@agentisend/sdk-node 0.1.0

package/dist/webhook-signing.js

@@ -0,0 +1,125 @@
+import crypto from 'node:crypto';
+/**
+ * Webhook signing — Stripe-shaped HMAC-SHA256.
+ *
+ * Header value format: `t=<unix seconds>,v1=<hmac_hex>`
+ * where hmac = HMAC-SHA256(secret, `${t}.${raw_body}`).
+ *
+ * Ported from a proven webhook-signing.ts; branding
+ * renamed X-Warmy-* -> X-AgentiSend-*, timestamps are unix seconds
+ * per the AgentiSend wire spec (PRD F4 / B2).
+ */
+/** 5-minute tolerance window for signature freshness. */
+export const SIGNATURE_TOLERANCE_SECONDS = 5 * 60;
+export const SIGNATURE_HEADER = 'x-agentisend-signature';
+export const EVENT_ID_HEADER = 'x-agentisend-event-id';
+export const EVENT_TYPE_HEADER = 'x-agentisend-event-type';
+export const TIMESTAMP_HEADER = 'x-agentisend-timestamp';
+export const REPLAY_HEADER = 'x-agentisend-replay';
+/**
+ * M5.11 — Svix's header set, beside ours, opt-in per endpoint.
+ *
+ * A receiver migrating from Resend already has a verifier: the `svix` library,
+ * or the twenty lines it documents. Making them rewrite it to accept our
+ * header is a migration cost with nothing on the other side of it, so an
+ * endpoint can ask for both and keep the verifier it has.
+ *
+ * The scheme is Svix's, exactly: HMAC-SHA256 over `${id}.${timestamp}.${body}`
+ * with the key being the base64-decoded bytes after the `whsec_` prefix, and
+ * the value a space-separated list of `v1,<base64>` — a list because Svix
+ * rotates by sending old and new signatures together.
+ */
+export const SVIX_ID_HEADER = 'svix-id';
+export const SVIX_TIMESTAMP_HEADER = 'svix-timestamp';
+export const SVIX_SIGNATURE_HEADER = 'svix-signature';
+/** The key bytes Svix derives from a `whsec_`-prefixed secret. */
+function svixKey(secret) {
+    const raw = secret.startsWith('whsec_') ? secret.slice('whsec_'.length) : secret;
+    return Buffer.from(raw, 'base64');
+}
+/** `v1,<base64 hmac>` over `${messageId}.${timestampSeconds}.${body}`. */
+export function signSvixPayload(secret, messageId, timestampSeconds, body) {
+    const hmac = crypto.createHmac('sha256', svixKey(secret));
+    hmac.update(`${messageId}.${timestampSeconds}.${body}`);
+    return `v1,${hmac.digest('base64')}`;
+}
+/** The three headers a Svix-shaped verifier reads. */
+export function generateSvixHeaders(secret, messageId, timestampSeconds, body) {
+    return {
+        [SVIX_ID_HEADER]: messageId,
+        [SVIX_TIMESTAMP_HEADER]: String(timestampSeconds),
+        [SVIX_SIGNATURE_HEADER]: signSvixPayload(secret, messageId, timestampSeconds, body),
+    };
+}
+/** Sign a raw body at a given unix-second timestamp. Pure. */
+export function signWebhookPayload(secret, timestampSeconds, body) {
+    const hmac = crypto.createHmac('sha256', secret);
+    hmac.update(`${timestampSeconds}.${body}`);
+    return `t=${timestampSeconds},v1=${hmac.digest('hex')}`;
+}
+/**
+ * Verify a signature header against a raw body. Timing-safe on the
+ * comparison path; every malformed input returns false, never throws.
+ */
+export function verifyWebhookSignature(secret, signatureHeader, body, options = {}) {
+    const nowSeconds = options.nowSeconds ?? Math.floor(Date.now() / 1000);
+    const toleranceSeconds = options.toleranceSeconds ?? SIGNATURE_TOLERANCE_SECONDS;
+    try {
+        let timestamp = null;
+        let signature = null;
+        for (const part of signatureHeader.split(',')) {
+            const eq = part.indexOf('=');
+            if (eq === -1)
+                continue;
+            const key = part.slice(0, eq).trim();
+            const value = part.slice(eq + 1).trim();
+            if (key === 't') {
+                timestamp = Number.parseInt(value, 10);
+                if (Number.isNaN(timestamp))
+                    return false;
+            }
+            else if (key === 'v1') {
+                signature = value;
+            }
+        }
+        if (timestamp === null || timestamp <= 0 || signature === null) {
+            return false;
+        }
+        if (Math.abs(nowSeconds - timestamp) > toleranceSeconds) {
+            return false;
+        }
+        const hmac = crypto.createHmac('sha256', secret);
+        hmac.update(`${timestamp}.${body}`);
+        const expected = Buffer.from(hmac.digest('hex'), 'hex');
+        // Hex-decoding arbitrary input can yield a buffer of any length;
+        // timingSafeEqual throws on length mismatch, so guard first.
+        const provided = Buffer.from(signature, 'hex');
+        if (provided.length !== expected.length) {
+            return false;
+        }
+        return crypto.timingSafeEqual(provided, expected);
+    }
+    catch {
+        return false;
+    }
+}
+/** Full delivery header set for an event payload. */
+export function generateWebhookHeaders(eventId, eventType, timestampSeconds, signature, replay = false, options = {}) {
+    const headers = {
+        'content-type': 'application/json',
+        [EVENT_ID_HEADER]: eventId,
+        [EVENT_TYPE_HEADER]: eventType,
+        [TIMESTAMP_HEADER]: String(timestampSeconds),
+        [SIGNATURE_HEADER]: signature,
+    };
+    if (replay) {
+        headers[REPLAY_HEADER] = 'true';
+    }
+    if (options.svixCompat) {
+        // Beside, never instead: an endpoint that opted in still gets our header,
+        // so turning the flag on cannot break a receiver that reads it.
+        Object.assign(headers, generateSvixHeaders(options.svixCompat.secret, eventId, timestampSeconds, options.svixCompat.body));
+    }
+    return headers;
+}
+//# sourceMappingURL=webhook-signing.js.map

package/dist/webhook-signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-signing.js","sourceRoot":"","sources":["../src/webhook-signing.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;GASG;AAEH,yDAAyD;AACzD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,CAAC;AAElD,MAAM,CAAC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AACzD,MAAM,CAAC,MAAM,eAAe,GAAG,uBAAuB,CAAC;AACvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC;AAC3D,MAAM,CAAC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AACzD,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAEnD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC;AACxC,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AACtD,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAEtD,kEAAkE;AAClE,SAAS,OAAO,CAAC,MAAc;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACjF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,SAAiB,EACjB,gBAAwB,EACxB,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,gBAAgB,IAAI,IAAI,EAAE,CAAC,CAAC;IACxD,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AACvC,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,SAAiB,EACjB,gBAAwB,EACxB,IAAY;IAEZ,OAAO;QACL,CAAC,cAAc,CAAC,EAAE,SAAS;QAC3B,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;QACjD,CAAC,qBAAqB,CAAC,EAAE,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,CAAC;KACpF,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,gBAAwB,EACxB,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,GAAG,gBAAgB,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,gBAAgB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1D,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,eAAuB,EACvB,IAAY,EACZ,UAAyB,EAAE;IAE3B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACvE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,2BAA2B,CAAC;IACjF,IAAI,CAAC;QACH,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,SAAS,GAAkB,IAAI,CAAC;QAEpC,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAE,SAAS;YACxB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;gBAChB,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACvC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;oBAAE,OAAO,KAAK,CAAC;YAC5C,CAAC;iBAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACxB,SAAS,GAAG,KAAK,CAAC;YACpB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC,GAAG,gBAAgB,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QAExD,iEAAiE;QACjE,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAYD,qDAAqD;AACrD,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,SAAiB,EACjB,gBAAwB,EACxB,SAAiB,EACjB,MAAM,GAAG,KAAK,EACd,UAAgC,EAAE;IAElC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,CAAC,eAAe,CAAC,EAAE,OAAO;QAC1B,CAAC,iBAAiB,CAAC,EAAE,SAAS;QAC9B,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,gBAAgB,CAAC;QAC5C,CAAC,gBAAgB,CAAC,EAAE,SAAS;KAC9B,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,CAAC,MAAM,CACX,OAAO,EACP,mBAAmB,CACjB,OAAO,CAAC,UAAU,CAAC,MAAM,EACzB,OAAO,EACP,gBAAgB,EAChB,OAAO,CAAC,UAAU,CAAC,IAAI,CACxB,CACF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -0,0 +1,65 @@
+{
+  "name": "@agentisend/sdk-node",
+  "version": "0.1.0",
+  "description": "Typed Node client for the AgentiSend API.",
+  "type": "module",
+  "license": "MIT",
+  "homepage": "https://agentisend.com/docs",
+  "bugs": {
+    "email": "hello@agentisend.com"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/fortuneflick/agentisend-claude-plugin.git"
+  },
+  "keywords": [
+    "email",
+    "email-api",
+    "transactional-email",
+    "webhooks",
+    "agents",
+    "resend-alternative"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "agentisend": "./dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./compat-resend": {
+      "types": "./dist/compat-resend.d.ts",
+      "default": "./dist/compat-resend.js"
+    },
+    "./cli-commands": {
+      "types": "./dist/cli/commands.d.ts",
+      "default": "./dist/cli/commands.js"
+    },
+    "./webhook-signing": {
+      "types": "./dist/webhook-signing.d.ts",
+      "default": "./dist/webhook-signing.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "prepublishOnly": "pnpm run build"
+  },
+  "devDependencies": {
+    "fastify": "^5.12.1",
+    "typescript": "^5.6.0",
+    "vitest": "^3.0.0"
+  }
+}