Add email to your app with one prompt.

Add transactional email to this app using the Mailumi email API.

Read the reference first: https://mailumi.com/docs.md (complete docs in one file: https://mailumi.com/llms-full.txt).

Requirements:
1. Call Mailumi only from server-side code (an API route, server action or backend/edge function). Never use the API key in browser or mobile code.
2. Read the key from the environment variable MAILUMI_API_KEY and the sender from MAILUMI_FROM, for example "Acme <hello@yourdomain.com>". Add both to .env.example without real values.
3. Create one helper, sendEmail({ to, subject, html, text, idempotencyKey }). In a JavaScript or TypeScript project, install the official package (npm install mailumi) and call new Mailumi(process.env.MAILUMI_API_KEY).emails.send({ from, to, subject, html, text }, { idempotencyKey }), which resolves to { data, error }. In any other language, send POST https://mailumi.com/api/v1/emails with the headers "Authorization: Bearer <MAILUMI_API_KEY>", "Content-Type: application/json" and "Idempotency-Key", and a JSON body with from, to, subject, html and text, using the project's existing HTTP client.
4. Use a stable idempotency key for each logical email, such as "welcome-<userId>", so a retry never sends twice.
5. If the result has an error, throw it with its message. The mailumi package already retries 429 and 5xx with the same idempotency key; with plain HTTP, retry 429 and 503 up to 3 times with backoff, using the same key.
6. Use the helper for: [describe your emails, for example a welcome email after sign-up and a password reset email].
7. Write simple, inline-styled HTML that works in email clients, and a plain-text version of each email.

When you are done, tell me which environment variables to set and where.

Add a webhook endpoint to this app that receives Mailumi email events.

Read the reference first: https://mailumi.com/docs.md (complete docs in one file: https://mailumi.com/llms-full.txt).

Requirements:
1. Create a server-side POST endpoint, for example /api/webhooks/mailumi.
2. Read the raw request body as text before parsing JSON; the signature covers the exact bytes.
3. Verify the Standard Webhooks signature. In a JavaScript or TypeScript project, use verifyWebhook({ payload: rawBody, headers: request.headers, secret: process.env.MAILUMI_WEBHOOK_SECRET }) from the official mailumi package; it resolves to { data: event, error }. Otherwise verify it yourself: the headers are webhook-id, webhook-timestamp and webhook-signature. The secret is in MAILUMI_WEBHOOK_SECRET and starts with "whsec_"; the HMAC key is the base64-decoded part after that prefix. Compute base64(HMAC-SHA256(key, webhook-id + "." + webhook-timestamp + "." + rawBody)) and compare it in constant time with each space-separated entry of webhook-signature, after its "v1," prefix. Respond 401 if none match or the timestamp is more than 5 minutes from now.
4. The event is JSON: { id, type, created_at, data }. data.email_id identifies the email and data.recipient the recipient the event is about.
5. Save each event id once (unique constraint) and ignore repeats; Mailumi retries failed deliveries with the same id.
6. Handle email.sent, email.delivered, email.delivery_delayed, email.bounced, email.complained, email.opened, email.clicked and email.failed: [describe what should happen, for example mark an address as invalid on email.bounced].
7. Respond 200 within 8 seconds and move slow work to a background job.

When you are done, tell me the endpoint URL to add in Mailumi under Dashboard → Webhooks.

Let this app receive incoming email through Mailumi.

Read the reference first: https://mailumi.com/docs.md (complete docs in one file: https://mailumi.com/llms-full.txt).

Requirements:
1. Create a server-side POST endpoint, for example /api/webhooks/mailumi-inbound.
2. Verify the Standard Webhooks signature before trusting anything: read the raw body as text, then check it with verifyWebhook from the official mailumi package in JavaScript or TypeScript, or in other languages check webhook-id, webhook-timestamp and webhook-signature with HMAC-SHA256 and the base64 part of MAILUMI_WEBHOOK_SECRET after "whsec_", exactly as the docs describe. Respond 401 if it does not match.
3. Handle events with type "email.received". data contains email_id, from, to, cc, reply_to, subject, text, html, message_id, spam and attachments.
4. Each attachment has filename, content_type, size and download_url. Download it from the server with the header "Authorization: Bearer <MAILUMI_API_KEY>" (a key with the email:read permission). Never send that URL or key to the browser.
5. Save each event id once and ignore repeats.
6. [Describe what to do with incoming email, for example create a support ticket or add the reply to a conversation.]
7. Respond 200 within 8 seconds; process large attachments in a background job.

Replace this app's current email provider (for example Resend, SendGrid, Mailgun, Postmark or SMTP with Nodemailer) with the Mailumi email API.

Read the reference first: https://mailumi.com/docs.md (complete docs in one file: https://mailumi.com/llms-full.txt, migration guide: https://mailumi.com/migration).

Requirements:
1. Find every place that sends email and route it through one server-side helper, sendEmail({ to, subject, html, text, idempotencyKey }). In JavaScript or TypeScript, use the official mailumi package (npm install mailumi); its emails.send and batch.send match the Resend SDK and also return { data, error }. In other languages, call POST https://mailumi.com/api/v1/emails with "Authorization: Bearer <MAILUMI_API_KEY>".
2. Keep the same senders, subjects and templates. Map cc, bcc, reply_to, attachments (base64 content and filename), custom headers and tags to the Mailumi fields in the docs.
3. Send a stable Idempotency-Key per logical email and retry 429 and 503 with the same key.
4. Replace the old provider's webhooks with a Mailumi webhook endpoint that verifies the Standard Webhooks signature with MAILUMI_WEBHOOK_SECRET, and map the old event names to Mailumi's email.* events.
5. Remove the old provider's package and environment variables once nothing uses them, and update .env.example.
6. List anything that has no direct equivalent so I can decide what to do.

If the app sends through SMTP and I only want to change settings, keep the SMTP code and point it at Mailumi instead: host smtp.mailumi.com, port 465 with TLS or 587 with STARTTLS, username mailumi, password MAILUMI_API_KEY.

# Mailumi email API

This project sends and receives email with Mailumi. Complete reference: https://mailumi.com/llms-full.txt

- Base URL: https://mailumi.com/api/v1. Authenticate with the header "Authorization: Bearer $MAILUMI_API_KEY". Call Mailumi only from server-side code; never expose the key to browsers or mobile apps.
- JavaScript and TypeScript: use the official package (npm install mailumi). const mailumi = new Mailumi(process.env.MAILUMI_API_KEY); const { data, error } = await mailumi.emails.send({ from, to, subject, html }, { idempotencyKey }). Methods never throw for API errors; they resolve to { data, error }. Verify webhooks with verifyWebhook({ payload: rawBody, headers, secret }).
- Send: POST /emails with JSON { from, to, subject, html and/or text } and optional cc, bcc, reply_to, attachments [{ filename, content (base64), content_type, content_id }], headers, tags [{ name, value }] and scheduled_at. The from domain must be verified in Mailumi.
- Batch: POST /emails/batch with an array of up to 100 emails (no attachments or scheduled_at). Templates: pass template_id and variables instead of subject and html.
- Software that only speaks SMTP: host smtp.mailumi.com, port 465 (TLS) or 587 (STARTTLS), username mailumi, password $MAILUMI_API_KEY.
- Always send an Idempotency-Key header that is stable for each logical email. Retry 429 and 503 with the same key.
- Errors are JSON { "error": "message", "code": "machine_readable_code" } with a 4xx or 5xx status. On 429, wait the seconds in the Retry-After header. OpenAPI description: https://mailumi.com/openapi.json
- Webhooks use the Standard Webhooks format. Verify webhook-signature ("v1," + base64 HMAC-SHA256 of webhook-id + "." + webhook-timestamp + "." + raw body) with the base64 part of MAILUMI_WEBHOOK_SECRET after "whsec_", in constant time. Reject timestamps older than 5 minutes and process each event id once.
- Events: email.sent, email.delivered, email.delivery_delayed, email.bounced, email.complained, email.opened, email.clicked, email.failed, email.unsubscribed, email.received.