@lssm-tech/integration.job-application-email
Allocates opaque per-application Resend aliases, verifies email.received webhooks over the raw body, deduplicates svix-id, authorizes the recipient before fetching content, sanitizes untrusted HTML, scans attachments, and reserves account-verification effects before opening links.
createApplicationResendWebhookIngressV1 is the injectable API composition port. Verification-link execution requires the current durable work item, lease owner, and fence. The exact candidate URL is reserved before redirect resolution or any browser action; replay, stale claims, and cancellation perform no link network work.
Inbound messages with a verification-link or OTP candidate enqueue an opaque candidate-scoped challenge only after the signed event is reserved and the sanitized inbox object is stored. Queue payloads contain the message reference, candidate kinds, and request digest—not links, codes, or message content.
completeAccountVerificationOtpV1 then reserves the exact worker effect before placing the short-lived code in the candidate material vault and gives the browser only its opaque reference. Ambiguous codes, stale fences, unexpected senders, expiry, replay, and cancellation fail closed.
createResendReceivingContentClientV1 binds the receiving ports to Resend's Receiving API. The isolated inbox worker owns the API key and an explicit allowlist for Resend attachment hosts. Attachment downloads deny redirects, stream into a configured bound, require the provider-declared byte size, and never expose signed URLs to agent prompts or browser surfaces.
