feat: inboxes endpoints

[isabellaaquino]

Summary by cubic

Adds inbox management to the Resend Node.js client, enabling programmatic control over inboxes, threads, labels, and drafts. The client now exposes resend.inboxes with nested resources, and the package version is bumped to 6.28.0-preview-inboxes.0 as a preview release.

New Features

• Adds resend.inboxes with create, list, get, update, and remove methods.
• Adds resend.inboxes.threads for listing, fetching, updating, and removing threads.
• Adds resend.inboxes.threads.emails for getting, replying to, and forwarding thread emails.
• Adds resend.inboxes.labels and resend.inboxes.drafts with full CRUD, plus sending drafts.
• Exports all new inbox types and interfaces from the package entry point.
• Updates the readme with inbox examples and the changelog for 6.28.0-preview-inboxes.0.

^{Written for commit b93e8b0. Summary will update on new commits.}

[cubic-dev-ai]

Running ultrareview automatically — This PR adds a large new public API surface (inboxes, threads, drafts, labels) with many new endpoint methods and custom query/pagination logic, so a deeper review reduces the risk of subtle bugs affecting all users of these new endpoints.. I'll post findings when complete.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/resend@1088

commit: b93e8b0

[cubic-dev-ai]

Ultrareview completed in 10m 19s

4 issues found across 47 files

Confidence score: 2/5

• src/inboxes/inboxes.spec.ts contains a hardcoded Resend API key, creating a credential-exposure risk; redact it from the test recording and revoke or rotate the key.
• The new inbox operations in src/resend.ts depend on API keys having inbox permissions, so production calls may fail for keys without that access; confirm the required permissions and document or enforce the prerequisite.
• src/inboxes/threads/interfaces/update-inbox-thread.interface.ts types the PATCH response as an inbox instead of an inbox thread, which can prevent consumers from correctly narrowing the result; update it to the thread response type.
• src/inboxes/labels/interfaces/update-inbox-label.interface.ts allows an empty label update payload, permitting no-op PATCH requests; require at least name or color with RequireAtLeastOne.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/inboxes/threads/interfaces/update-inbox-thread.interface.ts">

<violation number="1" location="src/inboxes/threads/interfaces/update-inbox-thread.interface.ts:16">
P2: The update response is typed as an inbox rather than an inbox thread. This disagrees with the other thread response types and prevents consumers from narrowing the PATCH result as an `inbox_thread`; use the thread object literal or reuse `InboxThreadSummary`.</violation>
</file>

<file name="src/inboxes/labels/interfaces/update-inbox-label.interface.ts">

<violation number="1" location="src/inboxes/labels/interfaces/update-inbox-label.interface.ts:4">
P2: `UpdateInboxLabelOptions` permits `{}`, allowing typed callers to send a no-op label PATCH. Define this payload with `RequireAtLeastOne` so every update changes `name` or `color`, matching the other inbox PATCH contracts.</violation>
</file>

<file name="src/resend.ts">

<violation number="1" location="src/resend.ts:68">
P2: Custom agent: **API Key Permission Check SDK Methods**

The new `inboxes` surface adds authenticated inbox, thread, draft, label, reply, and forward operations. Confirm production API keys have the required inbox permissions before release to prevent authorization failures.</violation>
</file>

<file name="src/inboxes/inboxes.spec.ts">

<violation number="1" location="src/inboxes/inboxes.spec.ts:14">
P1: Custom agent: **API Key Permission Check SDK Methods**

A hardcoded Resend API key (`re_zKa4RCko_Lhm9ost2YjNCctnPjbLw8Nop`) is committed in the test file. Secrets/API tokens must be redacted from test recordings and specs even when the keys are ephemeral; the fixture should use a non-sensitive placeholder instead (e.g., `re_<YOUR_API_KEY>` or an env-driven value).</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>