sently 0.9.2 → 1.0.0

package/site/content/docs/get-started/meta.json

@@ -7,6 +7,9 @@
     "installation",
     "entrypoints",
     "runtimes",
-    "migrate-nodemailer"
+    "migrate-nodemailer",
+    "stability",
+    "support-matrix",
+    "non-goals"
   ]
 }

package/site/content/docs/get-started/migrate-nodemailer.mdx

@@ -2,22 +2,149 @@
 title: Migrate from Nodemailer
 description: Move SMTP configuration and message fields to sently incrementally.
 icon: ArrowRightLeft
-source: "README.md"
+source: "src/smtp-mailer.ts"
 ---
 
-Keep your message object, replace transporter construction, and await the sently factory.
+Keep your welcome email, receipt, or password-reset fields (`from`, `to`, `subject`, `text` / `html`).
+Replace `createTransport` with `createSMTPMailer`, rename `sendMail` to `send`, and `await` the factory before the first send.
+
+<Callout title="The one rule">
+  Use `createSMTPMailer` for relay host/port/auth. Use `createMailer` only when you already have an explicit transport.
+</Callout>
+
+## Quick start
+
+<Steps>
+  <Step title="Create the mailer">
 
 ```ts
 import { createSMTPMailer } from "sently/smtp";
 
 const mailer = await createSMTPMailer({
   host: "smtp.example.com",
+  port: 587,
   auth: { user: "user@example.com", pass: process.env.SMTP_PASSWORD! },
 });
 ```
 
-<Callout title="The one rule">Use `createSMTPMailer` for relay configuration; use `createMailer` only with an explicit transport.</Callout>
+  </Step>
+  <Step title="Send with the same fields">
+
+```diff
+- const info = await transporter.sendMail({
++ const result = await mailer.send({
+    from: "Acme <hello@example.com>",
+    to: "person@example.com",
+    subject: "Welcome",
+    text: "Thanks for joining.",
+  });
+```
+
+  </Step>
+  <Step title="Read the result">
+
+```ts
+console.log(result.messageId, result.accepted, result.rejected);
+```
+
+  </Step>
+</Steps>
+
+## API map
+
+| Nodemailer | sently |
+| --- | --- |
+| `createTransport({ host, port, auth })` | `await createSMTPMailer({ host, port, auth })` |
+| `transporter.sendMail(msg)` | `mailer.send(msg)` |
+| `transporter.verify()` | `mailer.verify()` |
+| `transporter.close()` | `mailer.close()` |
+| `info.messageId` / `accepted` / `rejected` / `response` / `envelope` | Same fields on `SendResult` |
+| HTTP providers via plugins / custom | `createMailer` + `sently/transports/<provider>` |
+
+## Message fields
+
+| Nodemailer | sently |
+| --- | --- |
+| `from` / `to` / `cc` / `bcc` / `replyTo` | Same names on `MailOptions` |
+| `subject`, `text`, `html`, `headers`, `messageId`, `date` | Same names |
+| `priority` | `"high" \| "normal" \| "low"` |
+| `attachments[].filename` / `content` / `path` / `contentType` | Same names |
+| `attachments[].cid` | `attachments[].contentId` |
+| `attachments[].contentDisposition: "inline"` | `attachments[].inline: true` |
+| `icalEvent`, SOCKS proxy options | Not supported — see [Non-goals](/docs/get-started/non-goals) |
+
+## SMTP options
+
+| Option | Type | Default | Meaning |
+| --- | --- | --- | --- |
+| `host` | `string` | required | Relay hostname |
+| `port` | `number` | `587` (`465` if `secure`) | SMTP port |
+| `secure` | `boolean` | `false` | Implicit TLS on connect |
+| `auth` | `SMTPAuth` | — | `{ user, pass?, type?, oauth2? }` |
+| `pool` | `boolean` | `false` | Connection pooling |
+| `requireTLS` | `boolean` | `true` when `auth` is set | Refuse AUTH on a cleartext connection |
+| `tls` | `TLSOptions` | — | `rejectUnauthorized`, `servername`, `minVersion` |
+| `connectionTimeout` | `number` | — | Socket connect timeout (ms) |
+| `greetingTimeout` | `number` | — | Wait for SMTP greeting (ms) |
+| `socketTimeout` | `number` | — | Idle socket timeout (ms) |
+
+## Switch to an HTTP provider later
+
+Keep `mailer.send` and change only construction:
+
+```diff
+- import { createSMTPMailer } from "sently/smtp";
+- const mailer = await createSMTPMailer({ host, port, auth });
++ import { createMailer } from "sently/mailer";
++ import { ResendTransport } from "sently/transports/resend";
++ const mailer = await createMailer({
++   transport: new ResendTransport({ apiKey: process.env.RESEND_API_KEY! }),
++ });
+```
+
+**Consequence:** message fields stay the same; only the factory and transport change.
+
+## Troubleshooting
+
+<Accordions>
+  <Accordion title='Error: "SMTP config passed to transport-only createMailer"'>
+    `createMailer` accepts only `{ transport, plugins?, hooks? }`. Move host/port/auth to `createSMTPMailer` from `sently/smtp`.
+  </Accordion>
+  <Accordion title="Do I need to rewrite every message object?">
+    Usually no. Keep `from`, `to`, `subject`, and body fields; change construction and `sendMail` → `send`. Rename attachment `cid` to `contentId` when you use inline images.
+  </Accordion>
+  <Accordion title="Why is createSMTPMailer async?">
+    The factory prepares the runtime SMTP connection path (and optionally the pool) before returning. Always `await` it before `send`.
+  </Accordion>
+  <Accordion title="Is sently a drop-in for every Nodemailer plugin?">
+    No. SOCKS and iCal are intentional non-goals. See [Non-goals](/docs/get-started/non-goals) and [Compare](/docs/guides/compare).
+  </Accordion>
+</Accordions>
+
+## Learn more
+
+- [Email channel](/docs/channels/email) — mailer + transport model after you migrate
+- [Mail options](/docs/reference/mail-options) — full `MailOptions` field list
+- [Attachments](/docs/guides/attachments) — `content`, `path`, and `contentId`
+- [Entrypoints](/docs/get-started/entrypoints) — `sently/smtp` vs `sently/mailer`
+- [Support matrix](/docs/get-started/support-matrix) — which runtimes and exports are supported
 
-<Accordions><Accordion title="Why does transport-only createMailer reject host?">It only accepts a `transport`. Move relay configuration to `createSMTPMailer`.</Accordion></Accordions>
+## Next
 
-<Cards><Card title="Email channel" href="/docs/channels/email" /></Cards>
+<Cards>
+  <Card
+    title="Email channel"
+    description="Send with createMailer or createSMTPMailer."
+    href="/docs/channels/email"
+  />
+  <Card
+    title="SMTP transport"
+    description="Relay options when you wire SMTPTransport yourself."
+    href="/docs/transports/smtp"
+  />
+  <Card
+    title="Compare"
+    description="Nodemailer, vendor SDKs, and orchestration platforms."
+    href="/docs/guides/compare"
+  />
+</Cards>

package/site/content/docs/get-started/non-goals.mdx

@@ -0,0 +1,57 @@
+---
+title: Non-goals
+description: What sently intentionally does not ship — and what belongs on top.
+icon: Ban
+source: "README.md"
+---
+
+sently is a **channel-delivery library**. Keeping the surface focused is part of the 1.x promise.
+
+<Callout title="The one rule">
+  Do not expect dashboards, preference centers, digests, or workflow builders inside sently. Put that product logic — or Novu / Knock / Courier — on top of the delivery layer.
+</Callout>
+
+## Out of scope
+
+| Non-goal | Notes |
+| --- | --- |
+| Orchestration platforms | Preference centers, digests, journey builders, in-app inboxes |
+| Hosted SaaS / per-send billing | MIT library in your process |
+| APNs as a native push transport | Use FCM and/or Web Push for 1.x |
+| Voice channels | Not a sently channel |
+| Inbound email productization | Outbound + webhook parsers only |
+| Nodemailer SOCKS / iCal parity | Intentionally omitted |
+| Equal support for every export | See [Support matrix](./support-matrix) |
+| Cross-channel preview / idempotency | Email-only today |
+
+## Complementary stack
+
+| Need | Place it… |
+| --- | --- |
+| Send email / SMS / WhatsApp / push | sently channel senders |
+| Swap providers without rewriting call sites | sently transports |
+| Preferences, digests, workflows, in-app | Your app or Novu / Knock / Courier **on top of** sently |
+
+## Troubleshooting
+
+<Accordions>
+  <Accordion title="Will sently add a preference center?">
+    No. That is platform territory and conflicts with the library-not-platform position.
+  </Accordion>
+  <Accordion title="Where should I read the positioning story?">
+    See [Compare](/docs/guides/compare).
+  </Accordion>
+</Accordions>
+
+## Learn more
+
+- [Compare](/docs/guides/compare)
+- [Support matrix](./support-matrix)
+- [Stability policy](./stability)
+
+## Next
+
+<Cards>
+  <Card title="Compare" href="/docs/guides/compare" />
+  <Card title="Introduction" href="/docs/get-started/introduction" />
+</Cards>

package/site/content/docs/get-started/stability.mdx

@@ -0,0 +1,69 @@
+---
+title: Stability policy
+description: What is frozen at 1.0 and what may grow under semver.
+icon: Shield
+source: "package.json"
+---
+
+From **1.0.0**, sently follows semver for the public channel-delivery surface.
+Apps should depend on channel senders and contracts — not on vendor SDK shapes.
+
+<Callout title="The one rule">
+  Treat channel factories, transport contracts, hooks, `SentlyError` codes, and
+  published subpath entrypoints as stable. New transports and optional fields may
+  appear in minor releases; renames or narrowed types require a major.
+</Callout>
+
+## Frozen at 1.x (Tier A)
+
+| Surface | Stable APIs |
+| --- | --- |
+| Factories | `createMailer`, `createSMTPMailer`, `createSmsSender`, `createWhatsAppSender`, `createPushSender` |
+| Contracts | `Transport`, `SmsTransport`, `WhatsAppTransport`, `PushTransport` option and result shapes |
+| Shared | Lifecycle hooks, `SentlyError` / `sentlyCode`, `ChannelSendResult` / `toChannelSendResult` |
+| Decorators | `RetryTransport`, `FallbackTransport` on all channels |
+| Email-only decorators | `IdempotencyTransport`, `PreviewTransport` (documented as email-only; not removed) |
+| Entrypoints | Subpaths listed in `package.json` `exports` — no silent moves |
+
+## Intentional shapes (stable, not transitional)
+
+| Shape | Meaning |
+| --- | --- |
+| `PushOptions` | Discriminated union: Web Push `subscription` **or** FCM `token` |
+| `providerIndex` | Optional on send results when a fallback decorator handled the send |
+| Email-only preview / idempotency | Stay email-scoped; not a signal they will move to other channels soon |
+
+## Allowed without a major
+
+- New transport classes and webhook parsers
+- New optional fields on options/results
+- New subpath exports
+- Bug fixes and security patches on the current **1.x** line
+
+## Security patches
+
+See [`SECURITY.md`](https://github.com/alialnaghmoush/sently/blob/main/SECURITY.md) for reporting and which versions receive patches.
+
+## Troubleshooting
+
+<Accordions>
+  <Accordion title="Can I pin 0.x in production after 1.0?">
+    Prefer upgrading to 1.x. Pre-1.0 may still receive best-effort fixes but is not the supported security line.
+  </Accordion>
+  <Accordion title="Where is the production support promise?">
+    See [Support matrix](./support-matrix) for Supported vs Available transports.
+  </Accordion>
+</Accordions>
+
+## Learn more
+
+- [Support matrix](./support-matrix)
+- [Non-goals](./non-goals)
+- [Compare](/docs/guides/compare)
+
+## Next
+
+<Cards>
+  <Card title="Support matrix" href="/docs/get-started/support-matrix" />
+  <Card title="Non-goals" href="/docs/get-started/non-goals" />
+</Cards>

package/site/content/docs/get-started/support-matrix.mdx

@@ -0,0 +1,62 @@
+---
+title: Support matrix
+description: Supported vs Available transports and runtimes for production use.
+icon: LayoutGrid
+source: "package.json"
+---
+
+Not every exported transport is part of the **1.x production promise**.
+**Supported** paths are documented, tested, and operable (verify, retry/fallback, and webhooks where listed).
+**Available** paths ship and have unit coverage but are not the support bar.
+
+<Callout title="The one rule">
+  Build production apps on Supported transports. Treat Available exports as optional extras you can adopt knowing the promise is thinner.
+</Callout>
+
+## Supported (v1 promise)
+
+| Channel | Supported transports | Operability |
+| --- | --- | --- |
+| Email | SMTP, Resend, SES, SendGrid, Postmark | Attachments / HTML / text, `verify`, retry / fallback, webhooks for the HTTP majors |
+| SMS | Twilio SMS, Unifonic | Webhooks for Twilio and Unifonic |
+| WhatsApp | WhatsApp Cloud | Signature verify + delivery parse |
+| Push | Web Push, FCM | Option union: `subscription` (Web Push) or `token` (FCM) |
+| Runtimes | Node ≥18, Bun, Deno, Cloudflare Workers | Adapters and smoke scripts |
+
+FCM uses the current Firebase HTTP API (service-account JWT, no Google SDK). That is baseline push support, not a special feature tier.
+
+## Available (exported, not the v1 bar)
+
+| Channel | Available examples |
+| --- | --- |
+| Email | Mailgun, Brevo, MailerSend, Plunk, SparkPost, Mailtrap, Mailpit (dev), Loops, SNDR, Taqnyat Mail, Cloudflare Email, … |
+| SMS | Taqnyat SMS, Msegat |
+| WhatsApp | Taqnyat WhatsApp |
+| Decorators | `WeightedFallbackTransport` (advanced); preview / idempotency remain email-only |
+| Local email | [Mailpit](/docs/transports/mailpit) (SMTP catcher), [Preview](/docs/decorators/preview) (disk) |
+
+Available transports stay in the package. They are promoted to Supported when docs, operability, and smoke coverage meet the bar above.
+
+## Troubleshooting
+
+<Accordions>
+  <Accordion title="Can I use an Available transport in production?">
+    Yes, at your own risk. Prefer Supported paths when you need the documented operability promise.
+  </Accordion>
+  <Accordion title="Why is Mailgun Available but Postmark Supported?">
+    The Supported set is a deliberate short list for the 1.x promise — not a popularity ranking of every working export.
+  </Accordion>
+</Accordions>
+
+## Learn more
+
+- [Stability policy](./stability)
+- [Non-goals](./non-goals)
+- [Transports](/docs/transports)
+
+## Next
+
+<Cards>
+  <Card title="Stability policy" href="/docs/get-started/stability" />
+  <Card title="Transports" href="/docs/transports" />
+</Cards>

package/site/content/docs/guides/compare.mdx

@@ -0,0 +1,87 @@
+---
+title: Compare
+description: How sently fits next to vendor SDKs, Nodemailer, and orchestration platforms.
+icon: Scale
+source: "README.md"
+---
+
+Teams often start with one channel — usually email via SendGrid or Resend — then add SMS and push.
+Each new vendor SDK brings its own auth, retries, and error shapes into app code.
+
+<Callout title="The one rule">
+  Treat sently as the channel-delivery layer. Put preference centers, digests, workflow builders, and in-app inboxes on top of it — custom code or a tool like Novu, Knock, or Courier — not instead of it.
+</Callout>
+
+## What sently replaces
+
+| Instead of… | Use sently for… |
+| --- | --- |
+| A growing pile of vendor SDKs in call sites | Channel senders + pluggable transports |
+| Per-channel retry and error glue | Shared `SentlyError` codes and retry/fallback decorators |
+| Nodemailer when you need multi-channel or non-Node runtimes | `createMailer` / `createSMTPMailer` plus SMS, WhatsApp, and push |
+
+## What sently does not replace
+
+| Need | Where it lives |
+| --- | --- |
+| Preference centers and unsubscribe UX | Your product, or Novu / Knock / Courier |
+| Digest / batching product logic | Your product, or an orchestration platform |
+| Workflow builders and multi-step journeys | Your product, or Novu / Knock / Courier |
+| In-app notification inboxes | Your product, or an orchestration platform |
+
+Those tools (or your own routing) call sently — or any transport — to deliver. sently does not ship dashboards or per-send SaaS.
+
+## Versus a vendor SDK pile
+
+| Concern | Typical stack | sently |
+| --- | --- | --- |
+| As you add channels | New SDK, new auth, new retries | Same sender factories |
+| Failures | Per-vendor exceptions | Stable `SentlyError` codes |
+| Reliability | Ad-hoc loops per client | `RetryTransport` + `FallbackTransport` |
+| Provider swap | Rewrite call sites | Swap the transport |
+
+## Versus Nodemailer
+
+| Concern | Nodemailer | sently |
+| --- | --- | --- |
+| Channels | Email | Email · SMS · WhatsApp · Push |
+| Runtimes | Node.js | Node · Bun · Deno · CF Workers |
+| Module format | CommonJS | ESM only |
+| Edge / Workers weight | Full mail stack on import | Tree-shakeable subpaths (~6.3 KB HTTP) |
+
+Bundle size matters most on Workers and cold starts. It is supporting evidence, not the primary reason to adopt.
+
+## Versus Novu, Knock, and Courier
+
+| Concern | Orchestration platforms | sently |
+| --- | --- | --- |
+| Role | Workflows, preferences, digests, in-app | Channel delivery / transports |
+| Hosting | Usually hosted SaaS | Library in your process |
+| Pricing model | Often per-send or seat | MIT package; you pay providers |
+
+Use both when you need product orchestration **and** a typed, multi-runtime delivery layer underneath.
+
+## Troubleshooting
+
+<Accordions>
+  <Accordion title="Do I need sently if I already use Novu or Knock?">
+    Only if you want local, typed transports under your own routing — or to send outside that platform. Many teams use an orchestration tool for preferences and journeys, and a library like sently for direct transactional sends.
+  </Accordion>
+  <Accordion title="Is sently a Nodemailer drop-in?">
+    No. Migrate email with [Migrate from Nodemailer](/docs/get-started/migrate-nodemailer), then add other channels with the same sender pattern.
+  </Accordion>
+</Accordions>
+
+## Learn more
+
+- [Introduction](/docs/get-started/introduction)
+- [Stability policy](/docs/get-started/stability)
+- [Support matrix](/docs/get-started/support-matrix)
+- [Migrate from Nodemailer](/docs/get-started/migrate-nodemailer)
+
+## Next
+
+<Cards>
+  <Card title="Introduction" href="/docs/get-started/introduction" />
+  <Card title="Support matrix" href="/docs/get-started/support-matrix" />
+</Cards>

package/site/content/docs/guides/failover.mdx

@@ -0,0 +1,121 @@
+---
+title: Failover
+description: Retry inside a provider, then fail over across providers on any channel.
+icon: GitBranch
+source: "src/transports/fallback.ts"
+---
+
+When a provider blips, retry that transport first, then fail over to the next.
+The same decorator pattern works for email, SMS, WhatsApp, and push.
+
+<Callout title="The one rule">
+  Wrap each provider in `RetryTransport`, then pass the list to `FallbackTransport`. Use the channel sender that matches the transport contract.
+</Callout>
+
+## Quick start
+
+<Steps>
+  <Step title="Email — Resend then SES">
+
+```ts
+import { createMailer } from "sently/mailer";
+import { FallbackTransport } from "sently/transports/fallback";
+import { RetryTransport } from "sently/transports/retry";
+import { ResendTransport } from "sently/transports/resend";
+import { SESTransport } from "sently/transports/ses";
+
+const mailer = await createMailer({
+  transport: new FallbackTransport(
+    [
+      new RetryTransport(new ResendTransport({ apiKey: process.env.RESEND_API_KEY! })),
+      new RetryTransport(
+        new SESTransport({
+          region: process.env.AWS_REGION!,
+          accessKeyId: process.env.AWS_ACCESS_KEY_ID!,
+          secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!,
+        }),
+      ),
+    ],
+    { cooldownMs: 300_000 },
+  ),
+});
+```
+
+  </Step>
+  <Step title="SMS — Twilio then Unifonic">
+
+```ts
+import { createSmsSender } from "sently/sms";
+import { FallbackTransport } from "sently/transports/fallback";
+import { RetryTransport } from "sently/transports/retry";
+import { TwilioSmsTransport } from "sently/transports/twilio-sms";
+import { UnifonicTransport } from "sently/transports/unifonic";
+
+const sms = createSmsSender({
+  transport: new FallbackTransport(
+    [
+      new RetryTransport(
+        new TwilioSmsTransport({
+          accountSid: process.env.TWILIO_ACCOUNT_SID!,
+          authToken: process.env.TWILIO_AUTH_TOKEN!,
+        }),
+      ),
+      new RetryTransport(
+        new UnifonicTransport({
+          appSid: process.env.UNIFONIC_APPSID!,
+          senderId: "MyBrand",
+        }),
+      ),
+    ],
+    { cooldownMs: 300_000 },
+  ),
+});
+```
+
+  </Step>
+  <Step title="Inspect which provider won">
+
+```ts
+const result = await sms.send({
+  to: "+15551234567",
+  body: "Hello",
+  from: "+15557654321",
+});
+console.log(result.provider, result.providerIndex);
+```
+
+  </Step>
+</Steps>
+
+## Behavior
+
+| Behavior | Default |
+| --- | --- |
+| Fail over on 5xx / network | Yes |
+| Fail over on 400 / 401 / 403 | No (same client error on every provider) |
+| `cooldownMs` | Skip a failed provider until the cooldown ends |
+| Hooks | `onRetry` / `onFallback` on the channel sender when wired |
+
+## Troubleshooting
+
+<Accordions>
+  <Accordion title="Why did both providers reject the same message?">
+    Permanent client errors do not fail over by default. Fix the payload or credentials before expecting a second provider to succeed.
+  </Accordion>
+  <Accordion title="Can I mix email and SMS in one FallbackTransport?">
+    No. Every entry must implement the same channel contract as the sender.
+  </Accordion>
+</Accordions>
+
+## Learn more
+
+- [Retry](/docs/decorators/retry)
+- [Fallback](/docs/decorators/fallback)
+- [Support matrix](/docs/get-started/support-matrix)
+
+## Next
+
+<Cards>
+  <Card title="Fallback decorator" href="/docs/decorators/fallback" />
+  <Card title="Retry decorator" href="/docs/decorators/retry" />
+</Cards>

package/site/content/docs/guides/index.mdx

@@ -8,6 +8,8 @@ source: "README.md"
 Configure sently features around your delivery workflow.
 
 <Cards>
+  <Card title="Compare" href="/docs/guides/compare" />
+  <Card title="Failover" href="/docs/guides/failover" />
   <Card title="Adapters" href="/docs/guides/adapters" />
   <Card title="Webhooks" href="/docs/guides/webhooks" />
   <Card title="Security" href="/docs/guides/security" />

package/site/content/docs/guides/meta.json

@@ -3,6 +3,8 @@
   "icon": "Map",
   "pages": [
     "index",
+    "compare",
+    "failover",
     "adapters",
     "dkim",
     "oauth2",

package/site/content/docs/guides/security.mdx

@@ -1,17 +1,47 @@
 ---
 title: Security
-description: Protect credentials, delivery endpoints, and webhook integrity.
+description: Protect credentials, delivery endpoints, webhook integrity, and publish trust.
 icon: ShieldCheck
 source: "src/transports/webpush.ts"
 ---
 
-<Callout title="The one rule">Keep provider keys and VAPID private keys in a secrets manager or environment variables.</Callout>
+Provider API keys, VAPID private keys, and push endpoints are long-lived credentials.
+Keep them out of source control and out of unstructured logs.
 
-- Enable TLS for SMTP authentication; `requireTLS` defaults to true when auth is set.
-- Verify provider webhook signatures before parsing trusted events.
-- Do not log email bodies, SMS bodies, or full push subscription endpoints.
-- Treat a push endpoint as a delivery token.
+<Callout title="The one rule">
+  Keep provider keys and VAPID private keys in a secrets manager or environment variables.
+</Callout>
 
-<Accordions><Accordion title="Why is a push endpoint redacted in hooks?">Its path can contain a long-lived delivery token.</Accordion></Accordions>
+## Checklist
 
-<Cards><Card title="Webhooks" href="/docs/guides/webhooks" /></Cards>
+| Practice | Detail |
+| --- | --- |
+| SMTP TLS | `requireTLS` defaults to true when auth is set |
+| Webhooks | Verify signatures before trusting parsed events |
+| Logging | Do not log email/SMS bodies or full push endpoints |
+| Push | Treat subscription endpoints and FCM tokens as delivery tokens |
+| Reporting | Use private advisories — see root `SECURITY.md` |
+
+## Troubleshooting
+
+<Accordions>
+  <Accordion title="Why is a push endpoint redacted in hooks?">
+    Its path can contain a long-lived delivery token. Hook context keeps a short fingerprint.
+  </Accordion>
+  <Accordion title="Where do I report a vulnerability?">
+    Open a private GitHub Security Advisory for this repository. Do not file a public issue. Details and response targets are in [`SECURITY.md`](https://github.com/alialnaghmoush/sently/blob/main/SECURITY.md).
+  </Accordion>
+</Accordions>
+
+## Learn more
+
+- [Stability policy](/docs/get-started/stability)
+- [Webhooks](/docs/guides/webhooks)
+- [Web Push](/docs/transports/webpush)
+
+## Next
+
+<Cards>
+  <Card title="Webhooks" href="/docs/guides/webhooks" />
+  <Card title="Stability policy" href="/docs/get-started/stability" />
+</Cards>