@keystrokehq/sendgrid 0.0.1

package/dist/triggers.d.mts

@@ -0,0 +1,35 @@
+import { n as sendgrid } from "./integration-CmJ2TILG.mjs";
+import { sendgridEventWebhookEventSchema, sendgridEventWebhookPayloadSchema, sendgridInboundParsePayloadSchema } from "./schemas/index.mjs";
+import { z } from "zod";
+import { IntegrationTriggerBindingOptions } from "@keystrokehq/integration-authoring";
+import { BoundTrigger, WebhookRequest } from "@keystrokehq/core";
+import { WebhookTriggerManifest } from "@keystrokehq/core/trigger";
+
+//#region src/triggers.d.ts
+type SendGridCredentialSets = readonly [typeof sendgrid];
+type EventPayload = z.output<typeof sendgridEventWebhookEventSchema>;
+type InboundParsePayload = z.output<typeof sendgridInboundParsePayloadSchema>;
+type EventBindingOptions<TOutput = EventPayload> = IntegrationTriggerBindingOptions<EventPayload, TOutput, WebhookRequest>;
+type EventBoundTrigger<TOutput = EventPayload> = BoundTrigger<z.output<typeof sendgridEventWebhookPayloadSchema>, SendGridCredentialSets, WebhookTriggerManifest, TOutput, WebhookRequest>;
+type InboundParseBindingOptions<TOutput = InboundParsePayload> = IntegrationTriggerBindingOptions<InboundParsePayload, TOutput, WebhookRequest>;
+type InboundParseBoundTrigger<TOutput = InboundParsePayload> = BoundTrigger<InboundParsePayload, SendGridCredentialSets, WebhookTriggerManifest, TOutput, WebhookRequest>;
+type EventBindingSurface = <TOutput = EventPayload>(options?: EventBindingOptions<TOutput>) => EventBoundTrigger<TOutput>;
+type InboundParseBindingSurface = <TOutput = InboundParsePayload>(options?: InboundParseBindingOptions<TOutput>) => InboundParseBoundTrigger<TOutput>;
+interface SendGridEventTriggerNamespace {
+  readonly processed: EventBindingSurface;
+  readonly dropped: EventBindingSurface;
+  readonly deferred: EventBindingSurface;
+  readonly delivered: EventBindingSurface;
+  readonly bounce: EventBindingSurface;
+  readonly open: EventBindingSurface;
+  readonly click: EventBindingSurface;
+  readonly spamReport: EventBindingSurface;
+  readonly unsubscribe: EventBindingSurface;
+  readonly groupUnsubscribe: EventBindingSurface;
+  readonly groupResubscribe: EventBindingSurface;
+  readonly inboundParseReceived: InboundParseBindingSurface;
+}
+declare const triggers: SendGridEventTriggerNamespace;
+declare const sendgridEventEventNames: readonly ["processed", "dropped", "deferred", "delivered", "bounce", "open", "click", "spam_report", "unsubscribe", "group_unsubscribe", "group_resubscribe"];
+//#endregion
+export { SendGridEventTriggerNamespace, sendgridEventEventNames, triggers };

package/dist/triggers.mjs

@@ -0,0 +1,98 @@
+import { t as sendgrid } from "./integration-37BovSeK.mjs";
+import { a as sendgridInboundParsePayloadSchema, r as sendgridEventWebhookPayloadSchema } from "./webhooks-CKdsIikb.mjs";
+import { sendgridEventWebhookEventNames } from "./events.mjs";
+import { verifyInboundParseRequest, verifySendGridEventWebhookRequest } from "./verification.mjs";
+import { createWebhookTriggerBindingFactory } from "@keystrokehq/integration-authoring";
+
+//#region src/triggers.ts
+const EVENT_ROUTE = "/sendgrid/events";
+const INBOUND_PARSE_ROUTE = "/sendgrid/inbound-parse";
+const SIGNATURE_HEADER = "x-twilio-email-event-webhook-signature";
+const TIMESTAMP_HEADER = "x-twilio-email-event-webhook-timestamp";
+function findHeader(headers, name) {
+	const direct = headers[name] ?? headers[name.toLowerCase()];
+	if (direct !== void 0) return direct;
+	for (const [key, value] of Object.entries(headers)) if (key.toLowerCase() === name.toLowerCase()) return value;
+}
+function findFirstMatching(payload, event) {
+	for (const entry of payload) if (entry.event === event) return entry;
+	return null;
+}
+function createEventWebhookBinding(event, defaultName, defaultDescription) {
+	return createWebhookTriggerBindingFactory({
+		defaultName,
+		defaultDescription,
+		path: EVENT_ROUTE,
+		method: "POST",
+		payload: sendgridEventWebhookPayloadSchema,
+		credentialSets: [sendgrid],
+		verify: (request, ctx) => {
+			const publicKeyPem = ctx.credentials[sendgrid.id].SENDGRID_EVENT_WEBHOOK_PUBLIC_KEY;
+			if (!publicKeyPem) throw new Error("SendGrid event-webhook signature key is not configured. Fetch the Ed25519 public key via `getSignedPublicKey` and store it on the connection as `SENDGRID_EVENT_WEBHOOK_PUBLIC_KEY`.");
+			const signature = findHeader(request.headers, SIGNATURE_HEADER);
+			const timestamp = findHeader(request.headers, TIMESTAMP_HEADER);
+			if (!signature || !timestamp) throw new Error("SendGrid event-webhook signature headers are missing.");
+			if (!verifySendGridEventWebhookRequest({
+				rawBody: request.rawBody,
+				signature,
+				timestamp,
+				publicKeyPem
+			})) throw new Error("Invalid SendGrid event-webhook signature.");
+		},
+		definitionFilter: (payload) => Array.isArray(payload) && payload.some((entry) => entry.event === event),
+		mapPayload: (payload) => findFirstMatching(payload, event),
+		idempotencyKey: (_payload, mapped) => mapped ? `${mapped.event}:${mapped.sg_event_id}` : void 0,
+		response: { successStatus: 200 }
+	});
+}
+const processedBinding = createEventWebhookBinding("processed", "SendGrid Event: Processed", "Fires when SendGrid accepts a message for delivery.");
+const droppedBinding = createEventWebhookBinding("dropped", "SendGrid Event: Dropped", "Fires when SendGrid drops a message (e.g. suppressed recipient, invalid email).");
+const deferredBinding = createEventWebhookBinding("deferred", "SendGrid Event: Deferred", "Fires when the receiving mail server temporarily rejects the message.");
+const deliveredBinding = createEventWebhookBinding("delivered", "SendGrid Event: Delivered", "Fires when the receiving mail server accepts the message.");
+const bounceBinding = createEventWebhookBinding("bounce", "SendGrid Event: Bounce", "Fires when the receiving mail server permanently rejects the message.");
+const openBinding = createEventWebhookBinding("open", "SendGrid Event: Open", "Fires when the recipient opens the message. Filter `sg_machine_open` to exclude Apple MPP cache-fetches.");
+const clickBinding = createEventWebhookBinding("click", "SendGrid Event: Click", "Fires when the recipient clicks a tracked link.");
+const spamReportBinding = createEventWebhookBinding("spam_report", "SendGrid Event: Spam Report", "Fires when the recipient marks the message as spam via the ISP feedback loop.");
+const unsubscribeBinding = createEventWebhookBinding("unsubscribe", "SendGrid Event: Unsubscribe", "Fires when the recipient uses one-click or List-Unsubscribe headers.");
+const groupUnsubscribeBinding = createEventWebhookBinding("group_unsubscribe", "SendGrid Event: Group Unsubscribe", "Fires when the recipient unsubscribes from a specific suppression group. Includes `asm_group_id`.");
+const groupResubscribeBinding = createEventWebhookBinding("group_resubscribe", "SendGrid Event: Group Resubscribe", "Fires when the recipient re-subscribes to a specific suppression group.");
+const inboundParseBinding = createWebhookTriggerBindingFactory({
+	defaultName: "SendGrid Inbound Parse Received",
+	defaultDescription: "Fires when SendGrid receives an email for a configured Inbound Parse hostname. Payload is multipart; key fields like `from`, `to`, `subject`, `html`, `text`, and parsed `envelope` pass through.",
+	path: INBOUND_PARSE_ROUTE,
+	method: "POST",
+	payload: sendgridInboundParsePayloadSchema,
+	credentialSets: [sendgrid],
+	verify: (request, ctx) => {
+		const token = ctx.credentials[sendgrid.id].SENDGRID_INBOUND_PARSE_TOKEN;
+		if (!token) throw new Error("SendGrid Inbound Parse token is not configured. Generate one and store it on the connection as `SENDGRID_INBOUND_PARSE_TOKEN`; include it in the receiver URL path.");
+		if (!verifyInboundParseRequest({
+			path: request.path,
+			expectedToken: token
+		})) throw new Error("Invalid SendGrid Inbound Parse token in request path.");
+	},
+	idempotencyKey: (payload) => {
+		const messageId = typeof payload.headers === "string" ? payload.headers.match(/Message-ID:\s*([^\r\n]+)/iu)?.[1] : void 0;
+		if (messageId) return messageId.trim();
+		return `${typeof payload.envelope === "string" ? payload.envelope : ""}:${typeof payload.subject === "string" ? payload.subject : ""}`.slice(0, 200);
+	},
+	response: { successStatus: 200 }
+});
+const triggers = Object.freeze({
+	processed: processedBinding,
+	dropped: droppedBinding,
+	deferred: deferredBinding,
+	delivered: deliveredBinding,
+	bounce: bounceBinding,
+	open: openBinding,
+	click: clickBinding,
+	spamReport: spamReportBinding,
+	unsubscribe: unsubscribeBinding,
+	groupUnsubscribe: groupUnsubscribeBinding,
+	groupResubscribe: groupResubscribeBinding,
+	inboundParseReceived: inboundParseBinding
+});
+const sendgridEventEventNames = sendgridEventWebhookEventNames;
+
+//#endregion
+export { sendgridEventEventNames, triggers };

package/dist/user-account.d.mts

@@ -0,0 +1,108 @@
+import { z } from "zod";
+import * as _keystrokehq_core_credential_set0 from "@keystrokehq/core/credential-set";
+import * as _keystrokehq_core0 from "@keystrokehq/core";
+
+//#region src/user-account.d.ts
+declare const getUserProfile: _keystrokehq_core0.Operation<z.ZodOptional<z.ZodObject<{}, z.core.$strip>>, z.ZodObject<{
+  address: z.ZodOptional<z.ZodString>;
+  address2: z.ZodOptional<z.ZodString>;
+  city: z.ZodOptional<z.ZodString>;
+  company: z.ZodOptional<z.ZodString>;
+  country: z.ZodOptional<z.ZodString>;
+  first_name: z.ZodOptional<z.ZodString>;
+  last_name: z.ZodOptional<z.ZodString>;
+  phone: z.ZodOptional<z.ZodString>;
+  state: z.ZodOptional<z.ZodString>;
+  website: z.ZodOptional<z.ZodString>;
+  zip: z.ZodOptional<z.ZodString>;
+}, z.core.$catchall<z.ZodUnknown>>, readonly [_keystrokehq_core0.CredentialSet<"sendgrid", z.ZodObject<{
+  SENDGRID_API_KEY: z.ZodString;
+  SENDGRID_SUBUSER: z.ZodOptional<z.ZodString>;
+  SENDGRID_ACCOUNT_REGION: z.ZodDefault<z.ZodEnum<{
+    global: "global";
+    eu: "eu";
+  }>>;
+  SENDGRID_EVENT_WEBHOOK_PUBLIC_KEY: z.ZodOptional<z.ZodString>;
+  SENDGRID_INBOUND_PARSE_TOKEN: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
+  SENDGRID_API_KEY: z.ZodString;
+  SENDGRID_SUBUSER: z.ZodOptional<z.ZodString>;
+  SENDGRID_ACCOUNT_REGION: z.ZodDefault<z.ZodEnum<{
+    global: "global";
+    eu: "eu";
+  }>>;
+  SENDGRID_EVENT_WEBHOOK_PUBLIC_KEY: z.ZodOptional<z.ZodString>;
+  SENDGRID_INBOUND_PARSE_TOKEN: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>[] | undefined>], undefined>;
+declare const getAccountInfo: _keystrokehq_core0.Operation<z.ZodOptional<z.ZodObject<{}, z.core.$strip>>, z.ZodObject<{
+  type: z.ZodString;
+  reputation: z.ZodOptional<z.ZodNumber>;
+}, z.core.$catchall<z.ZodUnknown>>, readonly [_keystrokehq_core0.CredentialSet<"sendgrid", z.ZodObject<{
+  SENDGRID_API_KEY: z.ZodString;
+  SENDGRID_SUBUSER: z.ZodOptional<z.ZodString>;
+  SENDGRID_ACCOUNT_REGION: z.ZodDefault<z.ZodEnum<{
+    global: "global";
+    eu: "eu";
+  }>>;
+  SENDGRID_EVENT_WEBHOOK_PUBLIC_KEY: z.ZodOptional<z.ZodString>;
+  SENDGRID_INBOUND_PARSE_TOKEN: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
+  SENDGRID_API_KEY: z.ZodString;
+  SENDGRID_SUBUSER: z.ZodOptional<z.ZodString>;
+  SENDGRID_ACCOUNT_REGION: z.ZodDefault<z.ZodEnum<{
+    global: "global";
+    eu: "eu";
+  }>>;
+  SENDGRID_EVENT_WEBHOOK_PUBLIC_KEY: z.ZodOptional<z.ZodString>;
+  SENDGRID_INBOUND_PARSE_TOKEN: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>[] | undefined>], undefined>;
+declare const getUserScopes: _keystrokehq_core0.Operation<z.ZodOptional<z.ZodObject<{}, z.core.$strip>>, z.ZodObject<{
+  scopes: z.ZodArray<z.ZodString>;
+}, z.core.$strip>, readonly [_keystrokehq_core0.CredentialSet<"sendgrid", z.ZodObject<{
+  SENDGRID_API_KEY: z.ZodString;
+  SENDGRID_SUBUSER: z.ZodOptional<z.ZodString>;
+  SENDGRID_ACCOUNT_REGION: z.ZodDefault<z.ZodEnum<{
+    global: "global";
+    eu: "eu";
+  }>>;
+  SENDGRID_EVENT_WEBHOOK_PUBLIC_KEY: z.ZodOptional<z.ZodString>;
+  SENDGRID_INBOUND_PARSE_TOKEN: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
+  SENDGRID_API_KEY: z.ZodString;
+  SENDGRID_SUBUSER: z.ZodOptional<z.ZodString>;
+  SENDGRID_ACCOUNT_REGION: z.ZodDefault<z.ZodEnum<{
+    global: "global";
+    eu: "eu";
+  }>>;
+  SENDGRID_EVENT_WEBHOOK_PUBLIC_KEY: z.ZodOptional<z.ZodString>;
+  SENDGRID_INBOUND_PARSE_TOKEN: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>[] | undefined>], undefined>;
+declare const getCreditBalance: _keystrokehq_core0.Operation<z.ZodOptional<z.ZodObject<{}, z.core.$strip>>, z.ZodObject<{
+  remain: z.ZodOptional<z.ZodNumber>;
+  total: z.ZodOptional<z.ZodNumber>;
+  overage: z.ZodOptional<z.ZodNumber>;
+  used: z.ZodOptional<z.ZodNumber>;
+  last_reset: z.ZodOptional<z.ZodString>;
+  next_reset: z.ZodOptional<z.ZodString>;
+  reset_frequency: z.ZodOptional<z.ZodString>;
+}, z.core.$catchall<z.ZodUnknown>>, readonly [_keystrokehq_core0.CredentialSet<"sendgrid", z.ZodObject<{
+  SENDGRID_API_KEY: z.ZodString;
+  SENDGRID_SUBUSER: z.ZodOptional<z.ZodString>;
+  SENDGRID_ACCOUNT_REGION: z.ZodDefault<z.ZodEnum<{
+    global: "global";
+    eu: "eu";
+  }>>;
+  SENDGRID_EVENT_WEBHOOK_PUBLIC_KEY: z.ZodOptional<z.ZodString>;
+  SENDGRID_INBOUND_PARSE_TOKEN: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, readonly _keystrokehq_core_credential_set0.CredentialConnection<z.ZodObject<{
+  SENDGRID_API_KEY: z.ZodString;
+  SENDGRID_SUBUSER: z.ZodOptional<z.ZodString>;
+  SENDGRID_ACCOUNT_REGION: z.ZodDefault<z.ZodEnum<{
+    global: "global";
+    eu: "eu";
+  }>>;
+  SENDGRID_EVENT_WEBHOOK_PUBLIC_KEY: z.ZodOptional<z.ZodString>;
+  SENDGRID_INBOUND_PARSE_TOKEN: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>[] | undefined>], undefined>;
+//#endregion
+export { getAccountInfo, getCreditBalance, getUserProfile, getUserScopes };

package/dist/user-account.mjs

@@ -0,0 +1,59 @@
+import { n as __exportAll, t as sendgridOperation } from "./factory-BSL0D2L0.mjs";
+import { createSendGridClient } from "./client.mjs";
+import { f as sendgridAccountInfoSchema, g as sendgridUserProfileSchema, m as sendgridScopesSchema, p as sendgridCreditBalanceSchema } from "./webhooks-CKdsIikb.mjs";
+import { z } from "zod";
+
+//#region src/user-account.ts
+var user_account_exports = /* @__PURE__ */ __exportAll({
+	getAccountInfo: () => getAccountInfo,
+	getCreditBalance: () => getCreditBalance,
+	getUserProfile: () => getUserProfile,
+	getUserScopes: () => getUserScopes
+});
+const getUserProfile = sendgridOperation({
+	id: "get_user_profile",
+	name: "Get User Profile",
+	description: "Retrieve the account profile (name, company, mailing address).",
+	input: z.object({}).optional(),
+	output: sendgridUserProfileSchema,
+	run: async (_input, credentials) => {
+		const response = await createSendGridClient(credentials).request("/user/profile");
+		return sendgridUserProfileSchema.parse(response);
+	}
+});
+const getAccountInfo = sendgridOperation({
+	id: "get_account_info",
+	name: "Get Account Info",
+	description: "Retrieve account type + reputation score.",
+	input: z.object({}).optional(),
+	output: sendgridAccountInfoSchema,
+	run: async (_input, credentials) => {
+		const response = await createSendGridClient(credentials).request("/user/account");
+		return sendgridAccountInfoSchema.parse(response);
+	}
+});
+const getUserScopes = sendgridOperation({
+	id: "get_user_scopes",
+	name: "Get User Scopes",
+	description: "Retrieve the list of API scopes the current API key has access to.",
+	input: z.object({}).optional(),
+	output: sendgridScopesSchema,
+	run: async (_input, credentials) => {
+		const response = await createSendGridClient(credentials).request("/scopes");
+		return sendgridScopesSchema.parse(response);
+	}
+});
+const getCreditBalance = sendgridOperation({
+	id: "get_credit_balance",
+	name: "Get Credit Balance",
+	description: "Retrieve the current SendGrid credit balance for the account.",
+	input: z.object({}).optional(),
+	output: sendgridCreditBalanceSchema,
+	run: async (_input, credentials) => {
+		const response = await createSendGridClient(credentials).request("/user/credits");
+		return sendgridCreditBalanceSchema.parse(response);
+	}
+});
+
+//#endregion
+export { getAccountInfo, getCreditBalance, getUserProfile, getUserScopes, user_account_exports as t };

package/dist/verification.d.mts

@@ -0,0 +1,67 @@
+import { sendgridEventWebhookPayloadSchema } from "./schemas/index.mjs";
+import { z } from "zod";
+
+//#region src/verification.d.ts
+declare const SENDGRID_EVENT_SIGNATURE_HEADER = "x-twilio-email-event-webhook-signature";
+declare const SENDGRID_EVENT_TIMESTAMP_HEADER = "x-twilio-email-event-webhook-timestamp";
+interface SendGridEventWebhookVerifyInput {
+  /** Raw request body bytes (not a JSON-reparsed string). */
+  readonly rawBody: string | Uint8Array;
+  /** Value of the `X-Twilio-Email-Event-Webhook-Signature` header. */
+  readonly signature: string;
+  /** Value of the `X-Twilio-Email-Event-Webhook-Timestamp` header. */
+  readonly timestamp: string;
+  /** Ed25519 public key in PEM form (as returned by `GET /v3/user/webhooks/event/settings/signed`). */
+  readonly publicKeyPem: string;
+  /** Maximum allowed clock skew between provider and verifier, in seconds. Defaults to 300s. */
+  readonly toleranceSeconds?: number;
+  /** Override `now` in tests. Defaults to `Date.now()`. */
+  readonly now?: () => number;
+}
+/**
+ * Verify a SendGrid Event Webhook request. Returns `true` for a valid signature.
+ *
+ * SendGrid signs `timestamp + rawBody` with Ed25519. The public key rotates when
+ * `TOGGLE_WEBHOOK_SIGNATURE` is toggled, so callers should cache + refresh on
+ * verification failures.
+ */
+declare function verifySendGridEventWebhookRequest(input: SendGridEventWebhookVerifyInput): boolean;
+declare function parseSendGridEventWebhookBody(rawBody: string | Uint8Array): z.output<typeof sendgridEventWebhookPayloadSchema>;
+interface SendGridInboundParseVerifyInput {
+  /** Full URL path the request arrived at (including any Keystroke-minted token). */
+  readonly path: string;
+  /** Expected Keystroke-minted parse token (from `SENDGRID_INBOUND_PARSE_TOKEN`). */
+  readonly expectedToken: string;
+  /** Optional IP allowlist (SendGrid publishes the IP range for Inbound Parse). */
+  readonly sourceIp?: string;
+  readonly allowedIps?: readonly string[];
+}
+/**
+ * Verify an Inbound Parse request.
+ *
+ * SendGrid does NOT sign Inbound Parse payloads. Verification uses a Keystroke-minted
+ * token embedded in the receiver URL, plus an optional IP allowlist check. This is
+ * weaker than the Event Webhook's Ed25519 verification — callers are encouraged to
+ * rotate `expectedToken` periodically.
+ */
+declare function verifyInboundParseRequest(input: SendGridInboundParseVerifyInput): boolean;
+declare const sendgridInboundParseBodySchema: z.ZodObject<{
+  headers: z.ZodOptional<z.ZodString>;
+  dkim: z.ZodOptional<z.ZodString>;
+  to: z.ZodOptional<z.ZodString>;
+  from: z.ZodOptional<z.ZodString>;
+  subject: z.ZodOptional<z.ZodString>;
+  html: z.ZodOptional<z.ZodString>;
+  text: z.ZodOptional<z.ZodString>;
+  envelope: z.ZodOptional<z.ZodString>;
+  charsets: z.ZodOptional<z.ZodString>;
+  SPF: z.ZodOptional<z.ZodString>;
+  spam_score: z.ZodOptional<z.ZodString>;
+  spam_report: z.ZodOptional<z.ZodString>;
+  sender_ip: z.ZodOptional<z.ZodString>;
+  attachments: z.ZodOptional<z.ZodString>;
+  'attachment-info': z.ZodOptional<z.ZodString>;
+  email: z.ZodOptional<z.ZodString>;
+}, z.core.$catchall<z.ZodUnknown>>;
+//#endregion
+export { SENDGRID_EVENT_SIGNATURE_HEADER, SENDGRID_EVENT_TIMESTAMP_HEADER, SendGridEventWebhookVerifyInput, SendGridInboundParseVerifyInput, parseSendGridEventWebhookBody, sendgridInboundParseBodySchema, verifyInboundParseRequest, verifySendGridEventWebhookRequest };

package/dist/verification.mjs

@@ -0,0 +1,72 @@
+import { a as sendgridInboundParsePayloadSchema, r as sendgridEventWebhookPayloadSchema } from "./webhooks-CKdsIikb.mjs";
+import { createPublicKey, createVerify, verify } from "node:crypto";
+
+//#region src/verification.ts
+const SENDGRID_EVENT_SIGNATURE_HEADER = "x-twilio-email-event-webhook-signature";
+const SENDGRID_EVENT_TIMESTAMP_HEADER = "x-twilio-email-event-webhook-timestamp";
+/**
+* Verify a SendGrid Event Webhook request. Returns `true` for a valid signature.
+*
+* SendGrid signs `timestamp + rawBody` with Ed25519. The public key rotates when
+* `TOGGLE_WEBHOOK_SIGNATURE` is toggled, so callers should cache + refresh on
+* verification failures.
+*/
+function verifySendGridEventWebhookRequest(input) {
+	const tolerance = input.toleranceSeconds ?? 300;
+	const nowMs = (input.now ?? Date.now)();
+	const timestampSeconds = Number(input.timestamp);
+	if (!Number.isFinite(timestampSeconds)) return false;
+	if (Math.abs(nowMs / 1e3 - timestampSeconds) > tolerance) return false;
+	let publicKey;
+	try {
+		publicKey = createPublicKey({
+			key: input.publicKeyPem,
+			format: "pem"
+		});
+	} catch {
+		return false;
+	}
+	let signatureBytes;
+	try {
+		signatureBytes = Buffer.from(input.signature, "base64");
+	} catch {
+		return false;
+	}
+	const rawBodyBuffer = typeof input.rawBody === "string" ? Buffer.from(input.rawBody, "utf8") : Buffer.from(input.rawBody);
+	const payloadBuffer = Buffer.concat([Buffer.from(input.timestamp, "utf8"), rawBodyBuffer]);
+	try {
+		return verify(null, payloadBuffer, publicKey, signatureBytes);
+	} catch {
+		const verifier = createVerify("sha256");
+		verifier.update(payloadBuffer);
+		try {
+			return verifier.verify(publicKey, signatureBytes);
+		} catch {
+			return false;
+		}
+	}
+}
+function parseSendGridEventWebhookBody(rawBody) {
+	const text = typeof rawBody === "string" ? rawBody : Buffer.from(rawBody).toString("utf8");
+	const json = JSON.parse(text);
+	return sendgridEventWebhookPayloadSchema.parse(json);
+}
+/**
+* Verify an Inbound Parse request.
+*
+* SendGrid does NOT sign Inbound Parse payloads. Verification uses a Keystroke-minted
+* token embedded in the receiver URL, plus an optional IP allowlist check. This is
+* weaker than the Event Webhook's Ed25519 verification — callers are encouraged to
+* rotate `expectedToken` periodically.
+*/
+function verifyInboundParseRequest(input) {
+	if (!input.path.includes(input.expectedToken)) return false;
+	if (input.allowedIps && input.allowedIps.length > 0) {
+		if (!input.sourceIp || !input.allowedIps.includes(input.sourceIp)) return false;
+	}
+	return true;
+}
+const sendgridInboundParseBodySchema = sendgridInboundParsePayloadSchema;
+
+//#endregion
+export { SENDGRID_EVENT_SIGNATURE_HEADER, SENDGRID_EVENT_TIMESTAMP_HEADER, parseSendGridEventWebhookBody, sendgridInboundParseBodySchema, verifyInboundParseRequest, verifySendGridEventWebhookRequest };