@primitivedotdev/sdk 1.18.0 → 1.20.0

package/dist/webhook/index.d.ts

@@ -1,4 +1,4 @@
 import { $ as isPaymentFailedEvent, A as RawContentInline, B as InteractionEvent, C as ParsedData, D as ParsedStatus, E as ParsedError, F as ValidateEmailAuthResult, G as PaymentFailedEvent, H as InteractionX402Suffix, I as WebhookAttachment, J as WebhookEventType, K as PaymentSettledEvent, L as WebhookEvent, M as SpfResult, N as TlsReportAnalysis, O as RawContent, P as UnknownEvent, Q as isPaymentEvent, R as EMAIL_EVENT_TYPES, S as KnownWebhookEvent, T as ParsedDataFailed, U as PAYMENT_EVENT_TYPES, V as InteractionX402Event, W as PaymentEvent, X as isInteractionX402Event, Y as isEmailReceivedEvent, Z as isKnownWebhookEventType, _ as ForwardResultAttachmentAnalyzed, a as DkimSignature, b as ForwardVerdict, c as DmarcResult, d as EmailAuth, et as isPaymentSettledEvent, f as EmailReceivedEvent, g as ForwardResult, h as ForwardOriginalSender, i as DkimResult, j as RoutingDecision, k as RawContentDownloadOnly, l as EmailAddress, m as ForwardAnalysis, n as AuthVerdict, o as DmarcPolicy, p as EventType, q as WEBHOOK_EVENT_TYPES, r as BounceAnalysis, s as DmarcReportAnalysis, t as AuthConfidence, u as EmailAnalysis, v as ForwardResultAttachmentSkipped, w as ParsedDataComplete, x as ForwardVerification, y as ForwardResultInline, z as INTERACTION_EVENT_TYPES } from "../types-DVjBmOg0.js";
-import { _ as buildForwardSubject, a as RawEmailDecodeErrorCode, b as normalizeReceivedEmail, c as WebhookPayloadError, d as WebhookValidationErrorCode, f as WebhookVerificationError, g as ReceivedEmailThread, h as ReceivedEmailAddress, i as RawEmailDecodeError, l as WebhookPayloadErrorCode, m as ReceivedEmail, n as PrimitiveWebhookError, o as VERIFICATION_ERRORS, p as WebhookVerificationErrorCode, r as RAW_EMAIL_ERRORS, s as WebhookErrorCode, t as PAYLOAD_ERRORS, u as WebhookValidationError, v as buildReplySubject, x as parseHeaderAddress, y as formatAddress } from "../errors-BTHBQqJa.js";
-import { A as PRIMITIVE_SIGNATURE_HEADER, B as safeValidateEmailReceivedEvent, C as StandardWebhooksSignResult, D as LEGACY_CONFIRMED_HEADER, E as verifyStandardWebhooksSignature, F as GenerateDownloadTokenOptions, I as VerifyDownloadTokenOptions, L as VerifyDownloadTokenResult, M as VerifyOptions, N as signWebhookPayload, O as LEGACY_SIGNATURE_HEADER, P as verifyWebhookSignature, R as generateDownloadToken, S as STANDARD_WEBHOOK_TIMESTAMP_HEADER, T as signStandardWebhooksPayload, V as validateEmailReceivedEvent, _ as WEBHOOK_VERSION, a as WebhookHeaders, b as STANDARD_WEBHOOK_ID_HEADER, c as getDownloadTimeRemaining, d as handleWebhookEvent, f as isDownloadExpired, g as verifyRawEmailDownload, h as receive, i as WEBHOOK_EVENT_HEADER, j as SignResult, k as PRIMITIVE_CONFIRMED_HEADER, l as getEventHeader, m as parseWebhookEvent, n as HandleWebhookOptions, o as confirmedHeaders, p as isRawIncluded, r as ReceiveRequestOptions, s as decodeRawEmail, t as DecodeRawEmailOptions, u as handleWebhook, v as validateEmailAuth, w as StandardWebhooksVerifyOptions, x as STANDARD_WEBHOOK_SIGNATURE_HEADER, y as emailReceivedEventJsonSchema, z as verifyDownloadToken } from "../index-D2nlv8DS.js";
-export { AuthConfidence, AuthVerdict, BounceAnalysis, DecodeRawEmailOptions, DkimResult, DkimSignature, DmarcPolicy, DmarcReportAnalysis, DmarcResult, EMAIL_EVENT_TYPES, EmailAddress, EmailAnalysis, EmailAuth, EmailReceivedEvent, EventType, ForwardAnalysis, ForwardOriginalSender, ForwardResult, ForwardResultAttachmentAnalyzed, ForwardResultAttachmentSkipped, ForwardResultInline, ForwardVerdict, ForwardVerification, GenerateDownloadTokenOptions, HandleWebhookOptions, INTERACTION_EVENT_TYPES, InteractionEvent, InteractionX402Event, InteractionX402Suffix, KnownWebhookEvent, LEGACY_CONFIRMED_HEADER, LEGACY_SIGNATURE_HEADER, PAYLOAD_ERRORS, PAYMENT_EVENT_TYPES, PRIMITIVE_CONFIRMED_HEADER, PRIMITIVE_SIGNATURE_HEADER, ParsedData, ParsedDataComplete, ParsedDataFailed, ParsedError, ParsedStatus, PaymentEvent, PaymentFailedEvent, PaymentSettledEvent, PrimitiveWebhookError, RAW_EMAIL_ERRORS, RawContent, RawContentDownloadOnly, RawContentInline, RawEmailDecodeError, RawEmailDecodeErrorCode, ReceiveRequestOptions, ReceivedEmail, ReceivedEmailAddress, ReceivedEmailThread, RoutingDecision, STANDARD_WEBHOOK_ID_HEADER, STANDARD_WEBHOOK_SIGNATURE_HEADER, STANDARD_WEBHOOK_TIMESTAMP_HEADER, SignResult, SpfResult, StandardWebhooksSignResult, StandardWebhooksVerifyOptions, TlsReportAnalysis, UnknownEvent, VERIFICATION_ERRORS, ValidateEmailAuthResult, VerifyDownloadTokenOptions, VerifyDownloadTokenResult, VerifyOptions, WEBHOOK_EVENT_HEADER, WEBHOOK_EVENT_TYPES, WEBHOOK_VERSION, WebhookAttachment, WebhookErrorCode, WebhookEvent, WebhookEventType, WebhookHeaders, WebhookPayloadError, WebhookPayloadErrorCode, WebhookValidationError, WebhookValidationErrorCode, WebhookVerificationError, WebhookVerificationErrorCode, buildForwardSubject, buildReplySubject, confirmedHeaders, decodeRawEmail, emailReceivedEventJsonSchema, formatAddress, generateDownloadToken, getDownloadTimeRemaining, getEventHeader, handleWebhook, handleWebhookEvent, isDownloadExpired, isEmailReceivedEvent, isInteractionX402Event, isKnownWebhookEventType, isPaymentEvent, isPaymentFailedEvent, isPaymentSettledEvent, isRawIncluded, normalizeReceivedEmail, parseHeaderAddress, parseWebhookEvent, receive, safeValidateEmailReceivedEvent, signStandardWebhooksPayload, signWebhookPayload, validateEmailAuth, validateEmailReceivedEvent, verifyDownloadToken, verifyRawEmailDownload, verifyStandardWebhooksSignature, verifyWebhookSignature };
+import { C as buildReplySubject, E as parseHeaderAddress, S as buildForwardSubject, T as normalizeReceivedEmail, _ as isTrustedSender, a as RawEmailDecodeErrorCode, b as ReceivedEmailAddress, c as WebhookPayloadError, d as WebhookValidationErrorCode, f as WebhookVerificationError, g as TrustedSenderResult, h as TrustedSenderOptions, i as RawEmailDecodeError, l as WebhookPayloadErrorCode, m as TrustReason, n as PrimitiveWebhookError, o as VERIFICATION_ERRORS, p as WebhookVerificationErrorCode, r as RAW_EMAIL_ERRORS, s as WebhookErrorCode, t as PAYLOAD_ERRORS, u as WebhookValidationError, v as validateEmailAuth, w as formatAddress, x as ReceivedEmailThread, y as ReceivedEmail } from "../errors-DAHv2kWU.js";
+import { A as SignResult, B as validateEmailReceivedEvent, C as StandardWebhooksVerifyOptions, D as LEGACY_SIGNATURE_HEADER, E as LEGACY_CONFIRMED_HEADER, F as VerifyDownloadTokenOptions, I as VerifyDownloadTokenResult, L as generateDownloadToken, M as signWebhookPayload, N as verifyWebhookSignature, O as PRIMITIVE_CONFIRMED_HEADER, P as GenerateDownloadTokenOptions, R as verifyDownloadToken, S as StandardWebhooksSignResult, T as verifyStandardWebhooksSignature, _ as WEBHOOK_VERSION, a as WebhookHeaders, b as STANDARD_WEBHOOK_SIGNATURE_HEADER, c as getDownloadTimeRemaining, d as handleWebhookEvent, f as isDownloadExpired, g as verifyRawEmailDownload, h as receive, i as WEBHOOK_EVENT_HEADER, j as VerifyOptions, k as PRIMITIVE_SIGNATURE_HEADER, l as getEventHeader, m as parseWebhookEvent, n as HandleWebhookOptions, o as confirmedHeaders, p as isRawIncluded, r as ReceiveRequestOptions, s as decodeRawEmail, t as DecodeRawEmailOptions, u as handleWebhook, v as emailReceivedEventJsonSchema, w as signStandardWebhooksPayload, x as STANDARD_WEBHOOK_TIMESTAMP_HEADER, y as STANDARD_WEBHOOK_ID_HEADER, z as safeValidateEmailReceivedEvent } from "../index-DJeUuGUn.js";
+export { AuthConfidence, AuthVerdict, BounceAnalysis, DecodeRawEmailOptions, DkimResult, DkimSignature, DmarcPolicy, DmarcReportAnalysis, DmarcResult, EMAIL_EVENT_TYPES, EmailAddress, EmailAnalysis, EmailAuth, EmailReceivedEvent, EventType, ForwardAnalysis, ForwardOriginalSender, ForwardResult, ForwardResultAttachmentAnalyzed, ForwardResultAttachmentSkipped, ForwardResultInline, ForwardVerdict, ForwardVerification, GenerateDownloadTokenOptions, HandleWebhookOptions, INTERACTION_EVENT_TYPES, InteractionEvent, InteractionX402Event, InteractionX402Suffix, KnownWebhookEvent, LEGACY_CONFIRMED_HEADER, LEGACY_SIGNATURE_HEADER, PAYLOAD_ERRORS, PAYMENT_EVENT_TYPES, PRIMITIVE_CONFIRMED_HEADER, PRIMITIVE_SIGNATURE_HEADER, ParsedData, ParsedDataComplete, ParsedDataFailed, ParsedError, ParsedStatus, PaymentEvent, PaymentFailedEvent, PaymentSettledEvent, PrimitiveWebhookError, RAW_EMAIL_ERRORS, RawContent, RawContentDownloadOnly, RawContentInline, RawEmailDecodeError, RawEmailDecodeErrorCode, ReceiveRequestOptions, ReceivedEmail, ReceivedEmailAddress, ReceivedEmailThread, RoutingDecision, STANDARD_WEBHOOK_ID_HEADER, STANDARD_WEBHOOK_SIGNATURE_HEADER, STANDARD_WEBHOOK_TIMESTAMP_HEADER, SignResult, SpfResult, StandardWebhooksSignResult, StandardWebhooksVerifyOptions, TlsReportAnalysis, TrustReason, TrustedSenderOptions, TrustedSenderResult, UnknownEvent, VERIFICATION_ERRORS, ValidateEmailAuthResult, VerifyDownloadTokenOptions, VerifyDownloadTokenResult, VerifyOptions, WEBHOOK_EVENT_HEADER, WEBHOOK_EVENT_TYPES, WEBHOOK_VERSION, WebhookAttachment, WebhookErrorCode, WebhookEvent, WebhookEventType, WebhookHeaders, WebhookPayloadError, WebhookPayloadErrorCode, WebhookValidationError, WebhookValidationErrorCode, WebhookVerificationError, WebhookVerificationErrorCode, buildForwardSubject, buildReplySubject, confirmedHeaders, decodeRawEmail, emailReceivedEventJsonSchema, formatAddress, generateDownloadToken, getDownloadTimeRemaining, getEventHeader, handleWebhook, handleWebhookEvent, isDownloadExpired, isEmailReceivedEvent, isInteractionX402Event, isKnownWebhookEventType, isPaymentEvent, isPaymentFailedEvent, isPaymentSettledEvent, isRawIncluded, isTrustedSender, normalizeReceivedEmail, parseHeaderAddress, parseWebhookEvent, receive, safeValidateEmailReceivedEvent, signStandardWebhooksPayload, signWebhookPayload, validateEmailAuth, validateEmailReceivedEvent, verifyDownloadToken, verifyRawEmailDownload, verifyStandardWebhooksSignature, verifyWebhookSignature };

package/dist/webhook/index.js

@@ -1,3 +1,3 @@
-import { a as VERIFICATION_ERRORS, c as WebhookVerificationError, d as formatAddress, f as normalizeReceivedEmail, i as RawEmailDecodeError, l as buildForwardSubject, n as PrimitiveWebhookError, o as WebhookPayloadError, p as parseHeaderAddress, r as RAW_EMAIL_ERRORS, s as WebhookValidationError, t as PAYLOAD_ERRORS, u as buildReplySubject } from "../errors-BPJGp9I6.js";
-import { A as LEGACY_CONFIRMED_HEADER, B as isEmailReceivedEvent, C as SpfResult, D as STANDARD_WEBHOOK_TIMESTAMP_HEADER, E as STANDARD_WEBHOOK_SIGNATURE_HEADER, F as verifyWebhookSignature, G as isPaymentSettledEvent, H as isKnownWebhookEventType, I as EMAIL_EVENT_TYPES, J as safeValidateEmailReceivedEvent, K as generateDownloadToken, L as INTERACTION_EVENT_TYPES, M as PRIMITIVE_CONFIRMED_HEADER, N as PRIMITIVE_SIGNATURE_HEADER, O as signStandardWebhooksPayload, P as signWebhookPayload, R as PAYMENT_EVENT_TYPES, S as ParsedStatus, T as STANDARD_WEBHOOK_ID_HEADER, U as isPaymentEvent, V as isInteractionX402Event, W as isPaymentFailedEvent, Y as validateEmailReceivedEvent, _ as DkimResult, a as getEventHeader, b as EventType, c as isDownloadExpired, d as receive, f as verifyRawEmailDownload, g as AuthVerdict, h as AuthConfidence, i as getDownloadTimeRemaining, j as LEGACY_SIGNATURE_HEADER, k as verifyStandardWebhooksSignature, l as isRawIncluded, m as validateEmailAuth, n as confirmedHeaders, o as handleWebhook, p as WEBHOOK_VERSION, q as verifyDownloadToken, r as decodeRawEmail, s as handleWebhookEvent, t as WEBHOOK_EVENT_HEADER, u as parseWebhookEvent, v as DmarcPolicy, w as emailReceivedEventJsonSchema, x as ForwardVerdict, y as DmarcResult, z as WEBHOOK_EVENT_TYPES } from "../webhook-BekIm0Uf.js";
-export { AuthConfidence, AuthVerdict, DkimResult, DmarcPolicy, DmarcResult, EMAIL_EVENT_TYPES, EventType, ForwardVerdict, INTERACTION_EVENT_TYPES, LEGACY_CONFIRMED_HEADER, LEGACY_SIGNATURE_HEADER, PAYLOAD_ERRORS, PAYMENT_EVENT_TYPES, PRIMITIVE_CONFIRMED_HEADER, PRIMITIVE_SIGNATURE_HEADER, ParsedStatus, PrimitiveWebhookError, RAW_EMAIL_ERRORS, RawEmailDecodeError, STANDARD_WEBHOOK_ID_HEADER, STANDARD_WEBHOOK_SIGNATURE_HEADER, STANDARD_WEBHOOK_TIMESTAMP_HEADER, SpfResult, VERIFICATION_ERRORS, WEBHOOK_EVENT_HEADER, WEBHOOK_EVENT_TYPES, WEBHOOK_VERSION, WebhookPayloadError, WebhookValidationError, WebhookVerificationError, buildForwardSubject, buildReplySubject, confirmedHeaders, decodeRawEmail, emailReceivedEventJsonSchema, formatAddress, generateDownloadToken, getDownloadTimeRemaining, getEventHeader, handleWebhook, handleWebhookEvent, isDownloadExpired, isEmailReceivedEvent, isInteractionX402Event, isKnownWebhookEventType, isPaymentEvent, isPaymentFailedEvent, isPaymentSettledEvent, isRawIncluded, normalizeReceivedEmail, parseHeaderAddress, parseWebhookEvent, receive, safeValidateEmailReceivedEvent, signStandardWebhooksPayload, signWebhookPayload, validateEmailAuth, validateEmailReceivedEvent, verifyDownloadToken, verifyRawEmailDownload, verifyStandardWebhooksSignature, verifyWebhookSignature };
+import { C as normalizeReceivedEmail, S as formatAddress, _ as ForwardVerdict, a as VERIFICATION_ERRORS, b as buildForwardSubject, c as WebhookVerificationError, d as AuthConfidence, f as AuthVerdict, g as EventType, h as DmarcResult, i as RawEmailDecodeError, l as isTrustedSender, m as DmarcPolicy, n as PrimitiveWebhookError, o as WebhookPayloadError, p as DkimResult, r as RAW_EMAIL_ERRORS, s as WebhookValidationError, t as PAYLOAD_ERRORS, u as validateEmailAuth, v as ParsedStatus, w as parseHeaderAddress, x as buildReplySubject, y as SpfResult } from "../errors-D6WjisrD.js";
+import { A as isEmailReceivedEvent, C as PRIMITIVE_SIGNATURE_HEADER, D as INTERACTION_EVENT_TYPES, E as EMAIL_EVENT_TYPES, F as isPaymentSettledEvent, I as generateDownloadToken, L as verifyDownloadToken, M as isKnownWebhookEventType, N as isPaymentEvent, O as PAYMENT_EVENT_TYPES, P as isPaymentFailedEvent, R as safeValidateEmailReceivedEvent, S as PRIMITIVE_CONFIRMED_HEADER, T as verifyWebhookSignature, _ as STANDARD_WEBHOOK_TIMESTAMP_HEADER, a as getEventHeader, b as LEGACY_CONFIRMED_HEADER, c as isDownloadExpired, d as receive, f as verifyRawEmailDownload, g as STANDARD_WEBHOOK_SIGNATURE_HEADER, h as STANDARD_WEBHOOK_ID_HEADER, i as getDownloadTimeRemaining, j as isInteractionX402Event, k as WEBHOOK_EVENT_TYPES, l as isRawIncluded, m as emailReceivedEventJsonSchema, n as confirmedHeaders, o as handleWebhook, p as WEBHOOK_VERSION, r as decodeRawEmail, s as handleWebhookEvent, t as WEBHOOK_EVENT_HEADER, u as parseWebhookEvent, v as signStandardWebhooksPayload, w as signWebhookPayload, x as LEGACY_SIGNATURE_HEADER, y as verifyStandardWebhooksSignature, z as validateEmailReceivedEvent } from "../webhook-1cz088XC.js";
+export { AuthConfidence, AuthVerdict, DkimResult, DmarcPolicy, DmarcResult, EMAIL_EVENT_TYPES, EventType, ForwardVerdict, INTERACTION_EVENT_TYPES, LEGACY_CONFIRMED_HEADER, LEGACY_SIGNATURE_HEADER, PAYLOAD_ERRORS, PAYMENT_EVENT_TYPES, PRIMITIVE_CONFIRMED_HEADER, PRIMITIVE_SIGNATURE_HEADER, ParsedStatus, PrimitiveWebhookError, RAW_EMAIL_ERRORS, RawEmailDecodeError, STANDARD_WEBHOOK_ID_HEADER, STANDARD_WEBHOOK_SIGNATURE_HEADER, STANDARD_WEBHOOK_TIMESTAMP_HEADER, SpfResult, VERIFICATION_ERRORS, WEBHOOK_EVENT_HEADER, WEBHOOK_EVENT_TYPES, WEBHOOK_VERSION, WebhookPayloadError, WebhookValidationError, WebhookVerificationError, buildForwardSubject, buildReplySubject, confirmedHeaders, decodeRawEmail, emailReceivedEventJsonSchema, formatAddress, generateDownloadToken, getDownloadTimeRemaining, getEventHeader, handleWebhook, handleWebhookEvent, isDownloadExpired, isEmailReceivedEvent, isInteractionX402Event, isKnownWebhookEventType, isPaymentEvent, isPaymentFailedEvent, isPaymentSettledEvent, isRawIncluded, isTrustedSender, normalizeReceivedEmail, parseHeaderAddress, parseWebhookEvent, receive, safeValidateEmailReceivedEvent, signStandardWebhooksPayload, signWebhookPayload, validateEmailAuth, validateEmailReceivedEvent, verifyDownloadToken, verifyRawEmailDownload, verifyStandardWebhooksSignature, verifyWebhookSignature };

package/dist/{webhook-BekIm0Uf.js → webhook-1cz088XC.js}

@@ -1,4 +1,4 @@
-import { c as WebhookVerificationError, f as normalizeReceivedEmail, i as RawEmailDecodeError, o as WebhookPayloadError, s as WebhookValidationError } from "./errors-BPJGp9I6.js";
+import { C as normalizeReceivedEmail, c as WebhookVerificationError, i as RawEmailDecodeError, o as WebhookPayloadError, s as WebhookValidationError } from "./errors-D6WjisrD.js";
 import { createHash, createHmac, timingSafeEqual } from "node:crypto";
 //#region src/generated/email-received-event.validator.generated.ts
 /**
@@ -10026,256 +10026,6 @@ const emailReceivedEventJsonSchema = {
 	}
 };
 //#endregion
-//#region src/types.ts
-const EventType = {
-	EmailReceived: "email.received",
-	EmailBounced: "email.bounced",
-	EmailTlsReport: "email.tls_report",
-	EmailDmarcReport: "email.dmarc_report",
-	EmailDmarcFailure: "email.dmarc_failure"
-};
-const ParsedStatus = {
-	Complete: "complete",
-	Failed: "failed"
-};
-const ForwardVerdict = {
-	Legit: "legit",
-	Unknown: "unknown"
-};
-const SpfResult = {
-	Pass: "pass",
-	Fail: "fail",
-	Softfail: "softfail",
-	Neutral: "neutral",
-	None: "none",
-	Temperror: "temperror",
-	Permerror: "permerror"
-};
-const DmarcResult = {
-	Pass: "pass",
-	Fail: "fail",
-	None: "none",
-	Temperror: "temperror",
-	Permerror: "permerror"
-};
-const DmarcPolicy = {
-	Reject: "reject",
-	Quarantine: "quarantine",
-	None: "none"
-};
-const DkimResult = {
-	Pass: "pass",
-	Fail: "fail",
-	Temperror: "temperror",
-	Permerror: "permerror"
-};
-const AuthConfidence = {
-	High: "high",
-	Medium: "medium",
-	Low: "low"
-};
-const AuthVerdict = {
-	Legit: "legit",
-	Suspicious: "suspicious",
-	Unknown: "unknown"
-};
-//#endregion
-//#region src/webhook/auth.ts
-/**
-* Minimum DKIM key size considered acceptable.
-*
-* 1024-bit RSA keys are cryptographically weak by modern standards (NIST
-* deprecated them in 2013), but they remain extremely common in email due to:
-* - DNS TXT record size limits (255 bytes per string)
-* - Legacy infrastructure constraints
-* - Major ESPs like Amazon SES and Resend still use 1024-bit keys
-*
-* We flag keys <1024 bits as weak (these are truly dangerous), while accepting
-* >=1024 bits to avoid false positives against legitimate senders. For maximum
-* security, domain owners should use 2048+ bit keys where possible.
-*/
-const MIN_SECURE_KEY_BITS = 1024;
-/**
-* Validate email authentication and compute a verdict.
-*
-* This function analyzes SPF, DKIM, and DMARC results to determine
-* whether an email is likely authentic ("legit"), potentially spoofed
-* ("suspicious"), or indeterminate ("unknown").
-*
-* ## Verdict Logic
-*
-* **Legit (high confidence):**
-* - DMARC pass with DKIM alignment (cryptographic proof of authenticity)
-*
-* **Legit (medium confidence):**
-* - DMARC pass with SPF alignment only (no DKIM)
-*   - Note: SPF can break through forwarding, but DMARC pass is still meaningful
-*
-* **Suspicious (high confidence):**
-* - DMARC fail when domain has `reject` or `quarantine` policy
-*   - The domain owner explicitly says to distrust failing emails
-* - SPF explicitly fails (IP not authorized by sender)
-*
-* **Suspicious (low confidence):**
-* - DMARC fail when domain has `none` policy (monitoring mode)
-* - No DMARC record but SPF/DKIM fail
-*
-* **Unknown:**
-* - No DMARC record and no clear pass/fail
-* - Temporary errors during authentication
-* - No authentication data available
-*
-* @param auth - Email authentication results from the webhook
-* @returns Verdict, confidence level, and explanatory reasons
-*
-* @example
-* ```typescript
-* const result = validateEmailAuth({
-*   spf: 'pass',
-*   dmarc: 'pass',
-*   dmarcPolicy: 'reject',
-*   dmarcFromDomain: 'example.com',
-*   dmarcSpfAligned: true,
-*   dmarcDkimAligned: true,
-*   dmarcSpfStrict: false,
-*   dmarcDkimStrict: false,
-*   dkimSignatures: [{
-*     domain: 'example.com',
-*     selector: 'default',
-*     result: 'pass',
-*     aligned: true,
-*     keyBits: 2048,
-*     algo: 'rsa-sha256',
-*   }],
-* });
-*
-* // result.verdict === 'legit'
-* // result.confidence === 'high'
-* // result.reasons === ['DMARC passed with DKIM alignment']
-* ```
-*/
-function validateEmailAuth(auth) {
-	const reasons = [];
-	let verdict;
-	let confidence;
-	if (auth.dmarc === "temperror" || auth.dmarc === "permerror") return {
-		verdict: "unknown",
-		confidence: "low",
-		reasons: [`DMARC verification error (${auth.dmarc})`, "Cannot determine email authenticity due to DNS or policy errors"]
-	};
-	if (auth.spf === "temperror" || auth.spf === "permerror") reasons.push(`SPF verification error (${auth.spf})`);
-	const weakKeySignatures = auth.dkimSignatures.filter((sig) => sig.keyBits != null && sig.keyBits < MIN_SECURE_KEY_BITS);
-	if (weakKeySignatures.length > 0) for (const sig of weakKeySignatures) reasons.push(`Weak DKIM key (${sig.keyBits} bits) for ${sig.domain} - minimum ${MIN_SECURE_KEY_BITS} bits recommended`);
-	if (auth.dmarc === "pass") {
-		const alignedSigs = auth.dkimSignatures.filter((sig) => sig.result === "pass" && sig.aligned);
-		if (auth.dmarcDkimAligned && alignedSigs.length > 0) {
-			const domains = alignedSigs.map((sig) => sig.domain).join(", ");
-			reasons.unshift(`DMARC passed with DKIM alignment (${domains})`);
-			verdict = "legit";
-			confidence = weakKeySignatures.length > 0 ? "medium" : "high";
-			return {
-				verdict,
-				confidence,
-				reasons
-			};
-		}
-		if (auth.dmarcSpfAligned && auth.spf === "pass") {
-			reasons.unshift("DMARC passed with SPF alignment");
-			reasons.push("No aligned DKIM signature (SPF can break through forwarding)");
-			return {
-				verdict: "legit",
-				confidence: "medium",
-				reasons
-			};
-		}
-		reasons.unshift("DMARC passed");
-		return {
-			verdict: "legit",
-			confidence: "medium",
-			reasons
-		};
-	}
-	if (auth.dmarc === "fail") {
-		if (auth.dmarcPolicy === "reject") {
-			reasons.unshift("DMARC failed and domain has reject policy");
-			reasons.push("The sender's domain explicitly rejects emails that fail authentication");
-			return {
-				verdict: "suspicious",
-				confidence: "high",
-				reasons
-			};
-		}
-		if (auth.dmarcPolicy === "quarantine") {
-			reasons.unshift("DMARC failed and domain has quarantine policy");
-			reasons.push("The sender's domain marks failing emails as suspicious");
-			return {
-				verdict: "suspicious",
-				confidence: "high",
-				reasons
-			};
-		}
-		reasons.unshift("DMARC failed (domain is in monitoring mode)");
-		if (auth.spf === "fail") {
-			reasons.push("SPF failed - sending IP not authorized");
-			return {
-				verdict: "suspicious",
-				confidence: "medium",
-				reasons
-			};
-		}
-		return {
-			verdict: "suspicious",
-			confidence: "low",
-			reasons
-		};
-	}
-	if (auth.dmarc === "none") {
-		if (auth.spf === "fail") {
-			reasons.push("No DMARC record for sender domain");
-			reasons.push("SPF failed - sending IP not authorized");
-			return {
-				verdict: "suspicious",
-				confidence: "medium",
-				reasons
-			};
-		}
-		const passingDkim = auth.dkimSignatures.filter((sig) => sig.result === "pass");
-		if (passingDkim.length > 0) {
-			const domains = passingDkim.map((sig) => sig.domain).join(", ");
-			reasons.push("No DMARC record for sender domain");
-			reasons.push(`DKIM verified for: ${domains}`);
-			if (auth.spf === "pass") reasons.push("SPF passed");
-			return {
-				verdict: "unknown",
-				confidence: "low",
-				reasons
-			};
-		}
-		if (auth.spf === "pass") {
-			reasons.push("No DMARC record for sender domain");
-			reasons.push("No DKIM signatures present");
-			reasons.push("SPF passed (but SPF alone is weak authentication)");
-			return {
-				verdict: "unknown",
-				confidence: "low",
-				reasons
-			};
-		}
-		reasons.push("No DMARC record for sender domain");
-		reasons.push("No valid authentication found");
-		return {
-			verdict: "unknown",
-			confidence: "low",
-			reasons
-		};
-	}
-	return {
-		verdict: "unknown",
-		confidence: "low",
-		reasons: ["Unable to determine email authenticity"]
-	};
-}
-//#endregion
 //#region src/webhook/version.ts
 /**
 * Webhook API Version
@@ -10749,4 +10499,4 @@ function verifyRawEmailDownload(downloaded, event) {
 	return buffer;
 }
 //#endregion
-export { LEGACY_CONFIRMED_HEADER as A, isEmailReceivedEvent as B, SpfResult as C, STANDARD_WEBHOOK_TIMESTAMP_HEADER as D, STANDARD_WEBHOOK_SIGNATURE_HEADER as E, verifyWebhookSignature as F, isPaymentSettledEvent as G, isKnownWebhookEventType as H, EMAIL_EVENT_TYPES as I, safeValidateEmailReceivedEvent as J, generateDownloadToken as K, INTERACTION_EVENT_TYPES as L, PRIMITIVE_CONFIRMED_HEADER as M, PRIMITIVE_SIGNATURE_HEADER as N, signStandardWebhooksPayload as O, signWebhookPayload as P, PAYMENT_EVENT_TYPES as R, ParsedStatus as S, STANDARD_WEBHOOK_ID_HEADER as T, isPaymentEvent as U, isInteractionX402Event as V, isPaymentFailedEvent as W, validateEmailReceivedEvent as Y, DkimResult as _, getEventHeader as a, EventType as b, isDownloadExpired as c, receive as d, verifyRawEmailDownload as f, AuthVerdict as g, AuthConfidence as h, getDownloadTimeRemaining as i, LEGACY_SIGNATURE_HEADER as j, verifyStandardWebhooksSignature as k, isRawIncluded as l, validateEmailAuth as m, confirmedHeaders as n, handleWebhook as o, WEBHOOK_VERSION as p, verifyDownloadToken as q, decodeRawEmail as r, handleWebhookEvent as s, WEBHOOK_EVENT_HEADER as t, parseWebhookEvent as u, DmarcPolicy as v, emailReceivedEventJsonSchema as w, ForwardVerdict as x, DmarcResult as y, WEBHOOK_EVENT_TYPES as z };
+export { isEmailReceivedEvent as A, PRIMITIVE_SIGNATURE_HEADER as C, INTERACTION_EVENT_TYPES as D, EMAIL_EVENT_TYPES as E, isPaymentSettledEvent as F, generateDownloadToken as I, verifyDownloadToken as L, isKnownWebhookEventType as M, isPaymentEvent as N, PAYMENT_EVENT_TYPES as O, isPaymentFailedEvent as P, safeValidateEmailReceivedEvent as R, PRIMITIVE_CONFIRMED_HEADER as S, verifyWebhookSignature as T, STANDARD_WEBHOOK_TIMESTAMP_HEADER as _, getEventHeader as a, LEGACY_CONFIRMED_HEADER as b, isDownloadExpired as c, receive as d, verifyRawEmailDownload as f, STANDARD_WEBHOOK_SIGNATURE_HEADER as g, STANDARD_WEBHOOK_ID_HEADER as h, getDownloadTimeRemaining as i, isInteractionX402Event as j, WEBHOOK_EVENT_TYPES as k, isRawIncluded as l, emailReceivedEventJsonSchema as m, confirmedHeaders as n, handleWebhook as o, WEBHOOK_VERSION as p, decodeRawEmail as r, handleWebhookEvent as s, WEBHOOK_EVENT_HEADER as t, parseWebhookEvent as u, signStandardWebhooksPayload as v, signWebhookPayload as w, LEGACY_SIGNATURE_HEADER as x, verifyStandardWebhooksSignature as y, validateEmailReceivedEvent as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primitivedotdev/sdk",
-  "version": "1.18.0",
+  "version": "1.20.0",
   "description": "Official Primitive Node.js SDK: webhook, api, openapi, contract, and parser runtime modules.",
   "type": "module",
   "module": "./dist/index.js",

package/dist/errors-BPJGp9I6.js

@@ -1,287 +0,0 @@
-import { n as parseFromHeaderLoose } from "./address-parser-CQbFjgRC.js";
-//#region src/webhook/received-email.ts
-const REPLY_PREFIX_RE = /^re\s*:/i;
-const FORWARD_PREFIX_RE = /^(fwd?|fw)\s*:/i;
-function normalizeReceivedEmail(event) {
-	const receivedBy = event.email.smtp.rcpt_to[0];
-	if (!receivedBy) throw new Error("email.smtp.rcpt_to must contain at least one recipient");
-	const sender = parseHeaderAddress(event.email.headers.from) ?? {
-		address: event.email.smtp.mail_from.trim().toLowerCase(),
-		name: null
-	};
-	const replyTarget = firstStructuredAddress(event.email.parsed.reply_to) ?? sender;
-	const subject = event.email.headers.subject ?? null;
-	const references = event.email.parsed.references ?? [];
-	const messageId = event.email.headers.message_id ?? null;
-	return {
-		id: event.email.id,
-		eventId: event.id,
-		receivedAt: event.email.received_at,
-		sender,
-		replyTarget,
-		receivedBy,
-		receivedByAll: [...event.email.smtp.rcpt_to],
-		subject,
-		replySubject: buildReplySubject(subject),
-		forwardSubject: buildForwardSubject(subject),
-		text: event.email.parsed.body_text ?? null,
-		thread: {
-			messageId,
-			inReplyTo: event.email.parsed.in_reply_to ?? [],
-			references
-		},
-		attachments: event.email.parsed.attachments ?? [],
-		auth: event.email.auth,
-		analysis: event.email.analysis,
-		raw: event
-	};
-}
-function buildReplySubject(subject) {
-	const trimmed = subject?.trim() ?? "";
-	if (trimmed.length === 0) return "Re:";
-	return REPLY_PREFIX_RE.test(trimmed) ? trimmed : `Re: ${trimmed}`;
-}
-function buildForwardSubject(subject) {
-	const trimmed = subject?.trim() ?? "";
-	if (trimmed.length === 0) return "Fwd:";
-	return FORWARD_PREFIX_RE.test(trimmed) ? trimmed : `Fwd: ${trimmed}`;
-}
-function formatAddress(address) {
-	return address.name ? `${address.name} <${address.address}>` : address.address;
-}
-function firstStructuredAddress(addresses) {
-	const address = addresses?.[0];
-	if (!address) return null;
-	return {
-		address: address.address.trim().toLowerCase(),
-		name: address.name ?? null
-	};
-}
-function parseHeaderAddress(value) {
-	const parsed = parseFromHeaderLoose(value);
-	if (!parsed) return null;
-	return {
-		address: parsed.address,
-		name: parsed.name?.trim() || null
-	};
-}
-//#endregion
-//#region src/webhook/errors.ts
-/**
-* Verification error definitions.
-* Use these for documentation, dashboards, and i18n.
-*/
-const VERIFICATION_ERRORS = {
-	INVALID_SIGNATURE_HEADER: {
-		message: "Missing or malformed Primitive-Signature header",
-		suggestion: "Check that you're reading the correct header (Primitive-Signature) and it's being passed correctly from your web framework."
-	},
-	TIMESTAMP_OUT_OF_RANGE: {
-		message: "Timestamp is too old (possible replay attack)",
-		suggestion: "This could indicate a replay attack, network delay, or server clock drift. Check your server's time is synced."
-	},
-	SIGNATURE_MISMATCH: {
-		message: "Signature doesn't match expected value",
-		suggestion: "Verify the webhook secret matches and you're using the raw request body (not re-serialized JSON)."
-	},
-	MISSING_SECRET: {
-		message: "No webhook secret was provided",
-		suggestion: "Pass your webhook secret from the Primitive dashboard. Check that the environment variable is set."
-	}
-};
-/**
-* Payload parsing error definitions.
-* Use these for documentation, dashboards, and i18n.
-*/
-const PAYLOAD_ERRORS = {
-	PAYLOAD_NULL: {
-		message: "Webhook payload is null",
-		suggestion: "Ensure you're passing the parsed JSON body, not null. Check your framework's body parsing middleware."
-	},
-	PAYLOAD_UNDEFINED: {
-		message: "Webhook payload is undefined",
-		suggestion: "The payload was not provided. Make sure you're passing the request body to the handler."
-	},
-	PAYLOAD_WRONG_TYPE: {
-		message: "Webhook payload must be an object",
-		suggestion: "The payload should be a parsed JSON object. Check that you're not passing a string or other primitive."
-	},
-	PAYLOAD_IS_ARRAY: {
-		message: "Webhook payload is an array, expected object",
-		suggestion: "Primitive webhooks are single event objects, not arrays. Check the payload structure."
-	},
-	PAYLOAD_MISSING_EVENT: {
-		message: "Webhook payload missing 'event' field",
-		suggestion: "All webhook payloads must have an 'event' field. This may not be a valid Primitive webhook."
-	},
-	PAYLOAD_UNKNOWN_EVENT: {
-		message: "Unknown webhook event type",
-		suggestion: "This event type is not recognized. You may need to update your SDK or handle unknown events gracefully."
-	},
-	PAYLOAD_EMPTY_BODY: {
-		message: "Request body is empty",
-		suggestion: "The request body was empty. Ensure the webhook is sending data and your framework is parsing it correctly."
-	},
-	JSON_PARSE_FAILED: {
-		message: "Failed to parse JSON body",
-		suggestion: "The request body is not valid JSON. Check the raw body content and Content-Type header."
-	},
-	INVALID_ENCODING: {
-		message: "Invalid body encoding",
-		suggestion: "The request body encoding is not supported. Primitive webhooks use UTF-8 encoded JSON."
-	}
-};
-/**
-* Raw email decode error definitions.
-* Use these for documentation, dashboards, and i18n.
-*/
-const RAW_EMAIL_ERRORS = {
-	NOT_INCLUDED: {
-		message: "Raw email content not included inline",
-		suggestion: "Use the download URL at event.email.content.download.url to fetch the raw email."
-	},
-	INVALID_BASE64: {
-		message: "Raw email content is not valid base64",
-		suggestion: "The raw email data is malformed. Fetch the raw email from the download URL or regenerate the webhook payload."
-	},
-	HASH_MISMATCH: {
-		message: "SHA-256 hash verification failed",
-		suggestion: "The raw email data may be corrupted. Try downloading from the URL instead."
-	}
-};
-/**
-* Base class for all Primitive webhook errors.
-*
-* Catch this to handle any error from the SDK in a single catch block.
-*
-* @example
-* ```typescript
-* import { handleWebhook, PrimitiveWebhookError } from '@primitivedotdev/sdk';
-*
-* try {
-*   const event = handleWebhook({ body, headers, secret });
-* } catch (err) {
-*   if (err instanceof PrimitiveWebhookError) {
-*     console.error(`[${err.code}] ${err.message}`);
-*     return res.status(400).json({ error: err.code });
-*   }
-*   throw err;
-* }
-* ```
-*/
-var PrimitiveWebhookError = class extends Error {
-	/**
-	* Formats the error for logging/display.
-	*/
-	toString() {
-		return `${this.name} [${this.code}]: ${this.message}\n\nSuggestion: ${this.suggestion}`;
-	}
-	/**
-	* Serializes cleanly for structured logging (Datadog, CloudWatch, etc.)
-	*/
-	toJSON() {
-		return {
-			name: this.name,
-			code: this.code,
-			message: this.message,
-			suggestion: this.suggestion
-		};
-	}
-};
-/**
-* Error thrown when webhook signature verification fails.
-*
-* Use the `code` property to programmatically handle specific error cases.
-*/
-var WebhookVerificationError = class extends PrimitiveWebhookError {
-	code;
-	suggestion;
-	constructor(code, message, suggestion) {
-		super(message ?? VERIFICATION_ERRORS[code].message);
-		this.name = "WebhookVerificationError";
-		this.code = code;
-		this.suggestion = suggestion ?? VERIFICATION_ERRORS[code].suggestion;
-	}
-};
-/**
-* Error thrown when webhook payload parsing fails (lightweight parser).
-*
-* Use the `code` property for programmatic handling and monitoring.
-* The `suggestion` property contains actionable guidance for fixing the issue.
-*/
-var WebhookPayloadError = class extends PrimitiveWebhookError {
-	code;
-	suggestion;
-	/** Original error if this wraps another error (e.g., JSON.parse failure) */
-	cause;
-	constructor(code, message, suggestion, cause) {
-		super(message ?? PAYLOAD_ERRORS[code].message);
-		this.name = "WebhookPayloadError";
-		this.code = code;
-		this.suggestion = suggestion ?? PAYLOAD_ERRORS[code].suggestion;
-		this.cause = cause;
-	}
-};
-/**
-* Error thrown when schema validation fails.
-*/
-var WebhookValidationError = class extends PrimitiveWebhookError {
-	code = "SCHEMA_VALIDATION_FAILED";
-	suggestion;
-	/** The specific field path that failed (e.g., "email.headers.from") */
-	field;
-	/** Original schema validation errors for advanced debugging */
-	validationErrors;
-	/** Number of additional validation errors beyond the first */
-	additionalErrorCount;
-	constructor(field, message, suggestion, validationErrors) {
-		super(message);
-		this.name = "WebhookValidationError";
-		this.field = field;
-		this.suggestion = suggestion;
-		this.validationErrors = validationErrors;
-		this.additionalErrorCount = Math.max(0, validationErrors.length - 1);
-	}
-	/**
-	* Formats the error for logging/display.
-	* Includes error count and suggestion.
-	*/
-	toString() {
-		let output = `${this.name} [${this.code}]: ${this.message}`;
-		if (this.additionalErrorCount > 0) output += ` (and ${this.additionalErrorCount} more validation error${this.additionalErrorCount > 1 ? "s" : ""})`;
-		output += `\n\nSuggestion: ${this.suggestion}`;
-		return output;
-	}
-	/**
-	* Serializes cleanly for structured logging (Datadog, CloudWatch, etc.)
-	*/
-	toJSON() {
-		return {
-			name: this.name,
-			code: this.code,
-			field: this.field,
-			message: this.message,
-			suggestion: this.suggestion,
-			additionalErrorCount: this.additionalErrorCount
-		};
-	}
-};
-/**
-* Error thrown when raw email decoding or verification fails.
-*
-* Use the `code` property to determine the failure reason:
-* - `NOT_INCLUDED`: Raw email not inline, must download from URL
-* - `HASH_MISMATCH`: SHA-256 verification failed, content may be corrupted
-*/
-var RawEmailDecodeError = class extends PrimitiveWebhookError {
-	code;
-	suggestion;
-	constructor(code, message) {
-		super(message ?? RAW_EMAIL_ERRORS[code].message);
-		this.name = "RawEmailDecodeError";
-		this.code = code;
-		this.suggestion = RAW_EMAIL_ERRORS[code].suggestion;
-	}
-};
-//#endregion
-export { VERIFICATION_ERRORS as a, WebhookVerificationError as c, formatAddress as d, normalizeReceivedEmail as f, RawEmailDecodeError as i, buildForwardSubject as l, PrimitiveWebhookError as n, WebhookPayloadError as o, parseHeaderAddress as p, RAW_EMAIL_ERRORS as r, WebhookValidationError as s, PAYLOAD_ERRORS as t, buildReplySubject as u };