mailery 0.16.0 → 0.16.1

package/dist/index.d.cts

@@ -190,7 +190,15 @@ type WebhookToleranceOption = number | false;
 
 interface SendGridProviderOptions {
     apiKey: string;
-    /** ECDSA public key (PEM) from SendGrid → Settings → Mail Settings → Signed Event Webhook. */
+    /**
+     * ECDSA public key from SendGrid → Settings → Mail Settings → Signed Event
+     * Webhook. Either form SendGrid hands out is accepted: the single-line
+     * base64 string its dashboard shows and its API returns as `public_key`
+     * (what `mailery setup-sendgrid` prints), or the same key as a PEM block.
+     * A PEM whose newlines were escaped to `\n` for an .env line is unescaped.
+     * Anything that does not parse as a public key throws at construction —
+     * a key that silently verifies nothing is the failure this replaces.
+     */
     webhookVerificationKey?: string;
     /**
      * Replay window for the signed webhook timestamp, in seconds.
@@ -213,6 +221,8 @@ declare class SendGridProvider implements MailProvider {
     readonly sendRatePerSecond: number;
     /** Resolved replay window in seconds; `0` means the check is disabled. */
     readonly webhookToleranceSeconds: number;
+    /** The verification key as PEM, whatever shape it was configured in. */
+    private readonly verificationKeyPem;
     constructor(opts: SendGridProviderOptions);
     send(args: SendArgs): Promise<SendResult>;
     verifyWebhook(rawBody: Buffer, headers: Record<string, string>): Promise<boolean>;

package/dist/index.d.ts

@@ -190,7 +190,15 @@ type WebhookToleranceOption = number | false;
 
 interface SendGridProviderOptions {
     apiKey: string;
-    /** ECDSA public key (PEM) from SendGrid → Settings → Mail Settings → Signed Event Webhook. */
+    /**
+     * ECDSA public key from SendGrid → Settings → Mail Settings → Signed Event
+     * Webhook. Either form SendGrid hands out is accepted: the single-line
+     * base64 string its dashboard shows and its API returns as `public_key`
+     * (what `mailery setup-sendgrid` prints), or the same key as a PEM block.
+     * A PEM whose newlines were escaped to `\n` for an .env line is unescaped.
+     * Anything that does not parse as a public key throws at construction —
+     * a key that silently verifies nothing is the failure this replaces.
+     */
     webhookVerificationKey?: string;
     /**
      * Replay window for the signed webhook timestamp, in seconds.
@@ -213,6 +221,8 @@ declare class SendGridProvider implements MailProvider {
     readonly sendRatePerSecond: number;
     /** Resolved replay window in seconds; `0` means the check is disabled. */
     readonly webhookToleranceSeconds: number;
+    /** The verification key as PEM, whatever shape it was configured in. */
+    private readonly verificationKeyPem;
     constructor(opts: SendGridProviderOptions);
     send(args: SendArgs): Promise<SendResult>;
     verifyWebhook(rawBody: Buffer, headers: Record<string, string>): Promise<boolean>;

package/dist/index.js

@@ -268,8 +268,36 @@ var init_webhook_tolerance = __esm({
 // src/server/providers/sendgrid.ts
 var sendgrid_exports = {};
 __export(sendgrid_exports, {
-  SendGridProvider: () => SendGridProvider
+  SendGridProvider: () => SendGridProvider,
+  normalizeWebhookVerificationKey: () => normalizeWebhookVerificationKey
 });
+function normalizeWebhookVerificationKey(input) {
+  let key = String(input ?? "").trim().replace(/^["']|["']$/g, "");
+  if (key.includes("\\n")) key = key.replace(/\\n/g, "\n");
+  let pem;
+  if (key.includes(PEM_HEADER)) {
+    pem = key;
+  } else {
+    const b64 = key.replace(/\s+/g, "");
+    if (!b64 || !/^[A-Za-z0-9+/=]+$/.test(b64)) {
+      throw new Error(
+        "SendGridProvider: webhookVerificationKey is neither a PEM public key nor a base64 SPKI key. Copy the Verification Key from SendGrid \u2192 Settings \u2192 Mail Settings \u2192 Signed Event Webhook."
+      );
+    }
+    pem = `${PEM_HEADER}
+${b64.match(/.{1,64}/g).join("\n")}
+${PEM_FOOTER}
+`;
+  }
+  try {
+    crypto2.createPublicKey(pem);
+  } catch (err) {
+    throw new Error(
+      `SendGridProvider: webhookVerificationKey did not parse as a public key (${String(err?.message ?? err)}). Copy the Verification Key from SendGrid \u2192 Settings \u2192 Mail Settings \u2192 Signed Event Webhook.`
+    );
+  }
+  return pem;
+}
 function normalizeSendGridEvent(e) {
   const type = mapEventType(e.event);
   if (!type) return null;
@@ -308,24 +336,29 @@ function mapEventType(sgEvent) {
       return null;
   }
 }
-var SG_SIG_HEADER, SG_TS_HEADER, SendGridProvider;
+var SG_SIG_HEADER, SG_TS_HEADER, PEM_HEADER, PEM_FOOTER, SendGridProvider;
 var init_sendgrid = __esm({
   "src/server/providers/sendgrid.ts"() {
     init_webhook_tolerance();
     SG_SIG_HEADER = "x-twilio-email-event-webhook-signature";
     SG_TS_HEADER = "x-twilio-email-event-webhook-timestamp";
+    PEM_HEADER = "-----BEGIN PUBLIC KEY-----";
+    PEM_FOOTER = "-----END PUBLIC KEY-----";
     SendGridProvider = class {
       constructor(opts) {
         this.opts = opts;
         sgMail.setApiKey(opts.apiKey);
         this.sendRatePerSecond = opts.sendRatePerSecond ?? 10;
         this.webhookToleranceSeconds = resolveWebhookToleranceSeconds(opts.webhookToleranceSeconds);
+        this.verificationKeyPem = opts.webhookVerificationKey ? normalizeWebhookVerificationKey(opts.webhookVerificationKey) : null;
       }
       opts;
       name = "sendgrid";
       sendRatePerSecond;
       /** Resolved replay window in seconds; `0` means the check is disabled. */
       webhookToleranceSeconds;
+      /** The verification key as PEM, whatever shape it was configured in. */
+      verificationKeyPem;
       async send(args) {
         const msg = {
           to: args.to,
@@ -357,7 +390,7 @@ var init_sendgrid = __esm({
         };
       }
       async verifyWebhook(rawBody, headers) {
-        if (!this.opts.webhookVerificationKey) return false;
+        if (!this.verificationKeyPem) return false;
         const sig = headers[SG_SIG_HEADER];
         const ts = headers[SG_TS_HEADER];
         if (!sig || !ts) return false;
@@ -365,7 +398,7 @@ var init_sendgrid = __esm({
         try {
           const verifier = crypto2.createVerify("sha256");
           verifier.update(payload);
-          if (!verifier.verify(this.opts.webhookVerificationKey, sig, "base64")) return false;
+          if (!verifier.verify(this.verificationKeyPem, sig, "base64")) return false;
         } catch {
           return false;
         }
@@ -8205,7 +8238,7 @@ function unitToMs2(value, unit) {
 }
 
 // src/server/api/agent.ts
-var VERSION = "0.16.0" ;
+var VERSION = "0.16.1" ;
 var MIN_AGENT_TOKEN_LENGTH = 24;
 function createAgentRouter(mailer, opts) {
   if (!opts || !Array.isArray(opts.tokens) || opts.tokens.length === 0) {
@@ -9905,7 +9938,7 @@ var DEDUPE_POLICIES = [
 ];
 
 // src/server/index.ts
-var VERSION2 = "0.16.0" ;
+var VERSION2 = "0.16.1" ;
 
 export { DEDUPE_POLICIES, DEFAULT_BOT_UA_RE, FLOW_STEP_KINDS, FlowOperationError, MIN_AGENT_TOKEN_LENGTH, Mailer, MongoContactAdapter, NullProvider, PREDICATE_KINDS, RESERVED_VAR_KEYS, SEGMENT_FILTER_KINDS, SendGridProvider, TRACKING_SIG_LENGTH, VERSION2 as VERSION, applyTracking, applyWebhookEvent, armFlow, compileMailyTemplate, compileTemplate, computeDeliveryTime, createAdminApiRouter, createAdminRouter, createAgentRouter, createPublicRouter, defaultFlowStep, defaultPredicate, defaultSegmentFilter, defineVars, derivePlaintext, disarmFlow, dispatchSend, drainPendingUnsubscribes, ensureIndexes, gateFlow, getCollections, isCanaryGate, predicateKind, processNewlyFiredEventTriggers, processOneRunStep, referencedPaths, renderForContact, renderTemplate, runTick, sendgridInboundParser, sha256Hex, signTrackingToken, signUnsubscribeToken, simulateFlow, stampWatermarkIfNull, sweepStrandedFlowRuns, ungateFlow, validateSenderDomain, varsJsonSchema, verifyTemplate, verifyTrackingToken, verifyUnsubscribeToken };
 //# sourceMappingURL=index.js.map