@pidgeon-ai/sdk 1.1.0 → 1.3.0

package/CHANGELOG.md

@@ -9,6 +9,91 @@ call shapes, the result shape — not to the API behind it.
 
 ## Unreleased
 
+## 1.3.0 — a day of API that never reached a registry
+
+**Additive, and one fix that was a blocker.**
+
+1.2.0 went out on 14 October and then the contract moved for a day without
+this number moving with it. A field test on 15 October installed the published
+package, called a search the live API had been accepting since the morning,
+and got a `TypeError` for an argument the contract no longer requires. It
+built what it needed with a hand-written HTTP client instead. Everything below
+had already shipped; none of it was installable.
+
+**Fixed.** `verifyWebhook` reads the signature headers whatever case the
+framework spells them in. The lookup was `headers[name] ?? headers[name
+.toLowerCase()]` and `name` is already a lowercase constant — so it read the
+same key twice, and a plain object keyed `X-Pidgeon-Signature` was rejected as
+unsigned. Every existing test passed, because they all hand it a `Headers` or
+a lowercase object and both are already normalised. The broken branch is
+reached by an object somebody built themselves, which is what API Gateway
+hands a Lambda. `pidgeon` on PyPI was always right about this.
+
+**Added.**
+
+- `meGet`. What a key is, what it may do, and how many addresses it reaches —
+  the first call a credential can make about itself.
+- `eventsStream`'s endpoint is in the document. The client does not wrap SSE,
+  because a generated client has nowhere to put a long-lived connection; the
+  path, the cursor header and the event shape are typed so hand-rolling it is
+  twenty lines rather than a reverse-engineering exercise.
+- `thread.created` is emitted and subscribable. It was declared, accepted by
+  `POST /webhooks`, and had never once fired.
+- `from_self` on `message.received`. A workspace with several addresses sees
+  its own outbound mail arrive at the others, genuinely inbound, with nothing
+  to distinguish it from a stranger — so a handler written the obvious way
+  answers its own reply. Check it before you reply.
+- Quota pacing on a refusal: `Retry-After` and `X-RateLimit-*-Day`, so a
+  client refused a send can compute when it may try again instead of guessing
+  a day.
+
+**Declared, having always been returned.** Three fields the API sends and the
+document did not mention, so the generated types dropped them and a caller had
+to cast to reach them:
+
+- `sync_cursor` on a folder listing. `GET /mailboxes/changes` documents
+  `since` as "the `sync_cursor` from a listing" and no listing declared one,
+  so the change feed was unreachable from a typed client without defeating
+  its own types.
+- `folder` on a search hit, and `identity` beside `identity_id` — the address
+  rather than the uuid, which is what the rest of the API already carries on a
+  thread row, on an event and on `GET /messages/{id}`. A search is the one
+  endpoint that spans mailboxes, so it was the one that most needed to name
+  them and the only one that would not. A hit is now its own type,
+  `SearchHit`, rather than a `MessageListItem` with two fields missing.
+- `colour` is the eight-value enum it has always been enforced as, not
+  `string`. The palette existed only in the refusal, so the first call
+  anybody writes fails — somebody who has written CSS passes a hex. The
+  refusal was already good and is kept word for word.
+
+**Widened.** `messagesSearch` no longer requires `identity_id`. It searches
+every address the credential reaches, which is what it has always done on the
+server and what `skill.md` has always said; the document said "one mailbox at
+a time" in prose while declaring the parameter optional, and the generator
+followed the prose. `MessageListItem` carries `identity_id`, `to`,
+`counterparty` and `counterparty_name`, so a hit can be attributed to a
+mailbox without a second call.
+
+**Also.** `identitiesCreate` on the shared domain, a 404 that stopped
+pretending an address it had just listed did not exist, and `repository`
+fields that resolve — all four packages pointed at a private repository that
+404s for everybody who installs one.
+
+## 1.2.0 — the document says what its fields mean
+
+**Additive, and a correction.**
+
+**Added.** Every request field that means one thing everywhere now carries a
+description, so the types say what `from`, `to`, `attachment_ids` and twenty
+others are for — 0 of 136 had one before.
+
+**Corrected.** `messagesSend` is typed `Sent` at `202`, which is what the API
+has always answered. It was declared `Message` at `201`, a response that never
+arrives — so a caller reading `data.subject` off a send got `undefined`, and
+`send` and `reply` appeared to disagree about their shape when they never did.
+Minor rather than major because nothing could have depended on a status code
+the server does not send.
+
 ## 1.1.0 — the domain an address is on
 
 Additive. Nothing here changes a call that already works.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 PCN Labs OÜ
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.cjs

@@ -62,6 +62,7 @@ __export(index_exports, {
   draftsUpdate: () => draftsUpdate,
   eventsGet: () => eventsGet,
   eventsList: () => eventsList,
+  eventsStream: () => eventsStream,
   identitiesAccessCreate: () => identitiesAccessCreate,
   identitiesAccessDelete: () => identitiesAccessDelete,
   identitiesAccessGet: () => identitiesAccessGet,
@@ -90,6 +91,7 @@ __export(index_exports, {
   mailboxesEmptyTrash: () => mailboxesEmptyTrash,
   mailboxesList: () => mailboxesList,
   mailboxesListFolder: () => mailboxesListFolder,
+  meGet: () => meGet,
   messagesAct: () => messagesAct,
   messagesForward: () => messagesForward,
   messagesGet: () => messagesGet,
@@ -1117,7 +1119,7 @@ var messagesSend = (options) => (options.client ?? client).post({
     ...options.headers
   }
 });
-var messagesSearch = (options) => (options.client ?? client).get({
+var messagesSearch = (options) => (options?.client ?? client).get({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/messages/search",
   ...options
@@ -1353,6 +1355,11 @@ var appPasswordsRevoke = (options) => (options.client ?? client).delete({
   url: "/app-passwords/{id}",
   ...options
 });
+var meGet = (options) => (options?.client ?? client).get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/me",
+  ...options
+});
 var workspaceGet = (options) => (options?.client ?? client).get({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/workspace",
@@ -1368,6 +1375,11 @@ var eventsList = (options) => (options?.client ?? client).get({
   url: "/events",
   ...options
 });
+var eventsStream = (options) => (options?.client ?? client).sse.get({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/events/stream",
+  ...options
+});
 var eventsGet = (options) => (options.client ?? client).get({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/events/{id}",
@@ -1589,7 +1601,16 @@ var attachmentsDownloadUrl = (options) => (options.client ?? client).get({
 var SIGNATURE_HEADER = "x-pidgeon-signature";
 var TIMESTAMP_HEADER = "x-pidgeon-timestamp";
 async function verifyWebhook(input) {
-  const get = (name) => input.headers instanceof Headers ? input.headers.get(name) ?? void 0 : input.headers[name] ?? input.headers[name.toLowerCase()];
+  const get = (name) => {
+    if (input.headers instanceof Headers) return input.headers.get(name) ?? void 0;
+    const direct = input.headers[name];
+    if (direct !== void 0) return direct;
+    const wanted = name.toLowerCase();
+    for (const [key2, value] of Object.entries(input.headers)) {
+      if (key2.toLowerCase() === wanted) return value;
+    }
+    return void 0;
+  };
   const timestamp = get(TIMESTAMP_HEADER);
   const signature = get(SIGNATURE_HEADER);
   if (!timestamp || !signature) throw new Error("This request is not signed.");
@@ -1670,6 +1691,7 @@ function constantTimeEqual(a, b) {
   draftsUpdate,
   eventsGet,
   eventsList,
+  eventsStream,
   identitiesAccessCreate,
   identitiesAccessDelete,
   identitiesAccessGet,
@@ -1698,6 +1720,7 @@ function constantTimeEqual(a, b) {
   mailboxesEmptyTrash,
   mailboxesList,
   mailboxesListFolder,
+  meGet,
   messagesAct,
   messagesForward,
   messagesGet,