@primitivedotdev/sdk 1.3.0 → 1.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.d.ts CHANGED
@@ -1,187 +1,9 @@
1
- import { Jt as AgentAccountUpgradeHint, Mc as StartAgentClaimInput, Tn as CreateAgentClaimLinkInput, Xt as AgentClaimResult, Yt as AgentClaimLinkResult, Zo as PlanLimits, Zt as AgentClaimStartResult, a as ReplyInput, b as PrimitiveApiError, c as SendAttachment, d as SendThreadInput, f as client, i as PrimitiveClientOptions, l as SendInput, n as ForwardInput, p as createPrimitiveClient, qt as AgentAccountResult, r as PrimitiveClient, tu as VerifyAgentClaimInput, u as SendResult, yn as CreateAgentAccountInput } from "./index-X7RsDaVi.js";
2
- import { A as UnknownEvent, C as ParsedDataFailed, D as RawContentDownloadOnly, E as RawContent, M as WebhookAttachment, N as WebhookEvent, O as RawContentInline, S as ParsedDataComplete, T as ParsedStatus, _ as ForwardResultInline, a as DmarcPolicy, b as KnownWebhookEvent, c as EmailAnalysis, d as EventType, f as ForwardAnalysis, g as ForwardResultAttachmentSkipped, h as ForwardResultAttachmentAnalyzed, i as DkimSignature, j as ValidateEmailAuthResult, k as SpfResult, l as EmailAuth, m as ForwardResult, n as AuthVerdict, o as DmarcResult, p as ForwardOriginalSender, r as DkimResult, s as EmailAddress, t as AuthConfidence, u as EmailReceivedEvent, v as ForwardVerdict, w as ParsedError, x as ParsedData, y as ForwardVerification } from "./types-yNU-Oiea.js";
3
- import { _ as buildForwardSubject, a as RawEmailDecodeErrorCode, b as normalizeReceivedEmail, c as WebhookPayloadError, d as WebhookValidationErrorCode, f as WebhookVerificationError, g as ReceivedEmailThread, h as ReceivedEmailAddress, i as RawEmailDecodeError, l as WebhookPayloadErrorCode, m as ReceivedEmail, n as PrimitiveWebhookError, o as VERIFICATION_ERRORS, p as WebhookVerificationErrorCode, r as RAW_EMAIL_ERRORS, s as WebhookErrorCode, t as PAYLOAD_ERRORS, u as WebhookValidationError, v as buildReplySubject, x as parseHeaderAddress, y as formatAddress } from "./errors-7E9sW9eX.js";
4
- import { A as VerifyOptions, C as signStandardWebhooksPayload, D as PRIMITIVE_CONFIRMED_HEADER, E as LEGACY_SIGNATURE_HEADER, F as VerifyDownloadTokenResult, I as generateDownloadToken, L as verifyDownloadToken, M as verifyWebhookSignature, N as GenerateDownloadTokenOptions, O as PRIMITIVE_SIGNATURE_HEADER, P as VerifyDownloadTokenOptions, R as safeValidateEmailReceivedEvent, S as StandardWebhooksVerifyOptions, T as LEGACY_CONFIRMED_HEADER, _ as emailReceivedEventJsonSchema, a as confirmedHeaders, b as STANDARD_WEBHOOK_TIMESTAMP_HEADER, c as handleWebhook, d as isRawIncluded, f as parseWebhookEvent, g as validateEmailAuth, h as WEBHOOK_VERSION, i as WebhookHeaders, j as signWebhookPayload, k as SignResult, l as isDownloadExpired, m as verifyRawEmailDownload, n as HandleWebhookOptions, o as decodeRawEmail, p as receive, r as ReceiveRequestOptions, s as getDownloadTimeRemaining, t as DecodeRawEmailOptions, u as isEmailReceivedEvent, v as STANDARD_WEBHOOK_ID_HEADER, w as verifyStandardWebhooksSignature, x as StandardWebhooksSignResult, y as STANDARD_WEBHOOK_SIGNATURE_HEADER, z as validateEmailReceivedEvent } from "./index-DR978rq5.js";
5
- import { Address, Hex } from "viem";
1
+ import { Bc as StartAgentClaimInput, Dn as CreateAgentAccountInput, Nn as CreateAgentClaimLinkInput, O as PrimitiveApiError, _ as SendThreadInput, a as ForwardInput, an as AgentClaimStartResult, as as PlanLimits, b as createAgent, c as InboxStreamOptions, d as ReplyInput, g as SendResult, h as SendInput, i as CreatedAgent, in as AgentClaimResult, l as PrimitiveClient, lu as VerifyAgentClaimInput, m as SendAttachment, nn as AgentAccountUpgradeHint, o as InboundEmail, qt as Account, r as CreateAgentOptions, rn as AgentClaimLinkResult, s as InboxResource, t as AccountResource, tn as AgentAccountResult, u as PrimitiveClientOptions, v as WaitForNextOptions, x as createPrimitiveClient, y as client } from "./index-BDjVGtc8.js";
2
+ import { A as RawContentInline, C as ParsedData, D as ParsedStatus, E as ParsedError, F as WebhookAttachment, I as WebhookEvent, M as TlsReportAnalysis, N as UnknownEvent, O as RawContent, P as ValidateEmailAuthResult, S as KnownWebhookEvent, T as ParsedDataFailed, _ as ForwardResultAttachmentAnalyzed, a as DkimSignature, b as ForwardVerdict, c as DmarcResult, d as EmailAuth, f as EmailReceivedEvent, g as ForwardResult, h as ForwardOriginalSender, i as DkimResult, j as SpfResult, k as RawContentDownloadOnly, l as EmailAddress, m as ForwardAnalysis, n as AuthVerdict, o as DmarcPolicy, p as EventType, r as BounceAnalysis, s as DmarcReportAnalysis, t as AuthConfidence, u as EmailAnalysis, v as ForwardResultAttachmentSkipped, w as ParsedDataComplete, x as ForwardVerification, y as ForwardResultInline } from "./types-QT2ss9ho.js";
3
+ import { _ as buildForwardSubject, a as RawEmailDecodeErrorCode, b as normalizeReceivedEmail, c as WebhookPayloadError, d as WebhookValidationErrorCode, f as WebhookVerificationError, g as ReceivedEmailThread, h as ReceivedEmailAddress, i as RawEmailDecodeError, l as WebhookPayloadErrorCode, m as ReceivedEmail, n as PrimitiveWebhookError, o as VERIFICATION_ERRORS, p as WebhookVerificationErrorCode, r as RAW_EMAIL_ERRORS, s as WebhookErrorCode, t as PAYLOAD_ERRORS, u as WebhookValidationError, v as buildReplySubject, x as parseHeaderAddress, y as formatAddress } from "./errors-DyuAXctD.js";
4
+ import { A as VerifyOptions, C as signStandardWebhooksPayload, D as PRIMITIVE_CONFIRMED_HEADER, E as LEGACY_SIGNATURE_HEADER, F as VerifyDownloadTokenResult, I as generateDownloadToken, L as verifyDownloadToken, M as verifyWebhookSignature, N as GenerateDownloadTokenOptions, O as PRIMITIVE_SIGNATURE_HEADER, P as VerifyDownloadTokenOptions, R as safeValidateEmailReceivedEvent, S as StandardWebhooksVerifyOptions, T as LEGACY_CONFIRMED_HEADER, _ as emailReceivedEventJsonSchema, a as confirmedHeaders, b as STANDARD_WEBHOOK_TIMESTAMP_HEADER, c as handleWebhook, d as isRawIncluded, f as parseWebhookEvent, g as validateEmailAuth, h as WEBHOOK_VERSION, i as WebhookHeaders, j as signWebhookPayload, k as SignResult, l as isDownloadExpired, m as verifyRawEmailDownload, n as HandleWebhookOptions, o as decodeRawEmail, p as receive, r as ReceiveRequestOptions, s as getDownloadTimeRemaining, t as DecodeRawEmailOptions, u as isEmailReceivedEvent, v as STANDARD_WEBHOOK_ID_HEADER, w as verifyStandardWebhooksSignature, x as StandardWebhooksSignResult, y as STANDARD_WEBHOOK_SIGNATURE_HEADER, z as validateEmailReceivedEvent } from "./index-iZWfb98V.js";
5
+ import { NonceBinding, PayoutRegistrationMessageInput, TokenDomain, TransferAuthorization, X402Challenge, X402ChargeInput, X402Client, X402ClientOptions, X402Error, X402PaymentPayload, X402PaymentRequirements, X402PayoutAddress, X402Receipt, X402Signer, X402SpendPolicy, buildPayoutRegistrationMessage, createX402Client, deriveEip3009Nonce } from "./x402/index.js";
6
6
 
7
- //#region src/x402/sign.d.ts
8
- interface NonceBinding {
9
- /** The interaction id, including its `@domain`. Lowercased before hashing. */
10
- interactionId: string;
11
- /** The challenge step id (a UUID). Lowercased before hashing. */
12
- challengeStepId: string;
13
- /** The challenger's per-challenge random nonce: 64 lowercase hex chars. */
14
- challengeNonce: string;
15
- }
16
- /**
17
- * Derive the EIP-3009 nonce bound to a specific interaction step:
18
- *
19
- * keccak256( utf8(lower(interaction_id)) || 0x00
20
- * || utf8(lower(challenge_step_id)) || 0x00
21
- * || hexdecode(challenge_nonce) )
22
- *
23
- * The `0x00` separators pin the field boundaries (undelimited concatenation of
24
- * variable-length strings is collision-ambiguous), and the challenge nonce is
25
- * decoded to its 32 raw bytes before hashing. The platform recomputes this and
26
- * rejects a mismatch.
27
- */
28
- declare function deriveEip3009Nonce(input: NonceBinding): Hex;
29
- /**
30
- * The EIP-3009 `TransferWithAuthorization` EIP-712 type. The field order and
31
- * types are part of the on-chain contract and MUST NOT change.
32
- */
33
- declare const TRANSFER_WITH_AUTHORIZATION_TYPES: {
34
- readonly TransferWithAuthorization: readonly [{
35
- readonly name: "from";
36
- readonly type: "address";
37
- }, {
38
- readonly name: "to";
39
- readonly type: "address";
40
- }, {
41
- readonly name: "value";
42
- readonly type: "uint256";
43
- }, {
44
- readonly name: "validAfter";
45
- readonly type: "uint256";
46
- }, {
47
- readonly name: "validBefore";
48
- readonly type: "uint256";
49
- }, {
50
- readonly name: "nonce";
51
- readonly type: "bytes32";
52
- }];
53
- };
54
- /**
55
- * The token's EIP-712 domain. `name`/`version` MUST be the actual token's domain
56
- * params (Base mainnet USDC reports `name: "USD Coin"`, Base Sepolia `"USDC"`;
57
- * both `version: "2"`); they come from the challenge's payment requirements
58
- * `extra`. A wrong name/version produces a signature the verifier rejects.
59
- */
60
- interface TokenDomain {
61
- name: string;
62
- version: string;
63
- chainId: number;
64
- verifyingContract: Address;
65
- }
66
- interface TransferAuthorization {
67
- from: Address;
68
- to: Address;
69
- /** Token base units (USDC has 6 decimals), as a bigint. */
70
- value: bigint;
71
- validAfter: bigint;
72
- validBefore: bigint;
73
- nonce: Hex;
74
- }
75
- interface TransferWithAuthorizationTypedData {
76
- domain: {
77
- name: string;
78
- version: string;
79
- chainId: number;
80
- verifyingContract: Address;
81
- };
82
- types: typeof TRANSFER_WITH_AUTHORIZATION_TYPES;
83
- primaryType: "TransferWithAuthorization";
84
- message: TransferAuthorization;
85
- }
86
- /**
87
- * A customer-held signer. A viem `LocalAccount` satisfies this directly; any
88
- * key source (hardware wallet, injected provider) can be adapted. The key never
89
- * leaves the caller.
90
- */
91
- interface X402Signer {
92
- address: Address;
93
- signTypedData(typedData: TransferWithAuthorizationTypedData): Promise<Hex>;
94
- }
95
- /** The x402 wire payload (validated server-side against the x402 schema). */
96
- interface X402PaymentPayload {
97
- x402Version: 1;
98
- scheme: "exact";
99
- network: string;
100
- payload: {
101
- signature: Hex;
102
- authorization: {
103
- from: Address;
104
- to: Address;
105
- value: string;
106
- validAfter: string;
107
- validBefore: string;
108
- nonce: Hex;
109
- };
110
- };
111
- }
112
- //#endregion
113
- //#region src/x402/client.d.ts
114
- interface X402PaymentRequirements {
115
- scheme: string;
116
- network: string;
117
- maxAmountRequired: string;
118
- payTo: string;
119
- asset: string;
120
- extra: {
121
- name: string;
122
- version: string;
123
- };
124
- }
125
- /** A request for payment, as returned by `charge()` / the platform. */
126
- interface X402Challenge {
127
- id: string;
128
- network: string;
129
- amount: string;
130
- pay_to: string;
131
- nonce_binding: {
132
- interaction_id: string;
133
- challenge_step_id: string;
134
- challenge_nonce: string;
135
- };
136
- payment_requirements: X402PaymentRequirements;
137
- expires_at: string;
138
- }
139
- interface X402Receipt {
140
- id: string;
141
- status: string;
142
- settle_tx: string | null;
143
- }
144
- interface X402ChargeInput {
145
- /** Amount in token base units (USDC has 6 decimals, so "10000" = 0.01). */
146
- amount: string;
147
- /** Defaults to "base-sepolia". */
148
- network?: string;
149
- /** The org id allowed to pay this challenge (on-net binding). */
150
- payerOrg?: string;
151
- description?: string;
152
- /** A URL identifying the thing being paid for. */
153
- resource?: string;
154
- /** Seconds until the challenge expires (default 1h). */
155
- expiresIn?: number;
156
- }
157
- declare class X402Error extends Error {
158
- readonly status: number;
159
- readonly body: unknown;
160
- constructor(message: string, status: number, body?: unknown);
161
- }
162
- interface X402ClientOptions {
163
- /** API key. Defaults to `process.env.PRIMITIVE_API_KEY`. */
164
- apiKey?: string;
165
- /** API base URL. Defaults to the production host. */
166
- baseUrl?: string;
167
- /** Override the fetch implementation (e.g. for testing). */
168
- fetch?: typeof fetch;
169
- }
170
- declare class X402Client {
171
- #private;
172
- constructor(options?: X402ClientOptions);
173
- /** Request a payment (payee side). Returns the challenge to hand to the payer. */
174
- charge(input: X402ChargeInput): Promise<X402Challenge>;
175
- /**
176
- * Pay a challenge (payer side). Derives the interaction-bound authorization,
177
- * signs it locally with the caller's key, and submits it for settlement.
178
- */
179
- pay(challenge: X402Challenge, options: {
180
- signer: X402Signer;
181
- }): Promise<X402Receipt>;
182
- }
183
- declare function createX402Client(options?: X402ClientOptions): X402Client;
184
- //#endregion
185
7
  //#region src/index.d.ts
186
8
  declare const primitive: {
187
9
  client: typeof client;
@@ -189,4 +11,4 @@ declare const primitive: {
189
11
  x402: typeof createX402Client;
190
12
  };
191
13
  //#endregion
192
- export { type AgentAccountResult, type AgentAccountUpgradeHint, type AgentClaimLinkResult, type AgentClaimResult, type AgentClaimStartResult, AuthConfidence, AuthVerdict, type CreateAgentAccountInput, type CreateAgentClaimLinkInput, DecodeRawEmailOptions, DkimResult, DkimSignature, DmarcPolicy, DmarcResult, EmailAddress, EmailAnalysis, EmailAuth, EmailReceivedEvent, EventType, ForwardAnalysis, type ForwardInput, ForwardOriginalSender, ForwardResult, ForwardResultAttachmentAnalyzed, ForwardResultAttachmentSkipped, ForwardResultInline, ForwardVerdict, ForwardVerification, GenerateDownloadTokenOptions, HandleWebhookOptions, KnownWebhookEvent, LEGACY_CONFIRMED_HEADER, LEGACY_SIGNATURE_HEADER, type NonceBinding, PAYLOAD_ERRORS, PRIMITIVE_CONFIRMED_HEADER, PRIMITIVE_SIGNATURE_HEADER, ParsedData, ParsedDataComplete, ParsedDataFailed, ParsedError, ParsedStatus, type PlanLimits, PrimitiveApiError, PrimitiveClient, type PrimitiveClientOptions, PrimitiveWebhookError, RAW_EMAIL_ERRORS, RawContent, RawContentDownloadOnly, RawContentInline, RawEmailDecodeError, RawEmailDecodeErrorCode, ReceiveRequestOptions, ReceivedEmail, ReceivedEmailAddress, ReceivedEmailThread, type ReplyInput, STANDARD_WEBHOOK_ID_HEADER, STANDARD_WEBHOOK_SIGNATURE_HEADER, STANDARD_WEBHOOK_TIMESTAMP_HEADER, type SendAttachment, type SendInput, type SendResult, type SendThreadInput, SignResult, SpfResult, StandardWebhooksSignResult, StandardWebhooksVerifyOptions, type StartAgentClaimInput, type TokenDomain, type TransferAuthorization, UnknownEvent, VERIFICATION_ERRORS, ValidateEmailAuthResult, type VerifyAgentClaimInput, VerifyDownloadTokenOptions, VerifyDownloadTokenResult, VerifyOptions, WEBHOOK_VERSION, WebhookAttachment, WebhookErrorCode, WebhookEvent, WebhookHeaders, WebhookPayloadError, WebhookPayloadErrorCode, WebhookValidationError, WebhookValidationErrorCode, WebhookVerificationError, WebhookVerificationErrorCode, type X402Challenge, type X402ChargeInput, X402Client, type X402ClientOptions, X402Error, type X402PaymentPayload, type X402PaymentRequirements, type X402Receipt, type X402Signer, buildForwardSubject, buildReplySubject, client, confirmedHeaders, createPrimitiveClient, createX402Client, decodeRawEmail, primitive as default, deriveEip3009Nonce, emailReceivedEventJsonSchema, formatAddress, generateDownloadToken, getDownloadTimeRemaining, handleWebhook, isDownloadExpired, isEmailReceivedEvent, isRawIncluded, normalizeReceivedEmail, parseHeaderAddress, parseWebhookEvent, receive, safeValidateEmailReceivedEvent, signStandardWebhooksPayload, signWebhookPayload, validateEmailAuth, validateEmailReceivedEvent, verifyDownloadToken, verifyRawEmailDownload, verifyStandardWebhooksSignature, verifyWebhookSignature };
14
+ export { type Account, AccountResource, type AgentAccountResult, type AgentAccountUpgradeHint, type AgentClaimLinkResult, type AgentClaimResult, type AgentClaimStartResult, AuthConfidence, AuthVerdict, BounceAnalysis, type CreateAgentAccountInput, type CreateAgentClaimLinkInput, type CreateAgentOptions, type CreatedAgent, DecodeRawEmailOptions, DkimResult, DkimSignature, DmarcPolicy, DmarcReportAnalysis, DmarcResult, EmailAddress, EmailAnalysis, EmailAuth, EmailReceivedEvent, EventType, ForwardAnalysis, type ForwardInput, ForwardOriginalSender, ForwardResult, ForwardResultAttachmentAnalyzed, ForwardResultAttachmentSkipped, ForwardResultInline, ForwardVerdict, ForwardVerification, GenerateDownloadTokenOptions, HandleWebhookOptions, type InboundEmail, InboxResource, type InboxStreamOptions, KnownWebhookEvent, LEGACY_CONFIRMED_HEADER, LEGACY_SIGNATURE_HEADER, type NonceBinding, PAYLOAD_ERRORS, PRIMITIVE_CONFIRMED_HEADER, PRIMITIVE_SIGNATURE_HEADER, ParsedData, ParsedDataComplete, ParsedDataFailed, ParsedError, ParsedStatus, type PayoutRegistrationMessageInput, type PlanLimits, PrimitiveApiError, PrimitiveClient, type PrimitiveClientOptions, PrimitiveWebhookError, RAW_EMAIL_ERRORS, RawContent, RawContentDownloadOnly, RawContentInline, RawEmailDecodeError, RawEmailDecodeErrorCode, ReceiveRequestOptions, ReceivedEmail, ReceivedEmailAddress, ReceivedEmailThread, type ReplyInput, STANDARD_WEBHOOK_ID_HEADER, STANDARD_WEBHOOK_SIGNATURE_HEADER, STANDARD_WEBHOOK_TIMESTAMP_HEADER, type SendAttachment, type SendInput, type SendResult, type SendThreadInput, SignResult, SpfResult, StandardWebhooksSignResult, StandardWebhooksVerifyOptions, type StartAgentClaimInput, TlsReportAnalysis, type TokenDomain, type TransferAuthorization, UnknownEvent, VERIFICATION_ERRORS, ValidateEmailAuthResult, type VerifyAgentClaimInput, VerifyDownloadTokenOptions, VerifyDownloadTokenResult, VerifyOptions, WEBHOOK_VERSION, type WaitForNextOptions, WebhookAttachment, WebhookErrorCode, WebhookEvent, WebhookHeaders, WebhookPayloadError, WebhookPayloadErrorCode, WebhookValidationError, WebhookValidationErrorCode, WebhookVerificationError, WebhookVerificationErrorCode, type X402Challenge, type X402ChargeInput, X402Client, type X402ClientOptions, X402Error, type X402PaymentPayload, type X402PaymentRequirements, type X402PayoutAddress, type X402Receipt, type X402Signer, type X402SpendPolicy, buildForwardSubject, buildPayoutRegistrationMessage, buildReplySubject, client, confirmedHeaders, createAgent, createPrimitiveClient, createX402Client, decodeRawEmail, primitive as default, deriveEip3009Nonce, emailReceivedEventJsonSchema, formatAddress, generateDownloadToken, getDownloadTimeRemaining, handleWebhook, isDownloadExpired, isEmailReceivedEvent, isRawIncluded, normalizeReceivedEmail, parseHeaderAddress, parseWebhookEvent, receive, safeValidateEmailReceivedEvent, signStandardWebhooksPayload, signWebhookPayload, validateEmailAuth, validateEmailReceivedEvent, verifyDownloadToken, verifyRawEmailDownload, verifyStandardWebhooksSignature, verifyWebhookSignature };
package/dist/index.js CHANGED
@@ -1,197 +1,7 @@
1
- import { i as createPrimitiveClient, l as PrimitiveApiError, n as PrimitiveClient, r as client } from "./api-DacG4JSU.js";
1
+ import { a as client, f as PrimitiveApiError, i as PrimitiveClient, o as createAgent, r as InboxResource, s as createPrimitiveClient, t as AccountResource } from "./api-DoB7DrgV.js";
2
2
  import { a as VERIFICATION_ERRORS, c as WebhookVerificationError, d as formatAddress, f as normalizeReceivedEmail, i as RawEmailDecodeError, l as buildForwardSubject, n as PrimitiveWebhookError, o as WebhookPayloadError, p as parseHeaderAddress, r as RAW_EMAIL_ERRORS, s as WebhookValidationError, t as PAYLOAD_ERRORS, u as buildReplySubject } from "./errors-BPJGp9I6.js";
3
- import { A as PRIMITIVE_CONFIRMED_HEADER, C as STANDARD_WEBHOOK_ID_HEADER, D as verifyStandardWebhooksSignature, E as signStandardWebhooksPayload, F as verifyDownloadToken, I as safeValidateEmailReceivedEvent, L as validateEmailReceivedEvent, M as signWebhookPayload, N as verifyWebhookSignature, O as LEGACY_CONFIRMED_HEADER, P as generateDownloadToken, S as emailReceivedEventJsonSchema, T as STANDARD_WEBHOOK_TIMESTAMP_HEADER, _ as DmarcResult, a as isDownloadExpired, b as ParsedStatus, c as parseWebhookEvent, d as WEBHOOK_VERSION, f as validateEmailAuth, g as DmarcPolicy, h as DkimResult, i as handleWebhook, j as PRIMITIVE_SIGNATURE_HEADER, k as LEGACY_SIGNATURE_HEADER, l as receive, m as AuthVerdict, n as decodeRawEmail, o as isEmailReceivedEvent, p as AuthConfidence, r as getDownloadTimeRemaining, s as isRawIncluded, t as confirmedHeaders, u as verifyRawEmailDownload, v as EventType, w as STANDARD_WEBHOOK_SIGNATURE_HEADER, x as SpfResult, y as ForwardVerdict } from "./webhook-BAwK8EOG.js";
4
- import { concat, hexToBytes, keccak256, stringToBytes } from "viem";
5
- //#region src/x402/sign.ts
6
- /**
7
- * x402 client-side signing.
8
- *
9
- * The payer signs an EIP-3009 `transferWithAuthorization` over the customer's
10
- * own key; the key never leaves them. This module derives the interaction-bound
11
- * nonce and assembles the EIP-712 typed data and the wire payload. The byte
12
- * layout here MUST match the platform verifier exactly; a normative test vector
13
- * (see sign.test.ts) locks the nonce derivation to the same value the server
14
- * recomputes.
15
- */
16
- /** A challenge nonce is 32 bytes rendered as 64 lowercase hex chars, no 0x. */
17
- const CHALLENGE_NONCE_RE = /^[0-9a-f]{64}$/;
18
- /** Single-byte domain separator between the variable-length string fields. */
19
- const FIELD_SEPARATOR = new Uint8Array([0]);
20
- /**
21
- * Derive the EIP-3009 nonce bound to a specific interaction step:
22
- *
23
- * keccak256( utf8(lower(interaction_id)) || 0x00
24
- * || utf8(lower(challenge_step_id)) || 0x00
25
- * || hexdecode(challenge_nonce) )
26
- *
27
- * The `0x00` separators pin the field boundaries (undelimited concatenation of
28
- * variable-length strings is collision-ambiguous), and the challenge nonce is
29
- * decoded to its 32 raw bytes before hashing. The platform recomputes this and
30
- * rejects a mismatch.
31
- */
32
- function deriveEip3009Nonce(input) {
33
- if (!CHALLENGE_NONCE_RE.test(input.challengeNonce)) throw new Error("challengeNonce must be exactly 64 lowercase hex chars (32 bytes), no 0x prefix");
34
- return keccak256(concat([
35
- stringToBytes(input.interactionId.toLowerCase()),
36
- FIELD_SEPARATOR,
37
- stringToBytes(input.challengeStepId.toLowerCase()),
38
- FIELD_SEPARATOR,
39
- hexToBytes(`0x${input.challengeNonce}`)
40
- ]));
41
- }
42
- /**
43
- * The EIP-3009 `TransferWithAuthorization` EIP-712 type. The field order and
44
- * types are part of the on-chain contract and MUST NOT change.
45
- */
46
- const TRANSFER_WITH_AUTHORIZATION_TYPES = { TransferWithAuthorization: [
47
- {
48
- name: "from",
49
- type: "address"
50
- },
51
- {
52
- name: "to",
53
- type: "address"
54
- },
55
- {
56
- name: "value",
57
- type: "uint256"
58
- },
59
- {
60
- name: "validAfter",
61
- type: "uint256"
62
- },
63
- {
64
- name: "validBefore",
65
- type: "uint256"
66
- },
67
- {
68
- name: "nonce",
69
- type: "bytes32"
70
- }
71
- ] };
72
- function transferWithAuthorizationTypedData(domain, auth) {
73
- return {
74
- domain: {
75
- name: domain.name,
76
- version: domain.version,
77
- chainId: domain.chainId,
78
- verifyingContract: domain.verifyingContract
79
- },
80
- types: TRANSFER_WITH_AUTHORIZATION_TYPES,
81
- primaryType: "TransferWithAuthorization",
82
- message: auth
83
- };
84
- }
85
- /** Assemble the wire payload from a signed authorization. */
86
- function toPaymentPayload(network, auth, signature) {
87
- return {
88
- x402Version: 1,
89
- scheme: "exact",
90
- network,
91
- payload: {
92
- signature,
93
- authorization: {
94
- from: auth.from,
95
- to: auth.to,
96
- value: auth.value.toString(),
97
- validAfter: auth.validAfter.toString(),
98
- validBefore: auth.validBefore.toString(),
99
- nonce: auth.nonce
100
- }
101
- }
102
- };
103
- }
104
- //#endregion
105
- //#region src/x402/client.ts
106
- const CHAIN_IDS = {
107
- "base-sepolia": 84532,
108
- base: 8453
109
- };
110
- const CLOCK_SKEW_SEC = 300;
111
- const SETTLEMENT_MARGIN_SEC = 300;
112
- const DEFAULT_BASE_URL = "https://api.primitive.dev";
113
- var X402Error = class extends Error {
114
- status;
115
- body;
116
- constructor(message, status, body) {
117
- super(message);
118
- this.name = "X402Error";
119
- this.status = status;
120
- this.body = body;
121
- }
122
- };
123
- var X402Client = class {
124
- #apiKey;
125
- #baseUrl;
126
- #fetch;
127
- constructor(options = {}) {
128
- this.#apiKey = options.apiKey ?? process.env.PRIMITIVE_API_KEY ?? "";
129
- this.#baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
130
- this.#fetch = options.fetch ?? fetch;
131
- }
132
- async #request(method, path, body) {
133
- const res = await this.#fetch(`${this.#baseUrl}${path}`, {
134
- method,
135
- headers: {
136
- authorization: `Bearer ${this.#apiKey}`,
137
- "content-type": "application/json"
138
- },
139
- body: body === void 0 ? void 0 : JSON.stringify(body)
140
- });
141
- const json = await res.json().catch(() => ({}));
142
- if (!res.ok || json.success === false) throw new X402Error(json.error?.message ?? `request failed with ${res.status}`, res.status, json);
143
- return json.data ?? json;
144
- }
145
- /** Request a payment (payee side). Returns the challenge to hand to the payer. */
146
- charge(input) {
147
- const body = {
148
- amount: input.amount,
149
- network: input.network ?? "base-sepolia"
150
- };
151
- if (input.payerOrg) body.payer_org = input.payerOrg;
152
- if (input.description) body.description = input.description;
153
- if (input.resource) body.resource = input.resource;
154
- if (input.expiresIn !== void 0) body.expires_in = input.expiresIn;
155
- return this.#request("POST", "/v1/x402/challenges", body);
156
- }
157
- /**
158
- * Pay a challenge (payer side). Derives the interaction-bound authorization,
159
- * signs it locally with the caller's key, and submits it for settlement.
160
- */
161
- async pay(challenge, options) {
162
- const chainId = CHAIN_IDS[challenge.network];
163
- if (chainId === void 0) throw new X402Error(`unsupported network: ${challenge.network}`, 0);
164
- const pr = challenge.payment_requirements;
165
- const nonce = deriveEip3009Nonce({
166
- interactionId: challenge.nonce_binding.interaction_id,
167
- challengeStepId: challenge.nonce_binding.challenge_step_id,
168
- challengeNonce: challenge.nonce_binding.challenge_nonce
169
- });
170
- const nowSec = Math.floor(Date.now() / 1e3);
171
- const expiresAtMs = Date.parse(challenge.expires_at);
172
- if (Number.isNaN(expiresAtMs)) throw new X402Error(`challenge has an invalid expires_at: ${challenge.expires_at}`, 0);
173
- const expiresAtSec = Math.floor(expiresAtMs / 1e3);
174
- const auth = {
175
- from: options.signer.address,
176
- to: pr.payTo,
177
- value: BigInt(pr.maxAmountRequired),
178
- validAfter: BigInt(nowSec - CLOCK_SKEW_SEC),
179
- validBefore: BigInt(expiresAtSec + SETTLEMENT_MARGIN_SEC),
180
- nonce
181
- };
182
- const signature = await options.signer.signTypedData(transferWithAuthorizationTypedData({
183
- name: pr.extra.name,
184
- version: pr.extra.version,
185
- chainId,
186
- verifyingContract: pr.asset
187
- }, auth));
188
- return this.#request("POST", `/v1/x402/challenges/${challenge.id}/pay`, { payment: toPaymentPayload(challenge.network, auth, signature) });
189
- }
190
- };
191
- function createX402Client(options = {}) {
192
- return new X402Client(options);
193
- }
194
- //#endregion
3
+ import { A as PRIMITIVE_CONFIRMED_HEADER, C as STANDARD_WEBHOOK_ID_HEADER, D as verifyStandardWebhooksSignature, E as signStandardWebhooksPayload, F as verifyDownloadToken, I as safeValidateEmailReceivedEvent, L as validateEmailReceivedEvent, M as signWebhookPayload, N as verifyWebhookSignature, O as LEGACY_CONFIRMED_HEADER, P as generateDownloadToken, S as emailReceivedEventJsonSchema, T as STANDARD_WEBHOOK_TIMESTAMP_HEADER, _ as DmarcResult, a as isDownloadExpired, b as ParsedStatus, c as parseWebhookEvent, d as WEBHOOK_VERSION, f as validateEmailAuth, g as DmarcPolicy, h as DkimResult, i as handleWebhook, j as PRIMITIVE_SIGNATURE_HEADER, k as LEGACY_SIGNATURE_HEADER, l as receive, m as AuthVerdict, n as decodeRawEmail, o as isEmailReceivedEvent, p as AuthConfidence, r as getDownloadTimeRemaining, s as isRawIncluded, t as confirmedHeaders, u as verifyRawEmailDownload, v as EventType, w as STANDARD_WEBHOOK_SIGNATURE_HEADER, x as SpfResult, y as ForwardVerdict } from "./webhook-CwjCyFv-.js";
4
+ import { X402Client, X402Error, buildPayoutRegistrationMessage, createX402Client, deriveEip3009Nonce } from "./x402/index.js";
195
5
  //#region src/index.ts
196
6
  const primitive = {
197
7
  client,
@@ -200,4 +10,4 @@ const primitive = {
200
10
  x402: createX402Client
201
11
  };
202
12
  //#endregion
203
- export { AuthConfidence, AuthVerdict, DkimResult, DmarcPolicy, DmarcResult, EventType, ForwardVerdict, LEGACY_CONFIRMED_HEADER, LEGACY_SIGNATURE_HEADER, PAYLOAD_ERRORS, PRIMITIVE_CONFIRMED_HEADER, PRIMITIVE_SIGNATURE_HEADER, ParsedStatus, PrimitiveApiError, PrimitiveClient, PrimitiveWebhookError, RAW_EMAIL_ERRORS, RawEmailDecodeError, STANDARD_WEBHOOK_ID_HEADER, STANDARD_WEBHOOK_SIGNATURE_HEADER, STANDARD_WEBHOOK_TIMESTAMP_HEADER, SpfResult, VERIFICATION_ERRORS, WEBHOOK_VERSION, WebhookPayloadError, WebhookValidationError, WebhookVerificationError, X402Client, X402Error, buildForwardSubject, buildReplySubject, client, confirmedHeaders, createPrimitiveClient, createX402Client, decodeRawEmail, primitive as default, deriveEip3009Nonce, emailReceivedEventJsonSchema, formatAddress, generateDownloadToken, getDownloadTimeRemaining, handleWebhook, isDownloadExpired, isEmailReceivedEvent, isRawIncluded, normalizeReceivedEmail, parseHeaderAddress, parseWebhookEvent, receive, safeValidateEmailReceivedEvent, signStandardWebhooksPayload, signWebhookPayload, validateEmailAuth, validateEmailReceivedEvent, verifyDownloadToken, verifyRawEmailDownload, verifyStandardWebhooksSignature, verifyWebhookSignature };
13
+ export { AccountResource, AuthConfidence, AuthVerdict, DkimResult, DmarcPolicy, DmarcResult, EventType, ForwardVerdict, InboxResource, LEGACY_CONFIRMED_HEADER, LEGACY_SIGNATURE_HEADER, PAYLOAD_ERRORS, PRIMITIVE_CONFIRMED_HEADER, PRIMITIVE_SIGNATURE_HEADER, ParsedStatus, PrimitiveApiError, PrimitiveClient, PrimitiveWebhookError, RAW_EMAIL_ERRORS, RawEmailDecodeError, STANDARD_WEBHOOK_ID_HEADER, STANDARD_WEBHOOK_SIGNATURE_HEADER, STANDARD_WEBHOOK_TIMESTAMP_HEADER, SpfResult, VERIFICATION_ERRORS, WEBHOOK_VERSION, WebhookPayloadError, WebhookValidationError, WebhookVerificationError, X402Client, X402Error, buildForwardSubject, buildPayoutRegistrationMessage, buildReplySubject, client, confirmedHeaders, createAgent, createPrimitiveClient, createX402Client, decodeRawEmail, primitive as default, deriveEip3009Nonce, emailReceivedEventJsonSchema, formatAddress, generateDownloadToken, getDownloadTimeRemaining, handleWebhook, isDownloadExpired, isEmailReceivedEvent, isRawIncluded, normalizeReceivedEmail, parseHeaderAddress, parseWebhookEvent, receive, safeValidateEmailReceivedEvent, signStandardWebhooksPayload, signWebhookPayload, validateEmailAuth, validateEmailReceivedEvent, verifyDownloadToken, verifyRawEmailDownload, verifyStandardWebhooksSignature, verifyWebhookSignature };
@@ -1,2 +1,2 @@
1
- import { n as openapiDocument, t as operationManifest } from "../operations.generated-DSMTMcWh.js";
1
+ import { n as openapiDocument, t as operationManifest } from "../operations.generated-XrEy5EtX.js";
2
2
  export { openapiDocument, operationManifest };
@@ -79,7 +79,7 @@ const openapiDocument = {
79
79
  },
80
80
  {
81
81
  "name": "Functions",
82
- "description": "Deploy JavaScript handlers that run on inbound mail. Each function\nis a single ESM module whose default export is an object with an\nasync `fetch(request, env)` method, in the shape of a Workers-style\nhandler. Primitive signs each delivery and forwards the\n`Primitive-Signature` header to the handler; verify the raw request\nbody with `PRIMITIVE_WEBHOOK_SECRET` before trusting the parsed\n`email.received` event (see `EmailReceivedEvent` and the Webhook\npayload section for the full schema). Code runs on\nPrimitive's edge runtime; there is no infrastructure to manage.\nSecrets land in `env` as encrypted bindings and are refreshed on\nevery redeploy.\n"
82
+ "description": "Deploy JavaScript handlers that run on inbound mail. Each function\nis a single ESM module whose default export is an object with an\nasync `fetch(request, env)` method, in the shape of a Workers-style\nhandler. Primitive signs each delivery and forwards the\n`Primitive-Signature` header to the handler; verify the raw request\nbody with `PRIMITIVE_WEBHOOK_SECRET` before trusting the parsed event.\nThe `event` field is `email.received` for normal inbound mail, or a\nmachine-mail type (`email.bounced`, `email.tls_report`,\n`email.dmarc_report`, `email.dmarc_failure`) for bounces and reports;\nthe payload shape is otherwise identical. Code runs on\nPrimitive's edge runtime; there is no infrastructure to manage.\nSecrets land in `env` as encrypted bindings and are refreshed on\nevery redeploy.\n"
83
83
  }
84
84
  ],
85
85
  "paths": {
@@ -851,6 +851,25 @@ const openapiDocument = {
851
851
  "format": "date-time"
852
852
  },
853
853
  "description": "Filter emails created on or before this timestamp"
854
+ },
855
+ {
856
+ "name": "since",
857
+ "in": "query",
858
+ "schema": {
859
+ "type": "string",
860
+ "maxLength": 200
861
+ },
862
+ "description": "Forward-tail cursor. Returns rows that became visible AFTER this\ncursor, oldest-first, so a caller can stream new inbound mail by\nre-passing the cursor from each response. Mutually exclusive with\n`cursor` (which pages history newest-first). Pass the `meta.cursor`\nfrom the previous `since` response; an empty page means caught up.\n"
863
+ },
864
+ {
865
+ "name": "wait",
866
+ "in": "query",
867
+ "schema": {
868
+ "type": "integer",
869
+ "minimum": 0,
870
+ "maximum": 30
871
+ },
872
+ "description": "Long-poll: hold the request up to this many seconds waiting for new\nmail past `since`, returning as soon as any arrives (or an empty\npage when the wait elapses). Requires `since`. Omitted means no wait\n(returns immediately); the server treats an absent value as 0. NOT\ngiven an OpenAPI `default` on purpose: a default makes some\ngenerators (e.g. openapi-python-client) send `wait=0` on every call,\nwhich then fails the `wait` requires `since` check for plain history\nlistings.\n"
854
873
  }
855
874
  ],
856
875
  "responses": {
@@ -1790,7 +1809,7 @@ const openapiDocument = {
1790
1809
  "post": {
1791
1810
  "operationId": "createFunction",
1792
1811
  "summary": "Deploy a function",
1793
- "description": "Creates and deploys a new function. The handler must be a single\nESM module whose default export is an object with an async\n`fetch(request, env)` method (Workers-style). Primitive signs\neach delivery and forwards the `Primitive-Signature` header to\nthe handler. Verify the raw request body with\n`PRIMITIVE_WEBHOOK_SECRET` before parsing JSON; after verification\nthe request body parses to an `email.received` event (see\n`EmailReceivedEvent` and the Webhook payload section for the full\nschema). Code is bundled before being uploaded; ship a single\nself-contained file rather than relying on external imports.\n\n**Code limits.** `code` is capped at 1 MiB UTF-8. `sourceMap`\n(optional) is capped at 5 MiB UTF-8, stored with each deployment\nattempt, and sent to the runtime so stack traces can resolve to\noriginal source files.\n\n**Routing.** On successful deploy, the function code is live\nin the runtime, but inbound mail will not reach it until at\nleast one route is bound. Routes are managed from the Primitive\ndashboard. A `deploy_status` of `deployed` means the script is\ninstalled, not that the function is receiving mail. The\ninternal runtime URL is not returned by the API and is not a\ncustomer-facing integration surface.\n\n**Secrets.** New functions ship with the managed secrets\n(`PRIMITIVE_WEBHOOK_SECRET`, `PRIMITIVE_API_KEY`,\n`PRIMITIVE_API_BASE_URL`) already bound. Add user-set secrets via\n`POST /functions/{id}/secrets`; secret writes only land in the\nrunning handler on the next redeploy.\n",
1812
+ "description": "Creates and deploys a new function. The handler must be a single\nESM module whose default export is an object with an async\n`fetch(request, env)` method (Workers-style). Primitive signs\neach delivery and forwards the `Primitive-Signature` header to\nthe handler. Verify the raw request body with\n`PRIMITIVE_WEBHOOK_SECRET` before parsing JSON; after verification\nthe request body parses to a webhook event whose `event` field is\n`email.received` for normal inbound mail, or a machine-mail type\n(`email.bounced`, `email.tls_report`, `email.dmarc_report`,\n`email.dmarc_failure`) for bounces and reports. Code is bundled\nbefore being uploaded; ship a single self-contained file rather\nthan relying on external imports.\n\n**Code limits.** `code` is capped at 1 MiB UTF-8. `sourceMap`\n(optional) is capped at 5 MiB UTF-8, stored with each deployment\nattempt, and sent to the runtime so stack traces can resolve to\noriginal source files.\n\n**Routing.** On successful deploy, the function code is live\nin the runtime, but inbound mail will not reach it until at\nleast one route is bound. Routes are managed from the Primitive\ndashboard. A `deploy_status` of `deployed` means the script is\ninstalled, not that the function is receiving mail. The\ninternal runtime URL is not returned by the API and is not a\ncustomer-facing integration surface.\n\n**Secrets.** New functions ship with the managed secrets\n(`PRIMITIVE_WEBHOOK_SECRET`, `PRIMITIVE_API_KEY`,\n`PRIMITIVE_API_BASE_URL`) already bound. Add user-set secrets via\n`POST /functions/{id}/secrets`; secret writes only land in the\nrunning handler on the next redeploy.\n",
1794
1813
  "tags": ["Functions"],
1795
1814
  "requestBody": {
1796
1815
  "required": true,
@@ -3310,6 +3329,16 @@ const openapiDocument = {
3310
3329
  },
3311
3330
  "email": { "type": "string" },
3312
3331
  "plan": { "type": "string" },
3332
+ "limits": { "$ref": "#/components/schemas/PlanLimits" },
3333
+ "entitlements": {
3334
+ "type": "array",
3335
+ "items": { "type": "string" },
3336
+ "description": "Granted org entitlement keys (sorted). A headless caller reads its\ncapabilities here — e.g. an emailless agent seeing only\n[\"send_mail\", \"send_to_known_addresses\"] knows it is reply-only.\n"
3337
+ },
3338
+ "managed_inbox_address": {
3339
+ "type": ["string", "null"],
3340
+ "description": "The managed inbox FQDN to reply as, or null if the org has no managed inbox."
3341
+ },
3313
3342
  "created_at": {
3314
3343
  "type": "string",
3315
3344
  "format": "date-time"
@@ -3337,6 +3366,9 @@ const openapiDocument = {
3337
3366
  "id",
3338
3367
  "email",
3339
3368
  "plan",
3369
+ "limits",
3370
+ "entitlements",
3371
+ "managed_inbox_address",
3340
3372
  "created_at",
3341
3373
  "discard_content_on_webhook_confirmed"
3342
3374
  ]
@@ -6375,6 +6407,39 @@ const operationManifest = [
6375
6407
  },
6376
6408
  "email": { "type": "string" },
6377
6409
  "plan": { "type": "string" },
6410
+ "limits": {
6411
+ "type": "object",
6412
+ "description": "Plan-derived quota limits for an account.",
6413
+ "properties": {
6414
+ "storage_mb": { "type": "number" },
6415
+ "send_per_hour": { "type": "number" },
6416
+ "send_per_day": { "type": "number" },
6417
+ "api_per_minute": { "type": "number" },
6418
+ "webhooks_max_global": { "type": ["number", "null"] },
6419
+ "webhooks_per_domain": { "type": "boolean" },
6420
+ "filters_per_domain": { "type": "boolean" },
6421
+ "spam_thresholds_per_domain": { "type": "boolean" }
6422
+ },
6423
+ "required": [
6424
+ "storage_mb",
6425
+ "send_per_hour",
6426
+ "send_per_day",
6427
+ "api_per_minute",
6428
+ "webhooks_max_global",
6429
+ "webhooks_per_domain",
6430
+ "filters_per_domain",
6431
+ "spam_thresholds_per_domain"
6432
+ ]
6433
+ },
6434
+ "entitlements": {
6435
+ "type": "array",
6436
+ "items": { "type": "string" },
6437
+ "description": "Granted org entitlement keys (sorted). A headless caller reads its\ncapabilities here — e.g. an emailless agent seeing only\n[\"send_mail\", \"send_to_known_addresses\"] knows it is reply-only.\n"
6438
+ },
6439
+ "managed_inbox_address": {
6440
+ "type": ["string", "null"],
6441
+ "description": "The managed inbox FQDN to reply as, or null if the org has no managed inbox."
6442
+ },
6378
6443
  "created_at": {
6379
6444
  "type": "string",
6380
6445
  "format": "date-time"
@@ -6402,6 +6467,9 @@ const operationManifest = [
6402
6467
  "id",
6403
6468
  "email",
6404
6469
  "plan",
6470
+ "limits",
6471
+ "entitlements",
6472
+ "managed_inbox_address",
6405
6473
  "created_at",
6406
6474
  "discard_content_on_webhook_confirmed"
6407
6475
  ]
@@ -8858,6 +8926,22 @@ const operationManifest = [
8858
8926
  "name": "date_to",
8859
8927
  "required": false,
8860
8928
  "type": "string"
8929
+ },
8930
+ {
8931
+ "description": "Forward-tail cursor. Returns rows that became visible AFTER this\ncursor, oldest-first, so a caller can stream new inbound mail by\nre-passing the cursor from each response. Mutually exclusive with\n`cursor` (which pages history newest-first). Pass the `meta.cursor`\nfrom the previous `since` response; an empty page means caught up.\n",
8932
+ "enum": null,
8933
+ "name": "since",
8934
+ "required": false,
8935
+ "type": "string"
8936
+ },
8937
+ {
8938
+ "description": "Long-poll: hold the request up to this many seconds waiting for new\nmail past `since`, returning as soon as any arrives (or an empty\npage when the wait elapses). Requires `since`. Omitted means no wait\n(returns immediately); the server treats an absent value as 0. NOT\ngiven an OpenAPI `default` on purpose: a default makes some\ngenerators (e.g. openapi-python-client) send `wait=0` on every call,\nwhich then fails the `wait` requires `since` check for plain history\nlistings.\n",
8939
+ "enum": null,
8940
+ "maximum": 30,
8941
+ "minimum": 0,
8942
+ "name": "wait",
8943
+ "required": false,
8944
+ "type": "integer"
8861
8945
  }
8862
8946
  ],
8863
8947
  "requestSchema": null,
@@ -9867,7 +9951,7 @@ const operationManifest = [
9867
9951
  "binaryResponse": false,
9868
9952
  "bodyRequired": true,
9869
9953
  "command": "create-function",
9870
- "description": "Creates and deploys a new function. The handler must be a single\nESM module whose default export is an object with an async\n`fetch(request, env)` method (Workers-style). Primitive signs\neach delivery and forwards the `Primitive-Signature` header to\nthe handler. Verify the raw request body with\n`PRIMITIVE_WEBHOOK_SECRET` before parsing JSON; after verification\nthe request body parses to an `email.received` event (see\n`EmailReceivedEvent` and the Webhook payload section for the full\nschema). Code is bundled before being uploaded; ship a single\nself-contained file rather than relying on external imports.\n\n**Code limits.** `code` is capped at 1 MiB UTF-8. `sourceMap`\n(optional) is capped at 5 MiB UTF-8, stored with each deployment\nattempt, and sent to the runtime so stack traces can resolve to\noriginal source files.\n\n**Routing.** On successful deploy, the function code is live\nin the runtime, but inbound mail will not reach it until at\nleast one route is bound. Routes are managed from the Primitive\ndashboard. A `deploy_status` of `deployed` means the script is\ninstalled, not that the function is receiving mail. The\ninternal runtime URL is not returned by the API and is not a\ncustomer-facing integration surface.\n\n**Secrets.** New functions ship with the managed secrets\n(`PRIMITIVE_WEBHOOK_SECRET`, `PRIMITIVE_API_KEY`,\n`PRIMITIVE_API_BASE_URL`) already bound. Add user-set secrets via\n`POST /functions/{id}/secrets`; secret writes only land in the\nrunning handler on the next redeploy.\n",
9954
+ "description": "Creates and deploys a new function. The handler must be a single\nESM module whose default export is an object with an async\n`fetch(request, env)` method (Workers-style). Primitive signs\neach delivery and forwards the `Primitive-Signature` header to\nthe handler. Verify the raw request body with\n`PRIMITIVE_WEBHOOK_SECRET` before parsing JSON; after verification\nthe request body parses to a webhook event whose `event` field is\n`email.received` for normal inbound mail, or a machine-mail type\n(`email.bounced`, `email.tls_report`, `email.dmarc_report`,\n`email.dmarc_failure`) for bounces and reports. Code is bundled\nbefore being uploaded; ship a single self-contained file rather\nthan relying on external imports.\n\n**Code limits.** `code` is capped at 1 MiB UTF-8. `sourceMap`\n(optional) is capped at 5 MiB UTF-8, stored with each deployment\nattempt, and sent to the runtime so stack traces can resolve to\noriginal source files.\n\n**Routing.** On successful deploy, the function code is live\nin the runtime, but inbound mail will not reach it until at\nleast one route is bound. Routes are managed from the Primitive\ndashboard. A `deploy_status` of `deployed` means the script is\ninstalled, not that the function is receiving mail. The\ninternal runtime URL is not returned by the API and is not a\ncustomer-facing integration surface.\n\n**Secrets.** New functions ship with the managed secrets\n(`PRIMITIVE_WEBHOOK_SECRET`, `PRIMITIVE_API_KEY`,\n`PRIMITIVE_API_BASE_URL`) already bound. Add user-set secrets via\n`POST /functions/{id}/secrets`; secret writes only land in the\nrunning handler on the next redeploy.\n",
9871
9955
  "hasJsonBody": true,
9872
9956
  "method": "POST",
9873
9957
  "operationId": "createFunction",
@@ -1,4 +1,4 @@
1
- import { M as WebhookAttachment, S as ParsedDataComplete, s as EmailAddress } from "../types-yNU-Oiea.js";
1
+ import { F as WebhookAttachment, l as EmailAddress, w as ParsedDataComplete } from "../types-QT2ss9ho.js";
2
2
  import { a as parseFromHeader, i as ValidatedAddress, n as ParseFromHeaderResult, o as parseFromHeaderLoose, r as ParsedAddress, t as ParseFromHeaderFailureReason } from "../address-parser-CA6G7R-h.js";
3
3
 
4
4
  //#region src/parser/attachment-parser.d.ts