@pidgeon-ai/sdk 1.29.0 → 1.30.0

package/CHANGELOG.md

@@ -7,6 +7,12 @@ the two would publish a release for every unrelated product deploy.
 Semver applies to **this package's own surface** — the exported names, the
 call shapes, the result shape — not to the API behind it.
 
+## 1.30.0 — `authentication.signature`
+
+A message carries `authentication.signature`: `pass` when it came from
+another Pidgeon address directly and its signed sender verified against the
+sending domain's key, null otherwise. Additive.
+
 ## 1.29.0 — The signed-sender records
 
 Every domain's DNS records (`domainsGet`, `domainsCreate`, `domainsVerify`)

package/dist/index.d.cts

@@ -489,12 +489,16 @@ type Message = {
         [key: string]: string;
     };
     /**
-     * What the receiving transport said about the sending domain. Null means it did not report, not that the check failed — normal on outbound, and on inbound it is the difference between unknown and forged.
+     * What the receiving transport said about the sending domain. Null means it did not report, not that the check failed — normal on outbound, and on inbound it is the difference between unknown and forged. A `From:` is the sending domain's own word when `dmarc` or `signature` is `pass`.
      */
     authentication: {
         spf: string | null;
         dkim: string | null;
         dmarc: string | null;
+        /**
+         * `pass` when the message came from another Pidgeon address directly, and its signed sender verified against the sending domain's published key. Null on mail that came through SMTP, which DMARC speaks for instead.
+         */
+        signature: string | null;
     };
     /**
      * Who this message says it is from. A Pidgeon sender declares it on every message it sends; mail from ordinary email has only the address.
@@ -705,12 +709,16 @@ type AwaitedMessage = {
             [key: string]: string;
         };
         /**
-         * What the receiving transport said about the sending domain. Null means it did not report, not that the check failed — normal on outbound, and on inbound it is the difference between unknown and forged.
+         * What the receiving transport said about the sending domain. Null means it did not report, not that the check failed — normal on outbound, and on inbound it is the difference between unknown and forged. A `From:` is the sending domain's own word when `dmarc` or `signature` is `pass`.
          */
         authentication: {
             spf: string | null;
             dkim: string | null;
             dmarc: string | null;
+            /**
+             * `pass` when the message came from another Pidgeon address directly, and its signed sender verified against the sending domain's published key. Null on mail that came through SMTP, which DMARC speaks for instead.
+             */
+            signature: string | null;
         };
         /**
          * Who this message says it is from. A Pidgeon sender declares it on every message it sends; mail from ordinary email has only the address.

package/dist/index.d.ts

@@ -489,12 +489,16 @@ type Message = {
         [key: string]: string;
     };
     /**
-     * What the receiving transport said about the sending domain. Null means it did not report, not that the check failed — normal on outbound, and on inbound it is the difference between unknown and forged.
+     * What the receiving transport said about the sending domain. Null means it did not report, not that the check failed — normal on outbound, and on inbound it is the difference between unknown and forged. A `From:` is the sending domain's own word when `dmarc` or `signature` is `pass`.
      */
     authentication: {
         spf: string | null;
         dkim: string | null;
         dmarc: string | null;
+        /**
+         * `pass` when the message came from another Pidgeon address directly, and its signed sender verified against the sending domain's published key. Null on mail that came through SMTP, which DMARC speaks for instead.
+         */
+        signature: string | null;
     };
     /**
      * Who this message says it is from. A Pidgeon sender declares it on every message it sends; mail from ordinary email has only the address.
@@ -705,12 +709,16 @@ type AwaitedMessage = {
             [key: string]: string;
         };
         /**
-         * What the receiving transport said about the sending domain. Null means it did not report, not that the check failed — normal on outbound, and on inbound it is the difference between unknown and forged.
+         * What the receiving transport said about the sending domain. Null means it did not report, not that the check failed — normal on outbound, and on inbound it is the difference between unknown and forged. A `From:` is the sending domain's own word when `dmarc` or `signature` is `pass`.
          */
         authentication: {
             spf: string | null;
             dkim: string | null;
             dmarc: string | null;
+            /**
+             * `pass` when the message came from another Pidgeon address directly, and its signed sender verified against the sending domain's published key. Null on mail that came through SMTP, which DMARC speaks for instead.
+             */
+            signature: string | null;
         };
         /**
          * Who this message says it is from. A Pidgeon sender declares it on every message it sends; mail from ordinary email has only the address.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pidgeon-ai/sdk",
-  "version": "1.29.0",
+  "version": "1.30.0",
   "description": "Email inboxes for AI agents — TypeScript SDK for Pidgeon: create addresses, send, receive and reply.",
   "keywords": [
     "email",