(distinctiveRecipient.toLowerCase()));
+    const subjectInLogs = emittedLines.some((l) => l.includes(distinctiveSubject));
+    const bodyInLogs = emittedLines.some((l) => l.includes(distinctiveBody));
+    const recipientInThrown = Boolean(thrownMessage && thrownMessage.toLowerCase().includes(distinctiveRecipient.toLowerCase()));
+    const subjectInThrown = Boolean(thrownMessage && thrownMessage.includes(distinctiveSubject));
+    const bodyInThrown = Boolean(thrownMessage && thrownMessage.includes(distinctiveBody));
+    const cleanCall = !recipientInError && !subjectInError && !bodyInError && !recipientInLogs && !subjectInLogs && !bodyInLogs && !recipientInThrown && !subjectInThrown && !bodyInThrown;
+    // AC-4102-1 refusal outcome: the strict-evidence contract requires the row to
+    // assert BOTH a valid providerStatus AND providerMessageId===null
+    // alongside the RESEND_SENDER_UNVERIFIED class prefix; the shape
+    // is owned on TAC-401-email-smtp-resend-send-adapter.interfaces.send.
+    const providerStatusValid = typeof outcome?.providerStatus === 'number' && Number.isInteger(outcome.providerStatus) && outcome.providerStatus > 0;
+    const providerMessageIdIsNull = outcome?.providerMessageId === null;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_4102_1,
+      verdict: outcome?.ok === false && startsWithClass && providerStatusValid && providerMessageIdIsNull && thrownMessage === null ? 'pass' : 'fail',
+      detail: `observed adapter.send() against the local catch-all SMTP fixture: ok=${outcome?.ok} providerStatus=${outcome?.providerStatus} providerStatusValid=${providerStatusValid} providerMessageId=${JSON.stringify(outcome?.providerMessageId ?? null)} providerMessageIdIsNull=${providerMessageIdIsNull} error='${errorString}' startsWithClass=${startsWithClass} thrown=${thrownMessage === null ? 'null' : `'${thrownMessage}'`}. Fixture-as-engine; Resend API not called for this refusal.`,
+      evidence: { ok: outcome?.ok, providerStatus: outcome?.providerStatus, providerStatusValid, providerMessageIdIsNull, errorString, startsWithClass, thrownMessage, code: outcome?.providerStatus, messageId: outcome?.providerMessageId ?? null, lastLine: emittedLines[emittedLines.length - 1] ?? null, bodyExcerpt: `refusal ok=${outcome?.ok} providerStatus=${outcome?.providerStatus} error='${errorString}'` },
+    });
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_4102_2,
+      verdict: cleanCall && srv.messages.length === 0 ? 'pass' : 'fail',
+      detail: `observed recipient/subject/body in adapter.error=${recipientInError}/${subjectInError}/${bodyInError}; in emitted log lines=${recipientInLogs}/${subjectInLogs}/${bodyInLogs}; in thrown exception=${recipientInThrown}/${subjectInThrown}/${bodyInThrown}; server accepted messages=${srv.messages.length} (must be 0 on unverified-sender refusal). Fixture-as-engine; Resend API not called for this refusal.`,
+      evidence: { recipientInError, subjectInError, bodyInError, recipientInLogs, subjectInLogs, bodyInLogs, recipientInThrown, subjectInThrown, bodyInThrown, serverAcceptedMessages: srv.messages.length, errorString, recipientInRefusal: recipientInError, lastLine: emittedLines[emittedLines.length - 1] ?? null, emittedLines, bodyExcerpt: `cleanCall=${cleanCall} serverAcceptedMessages=${srv.messages.length}` },
+    });
+  } finally {
+    await srv.close();
+  }
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_SMTP_PORT'], port, adapterOutcome: outcome, emittedLogLines: emittedLines, thrownMessage } };
+}

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-001.json

@@ -2,7 +2,11 @@
   "reqId": "email-smtp-resend-REQ-001",
   "prdId": "PRD-001",
   "title": "The adapter satisfies the mail-adapter interface named by the shipped magic-link blueprint's TAC-504",
-  "description": "The Resend send adapter exposes exactly the `send({ to, subject, textBody, htmlBody })` method the magic-link blueprint's `TAC-504-security-auth-magic-link-email-delivery-adapter` names, and resolves the fixed outcome shape `{ ok, providerStatus, providerMessageId, error }` on every call. No other method is added to the auth-facing surface; provider status codes and provider message ids are normalised into the four declared fields inside the adapter. A project composing this blueprint alongside the magic-link blueprint wires the adapter reference into the auth routes at composition time and calls `adapter.send` directly.",
+  "description": "The Resend send adapter exposes the send interface named by the magic-link blueprint's TAC-504-security-auth-magic-link-email-delivery-adapter, matching the signature owned on TAC-401-email-smtp-resend-send-adapter.interfaces.send, and resolves the fixed outcome shape declared on that same owner on every call. No other method is added to the auth-facing surface; provider status codes and provider message ids are normalised into the declared outcome fields inside the adapter. A project composing this blueprint alongside the magic-link blueprint wires the adapter reference into the auth routes at composition time and calls the adapter send method directly.",
+  "deliveredBy": {
+    "tacId": "TAC-401-email-smtp-resend-send-adapter",
+    "field": "interfaces.send"
+  },
   "category": "functional",
   "domain": "email",
   "priority": "must",
@@ -11,8 +15,8 @@
     "blueprint:email-smtp-resend",
     "category:01-mail-adapter-contract"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-002.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Transport is Resend's SMTP endpoint, credentialed from placeholder-referenced secrets and a placeholder-referenced verified sender address",
   "description": "The adapter dials Resend's SMTP submission endpoint (host and port declared as configuration references, not literal in-code strings) and authenticates with an SMTP username and an SMTP password sourced from a Secrets Manager slice. The from-address on every outgoing message is a project-configured verified sender address, also sourced from configuration rather than a literal. Three configuration references are named by the adapter: `RESEND_SMTP_USER`, `RESEND_SMTP_PASSWORD`, and `RESEND_FROM_ADDRESS`. The names are references only; the values live in the vendor the project's Secrets Manager resolves against. No SMTP credential, no signing secret, and no real sender domain is ever committed to the repo or embedded in the adapter's code paths.",
+  "deliveredBy": {
+    "tacId": "TAC-401-email-smtp-resend-send-adapter",
+    "field": "interfaces.secretResolver"
+  },
   "category": "functional",
   "domain": "email",
   "priority": "must",

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-003.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Provider-side failure modes are enumerated and each maps to a stable-coded error the adapter returns without leaking recipient identity",
   "description": "The adapter enumerates four provider-side failure classes and maps each to a stable error code on the `error` field of the send-contract return shape, with `ok: false` and the provider's own status code on `providerStatus` when the provider surfaced one. The classes are: rate-limit refusal (`RESEND_RATE_LIMITED`), unverified sender domain or address (`RESEND_SENDER_UNVERIFIED`), invalid or malformed recipient input the provider rejected before dispatch (`RESEND_RECIPIENT_REJECTED`), and generic transport error covering network faults and the provider's 5xx range (`RESEND_TRANSPORT_ERROR`). The error string carries the class code and a short structured reason; the recipient address, the message subject, and the message body never appear on the returned error string, on any log line the adapter writes, or on any exception the adapter throws.",
+  "deliveredBy": {
+    "tacId": "TAC-401-email-smtp-resend-send-adapter",
+    "field": "interfaces.send"
+  },
   "category": "functional",
   "domain": "email",
   "priority": "must",

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-004.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Retry-and-backoff posture is bounded, jittered, and refuses to loop on a rejection the provider has already classified as terminal",
   "description": "On a `RESEND_TRANSPORT_ERROR` or a `RESEND_RATE_LIMITED` return, the adapter retries up to a bounded budget (default 2 retries, project-configurable via a numeric configuration reference; total attempts including the first are therefore at most 3) with exponential backoff and full jitter (base 250ms, cap 8000ms). On `RESEND_SENDER_UNVERIFIED` and `RESEND_RECIPIENT_REJECTED` the adapter does not retry: the provider classified the request as terminally invalid and looping wastes budget and risks a rate-limit escalation. After exhausting the retry budget the adapter returns `{ ok: false, ... }` with the last-observed provider status and the class code that caused the exhaustion; the caller sees one adapter return, not a retry storm.",
+  "deliveredBy": {
+    "tacId": "TAC-401-email-smtp-resend-send-adapter",
+    "field": "interfaces.retryClock"
+  },
   "category": "functional",
   "domain": "email",
   "priority": "must",

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-005.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Delivery events posted by Resend's webhook are signature-verified and refused when verification fails",
   "description": "The project exposes one HTTP route the Resend webhook posts delivery events to. The webhook verifier reads the incoming request's signature header (name declared as a configuration reference), reads the timestamp header (name declared as a configuration reference), and computes the expected signature using the webhook signing secret sourced from configuration (`RESEND_WEBHOOK_SIGNING_SECRET` placeholder reference). The verifier compares the computed signature against the header using a constant-time comparison. On mismatch the verifier returns HTTP 401 with an empty body and emits a structured `webhookVerificationFailed` audit event; the delivery event is not delivered to any downstream handler. The signing secret never appears on any log line, error string, or exception message. The header names, the signing algorithm identifier, and the timestamp-tolerance window are configuration references, not literals baked into the verifier.",
+  "deliveredBy": {
+    "tacId": "TAC-402-email-smtp-resend-webhook-verifier",
+    "field": "interfaces.verify"
+  },
   "category": "functional",
   "domain": "email",
   "priority": "must",

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-006.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The webhook verifier refuses replayed events by rejecting stale timestamps and refusing already-seen delivery ids inside a bounded window",
   "description": "The verifier reads the webhook timestamp header and refuses any request whose timestamp is older than the configured tolerance window (default 300 seconds, project-configurable via a numeric configuration reference); a refused request returns HTTP 401 with an empty body and emits a `webhookReplayStale` audit event. On a verification-passing request, the verifier extracts the provider's delivery event id from the payload and consults a bounded event-id store (a stateful component the project realises: an in-memory LRU sized to the tolerance window's expected event volume, or a persisted store with a matching TTL); an event id that already appears in the store is refused with HTTP 200 (idempotent replay acknowledged, no downstream side effect), and emits a `webhookReplayDuplicate` audit event. New event ids are recorded in the store with an expiry equal to the tolerance window.",
+  "deliveredBy": {
+    "tacId": "TAC-402-email-smtp-resend-webhook-verifier",
+    "field": "interfaces.eventIdStore"
+  },
   "category": "functional",
   "domain": "email",
   "priority": "must",

package/blueprints/email-smtp-resend/contributions/tacs/tac-401-email-smtp-resend-send-adapter.json

@@ -5,10 +5,10 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Resend SMTP send adapter",
-  "purpose": "The one module in the project that submits outbound mail to Resend's SMTP endpoint. Satisfies the `send({ to, subject, textBody, htmlBody }) -> Promise<{ ok, providerStatus, providerMessageId, error }>` interface named by the magic-link blueprint's `TAC-504-security-auth-magic-link-email-delivery-adapter`. Normalises provider-specific status codes and error prose into the four declared fields, applies the bounded jittered retry posture named by ADR-402, and sources every credential and the from-address through configured references rather than embedded literals. Every module that hands mail to the provider imports this adapter; nothing else imports the SMTP client library or reaches around the interface.",
+  "purpose": "The one module in the project that submits outbound mail to Resend's SMTP endpoint. Satisfies the send interface owned on interfaces.send below, shape-compatible with the magic-link blueprint's TAC-504-security-auth-magic-link-email-delivery-adapter. Normalises provider-specific status codes and error prose into the outcome fields owned on interfaces.send, applies the bounded jittered retry posture named by ADR-402, and sources every credential and the from-address through configured references rather than embedded literals. Every module that hands mail to the provider imports this adapter; nothing else imports the SMTP client library or reaches around the interface.",
   "responsibilities": [
-    "Expose `send({ to, subject, textBody, htmlBody })` as the sole auth-facing method and no other public method matching that shape (AC-4101-1).",
-    "Return `{ ok, providerStatus, providerMessageId, error }` on every call; on success `ok === true`, `providerStatus` the provider's accepted-status integer, `providerMessageId` the provider's returned identifier, `error === null` (AC-4101-2).",
+    "Expose the send method owned on interfaces.send below as the sole auth-facing surface and no other public method matching that shape (AC-4101-1).",
+    "Return the outcome fields owned on interfaces.send below on every call; on success the ok field is true, the providerStatus field carries the provider's accepted-status integer, the providerMessageId field carries the provider's returned identifier, and the error field is null (AC-4101-2).",
     "Dispatch exactly one SMTP submission per adapter call on the successful path (AC-4101-3).",
     "Classify every non-success provider response into `RESEND_RATE_LIMITED`, `RESEND_SENDER_UNVERIFIED`, `RESEND_RECIPIENT_REJECTED`, or `RESEND_TRANSPORT_ERROR` and place the code at the start of the `error` string; carry the provider's own status code on `providerStatus` when the provider surfaced one (AC-4102-1, AC-4103-2).",
     "Suppress recipient address, subject, and body from the `error` string, every log line the adapter writes for the call, and every exception the adapter throws for the call (AC-4102-2).",

package/blueprints/email-smtp-resend/contributions/tacs/tac-402-email-smtp-resend-webhook-verifier.json

@@ -12,7 +12,7 @@
     "Suppress the signing secret from the response body, from every log line the verifier writes for the call, and from every exception the verifier throws for the call (AC-4104-3).",
     "Refuse a webhook whose timestamp header is older than the configured tolerance window (default 300 seconds) with HTTP 401, empty body, no handler invocation, and one `webhookReplayStale` audit event (AC-4105-1).",
     "On a signature-passing request, read the provider's delivery event id from the payload and consult the bounded event-id store; refuse a duplicate with HTTP 200, no handler invocation, and one `webhookReplayDuplicate` audit event; record a new id with an expiry equal to the tolerance window (AC-4105-2).",
-    "Resolve `RESEND_WEBHOOK_SIGNING_SECRET`, the signature header name, the timestamp header name, the signing algorithm identifier, and the tolerance window at boot through the project's configured resolver; carry no literal for the signing secret in verifier source (AC-4106-2)."
+    "Resolve `RESEND_WEBHOOK_SIGNING_SECRET`, the signature header name, the timestamp header name, the signing algorithm identifier, and the tolerance window at boot through the project's configured resolver; carry no literal for the signing secret in verifier source (AC-4106-3)."
   ],
   "internalStructure": "One stateless verifier per process, constructed at boot with an injected signature-computation function (a project-selected HMAC implementation matching the configured algorithm identifier), an injected event-id store (an in-memory LRU sized to the tolerance window or a project-authored persistent store with a matching TTL, satisfying the same put-if-absent-with-expiry interface), an injected audit sink, and an injected clock the tolerance check consults. The route handler is a thin adapter over the verifier: the verifier is the thing under test, the route wiring is not.",
   "interfaces": [
@@ -35,6 +35,11 @@
       "name": "verifierClock",
       "kind": "read-api",
       "description": "Project-supplied clock the tolerance check consults; a real clock in production, a test double in unit tests. Injected at boot; deterministic under test."
+    },
+    {
+      "name": "secretResolver",
+      "kind": "read-api",
+      "description": "Project-supplied secret-reference resolver. The verifier reads the webhook signing secret (`RESEND_WEBHOOK_SIGNING_SECRET`), the signature header name, the timestamp header name, the signing algorithm identifier, and the tolerance window through it at boot; carries no literal for the signing secret in verifier source (AC-4106-3). The resolver shape matches the resolver TAC-401 consumes for the SMTP secrets, so a project realises one resolver for both TACs."
     }
   ],
   "dependencies": [
@@ -52,5 +57,5 @@
   ],
   "tradeoffs": "The event-id store is a stateful component the project realises; an in-memory LRU sized to the tolerance window is cheap and defends the replay class the tolerance window bounds, but does not defend cross-process replay in a horizontally-scaled deployment. Projects running multiple webhook-consuming processes supply a shared store (a small Redis, a small database table) implementing the same put-if-absent-with-expiry interface. The constant-time comparison assumes a comparison function that itself runs in constant time over the byte length of the expected signature; a project that provides a naive comparison re-opens the timing side channel the verifier is closing.",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/email-smtp-resend/contributions/user-stories/email-smtp-resend-us-4101.json

@@ -2,7 +2,7 @@
   "usId": "email-smtp-resend-US-4101",
   "prdId": "PRD-001",
   "reqId": "email-smtp-resend-REQ-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "The magic-link route hands a composed sign-in URL to the adapter and the adapter dispatches one message",
   "asA": "operator using a project that composed this blueprint alongside the magic-link blueprint",
@@ -11,21 +11,27 @@
   "acceptanceCriteria": [
     {
       "id": "AC-4101-1",
-      "description": "The adapter exposes exactly the `send({ to, subject, textBody, htmlBody })` method the magic-link blueprint's TAC-504 names and no other auth-facing method.",
+      "description": "The adapter exposes exactly the send method owned on TAC-401-email-smtp-resend-send-adapter.interfaces.send (shape-compatible with the magic-link blueprint's TAC-504) as the sole auth-facing method.",
       "given": "the adapter module imported into a running process",
       "when": "the process enumerates the adapter's exported surface",
       "then": "the enumeration returns `send` as the sole async method and no other public method matches the auth-facing shape",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-4101-2",
-      "description": "A successful send resolves the fixed outcome shape `{ ok, providerStatus, providerMessageId, error }` with `ok: true`, `providerStatus` equal to the provider's own accepted-status code, `providerMessageId` equal to the provider's returned identifier, and `error` equal to null.",
+      "description": "A successful send resolves the outcome record owned on TAC-401-email-smtp-resend-send-adapter.interfaces.send in its success shape (per that interface's contract).",
       "given": "a running project with valid configuration and a recipient the provider accepts",
-      "when": "the magic-link route calls `adapter.send({ to, subject, textBody, htmlBody })`",
-      "then": "the returned object matches the shape with `ok === true`, `providerStatus` a positive integer, `providerMessageId` a non-empty string, and `error === null`",
+      "when": "the magic-link route calls the adapter's send interface defined on `TAC-401-email-smtp-resend-send-adapter.interfaces.send`",
+      "then": "the returned object matches the success shape owned on TAC-401-email-smtp-resend-send-adapter.interfaces.send",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-401-email-smtp-resend-send-adapter",
+        "field": "interfaces.send"
+      }
     },
     {
       "id": "AC-4101-3",
@@ -34,7 +40,8 @@
       "when": "the magic-link route triggers one adapter send",
       "then": "the submission counter increments by exactly one and no additional submission is observed within the retry window",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [