@pidgeon-ai/sdk 1.23.0 → 1.25.0

package/CHANGELOG.md

@@ -7,6 +7,24 @@ the two would publish a release for every unrelated product deploy.
 Semver applies to **this package's own surface** — the exported names, the
 call shapes, the result shape — not to the API behind it.
 
+## 1.25.0 — a forged `from` is held back
+
+`messagesAwait` with `from` matches only mail that passed DMARC (or that
+Pidgeon delivered between its own addresses), because anybody can write a
+`From:`. A match that did not is counted in `held_back.unauthenticated`, and
+its id is in `held_back.message_ids`; `include_unauthenticated: 'true'`
+returns it. A behaviour change for a sender that publishes no DMARC record.
+
+## 1.24.0 — test mode
+
+`keysCreate` takes `test: true` for a `pgn_test_` key: everything works, and
+nothing it sends leaves Pidgeon or counts against the plan. A test key's
+children are test keys. Every key, message and send answer (`messagesSend`,
+`messagesReply`, `messagesReplyAll`, `messagesForward`, `draftsSend`) has
+`test`. `testInbound` (`POST /test/inbound`) delivers a simulated message to
+one of a test key's addresses, optionally as a reply (`in_reply_to`). A test
+key gets `403` creating addresses, domains, pods or app passwords. Additive.
+
 ## 1.23.0 — rotating a key
 
 `keysRotate` (`POST /api-keys/{id}/rotate`) gives a key a new secret and

package/dist/index.cjs

@@ -119,6 +119,7 @@ __export(index_exports, {
   routingList: () => routingList,
   routingUpdate: () => routingUpdate,
   streamEvents: () => streamEvents,
+  testInbound: () => testInbound,
   threadsGet: () => threadsGet,
   threadsLabelsCreate: () => threadsLabelsCreate,
   threadsLabelsDelete: () => threadsLabelsDelete,
@@ -1393,6 +1394,15 @@ var keysRotate = (options) => (options.client ?? client).post({
     ...options.headers
   }
 });
+var testInbound = (options) => (options.client ?? client).post({
+  security: [{ scheme: "bearer", type: "http" }],
+  url: "/test/inbound",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
 var appPasswordsList = (options) => (options.client ?? client).get({
   security: [{ scheme: "bearer", type: "http" }],
   url: "/app-passwords",
@@ -1914,6 +1924,7 @@ function sleep(ms, signal) {
   routingList,
   routingUpdate,
   streamEvents,
+  testInbound,
   threadsGet,
   threadsLabelsCreate,
   threadsLabelsDelete,