delivery

type CertFetcher func(ctx context.Context, url string) ([]byte, error)

type Consumer struct {
	// contains filtered or unexported fields
}

type CorrelatedMessage struct {
	MessageID string
	UserID    string
	// AgentID is the agent's own address (an agent identity's id IS its
	// email), so it doubles as agent_email on event payloads.
	AgentID        string
	Subject        string
	ConversationID string
	Method         string
	MessageType    string
	From           string
	To             []string
	CC             []string
	BCC            []string
}

type Event struct {
	Kind            EventKind
	SESMessageID    string // the mail.messageId — correlates to messages.provider_message_id
	ProviderEventID string
	OccurredAt      time.Time
	// E2AMessageID is the e2a message id echoed back by SES from the
	// MessageIDHeader stamped at submit time (`mail.headers` — present only
	// when the SES configuration set enables "include original headers").
	// It is the correlation fallback for the SMTP-accept↔mark-sent crash
	// window; empty when headers are absent or the marker isn't among them.
	E2AMessageID string
	Recipients   []RecipientOutcome
	// BounceType / BounceSubType carry the SES bounce classification (Bounce
	// events only; empty otherwise). BounceType is normalized to the stable
	// event vocabulary — permanent | transient | undetermined — the value
	// email.bounced's bounce_type field emits; BounceSubType is the raw SES
	// bounceSubType (e.g. General, NoEmail, MailboxFull).
	BounceType    string
	BounceSubType string
}

type EventKind string

type FailureSource string

type FiredEvent struct {
	UserID         string
	AgentID        string
	ConversationID string
	MessageID      string
	Type           string
	Data           any
	DedupKey       string
	OccurredAt     time.Time
}

type Firer func(ctx context.Context, tx pgx.Tx, e FiredEvent) error

type ProviderAcceptanceFinalizer func(ctx context.Context, tx pgx.Tx, messageID string) error

type RecipientOutcome struct {
	Address  string
	Status   Status
	Detail   string
	Suppress bool // hard bounce or complaint → add to the suppression list
}

type SNSMessage struct {
	Type             string `json:"Type"` // Notification | SubscriptionConfirmation | UnsubscribeConfirmation
	MessageId        string `json:"MessageId"`
	TopicArn         string `json:"TopicArn"`
	Subject          string `json:"Subject,omitempty"` // Notifications only, optional
	Message          string `json:"Message"`
	Timestamp        string `json:"Timestamp"`
	SignatureVersion string `json:"SignatureVersion"`
	Signature        string `json:"Signature"`
	SigningCertURL   string `json:"SigningCertURL"`
	// SubscribeURL and Token are present only on SubscriptionConfirmation and
	// UnsubscribeConfirmation envelopes.
	SubscribeURL string `json:"SubscribeURL,omitempty"`
	Token        string `json:"Token,omitempty"`
}

type Status string

type Store interface {
	// CorrelateBySESMessageID finds the outbound message + owning user + agent
	// (plus the message fields the event payloads need — same single SELECT,
	// no extra query) by the SES-assigned provider_message_id captured at send
	// time. found=false when the id is unknown (message deleted, or an event
	// for another deployment).
	CorrelateBySESMessageID(ctx context.Context, sesMessageID string) (m *CorrelatedMessage, found bool, err error)
	// CorrelateByE2AMessageID finds the outbound message by the e2a message id
	// SES echoed back from the MessageIDHeader stamped at submit time — the
	// correlation fallback for the SMTP-accept↔mark-sent crash window, where
	// the provider id from the 250 response was never captured. Same return
	// shape as CorrelateBySESMessageID; found=false for unknown/non-outbound.
	CorrelateByE2AMessageID(ctx context.Context, e2aMessageID string) (m *CorrelatedMessage, found bool, err error)
	// RecordProviderAcceptEvidence durably notes that SES reported having
	// accepted this message's submission (any correlated post-acceptance
	// notification kind) and repairs a provider_message_id lost to the
	// crash window. Idempotent. The worker/terminal-reconciler guards read
	// this evidence before declaring a terminal failure.
	WithTx(ctx context.Context, fn func(tx pgx.Tx) error) error
	// HasApplicableRecipientTx locks and checks the persisted immutable
	// envelope. Recipient-bearing feedback must pass this preflight before it
	// can establish provider acceptance or trigger canonical sent finalization.
	HasApplicableRecipientTx(ctx context.Context, tx pgx.Tx, messageID string, addresses []string) (bool, error)
	RecordProviderAcceptEvidenceTx(ctx context.Context, tx pgx.Tx, messageID, sesMessageID string, occurredAt time.Time) error
	ProviderAcceptancePendingTx(ctx context.Context, tx pgx.Tx, messageID string) (bool, error)
	RecordProviderRejectTx(ctx context.Context, tx pgx.Tx, messageID, detail string, occurredAt time.Time) error
	// RecordDeliveryOutcome upserts the per-recipient status monotonically and
	// recomputes the message rollup (worst status by precedence). Idempotent:
	// a duplicate/older event is a no-op.
	RecordDeliveryOutcomeTx(ctx context.Context, tx pgx.Tx, messageID, address string, status Status, detail string) (applied bool, err error)
	// AddSuppression idempotently inserts a (user, address) suppression.
	// added=false when it already existed (so the event fires at most once).
	AddSuppressionTx(ctx context.Context, tx pgx.Tx, userID, address, reason, source, sourceMessageID string) (suppressionID string, added bool, err error)
	AppendLifecycleTx(ctx context.Context, tx pgx.Tx, input messagelifecycle.AppendInput) (messagelifecycle.MessageLifecycleTransition, error)
}

type Verifier struct {
	// contains filtered or unexported fields
}