@earendil-works/mailhook 0.1.2 → 0.2.0

package/dist/mailhook/webhook.d.ts

@@ -5,24 +5,55 @@ import { WebhookEvent } from "./_internals/types.ts";
 /**
  * Parse a webhook event payload into a WebhookEvent object.
  *
+ * This does not verify the signature; use `verifyAndParseWebhook` for
+ * untrusted input.
+ *
  * @param payload - The webhook payload as a string, Buffer, or object
  * @returns The parsed webhook event
  * @throws Error if the payload is invalid or cannot be parsed
  */
 export declare function parseWebhookEvent(payload: string | Buffer | Record<string, unknown>): WebhookEvent;
+/** Default tolerance in seconds for the webhook-timestamp header (replay protection). */
+export declare const DEFAULT_TOLERANCE_SECONDS = 300;
+/**
+ * Options for webhook verification.
+ */
+export interface WebhookVerifyOptions {
+    /**
+     * Maximum allowed difference in seconds between the `webhook-timestamp`
+     * header and the current time (default 300). Older or future deliveries are
+     * rejected to prevent replay attacks. `null` disables the check, which is
+     * not recommended.
+     */
+    toleranceSeconds?: number | null;
+    /** The current time, for testing. Defaults to `Date.now()`. */
+    now?: Date | number;
+}
+/**
+ * Error thrown when a webhook delivery cannot be verified.
+ */
+export declare class WebhookVerificationError extends Error {
+    constructor(message: string);
+}
 /**
- * Validate a webhook signature.
+ * Validate a Standard Webhooks signature.
  *
- * Supports both Standard Webhooks format (v1,base64_signature) and legacy format (hex).
+ * Mailhook signs `${webhookId}.${timestamp}.${payload}` with HMAC-SHA256
+ * keyed with the base64-decoded webhook secret and sends it as
+ * `v1,<base64 signature>` in the `webhook-signature` header.
  *
- * @param payload - The raw webhook payload
- * @param signature - The signature from the webhook headers (Webhook-Signature or X-Webhook-Signature)
- * @param secret - The webhook secret (may be base64 encoded for Standard Webhooks)
- * @param timestamp - The timestamp from Webhook-Timestamp header (for Standard Webhooks)
- * @param webhookId - The webhook ID from Webhook-Id header (for Standard Webhooks)
- * @returns True if the signature is valid, false otherwise
+ * @param payload - The raw webhook request body, exactly as received
+ * @param signature - The `webhook-signature` header. It may contain several
+ *   space separated `v1,<base64>` signatures; any valid one is accepted.
+ * @param secret - The webhook secret, `whsec_<base64>` or bare base64
+ * @param timestamp - The `webhook-timestamp` header (Unix seconds)
+ * @param webhookId - The `webhook-id` header
+ * @param options - Timestamp tolerance (default 300 seconds) and clock override
+ * @returns True if the signature is valid and the timestamp is within the
+ *   tolerance, false otherwise
+ * @throws Error if the secret is not valid base64
  */
-export declare function validateWebhookSignature(payload: Buffer | string, signature: string, secret: string, timestamp: string, webhookId: string): boolean;
+export declare function validateWebhookSignature(payload: Buffer | string, signature: string, secret: string, timestamp: string, webhookId: string, options?: WebhookVerifyOptions): boolean;
 /**
  * Headers interface for webhook verification
  */
@@ -33,19 +64,22 @@ export interface WebhookHeaders {
     [key: string]: string | undefined;
 }
 /**
- * Verify webhook signature and parse the event.
+ * Verify a webhook delivery and parse the event.
  *
- * This is a convenience function that combines signature validation
- * and event parsing.
+ * The signature, timestamp and webhook id are taken from the explicit
+ * arguments or, if not given, from `headers` (looked up case-insensitively).
  *
- * @param payload - The raw webhook payload
- * @param secret - The webhook secret
- * @param signature - The signature from the webhook headers
- * @param timestamp - The timestamp from webhook-timestamp header
- * @param webhookId - The webhook id from webhook-id header
- * @param headers - A mapping of http headers (case insensitive) as alternative to signature, timestamp and webhookId
+ * @param payload - The raw webhook request body, exactly as received
+ * @param secret - The webhook secret, `whsec_<base64>` or bare base64
+ * @param signature - The `webhook-signature` header
+ * @param timestamp - The `webhook-timestamp` header
+ * @param webhookId - The `webhook-id` header
+ * @param headers - The request headers, as an alternative to signature, timestamp and webhookId
+ * @param options - Timestamp tolerance (default 300 seconds) and clock override
  * @returns The parsed webhook event
- * @throws Error if the signature is invalid or payload cannot be parsed
+ * @throws WebhookVerificationError if a header is missing, the timestamp is
+ *   outside the tolerance or the signature is invalid
+ * @throws Error if the secret is not valid base64 or the payload cannot be parsed
  */
-export declare function verifyAndParseWebhook(payload: Buffer | string, secret: string, signature?: string, timestamp?: string, webhookId?: string, headers?: WebhookHeaders): WebhookEvent;
+export declare function verifyAndParseWebhook(payload: Buffer | string, secret: string, signature?: string, timestamp?: string, webhookId?: string, headers?: WebhookHeaders, options?: WebhookVerifyOptions): WebhookEvent;
 //# sourceMappingURL=webhook.d.ts.map

package/dist/mailhook/webhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/mailhook/webhook.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjD,YAAY,CAgBd;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAmDT;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,cAAc,GACvB,YAAY,CA+Bd"}
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../src/mailhook/webhook.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjD,YAAY,CAgBd;AAED,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,+DAA+D;IAC/D,GAAG,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AA4DD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CA+CT;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,cAAc,EACxB,OAAO,GAAE,oBAAyB,GACjC,YAAY,CA0Cd"}

package/dist/mailhook/webhook.js

@@ -6,6 +6,9 @@ import { WebhookEvent } from "./_internals/types.js";
 /**
  * Parse a webhook event payload into a WebhookEvent object.
  *
+ * This does not verify the signature; use `verifyAndParseWebhook` for
+ * untrusted input.
+ *
  * @param payload - The webhook payload as a string, Buffer, or object
  * @returns The parsed webhook event
  * @throws Error if the payload is invalid or cannot be parsed
@@ -28,80 +31,137 @@ export function parseWebhookEvent(payload) {
     }
     return WebhookEvent.fromApiDict(data);
 }
+/** Default tolerance in seconds for the webhook-timestamp header (replay protection). */
+export const DEFAULT_TOLERANCE_SECONDS = 300;
+/**
+ * Error thrown when a webhook delivery cannot be verified.
+ */
+export class WebhookVerificationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "WebhookVerificationError";
+    }
+}
+const BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
+// Strictly decode standard base64; returns null for anything else.
+// Buffer.from(..., "base64") never throws and silently skips invalid input.
+function decodeBase64Strict(value) {
+    if (value.length % 4 !== 0 || !BASE64_RE.test(value)) {
+        return null;
+    }
+    const decoded = Buffer.from(value, "base64");
+    if (decoded.toString("base64") !== value) {
+        return null;
+    }
+    return decoded;
+}
+function decodeSecret(secret) {
+    const raw = secret.startsWith("whsec_") ? secret.slice(6) : secret;
+    const decoded = decodeBase64Strict(raw);
+    if (!decoded) {
+        throw new Error("Invalid webhook secret: expected base64, optionally prefixed with 'whsec_'");
+    }
+    return decoded;
+}
+function checkTimestamp(timestamp, options = {}) {
+    if (!/^\d+$/.test(timestamp)) {
+        throw new WebhookVerificationError("Invalid webhook timestamp");
+    }
+    const tolerance = options.toleranceSeconds === undefined
+        ? DEFAULT_TOLERANCE_SECONDS
+        : options.toleranceSeconds;
+    if (tolerance === null) {
+        return;
+    }
+    const nowMs = options.now === undefined
+        ? Date.now()
+        : typeof options.now === "number"
+            ? options.now
+            : options.now.getTime();
+    const now = Math.floor(nowMs / 1000);
+    const ts = Number(timestamp);
+    if (ts < now - tolerance) {
+        throw new WebhookVerificationError("Webhook timestamp is too old");
+    }
+    if (ts > now + tolerance) {
+        throw new WebhookVerificationError("Webhook timestamp is too far in the future");
+    }
+}
 /**
- * Validate a webhook signature.
+ * Validate a Standard Webhooks signature.
  *
- * Supports both Standard Webhooks format (v1,base64_signature) and legacy format (hex).
+ * Mailhook signs `${webhookId}.${timestamp}.${payload}` with HMAC-SHA256
+ * keyed with the base64-decoded webhook secret and sends it as
+ * `v1,<base64 signature>` in the `webhook-signature` header.
  *
- * @param payload - The raw webhook payload
- * @param signature - The signature from the webhook headers (Webhook-Signature or X-Webhook-Signature)
- * @param secret - The webhook secret (may be base64 encoded for Standard Webhooks)
- * @param timestamp - The timestamp from Webhook-Timestamp header (for Standard Webhooks)
- * @param webhookId - The webhook ID from Webhook-Id header (for Standard Webhooks)
- * @returns True if the signature is valid, false otherwise
+ * @param payload - The raw webhook request body, exactly as received
+ * @param signature - The `webhook-signature` header. It may contain several
+ *   space separated `v1,<base64>` signatures; any valid one is accepted.
+ * @param secret - The webhook secret, `whsec_<base64>` or bare base64
+ * @param timestamp - The `webhook-timestamp` header (Unix seconds)
+ * @param webhookId - The `webhook-id` header
+ * @param options - Timestamp tolerance (default 300 seconds) and clock override
+ * @returns True if the signature is valid and the timestamp is within the
+ *   tolerance, false otherwise
+ * @throws Error if the secret is not valid base64
  */
-export function validateWebhookSignature(payload, signature, secret, timestamp, webhookId) {
-    // Standard Webhooks format
-    if (!timestamp || !webhookId) {
+export function validateWebhookSignature(payload, signature, secret, timestamp, webhookId, options = {}) {
+    if (!timestamp || !webhookId || !signature) {
         return false;
     }
-    // Convert payload to Buffer if it's a string
-    const payloadBuffer = typeof payload === "string" ? Buffer.from(payload, "utf-8") : payload;
-    // Try to decode the secret as base64 first, falling back to raw if it fails
-    let decodedSecret;
-    if (secret.startsWith("whsec_")) {
-        secret = secret.slice(6);
-    }
+    const decodedSecret = decodeSecret(secret);
     try {
-        decodedSecret = Buffer.from(secret, "base64");
+        checkTimestamp(timestamp, options);
     }
     catch {
-        decodedSecret = Buffer.from(secret, "utf-8");
+        return false;
     }
-    // Create the signed content (webhook_id.timestamp.payload)
-    const signedContent = `${webhookId}.${timestamp}.${payloadBuffer.toString("utf-8")}`;
-    // Generate HMAC-SHA256
+    const payloadBuffer = typeof payload === "string" ? Buffer.from(payload, "utf-8") : payload;
+    const signedContent = Buffer.concat([
+        Buffer.from(`${webhookId}.${timestamp}.`, "utf-8"),
+        payloadBuffer,
+    ]);
     const expectedSignature = crypto
         .createHmac("sha256", decodedSecret)
         .update(signedContent)
         .digest();
-    // Check each versioned signature
-    const signatures = signature.split(" ");
-    for (const versionedSignature of signatures) {
-        const pieces = versionedSignature.split(",");
-        if (pieces.length !== 2) {
+    for (const versionedSignature of signature.split(" ")) {
+        const comma = versionedSignature.indexOf(",");
+        if (comma === -1) {
             continue;
         }
-        const [version, b64Signature] = pieces;
+        const version = versionedSignature.slice(0, comma);
         if (version !== "v1") {
             continue;
         }
-        try {
-            const actualSignature = Buffer.from(b64Signature, "base64");
-            if (crypto.timingSafeEqual(actualSignature, expectedSignature)) {
-                return true;
-            }
+        const actualSignature = decodeBase64Strict(versionedSignature.slice(comma + 1));
+        if (actualSignature &&
+            actualSignature.length === expectedSignature.length &&
+            crypto.timingSafeEqual(actualSignature, expectedSignature)) {
+            return true;
         }
-        catch { }
     }
     return false;
 }
 /**
- * Verify webhook signature and parse the event.
+ * Verify a webhook delivery and parse the event.
  *
- * This is a convenience function that combines signature validation
- * and event parsing.
+ * The signature, timestamp and webhook id are taken from the explicit
+ * arguments or, if not given, from `headers` (looked up case-insensitively).
  *
- * @param payload - The raw webhook payload
- * @param secret - The webhook secret
- * @param signature - The signature from the webhook headers
- * @param timestamp - The timestamp from webhook-timestamp header
- * @param webhookId - The webhook id from webhook-id header
- * @param headers - A mapping of http headers (case insensitive) as alternative to signature, timestamp and webhookId
+ * @param payload - The raw webhook request body, exactly as received
+ * @param secret - The webhook secret, `whsec_<base64>` or bare base64
+ * @param signature - The `webhook-signature` header
+ * @param timestamp - The `webhook-timestamp` header
+ * @param webhookId - The `webhook-id` header
+ * @param headers - The request headers, as an alternative to signature, timestamp and webhookId
+ * @param options - Timestamp tolerance (default 300 seconds) and clock override
  * @returns The parsed webhook event
- * @throws Error if the signature is invalid or payload cannot be parsed
+ * @throws WebhookVerificationError if a header is missing, the timestamp is
+ *   outside the tolerance or the signature is invalid
+ * @throws Error if the secret is not valid base64 or the payload cannot be parsed
  */
-export function verifyAndParseWebhook(payload, secret, signature, timestamp, webhookId, headers) {
+export function verifyAndParseWebhook(payload, secret, signature, timestamp, webhookId, headers, options = {}) {
     // Extract from headers if provided
     if (headers) {
         // Convert headers to lowercase for case-insensitive lookup
@@ -114,16 +174,19 @@ export function verifyAndParseWebhook(payload, secret, signature, timestamp, web
         webhookId = webhookId || lowerHeaders["webhook-id"];
     }
     if (!signature) {
-        throw new Error("Signature is required");
+        throw new WebhookVerificationError("Signature is required");
     }
     if (!timestamp) {
-        throw new Error("Timestamp is required");
+        throw new WebhookVerificationError("Timestamp is required");
     }
     if (!webhookId) {
-        throw new Error("Webhook ID is required");
+        throw new WebhookVerificationError("Webhook ID is required");
     }
-    if (!validateWebhookSignature(payload, signature, secret, timestamp, webhookId)) {
-        throw new Error("Invalid webhook signature");
+    checkTimestamp(timestamp, options);
+    if (!validateWebhookSignature(payload, signature, secret, timestamp, webhookId, {
+        toleranceSeconds: null,
+    })) {
+        throw new WebhookVerificationError("Invalid webhook signature");
     }
     return parseWebhookEvent(payload);
 }

package/dist/mailhook/webhook.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../../src/mailhook/webhook.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAkD;IAElD,IAAI,IAAa,CAAC;IAElB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC3D,IAAI,GAAG,OAAO,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAwB,EACxB,SAAiB,EACjB,MAAc,EACd,SAAiB,EACjB,SAAiB;IAEjB,2BAA2B;IAC3B,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6CAA6C;IAC7C,MAAM,aAAa,GACjB,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAExE,4EAA4E;IAC5E,IAAI,aAAqB,CAAC;IAC1B,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,2DAA2D;IAC3D,MAAM,aAAa,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;IAErF,uBAAuB;IACvB,MAAM,iBAAiB,GAAG,MAAM;SAC7B,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC;SACnC,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,EAAE,CAAC;IAEZ,iCAAiC;IACjC,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,KAAK,MAAM,kBAAkB,IAAI,UAAU,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,GAAG,MAAM,CAAC;QACvC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBAC/D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAYD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAwB,EACxB,MAAc,EACd,SAAkB,EAClB,SAAkB,EAClB,SAAkB,EAClB,OAAwB;IAExB,mCAAmC;IACnC,IAAI,OAAO,EAAE,CAAC;QACZ,2DAA2D;QAC3D,MAAM,YAAY,GAAmB,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;QAC1C,CAAC;QAED,SAAS,GAAG,SAAS,IAAI,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAC3D,SAAS,GAAG,SAAS,IAAI,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAC3D,SAAS,GAAG,SAAS,IAAI,YAAY,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,IACE,CAAC,wBAAwB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,EAC3E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../../src/mailhook/webhook.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAkD;IAElD,IAAI,IAAa,CAAC;IAElB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC3D,IAAI,GAAG,OAAO,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAiB7C;;GAEG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAE3C,mEAAmE;AACnE,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACnE,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CACrB,SAAiB,EACjB,UAAgC,EAAE;IAElC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,SAAS,GACb,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACpC,CAAC,CAAC,yBAAyB;QAC3B,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC/B,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,KAAK,SAAS;QACvB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;QACZ,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,CAAC,CAAC,OAAO,CAAC,GAAG;YACb,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,EAAE,GAAG,GAAG,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,wBAAwB,CAAC,8BAA8B,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,EAAE,GAAG,GAAG,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,wBAAwB,CAChC,4CAA4C,CAC7C,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAwB,EACxB,SAAiB,EACjB,MAAc,EACd,SAAiB,EACjB,SAAiB,EACjB,UAAgC,EAAE;IAElC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,aAAa,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAE3C,IAAI,CAAC;QACH,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,aAAa,GACjB,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACxE,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,IAAI,SAAS,GAAG,EAAE,OAAO,CAAC;QAClD,aAAa;KACd,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,MAAM;SAC7B,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC;SACnC,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,EAAE,CAAC;IAEZ,KAAK,MAAM,kBAAkB,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,SAAS;QACX,CAAC;QACD,MAAM,eAAe,GAAG,kBAAkB,CACxC,kBAAkB,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CACpC,CAAC;QACF,IACE,eAAe;YACf,eAAe,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM;YACnD,MAAM,CAAC,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,EAC1D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAYD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAwB,EACxB,MAAc,EACd,SAAkB,EAClB,SAAkB,EAClB,SAAkB,EAClB,OAAwB,EACxB,UAAgC,EAAE;IAElC,mCAAmC;IACnC,IAAI,OAAO,EAAE,CAAC;QACZ,2DAA2D;QAC3D,MAAM,YAAY,GAAmB,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;QAC1C,CAAC;QAED,SAAS,GAAG,SAAS,IAAI,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAC3D,SAAS,GAAG,SAAS,IAAI,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAC3D,SAAS,GAAG,SAAS,IAAI,YAAY,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAAC,uBAAuB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAAC,wBAAwB,CAAC,CAAC;IAC/D,CAAC;IAED,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAEnC,IACE,CAAC,wBAAwB,CACvB,OAAO,EACP,SAAS,EACT,MAAM,EACN,SAAS,EACT,SAAS,EACT;QACE,gBAAgB,EAAE,IAAI;KACvB,CACF,EACD,CAAC;QACD,MAAM,IAAI,wBAAwB,CAAC,2BAA2B,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@earendil-works/mailhook",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "TypeScript SDK for the Mailhook API",
   "type": "module",
   "author": "Armin Ronacher <armin.ronacher@active-4.com>",
@@ -27,8 +27,6 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.js",
-      "require": "./dist/index.js",
       "default": "./dist/index.js"
     },
     "./package.json": "./package.json"
@@ -46,19 +44,18 @@
     "generate": "cd ../generator && uv run main.py typescript",
     "dev": "tsc -p tsconfig.json --watch",
     "lint": "biome check .",
-    "lint:fix": "biome check --write --unsafe .",
-    "format": "prettier --write \"src/**/*.{ts,tsx,json,md}\"",
-    "format:check": "prettier --check \"src/**/*.{ts,tsx,json,md}\"",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "lint:fix": "biome check --write .",
+    "format": "biome format --write .",
+    "typecheck": "tsc -p tsconfig.check.json",
+    "test": "node --test test/*.test.ts",
     "prepublishOnly": "pnpm run generate && pnpm run build"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=20.19.0"
   },
   "devDependencies": {
     "@biomejs/biome": "2.3.9",
-    "@types/node": "^20.0.0",
-    "prettier": "^3.0.0",
-    "typescript": "^5.9.0"
+    "@types/node": "^20.19.43",
+    "typescript": "^5.9.3"
   }
 }

package/dist/mailhook/client.d.ts

@@ -1,2 +0,0 @@
-export { Mailhook } from "./_internals/base-client.ts";
-//# sourceMappingURL=client.d.ts.map

package/dist/mailhook/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/mailhook/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/mailhook/client.js

@@ -1,2 +0,0 @@
-export { Mailhook } from "./_internals/base-client.js";
-//# sourceMappingURL=client.js.map

package/dist/mailhook/client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/mailhook/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC"}