@primitivedotdev/sdk 1.22.0 → 1.23.0

package/dist/payloads-CQtSsUT6.js

@@ -0,0 +1,409 @@
+//#region src/payloads/node-fs.ts
+/**
+* Load a Node builtin at call time. Exported for direct testing of the
+* unavailable-module error path; production code goes through the typed
+* wrappers below.
+*/
+async function loadBuiltin(specifier, operation) {
+	let builtin;
+	if (typeof process !== "undefined" && typeof process.getBuiltinModule === "function") try {
+		builtin = process.getBuiltinModule(specifier);
+	} catch {
+		builtin = void 0;
+	}
+	if (builtin !== void 0 && builtin !== null) return builtin;
+	try {
+		return await import(specifier);
+	} catch (cause) {
+		throw new Error(`${operation} requires file system access, which this runtime does not provide. Pass in-memory bytes instead of a file path when running outside Node.js.`, { cause });
+	}
+}
+/** `node:fs`, loaded lazily so Workers-style bundles never see the import. */
+function loadNodeFs(operation) {
+	return loadBuiltin("node:fs", operation);
+}
+/** `node:fs/promises`, loaded lazily for the same reason as {@link loadNodeFs}. */
+function loadNodeFsPromises(operation) {
+	return loadBuiltin("node:fs/promises", operation);
+}
+//#endregion
+//#region src/payloads/index.ts
+const CHUNK_SIZE = 64 * 1024 * 1024;
+const MANIFEST_VERSION = 1;
+const CHUNK_KDF_INFO = "payloads-chunk";
+const OBJECT_ID_BYTES = 16;
+const CEK_BYTES = 32;
+const subtle = globalThis.crypto.subtle;
+const textEncoder = new TextEncoder();
+function randomBytes(length) {
+	const out = new Uint8Array(length);
+	globalThis.crypto.getRandomValues(out);
+	return out;
+}
+function toHex(bytes) {
+	let out = "";
+	for (const b of bytes) out += b.toString(16).padStart(2, "0");
+	return out;
+}
+function fromHex(hex) {
+	if (hex.length % 2 !== 0) throw new Error("invalid hex: odd length");
+	if (hex.length > 0 && !/^[0-9a-fA-F]+$/.test(hex)) throw new Error("invalid hex: non-hex character");
+	const out = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+	return out;
+}
+async function contentHash(bytes) {
+	return new Uint8Array(await subtle.digest("SHA-256", bytes));
+}
+async function contentHashHex(bytes) {
+	return toHex(await contentHash(bytes));
+}
+/** Binary Merkle root over ordered hex leaf hashes (odd node promoted). */
+async function merkleRoot(leafHashesHex) {
+	if (leafHashesHex.length === 0) return contentHashHex(new Uint8Array(0));
+	let level = leafHashesHex.map(fromHex);
+	while (level.length > 1) {
+		const next = [];
+		for (let i = 0; i < level.length; i += 2) {
+			const left = level[i];
+			const right = i + 1 < level.length ? level[i + 1] : level[i];
+			const combined = new Uint8Array(left.length + right.length);
+			combined.set(left, 0);
+			combined.set(right, left.length);
+			next.push(await contentHash(combined));
+		}
+		level = next;
+	}
+	return toHex(level[0]);
+}
+async function deriveChunkKey(cek, index) {
+	const baseKey = await subtle.importKey("raw", cek, "HKDF", false, ["deriveKey"]);
+	const info = textEncoder.encode(`${CHUNK_KDF_INFO}:${index}`);
+	return subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: new Uint8Array(32),
+		info
+	}, baseKey, {
+		name: "AES-GCM",
+		length: 256
+	}, false, ["encrypt", "decrypt"]);
+}
+function chunkNonce(index) {
+	const nonce = new Uint8Array(12);
+	new DataView(nonce.buffer).setUint32(8, index >>> 0, false);
+	return nonce;
+}
+function chunkAad(objectId, index) {
+	const aad = new Uint8Array(objectId.length + 4);
+	aad.set(objectId, 0);
+	new DataView(aad.buffer).setUint32(objectId.length, index >>> 0, false);
+	return aad;
+}
+async function encryptChunk(cek, objectId, index, plaintext) {
+	const key = await deriveChunkKey(cek, index);
+	const ct = await subtle.encrypt({
+		name: "AES-GCM",
+		iv: chunkNonce(index),
+		additionalData: chunkAad(objectId, index)
+	}, key, plaintext);
+	return new Uint8Array(ct);
+}
+async function decryptChunk(cek, objectId, index, ciphertext) {
+	const key = await deriveChunkKey(cek, index);
+	const pt = await subtle.decrypt({
+		name: "AES-GCM",
+		iv: chunkNonce(index),
+		additionalData: chunkAad(objectId, index)
+	}, key, ciphertext);
+	return new Uint8Array(pt);
+}
+function authHeaders(apiKey) {
+	return { authorization: `Bearer ${apiKey}` };
+}
+function apiRoot(baseUrl) {
+	let end = baseUrl.length;
+	while (end > 0 && baseUrl.charCodeAt(end - 1) === 47) end--;
+	return `${baseUrl.slice(0, end)}/v1/payloads`;
+}
+const DEFAULT_MAX_RETRIES = 6;
+const RETRYABLE_STATUS = new Set([
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+* fetch with exponential backoff on transient failures. Request bodies here are
+* in-memory buffers/strings (never streams), so a retry can safely resend them.
+*/
+async function retryingFetch(url, init, label, maxRetries = DEFAULT_MAX_RETRIES) {
+	for (let attempt = 0;; attempt++) {
+		let res;
+		let networkError;
+		try {
+			res = await fetch(url, init);
+		} catch (err) {
+			networkError = err;
+		}
+		if (res && !RETRYABLE_STATUS.has(res.status)) return res;
+		if (attempt >= maxRetries) {
+			if (res) return res;
+			throw new Error(`${label}: network error after ${attempt} retries: ${networkError?.message ?? networkError}`);
+		}
+		if (res) await res.text().catch(() => {});
+		await sleep(Math.min(1e3 * 2 ** attempt, 15e3) + Math.floor(Math.random() * 250));
+	}
+}
+async function initiate(opts, manifest) {
+	const res = await retryingFetch(apiRoot(opts.baseUrl), {
+		method: "POST",
+		headers: {
+			...authHeaders(opts.apiKey),
+			"content-type": "application/json"
+		},
+		body: JSON.stringify({ manifest })
+	}, "initiate");
+	if (!res.ok) throw new Error(`initiate failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function putChunk(opts, root, d, bytes) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, {
+		method: "PUT",
+		headers: {
+			...authHeaders(opts.apiKey),
+			"content-type": "application/octet-stream"
+		},
+		body: bytes
+	}, `chunk ${d.index} upload`);
+	if (!res.ok) throw new Error(`chunk ${d.index} upload failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function finalize(opts, root) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/finalize`, {
+		method: "POST",
+		headers: authHeaders(opts.apiKey)
+	}, "finalize");
+	if (!res.ok) throw new Error(`finalize failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function fetchManifest(opts, root) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/manifest`, { headers: authHeaders(opts.apiKey) }, "get manifest");
+	if (!res.ok) throw new Error(`get manifest failed: HTTP ${res.status} ${await res.text()}`);
+	return (await res.json()).data.manifest;
+}
+async function getChunkBytes(opts, root, d) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, { headers: authHeaders(opts.apiKey) }, `get chunk ${d.index}`);
+	if (!res.ok) throw new Error(`get chunk ${d.index} failed: HTTP ${res.status}`);
+	return new Uint8Array(await res.arrayBuffer());
+}
+/**
+* Encode in-memory bytes into a payload manifest (no upload). Exposed for
+* precomputing an object's content address and for conformance-testing the
+* chunk/crypto/Merkle construction against the server object model. With a fixed
+* cek/objectId the output is fully deterministic.
+*/
+async function encodeManifest(bytes, opts = {}) {
+	const chunkSize = opts.chunkSize ?? CHUNK_SIZE;
+	const cek = opts.cekHex ? fromHex(opts.cekHex) : randomBytes(CEK_BYTES);
+	const objectId = opts.objectIdHex ? fromHex(opts.objectIdHex) : randomBytes(OBJECT_ID_BYTES);
+	const chunkCount = bytes.length === 0 ? 0 : Math.ceil(bytes.length / chunkSize);
+	const descriptors = [];
+	for (let index = 0; index < chunkCount; index++) {
+		const start = index * chunkSize;
+		const plaintext = bytes.subarray(start, Math.min(start + chunkSize, bytes.length));
+		const ciphertext = await encryptChunk(cek, objectId, index, plaintext);
+		descriptors.push({
+			index,
+			ciphertextHash: await contentHashHex(ciphertext),
+			plaintextSize: plaintext.length,
+			ciphertextSize: ciphertext.length
+		});
+	}
+	return {
+		version: MANIFEST_VERSION,
+		objectId: toHex(objectId),
+		chunkSize,
+		totalPlaintextSize: bytes.length,
+		chunkCount,
+		chunks: descriptors,
+		merkleRoot: await merkleRoot(descriptors.map((d) => d.ciphertextHash))
+	};
+}
+async function readWindow(fh, position, length) {
+	const buf = Buffer.allocUnsafe(length);
+	let read = 0;
+	while (read < length) {
+		const { bytesRead } = await fh.read(buf, read, length - read, position + read);
+		if (bytesRead === 0) break;
+		read += bytesRead;
+	}
+	return read === length ? buf : buf.subarray(0, read);
+}
+async function mapLimit(items, limit, fn) {
+	let next = 0;
+	let firstError;
+	const worker = async () => {
+		while (next < items.length && firstError === void 0) {
+			const i = next++;
+			try {
+				await fn(items[i], i);
+			} catch (err) {
+				if (firstError === void 0) firstError = err;
+				return;
+			}
+		}
+	};
+	await Promise.all(Array.from({ length: Math.min(limit, items.length || 1) }, () => worker()));
+	if (firstError !== void 0) throw firstError;
+}
+/**
+* Stream a file up as a Primitive Payload. Two passes over the file (encrypt to
+* build the manifest, then encrypt again to upload) keep memory bounded to a few
+* chunks — the whole object is never resident. Returns the content address
+* (merkleRoot) and the hex CEK needed to download it.
+*/
+async function pushFile(filePath, opts) {
+	const { open, stat } = await loadNodeFsPromises("pushFile");
+	const chunkSize = opts.chunkSize ?? CHUNK_SIZE;
+	const concurrency = opts.concurrency ?? 3;
+	const { size } = await stat(filePath);
+	const cek = randomBytes(CEK_BYTES);
+	const objectId = randomBytes(OBJECT_ID_BYTES);
+	const chunkCount = size === 0 ? 0 : Math.ceil(size / chunkSize);
+	const fh = await open(filePath, "r");
+	try {
+		const descriptors = [];
+		for (let index = 0; index < chunkCount; index++) {
+			const position = index * chunkSize;
+			const length = Math.min(chunkSize, size - position);
+			const plaintext = await readWindow(fh, position, length);
+			const ciphertext = await encryptChunk(cek, objectId, index, plaintext);
+			descriptors.push({
+				index,
+				ciphertextHash: await contentHashHex(ciphertext),
+				plaintextSize: length,
+				ciphertextSize: ciphertext.length
+			});
+			opts.onProgress?.("encrypt", index + 1, chunkCount);
+		}
+		const root = await merkleRoot(descriptors.map((d) => d.ciphertextHash));
+		await initiate(opts, {
+			version: MANIFEST_VERSION,
+			objectId: toHex(objectId),
+			chunkSize,
+			totalPlaintextSize: size,
+			chunkCount,
+			chunks: descriptors,
+			merkleRoot: root
+		});
+		let uploaded = 0;
+		await mapLimit(descriptors, concurrency, async (d) => {
+			const plaintext = await readWindow(fh, d.index * chunkSize, d.plaintextSize);
+			await putChunk(opts, root, d, await encryptChunk(cek, objectId, d.index, plaintext));
+			opts.onProgress?.("upload", ++uploaded, chunkCount);
+		});
+		await finalize(opts, root);
+		return {
+			merkleRoot: root,
+			cek: toHex(cek),
+			chunkCount,
+			totalBytes: size
+		};
+	} finally {
+		await fh.close();
+	}
+}
+/**
+* Push an in-memory buffer as a Primitive Payload. Same chunked, content-
+* addressed, per-chunk-AEAD encoding as {@link pushFile}, over a Uint8Array
+* (chunks are views, so no copy). Use {@link pushFile} for large objects that
+* shouldn't be resident in memory. Returns the content address (merkleRoot) and
+* the hex CEK.
+*/
+async function pushBytes(bytes, opts) {
+	const chunkSize = opts.chunkSize ?? CHUNK_SIZE;
+	const concurrency = opts.concurrency ?? 3;
+	const size = bytes.length;
+	const cek = randomBytes(CEK_BYTES);
+	const objectId = randomBytes(OBJECT_ID_BYTES);
+	const chunkCount = size === 0 ? 0 : Math.ceil(size / chunkSize);
+	const chunkOf = (index) => bytes.subarray(index * chunkSize, Math.min(size, (index + 1) * chunkSize));
+	const descriptors = [];
+	for (let index = 0; index < chunkCount; index++) {
+		const plaintext = chunkOf(index);
+		const ciphertext = await encryptChunk(cek, objectId, index, plaintext);
+		descriptors.push({
+			index,
+			ciphertextHash: await contentHashHex(ciphertext),
+			plaintextSize: plaintext.length,
+			ciphertextSize: ciphertext.length
+		});
+		opts.onProgress?.("encrypt", index + 1, chunkCount);
+	}
+	const root = await merkleRoot(descriptors.map((d) => d.ciphertextHash));
+	await initiate(opts, {
+		version: MANIFEST_VERSION,
+		objectId: toHex(objectId),
+		chunkSize,
+		totalPlaintextSize: size,
+		chunkCount,
+		chunks: descriptors,
+		merkleRoot: root
+	});
+	let uploaded = 0;
+	await mapLimit(descriptors, concurrency, async (d) => {
+		await putChunk(opts, root, d, await encryptChunk(cek, objectId, d.index, chunkOf(d.index)));
+		opts.onProgress?.("upload", ++uploaded, chunkCount);
+	});
+	await finalize(opts, root);
+	return {
+		merkleRoot: root,
+		cek: toHex(cek),
+		chunkCount,
+		totalBytes: size
+	};
+}
+/**
+* Stream a Primitive Payload down to a file, verifying and decrypting one chunk
+* at a time (bounded memory). Every chunk is content-address-checked before
+* decryption, so a corrupt or substituted chunk throws.
+*/
+async function pullFile(root, outPath, opts) {
+	const { createWriteStream } = await loadNodeFs("pullFile");
+	const { rm } = await loadNodeFsPromises("pullFile");
+	const manifest = await fetchManifest(opts, root);
+	const computedRoot = await merkleRoot(manifest.chunks.map((c) => c.ciphertextHash));
+	if (computedRoot !== root) throw new Error(`manifest does not match the requested content address (got ${computedRoot})`);
+	const cek = fromHex(opts.cek);
+	const objectId = fromHex(manifest.objectId);
+	const out = createWriteStream(outPath);
+	let onWriteError = () => {};
+	const writeErrored = new Promise((_, reject) => {
+		onWriteError = reject;
+	});
+	writeErrored.catch(() => {});
+	out.on("error", (err) => onWriteError(err));
+	try {
+		let done = 0;
+		for (const d of manifest.chunks) {
+			const ciphertext = await getChunkBytes(opts, root, d);
+			if (await contentHashHex(ciphertext) !== d.ciphertextHash) throw new Error(`chunk ${d.index} failed integrity check`);
+			const plaintext = await decryptChunk(cek, objectId, d.index, ciphertext);
+			if (!out.write(plaintext)) await Promise.race([new Promise((resolve) => out.once("drain", resolve)), writeErrored]);
+			opts.onProgress?.("download", ++done, manifest.chunkCount);
+		}
+		await Promise.race([new Promise((resolve) => out.end(resolve)), writeErrored]);
+	} catch (err) {
+		out.destroy();
+		await rm(outPath, { force: true });
+		throw err;
+	}
+	return manifest;
+}
+//#endregion
+export { pushFile as a, pushBytes as i, fetchManifest as n, loadNodeFsPromises as o, pullFile as r, encodeManifest as t };

package/dist/{types-DVjBmOg0.d.ts → types-DcXtFARL.d.ts}

@@ -459,7 +459,7 @@ interface EmailAnalysis$1 {
 /**
  * Forward detection and analysis results.
  *
- * Optional. Present when the email was processed by a forward-detection pipeline (always present in Primitive's managed service). When absent, forward detection was not performed on this email.
+ * Optional. In Primitive's managed service this object is included only when forwarded content is detected; when absent, no forward was detected or forward detection was not performed.
  */
 interface ForwardAnalysis$1 {
   /**

package/dist/webhook/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as isPaymentFailedEvent, A as RawContentInline, B as InteractionEvent, C as ParsedData, D as ParsedStatus, E as ParsedError, F as ValidateEmailAuthResult, G as PaymentFailedEvent, H as InteractionX402Suffix, I as WebhookAttachment, J as WebhookEventType, K as PaymentSettledEvent, L as WebhookEvent, M as SpfResult, N as TlsReportAnalysis, O as RawContent, P as UnknownEvent, Q as isPaymentEvent, R as EMAIL_EVENT_TYPES, S as KnownWebhookEvent, T as ParsedDataFailed, U as PAYMENT_EVENT_TYPES, V as InteractionX402Event, W as PaymentEvent, X as isInteractionX402Event, Y as isEmailReceivedEvent, Z as isKnownWebhookEventType, _ as ForwardResultAttachmentAnalyzed, a as DkimSignature, b as ForwardVerdict, c as DmarcResult, d as EmailAuth, et as isPaymentSettledEvent, f as EmailReceivedEvent, g as ForwardResult, h as ForwardOriginalSender, i as DkimResult, j as RoutingDecision, k as RawContentDownloadOnly, l as EmailAddress, m as ForwardAnalysis, n as AuthVerdict, o as DmarcPolicy, p as EventType, q as WEBHOOK_EVENT_TYPES, r as BounceAnalysis, s as DmarcReportAnalysis, t as AuthConfidence, u as EmailAnalysis, v as ForwardResultAttachmentSkipped, w as ParsedDataComplete, x as ForwardVerification, y as ForwardResultInline, z as INTERACTION_EVENT_TYPES } from "../types-DVjBmOg0.js";
-import { C as buildReplySubject, E as parseHeaderAddress, S as buildForwardSubject, T as normalizeReceivedEmail, _ as isTrustedSender, a as RawEmailDecodeErrorCode, b as ReceivedEmailAddress, c as WebhookPayloadError, d as WebhookValidationErrorCode, f as WebhookVerificationError, g as TrustedSenderResult, h as TrustedSenderOptions, i as RawEmailDecodeError, l as WebhookPayloadErrorCode, m as TrustReason, n as PrimitiveWebhookError, o as VERIFICATION_ERRORS, p as WebhookVerificationErrorCode, r as RAW_EMAIL_ERRORS, s as WebhookErrorCode, t as PAYLOAD_ERRORS, u as WebhookValidationError, v as validateEmailAuth, w as formatAddress, x as ReceivedEmailThread, y as ReceivedEmail } from "../errors-DAHv2kWU.js";
-import { A as SignResult, B as validateEmailReceivedEvent, C as StandardWebhooksVerifyOptions, D as LEGACY_SIGNATURE_HEADER, E as LEGACY_CONFIRMED_HEADER, F as VerifyDownloadTokenOptions, I as VerifyDownloadTokenResult, L as generateDownloadToken, M as signWebhookPayload, N as verifyWebhookSignature, O as PRIMITIVE_CONFIRMED_HEADER, P as GenerateDownloadTokenOptions, R as verifyDownloadToken, S as StandardWebhooksSignResult, T as verifyStandardWebhooksSignature, _ as WEBHOOK_VERSION, a as WebhookHeaders, b as STANDARD_WEBHOOK_SIGNATURE_HEADER, c as getDownloadTimeRemaining, d as handleWebhookEvent, f as isDownloadExpired, g as verifyRawEmailDownload, h as receive, i as WEBHOOK_EVENT_HEADER, j as VerifyOptions, k as PRIMITIVE_SIGNATURE_HEADER, l as getEventHeader, m as parseWebhookEvent, n as HandleWebhookOptions, o as confirmedHeaders, p as isRawIncluded, r as ReceiveRequestOptions, s as decodeRawEmail, t as DecodeRawEmailOptions, u as handleWebhook, v as emailReceivedEventJsonSchema, w as signStandardWebhooksPayload, x as STANDARD_WEBHOOK_TIMESTAMP_HEADER, y as STANDARD_WEBHOOK_ID_HEADER, z as safeValidateEmailReceivedEvent } from "../index-DJeUuGUn.js";
+import { $ as isPaymentFailedEvent, A as RawContentInline, B as InteractionEvent, C as ParsedData, D as ParsedStatus, E as ParsedError, F as ValidateEmailAuthResult, G as PaymentFailedEvent, H as InteractionX402Suffix, I as WebhookAttachment, J as WebhookEventType, K as PaymentSettledEvent, L as WebhookEvent, M as SpfResult, N as TlsReportAnalysis, O as RawContent, P as UnknownEvent, Q as isPaymentEvent, R as EMAIL_EVENT_TYPES, S as KnownWebhookEvent, T as ParsedDataFailed, U as PAYMENT_EVENT_TYPES, V as InteractionX402Event, W as PaymentEvent, X as isInteractionX402Event, Y as isEmailReceivedEvent, Z as isKnownWebhookEventType, _ as ForwardResultAttachmentAnalyzed, a as DkimSignature, b as ForwardVerdict, c as DmarcResult, d as EmailAuth, et as isPaymentSettledEvent, f as EmailReceivedEvent, g as ForwardResult, h as ForwardOriginalSender, i as DkimResult, j as RoutingDecision, k as RawContentDownloadOnly, l as EmailAddress, m as ForwardAnalysis, n as AuthVerdict, o as DmarcPolicy, p as EventType, q as WEBHOOK_EVENT_TYPES, r as BounceAnalysis, s as DmarcReportAnalysis, t as AuthConfidence, u as EmailAnalysis, v as ForwardResultAttachmentSkipped, w as ParsedDataComplete, x as ForwardVerification, y as ForwardResultInline, z as INTERACTION_EVENT_TYPES } from "../types-DcXtFARL.js";
+import { C as buildReplySubject, E as parseHeaderAddress, S as buildForwardSubject, T as normalizeReceivedEmail, _ as isTrustedSender, a as RawEmailDecodeErrorCode, b as ReceivedEmailAddress, c as WebhookPayloadError, d as WebhookValidationErrorCode, f as WebhookVerificationError, g as TrustedSenderResult, h as TrustedSenderOptions, i as RawEmailDecodeError, l as WebhookPayloadErrorCode, m as TrustReason, n as PrimitiveWebhookError, o as VERIFICATION_ERRORS, p as WebhookVerificationErrorCode, r as RAW_EMAIL_ERRORS, s as WebhookErrorCode, t as PAYLOAD_ERRORS, u as WebhookValidationError, v as validateEmailAuth, w as formatAddress, x as ReceivedEmailThread, y as ReceivedEmail } from "../errors-BgI9FKHK.js";
+import { A as SignResult, B as validateEmailReceivedEvent, C as StandardWebhooksVerifyOptions, D as LEGACY_SIGNATURE_HEADER, E as LEGACY_CONFIRMED_HEADER, F as VerifyDownloadTokenOptions, I as VerifyDownloadTokenResult, L as generateDownloadToken, M as signWebhookPayload, N as verifyWebhookSignature, O as PRIMITIVE_CONFIRMED_HEADER, P as GenerateDownloadTokenOptions, R as verifyDownloadToken, S as StandardWebhooksSignResult, T as verifyStandardWebhooksSignature, _ as WEBHOOK_VERSION, a as WebhookHeaders, b as STANDARD_WEBHOOK_SIGNATURE_HEADER, c as getDownloadTimeRemaining, d as handleWebhookEvent, f as isDownloadExpired, g as verifyRawEmailDownload, h as receive, i as WEBHOOK_EVENT_HEADER, j as VerifyOptions, k as PRIMITIVE_SIGNATURE_HEADER, l as getEventHeader, m as parseWebhookEvent, n as HandleWebhookOptions, o as confirmedHeaders, p as isRawIncluded, r as ReceiveRequestOptions, s as decodeRawEmail, t as DecodeRawEmailOptions, u as handleWebhook, v as emailReceivedEventJsonSchema, w as signStandardWebhooksPayload, x as STANDARD_WEBHOOK_TIMESTAMP_HEADER, y as STANDARD_WEBHOOK_ID_HEADER, z as safeValidateEmailReceivedEvent } from "../index-fS1gVNuX.js";
 export { AuthConfidence, AuthVerdict, BounceAnalysis, DecodeRawEmailOptions, DkimResult, DkimSignature, DmarcPolicy, DmarcReportAnalysis, DmarcResult, EMAIL_EVENT_TYPES, EmailAddress, EmailAnalysis, EmailAuth, EmailReceivedEvent, EventType, ForwardAnalysis, ForwardOriginalSender, ForwardResult, ForwardResultAttachmentAnalyzed, ForwardResultAttachmentSkipped, ForwardResultInline, ForwardVerdict, ForwardVerification, GenerateDownloadTokenOptions, HandleWebhookOptions, INTERACTION_EVENT_TYPES, InteractionEvent, InteractionX402Event, InteractionX402Suffix, KnownWebhookEvent, LEGACY_CONFIRMED_HEADER, LEGACY_SIGNATURE_HEADER, PAYLOAD_ERRORS, PAYMENT_EVENT_TYPES, PRIMITIVE_CONFIRMED_HEADER, PRIMITIVE_SIGNATURE_HEADER, ParsedData, ParsedDataComplete, ParsedDataFailed, ParsedError, ParsedStatus, PaymentEvent, PaymentFailedEvent, PaymentSettledEvent, PrimitiveWebhookError, RAW_EMAIL_ERRORS, RawContent, RawContentDownloadOnly, RawContentInline, RawEmailDecodeError, RawEmailDecodeErrorCode, ReceiveRequestOptions, ReceivedEmail, ReceivedEmailAddress, ReceivedEmailThread, RoutingDecision, STANDARD_WEBHOOK_ID_HEADER, STANDARD_WEBHOOK_SIGNATURE_HEADER, STANDARD_WEBHOOK_TIMESTAMP_HEADER, SignResult, SpfResult, StandardWebhooksSignResult, StandardWebhooksVerifyOptions, TlsReportAnalysis, TrustReason, TrustedSenderOptions, TrustedSenderResult, UnknownEvent, VERIFICATION_ERRORS, ValidateEmailAuthResult, VerifyDownloadTokenOptions, VerifyDownloadTokenResult, VerifyOptions, WEBHOOK_EVENT_HEADER, WEBHOOK_EVENT_TYPES, WEBHOOK_VERSION, WebhookAttachment, WebhookErrorCode, WebhookEvent, WebhookEventType, WebhookHeaders, WebhookPayloadError, WebhookPayloadErrorCode, WebhookValidationError, WebhookValidationErrorCode, WebhookVerificationError, WebhookVerificationErrorCode, buildForwardSubject, buildReplySubject, confirmedHeaders, decodeRawEmail, emailReceivedEventJsonSchema, formatAddress, generateDownloadToken, getDownloadTimeRemaining, getEventHeader, handleWebhook, handleWebhookEvent, isDownloadExpired, isEmailReceivedEvent, isInteractionX402Event, isKnownWebhookEventType, isPaymentEvent, isPaymentFailedEvent, isPaymentSettledEvent, isRawIncluded, isTrustedSender, normalizeReceivedEmail, parseHeaderAddress, parseWebhookEvent, receive, safeValidateEmailReceivedEvent, signStandardWebhooksPayload, signWebhookPayload, validateEmailAuth, validateEmailReceivedEvent, verifyDownloadToken, verifyRawEmailDownload, verifyStandardWebhooksSignature, verifyWebhookSignature };

package/dist/webhook/index.js

@@ -1,3 +1,3 @@
-import { C as normalizeReceivedEmail, S as formatAddress, _ as ForwardVerdict, a as VERIFICATION_ERRORS, b as buildForwardSubject, c as WebhookVerificationError, d as AuthConfidence, f as AuthVerdict, g as EventType, h as DmarcResult, i as RawEmailDecodeError, l as isTrustedSender, m as DmarcPolicy, n as PrimitiveWebhookError, o as WebhookPayloadError, p as DkimResult, r as RAW_EMAIL_ERRORS, s as WebhookValidationError, t as PAYLOAD_ERRORS, u as validateEmailAuth, v as ParsedStatus, w as parseHeaderAddress, x as buildReplySubject, y as SpfResult } from "../errors-D6WjisrD.js";
-import { A as isEmailReceivedEvent, C as PRIMITIVE_SIGNATURE_HEADER, D as INTERACTION_EVENT_TYPES, E as EMAIL_EVENT_TYPES, F as isPaymentSettledEvent, I as generateDownloadToken, L as verifyDownloadToken, M as isKnownWebhookEventType, N as isPaymentEvent, O as PAYMENT_EVENT_TYPES, P as isPaymentFailedEvent, R as safeValidateEmailReceivedEvent, S as PRIMITIVE_CONFIRMED_HEADER, T as verifyWebhookSignature, _ as STANDARD_WEBHOOK_TIMESTAMP_HEADER, a as getEventHeader, b as LEGACY_CONFIRMED_HEADER, c as isDownloadExpired, d as receive, f as verifyRawEmailDownload, g as STANDARD_WEBHOOK_SIGNATURE_HEADER, h as STANDARD_WEBHOOK_ID_HEADER, i as getDownloadTimeRemaining, j as isInteractionX402Event, k as WEBHOOK_EVENT_TYPES, l as isRawIncluded, m as emailReceivedEventJsonSchema, n as confirmedHeaders, o as handleWebhook, p as WEBHOOK_VERSION, r as decodeRawEmail, s as handleWebhookEvent, t as WEBHOOK_EVENT_HEADER, u as parseWebhookEvent, v as signStandardWebhooksPayload, w as signWebhookPayload, x as LEGACY_SIGNATURE_HEADER, y as verifyStandardWebhooksSignature, z as validateEmailReceivedEvent } from "../webhook-1cz088XC.js";
+import { C as normalizeReceivedEmail, S as formatAddress, _ as ForwardVerdict, a as VERIFICATION_ERRORS, b as buildForwardSubject, c as WebhookVerificationError, d as AuthConfidence, f as AuthVerdict, g as EventType, h as DmarcResult, i as RawEmailDecodeError, l as isTrustedSender, m as DmarcPolicy, n as PrimitiveWebhookError, o as WebhookPayloadError, p as DkimResult, r as RAW_EMAIL_ERRORS, s as WebhookValidationError, t as PAYLOAD_ERRORS, u as validateEmailAuth, v as ParsedStatus, w as parseHeaderAddress, x as buildReplySubject, y as SpfResult } from "../errors-Bo0f7eId.js";
+import { A as isEmailReceivedEvent, C as PRIMITIVE_SIGNATURE_HEADER, D as INTERACTION_EVENT_TYPES, E as EMAIL_EVENT_TYPES, F as isPaymentSettledEvent, I as generateDownloadToken, L as verifyDownloadToken, M as isKnownWebhookEventType, N as isPaymentEvent, O as PAYMENT_EVENT_TYPES, P as isPaymentFailedEvent, R as safeValidateEmailReceivedEvent, S as PRIMITIVE_CONFIRMED_HEADER, T as verifyWebhookSignature, _ as STANDARD_WEBHOOK_TIMESTAMP_HEADER, a as getEventHeader, b as LEGACY_CONFIRMED_HEADER, c as isDownloadExpired, d as receive, f as verifyRawEmailDownload, g as STANDARD_WEBHOOK_SIGNATURE_HEADER, h as STANDARD_WEBHOOK_ID_HEADER, i as getDownloadTimeRemaining, j as isInteractionX402Event, k as WEBHOOK_EVENT_TYPES, l as isRawIncluded, m as emailReceivedEventJsonSchema, n as confirmedHeaders, o as handleWebhook, p as WEBHOOK_VERSION, r as decodeRawEmail, s as handleWebhookEvent, t as WEBHOOK_EVENT_HEADER, u as parseWebhookEvent, v as signStandardWebhooksPayload, w as signWebhookPayload, x as LEGACY_SIGNATURE_HEADER, y as verifyStandardWebhooksSignature, z as validateEmailReceivedEvent } from "../webhook-BtyuJtUF.js";
 export { AuthConfidence, AuthVerdict, DkimResult, DmarcPolicy, DmarcResult, EMAIL_EVENT_TYPES, EventType, ForwardVerdict, INTERACTION_EVENT_TYPES, LEGACY_CONFIRMED_HEADER, LEGACY_SIGNATURE_HEADER, PAYLOAD_ERRORS, PAYMENT_EVENT_TYPES, PRIMITIVE_CONFIRMED_HEADER, PRIMITIVE_SIGNATURE_HEADER, ParsedStatus, PrimitiveWebhookError, RAW_EMAIL_ERRORS, RawEmailDecodeError, STANDARD_WEBHOOK_ID_HEADER, STANDARD_WEBHOOK_SIGNATURE_HEADER, STANDARD_WEBHOOK_TIMESTAMP_HEADER, SpfResult, VERIFICATION_ERRORS, WEBHOOK_EVENT_HEADER, WEBHOOK_EVENT_TYPES, WEBHOOK_VERSION, WebhookPayloadError, WebhookValidationError, WebhookVerificationError, buildForwardSubject, buildReplySubject, confirmedHeaders, decodeRawEmail, emailReceivedEventJsonSchema, formatAddress, generateDownloadToken, getDownloadTimeRemaining, getEventHeader, handleWebhook, handleWebhookEvent, isDownloadExpired, isEmailReceivedEvent, isInteractionX402Event, isKnownWebhookEventType, isPaymentEvent, isPaymentFailedEvent, isPaymentSettledEvent, isRawIncluded, isTrustedSender, normalizeReceivedEmail, parseHeaderAddress, parseWebhookEvent, receive, safeValidateEmailReceivedEvent, signStandardWebhooksPayload, signWebhookPayload, validateEmailAuth, validateEmailReceivedEvent, verifyDownloadToken, verifyRawEmailDownload, verifyStandardWebhooksSignature, verifyWebhookSignature };

package/dist/{webhook-1cz088XC.js → webhook-BtyuJtUF.js}

@@ -1,4 +1,4 @@
-import { C as normalizeReceivedEmail, c as WebhookVerificationError, i as RawEmailDecodeError, o as WebhookPayloadError, s as WebhookValidationError } from "./errors-D6WjisrD.js";
+import { C as normalizeReceivedEmail, c as WebhookVerificationError, i as RawEmailDecodeError, o as WebhookPayloadError, s as WebhookValidationError } from "./errors-Bo0f7eId.js";
 import { createHash, createHmac, timingSafeEqual } from "node:crypto";
 //#region src/generated/email-received-event.validator.generated.ts
 /**
@@ -9343,7 +9343,7 @@ const emailReceivedEventJsonSchema = {
 				},
 				"forward": {
 					"$ref": "#/definitions/ForwardAnalysis",
-					"description": "Forward detection and analysis results.\n\nOptional. Present when the email was processed by a forward-detection pipeline (always present in Primitive's managed service). When absent, forward detection was not performed on this email."
+					"description": "Forward detection and analysis results.\n\nOptional. In Primitive's managed service this object is included only when forwarded content is detected; when absent, no forward was detected or forward detection was not performed."
 				},
 				"bounce": {
 					"$ref": "#/definitions/BounceAnalysis",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@primitivedotdev/sdk",
-  "version": "1.22.0",
+  "version": "1.23.0",
   "description": "Official Primitive Node.js SDK: webhook, api, openapi, contract, and parser runtime modules.",
   "type": "module",
   "module": "./dist/index.js",
@@ -61,13 +61,13 @@
     "generate:types": "tsx scripts/generate-types.ts",
     "generate:validator": "tsx scripts/generate-validator.ts",
     "generate": "pnpm --filter @primitivedotdev/api-core generate && pnpm generate:schema && pnpm generate:types && pnpm generate:validator",
-    "build": "pnpm generate && NODE_OPTIONS=\"--max-old-space-size=4096\" tsdown",
+    "build": "pnpm generate && NODE_OPTIONS=\"--max-old-space-size=6144\" tsdown",
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
     "test:watch": "vitest",
     "typecheck": "pnpm generate && tsc --noEmit -p tsconfig.typecheck.json",
-    "lint": "biome check --error-on-warnings src/index.ts src/validation.ts src/types.ts src/webhook src/contract src/parser src/api/index.ts src/x402 src/openapi/index.ts src/payloads/index.ts tests/",
-    "lint:fix": "biome check --write --error-on-warnings src/index.ts src/validation.ts src/types.ts src/webhook src/contract src/parser src/api/index.ts src/x402 src/openapi/index.ts tests/",
+    "lint": "biome check --error-on-warnings src/index.ts src/validation.ts src/types.ts src/webhook src/contract src/parser src/api/index.ts src/x402 src/openapi/index.ts src/payloads tests/",
+    "lint:fix": "biome check --write --error-on-warnings src/index.ts src/validation.ts src/types.ts src/webhook src/contract src/parser src/api/index.ts src/x402 src/openapi/index.ts src/payloads tests/",
     "prepublishOnly": "pnpm build"
   },
   "keywords": [
@@ -97,9 +97,9 @@
   },
   "dependencies": {
     "ajv": "^8.17.1",
-    "mailparser": "^3.9.0",
+    "mailparser": "^3.9.14",
     "nodemailer": "^9.0.1",
-    "sanitize-html": "^2.14.0",
+    "sanitize-html": "^2.17.5",
     "tar-stream": "^3.1.8",
     "validator": "^13.15.35",
     "viem": "^2.21.0"
@@ -115,6 +115,7 @@
     "@types/tar-stream": "^3.1.4",
     "@types/validator": "^13.15.10",
     "@vitest/coverage-v8": "^4.1.4",
+    "esbuild": "^0.27.0",
     "json-schema-to-typescript": "^15.0.4",
     "tsdown": "^0.21.10",
     "tsx": "^4.21.0",