ESP response codes mapped to internal status model

When a worker catches all ESP errors with a single catch block and re-throws them into the retry pipeline, invalid email addresses are retried five times before being discarded, burning send quota and generating five bounce events against your domain reputation. SendGrid and Mailgun rate response codes differently: a 400 (invalid address) is permanent; a 503 (service unavailable) is transient; a 429 (rate limit) needs a long backoff. Treating all three identically is the mechanism behind CWE-390 (detection of errors without action) and CWE-400 (resource exhaustion from unnecessary retry).

Create a classifyEspError function in lib/email/errors.ts and use it in the worker to route each failure class to the correct outcome:

export type EmailFailureKind = 'permanent' | 'transient' | 'rate_limited' | 'quota_exceeded'

export function classifyEspError(err: unknown): EmailFailureKind {
  const code = (err as { code?: number; statusCode?: number }).statusCode
  if (code === 429) return 'rate_limited'
  if (code && code >= 400 && code < 500) return 'permanent'
  if (code && code >= 500) return 'transient'
  return 'transient'
}

In the job processor, return (acknowledge without retry) on permanent and re-throw on transient so BullMQ applies its backoff schedule.