import { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
import { E as EmailStatus, a as EmailListOptions, b as EmailListResult, I as InboxListOptions, c as InboxListResult, d as InboxEmail, e as InboxGetAttachmentOptions, f as InboxForwardOptions, S as SendEmailResult, g as InboxReplyOptions, h as SuppressionEntry, i as SuppressionReason, j as SuppressionListOptions, k as SuppressionListResult, C as CreateTemplateParams, l as CreateTemplateFromReactParams, U as UpdateTemplateParams, T as Template, m as TemplateMetadata, W as WrapsEmailConfig, n as SendEmailParams, o as SendTemplateParams, p as SendBulkTemplateParams, q as SendBulkTemplateResult, r as SendBatchParams, s as SendBatchResult } from './html-to-text-DT5aZy7u.js';
export { A as Attachment, B as BatchEmailEntry, t as BatchEntryResult, u as BulkTemplateDestination, v as CredentialsError, D as DynamoDBError, w as EmailAddress, x as EmailEvent, y as InboxAttachment, z as InboxEmailAddress, F as InboxEmailSummary, R as ReplyThreadingConfig, G as SESError, H as SES_SIMULATOR_SUCCESS, J as SandboxError, K as SendEmailBody, L as SendEmailParamsBase, V as ValidationError, M as WrapsEmailError, N as htmlToPlainText } from './html-to-text-DT5aZy7u.js';
import { S3Client } from '@aws-sdk/client-s3';
import { SESClient } from '@aws-sdk/client-ses';
import { SSMClient } from '@aws-sdk/client-ssm';
import { SESv2Client } from '@aws-sdk/client-sesv2';
import '@aws-sdk/types';
import 'react';

declare class WrapsEmailEvents {
    private client;
    private tableName;
    constructor(client: DynamoDBDocumentClient, tableName: string);
    /**
     * Get all events for a single email by messageId
     * Returns null if no events found
     */
    get(messageId: string): Promise<EmailStatus | null>;
    /**
     * List emails with events, queried via the accountId-sentAt GSI
     * Requires accountId for efficient querying
     *
     * `maxResults` bounds *messages*, not events. The GSI stores one row per
     * event, so a single DynamoDB page holds a mix of partial event sets; this
     * pages until enough distinct messages are found, then re-reads each message's
     * full event set from the base table. Without that second read `sentAt` would
     * be whichever event happened to fall inside the scan window.
     */
    list(options: EmailListOptions): Promise<EmailListResult>;
    /** All events for one messageId, read from the base table's partition. */
    private fetchMessage;
    private aggregateStatus;
    private handleDynamoDBError;
}

/**
 * WrapsInbox - Read and manage inbound emails stored in S3
 *
 * Emails are stored by the inbound Lambda processor:
 *   raw/{messageId}           - Raw MIME from SES
 *   parsed/{emailId}.json     - Parsed email JSON
 *   attachments/{emailId}/    - Extracted attachments
 */
declare class WrapsInbox {
    private s3Client;
    private bucketName;
    private sesClient;
    constructor(s3Client: S3Client, bucketName: string, sesClient?: SESClient);
    private requireSES;
    /**
     * List parsed inbound emails
     */
    list(options?: InboxListOptions): Promise<InboxListResult>;
    /**
     * Get a parsed inbound email by ID
     */
    get(emailId: string): Promise<InboxEmail>;
    /**
     * Get a presigned URL for an attachment
     */
    getAttachment(emailId: string, attachmentId: string, options?: InboxGetAttachmentOptions): Promise<string>;
    /**
     * Get a presigned URL for the raw MIME email
     */
    getRaw(emailId: string): Promise<string>;
    /**
     * Delete an inbound email and all associated files
     */
    delete(emailId: string): Promise<void>;
    /**
     * Forward an inbound email to new recipients
     *
     * Two modes:
     * - passthrough (default): Re-sends raw MIME with rewritten From/To/Subject headers
     * - wrapped: Builds a new message wrapping the original content
     */
    forward(emailId: string, options: InboxForwardOptions): Promise<SendEmailResult>;
    /**
     * Reply to an inbound email with proper threading headers (In-Reply-To, References)
     */
    reply(emailId: string, options: InboxReplyOptions): Promise<SendEmailResult>;
    private handleError;
}

type WrapsReplyThreadingOptions = {
    /**
     * SSM client used to fetch per-domain signing secrets.
     * Injected (not constructed inline) for testability.
     */
    ssmClient: SSMClient;
    /**
     * SSM parameter name prefix. Full name = prefix + fromDomain.
     * Typically `"/wraps/email/reply-secret/"`.
     */
    parameterPrefix: string;
    /**
     * Per-domain secret cache TTL in milliseconds. Defaults to 5 minutes.
     */
    cacheTtlMs?: number;
    /**
     * Default exp (seconds from now) baked into tokens. Defaults to 90 days.
     * `0` means infinite (no expiry).
     */
    defaultTtlSeconds?: number;
    /**
     * Constructor-level override for the reply domain. If unset, the reply
     * domain is auto-derived as `r.mail.{fromDomain}`. Per-call `replyDomain`
     * still wins over this.
     */
    defaultReplyDomainOverride?: string;
};
type GenerateReplyToParams = {
    fromDomain: string;
    replyDomain?: string;
    conversationId?: string;
    sendId?: string;
    /**
     * Override default TTL for this token. `0` = infinite.
     */
    ttlSeconds?: number;
};
type GenerateReplyToResult = {
    /** Full signed reply-to address: `<51-char-token>@{replyDomain}` */
    address: string;
    conversationId: string;
    sendId: string;
    /** Unix seconds when the token expires; `null` when infinite. */
    expiresAt: number | null;
};
/**
 * WrapsReplyThreading - Mint signed reply-to addresses for email threading.
 *
 * Per-domain secrets are fetched from SSM and cached for `cacheTtlMs`
 * (default 5 minutes) so rotation eventually-converges without constant
 * SSM traffic. One instance handles N sending domains transparently.
 */
declare class WrapsReplyThreading {
    private ssmClient;
    private parameterPrefix;
    private cacheTtlMs;
    private defaultTtlSeconds;
    private defaultReplyDomainOverride?;
    private cache;
    constructor(opts: WrapsReplyThreadingOptions);
    /**
     * Generate a new conversation id (11-char base64url from 8 random bytes).
     * Synchronous — no SSM call.
     */
    newConversation(): string;
    /**
     * Mint a signed reply-to address for the given sending domain.
     *
     * @throws {ValidationError} if reply threading is not enabled for `fromDomain`
     *   (SSM parameter missing).
     */
    generateReplyTo(params: GenerateReplyToParams): Promise<GenerateReplyToResult>;
    private getSecret;
}

declare class WrapsEmailSuppression {
    private client;
    constructor(client: SESv2Client);
    /**
     * Check if an email is on the suppression list
     * Returns the entry if suppressed, null if not
     */
    get(email: string): Promise<SuppressionEntry | null>;
    /**
     * Add an email to the suppression list
     * Idempotent — succeeds silently if already suppressed
     */
    add(email: string, reason: SuppressionReason): Promise<void>;
    /**
     * Remove an email from the suppression list
     * Idempotent — silently succeeds if email is not on the list
     */
    remove(email: string): Promise<void>;
    /**
     * List suppressed emails with optional filters
     */
    list(options?: SuppressionListOptions): Promise<SuppressionListResult>;
    /**
     * Route through the shared mapper so a credential-chain failure here becomes
     * a `CredentialsError` rather than escaping as raw AWS text, exactly as it
     * does on the send path.
     */
    private handleError;
    /**
     * The region to name in an error, resolved only when the message will use it.
     * Resolution can walk to IMDS, so every other failure skips it.
     */
    private errorRegion;
}

declare class WrapsEmail {
    private sesClient;
    private sesv2Client;
    /**
     * Inbox for reading inbound emails
     * Only available when inboxBucketName is configured
     */
    readonly inbox: WrapsInbox | null;
    /**
     * Email event history from DynamoDB
     * Only available when historyTableName is configured
     */
    readonly events: WrapsEmailEvents | null;
    /**
     * Suppression list management (SES v2)
     * Always available when credentials are configured
     */
    readonly suppression: WrapsEmailSuppression;
    /**
     * Signed reply-to threading
     * Only available when `replyThreading` is configured
     */
    readonly replyThreading: WrapsReplyThreading | null;
    /**
     * Constructor-level `replyDomain` override, preserved so per-send
     * resolution can honor it without re-reading config.
     */
    private readonly replyDomainOverride;
    /** Clients this instance created itself and is responsible for closing. */
    private readonly ownedClients;
    /**
     * Region resolution shared by every client this instance builds, so the
     * profile/IMDS legs of the chain are walked at most once.
     */
    private readonly region;
    /**
     * Template management methods
     */
    readonly templates: {
        create: (params: CreateTemplateParams) => Promise<void>;
        createFromReact: (params: CreateTemplateFromReactParams) => Promise<void>;
        update: (params: UpdateTemplateParams) => Promise<void>;
        get: (name: string) => Promise<Template>;
        list: () => Promise<TemplateMetadata[]>;
        delete: (name: string) => Promise<void>;
    };
    constructor(config?: WrapsEmailConfig);
    /**
     * Send a single email through SES.
     *
     * Exactly one primary body is required — `html`, `react`, or `text` — and the
     * type rejects both "no body" and `html` + `react` together at compile time.
     * A plain-text part is auto-generated from `html` when `text` is omitted.
     * Passing `attachments` switches to `SendRawEmail` transparently.
     *
     * @param params - Sender, recipients, subject, and body. See {@link SendEmailParams}.
     * @returns The SES `messageId` and `requestId`, plus `conversationId` /
     *   `sendId` when the send was signed for reply threading.
     * @throws {ValidationError} Before any network call, when a field is missing
     *   or an address is malformed. `error.field` names the offender.
     * @throws {CredentialsError} When the AWS credential chain produced nothing —
     *   nothing was sent. The message lists every way to supply credentials.
     * @throws {SandboxError} When SES rejects the send because an identity is not
     *   verified in the region used. The message separates the two causes: a
     *   region mismatch and the SES sandbox.
     * @throws {SESError} For every other SES failure, carrying `code`,
     *   `requestId`, and `retryable`.
     *
     * @example
     * ```typescript
     * import { WrapsEmail, SandboxError } from '@wraps.dev/email';
     *
     * // Region comes from AWS_REGION when not passed explicitly.
     * const email = new WrapsEmail();
     *
     * try {
     *   const result = await email.send({
     *     from: 'hello@yourdomain.com',
     *     to: 'user@example.com',
     *     subject: 'Welcome!',
     *     html: '<h1>Hello</h1>',
     *   });
     *   console.log(result.messageId);
     * } catch (error) {
     *   if (error instanceof SandboxError) {
     *     // Sandboxed accounts can still prove the pipeline works:
     *     // send to success@simulator.amazonses.com.
     *     console.error(error.message);
     *   }
     * }
     * ```
     */
    send(params: SendEmailParams): Promise<SendEmailResult>;
    private sendWithAttachments;
    /**
     * Resolve the `ReplyToAddresses` for a send, optionally minting a signed
     * reply-to address when `conversationId` is set and reply threading is
     * configured.
     */
    private resolveReplyTo;
    /**
     * Resolve the region this client actually sends to. Errors name it, so an
     * identity verified in another region is distinguishable from a sandbox block.
     */
    private resolvedRegion;
    private handleSESError;
    /**
     * Send email using an SES template
     */
    sendTemplate(params: SendTemplateParams): Promise<SendEmailResult>;
    /**
     * Send bulk emails using an SES template (up to 50 recipients)
     */
    sendBulkTemplate(params: SendBulkTemplateParams): Promise<SendBulkTemplateResult>;
    /**
     * Send batch emails with unique content per recipient (max 100 entries).
     *
     * Unlike `sendBulkTemplate()` which requires a pre-created SES template,
     * `sendBatch()` lets you provide different subject/html/text per recipient
     * inline without creating a template first.
     *
     * Uses SES v2 `SendBulkEmailCommand` with inline template content.
     *
     * **Note:** Literal `{{` and `}}` in HTML content will be interpreted as
     * SES template placeholders.
     *
     * @example
     * ```typescript
     * const result = await wraps.sendBatch({
     *   from: 'hello@example.com',
     *   entries: [
     *     { to: 'alice@example.com', subject: 'Hi Alice', html: '<p>Hello Alice!</p>' },
     *     { to: 'bob@example.com', subject: 'Hi Bob', html: '<p>Hello Bob!</p>' },
     *   ],
     * });
     * console.log(result.successCount); // 2
     * ```
     */
    sendBatch(params: SendBatchParams): Promise<SendBatchResult>;
    /**
     * Create a new SES template
     */
    private createTemplate;
    /**
     * Create template from React.email component
     */
    private createTemplateFromReact;
    /**
     * Update an existing SES template
     */
    private updateTemplate;
    /**
     * Get template details
     */
    private getTemplate;
    /**
     * List all templates
     */
    private listTemplates;
    /**
     * Delete a template
     */
    private deleteTemplate;
    /**
     * Close the SES client and clean up resources
     */
    destroy(): void;
}

type EncodeReplyTokenInput = {
    kid: number;
    convId: Buffer;
    sendId: Buffer;
    exp: number;
    secret: Buffer;
};
/**
 * Encode a signed reply token.
 *
 * Produces the 51-char base64url local-part that the inbound Lambda verifies.
 * Byte-identical to `@wraps/core`'s `encodeReplyToken`.
 */
declare function encodeReplyToken(input: EncodeReplyTokenInput): string;
/**
 * Generate a random 11-char base64url conversation id (8 random bytes).
 */
declare function generateConversationId(): string;
/**
 * Generate a random 11-char base64url send id (8 random bytes).
 */
declare function generateSendId(): string;

export { CreateTemplateFromReactParams, CreateTemplateParams, EmailListOptions, EmailListResult, EmailStatus, type GenerateReplyToParams, type GenerateReplyToResult, InboxEmail, InboxForwardOptions, InboxGetAttachmentOptions, InboxListOptions, InboxListResult, InboxReplyOptions, SendBatchParams, SendBatchResult, SendBulkTemplateParams, SendBulkTemplateResult, SendEmailParams, SendEmailResult, SendTemplateParams, SuppressionEntry, SuppressionListOptions, SuppressionListResult, SuppressionReason, Template, TemplateMetadata, UpdateTemplateParams, WrapsEmail, WrapsEmailConfig, WrapsEmailEvents, WrapsEmailSuppression, WrapsInbox, WrapsReplyThreading, type WrapsReplyThreadingOptions, encodeReplyToken, generateConversationId, generateSendId };