ePDS@0.7.0

Who should read this release

• Operators:
  • Email delivery logs use a consistent recipient field.
  • OTP send logs now record how long the email handoff took, the provider's message ID, and the SMTP server response.
  • Optional email-event logging for operators who choose the third-party Resend service to send email; ePDS continues to support other email providers.

Minor Changes

• #197 ce25beb Thanks @aspiers! - Email delivery logs use a consistent recipient field.

  Affects: Operators

  Operators: All four email delivery paths now log the recipient as email: client-branded OTP, standard sign-in OTP, welcome OTP, and backup-email verification. Update structured-log queries for Sent client-branded OTP email to read email instead of to.

• #203 2193515 Thanks @aspiers! - OTP send logs now record how long the email handoff took, the provider's message ID, and the SMTP server response.

  Affects: Operators

  Operators: every OTP email completion line (all four paths — client-branded, sign-in, welcome, backup-email verification) now carries elapsedMs, messageId, and smtpResponse alongside email. messageId lets these logs be joined to Resend delivery events; elapsedMs isolates a slow SMTP handoff from other causes of late-arriving codes. Failed sends log elapsedMs too, on the existing better-auth: failed to send OTP email error line.

• #198 2bf9af4 Thanks @aspiers! - Optional email-event logging for operators who choose the third-party Resend service to send email; ePDS continues to support other email providers.

  Affects: Operators

  Operators: ePDS remains compatible with any SMTP provider and does not require Resend. Operators who already use Resend can opt in by registering https://<AUTH_HOSTNAME>/webhooks/resend for the documented email events and setting RESEND_WEBHOOK_SECRET; logs include delivery, open, complaint, suppression, and scheduling events. The route verifies each webhook, logs only events whose sender exactly matches SMTP_FROM, acknowledges unsupported click and inbound events without logging their payloads, and does not persist webhook data.