mailery 0.16.0 → 0.16.2

package/dist/index.d.cts

@@ -190,7 +190,15 @@ type WebhookToleranceOption = number | false;
 
 interface SendGridProviderOptions {
     apiKey: string;
-    /** ECDSA public key (PEM) from SendGrid → Settings → Mail Settings → Signed Event Webhook. */
+    /**
+     * ECDSA public key from SendGrid → Settings → Mail Settings → Signed Event
+     * Webhook. Either form SendGrid hands out is accepted: the single-line
+     * base64 string its dashboard shows and its API returns as `public_key`
+     * (what `mailery setup-sendgrid` prints), or the same key as a PEM block.
+     * A PEM whose newlines were escaped to `\n` for an .env line is unescaped.
+     * Anything that does not parse as a public key throws at construction —
+     * a key that silently verifies nothing is the failure this replaces.
+     */
     webhookVerificationKey?: string;
     /**
      * Replay window for the signed webhook timestamp, in seconds.
@@ -213,6 +221,8 @@ declare class SendGridProvider implements MailProvider {
     readonly sendRatePerSecond: number;
     /** Resolved replay window in seconds; `0` means the check is disabled. */
     readonly webhookToleranceSeconds: number;
+    /** The verification key as PEM, whatever shape it was configured in. */
+    private readonly verificationKeyPem;
     constructor(opts: SendGridProviderOptions);
     send(args: SendArgs): Promise<SendResult>;
     verifyWebhook(rawBody: Buffer, headers: Record<string, string>): Promise<boolean>;

package/dist/index.d.ts

@@ -190,7 +190,15 @@ type WebhookToleranceOption = number | false;
 
 interface SendGridProviderOptions {
     apiKey: string;
-    /** ECDSA public key (PEM) from SendGrid → Settings → Mail Settings → Signed Event Webhook. */
+    /**
+     * ECDSA public key from SendGrid → Settings → Mail Settings → Signed Event
+     * Webhook. Either form SendGrid hands out is accepted: the single-line
+     * base64 string its dashboard shows and its API returns as `public_key`
+     * (what `mailery setup-sendgrid` prints), or the same key as a PEM block.
+     * A PEM whose newlines were escaped to `\n` for an .env line is unescaped.
+     * Anything that does not parse as a public key throws at construction —
+     * a key that silently verifies nothing is the failure this replaces.
+     */
     webhookVerificationKey?: string;
     /**
      * Replay window for the signed webhook timestamp, in seconds.
@@ -213,6 +221,8 @@ declare class SendGridProvider implements MailProvider {
     readonly sendRatePerSecond: number;
     /** Resolved replay window in seconds; `0` means the check is disabled. */
     readonly webhookToleranceSeconds: number;
+    /** The verification key as PEM, whatever shape it was configured in. */
+    private readonly verificationKeyPem;
     constructor(opts: SendGridProviderOptions);
     send(args: SendArgs): Promise<SendResult>;
     verifyWebhook(rawBody: Buffer, headers: Record<string, string>): Promise<boolean>;

package/dist/index.js

@@ -268,15 +268,49 @@ var init_webhook_tolerance = __esm({
 // src/server/providers/sendgrid.ts
 var sendgrid_exports = {};
 __export(sendgrid_exports, {
-  SendGridProvider: () => SendGridProvider
+  SendGridProvider: () => SendGridProvider,
+  normalizeSendGridMessageId: () => normalizeSendGridMessageId,
+  normalizeWebhookVerificationKey: () => normalizeWebhookVerificationKey
 });
+function normalizeWebhookVerificationKey(input) {
+  let key = String(input ?? "").trim().replace(/^["']|["']$/g, "");
+  if (key.includes("\\n")) key = key.replace(/\\n/g, "\n");
+  let pem;
+  if (key.includes(PEM_HEADER)) {
+    pem = key;
+  } else {
+    const b64 = key.replace(/\s+/g, "");
+    if (!b64 || !/^[A-Za-z0-9+/=]+$/.test(b64)) {
+      throw new Error(
+        "SendGridProvider: webhookVerificationKey is neither a PEM public key nor a base64 SPKI key. Copy the Verification Key from SendGrid \u2192 Settings \u2192 Mail Settings \u2192 Signed Event Webhook."
+      );
+    }
+    pem = `${PEM_HEADER}
+${b64.match(/.{1,64}/g).join("\n")}
+${PEM_FOOTER}
+`;
+  }
+  try {
+    crypto2.createPublicKey(pem);
+  } catch (err) {
+    throw new Error(
+      `SendGridProvider: webhookVerificationKey did not parse as a public key (${String(err?.message ?? err)}). Copy the Verification Key from SendGrid \u2192 Settings \u2192 Mail Settings \u2192 Signed Event Webhook.`
+    );
+  }
+  return pem;
+}
+function normalizeSendGridMessageId(raw) {
+  const id = String(raw ?? "");
+  const marker = /\.(?:filter|recvd)\S*$/i.exec(id);
+  return marker ? id.slice(0, marker.index) : id;
+}
 function normalizeSendGridEvent(e) {
   const type = mapEventType(e.event);
   if (!type) return null;
   return {
     type,
     providerEventId: String(e.sg_event_id ?? e["smtp-id"] ?? `${e.event}-${e.timestamp}-${e.email}`),
-    providerMessageId: String(e.sg_message_id ?? e["smtp-id"] ?? ""),
+    providerMessageId: e.sg_message_id != null ? normalizeSendGridMessageId(e.sg_message_id) : String(e["smtp-id"] ?? ""),
     email: String(e.email ?? "").toLowerCase(),
     occurredAt: new Date(Number(e.timestamp) * 1e3),
     details: {
@@ -308,24 +342,29 @@ function mapEventType(sgEvent) {
       return null;
   }
 }
-var SG_SIG_HEADER, SG_TS_HEADER, SendGridProvider;
+var SG_SIG_HEADER, SG_TS_HEADER, PEM_HEADER, PEM_FOOTER, SendGridProvider;
 var init_sendgrid = __esm({
   "src/server/providers/sendgrid.ts"() {
     init_webhook_tolerance();
     SG_SIG_HEADER = "x-twilio-email-event-webhook-signature";
     SG_TS_HEADER = "x-twilio-email-event-webhook-timestamp";
+    PEM_HEADER = "-----BEGIN PUBLIC KEY-----";
+    PEM_FOOTER = "-----END PUBLIC KEY-----";
     SendGridProvider = class {
       constructor(opts) {
         this.opts = opts;
         sgMail.setApiKey(opts.apiKey);
         this.sendRatePerSecond = opts.sendRatePerSecond ?? 10;
         this.webhookToleranceSeconds = resolveWebhookToleranceSeconds(opts.webhookToleranceSeconds);
+        this.verificationKeyPem = opts.webhookVerificationKey ? normalizeWebhookVerificationKey(opts.webhookVerificationKey) : null;
       }
       opts;
       name = "sendgrid";
       sendRatePerSecond;
       /** Resolved replay window in seconds; `0` means the check is disabled. */
       webhookToleranceSeconds;
+      /** The verification key as PEM, whatever shape it was configured in. */
+      verificationKeyPem;
       async send(args) {
         const msg = {
           to: args.to,
@@ -357,7 +396,7 @@ var init_sendgrid = __esm({
         };
       }
       async verifyWebhook(rawBody, headers) {
-        if (!this.opts.webhookVerificationKey) return false;
+        if (!this.verificationKeyPem) return false;
         const sig = headers[SG_SIG_HEADER];
         const ts = headers[SG_TS_HEADER];
         if (!sig || !ts) return false;
@@ -365,7 +404,7 @@ var init_sendgrid = __esm({
         try {
           const verifier = crypto2.createVerify("sha256");
           verifier.update(payload);
-          if (!verifier.verify(this.opts.webhookVerificationKey, sig, "base64")) return false;
+          if (!verifier.verify(this.verificationKeyPem, sig, "base64")) return false;
         } catch {
           return false;
         }
@@ -1708,11 +1747,20 @@ async function processWebhookBacklog(ctx, opts = {}) {
     }
   }
 }
+async function findSendForEvent(event, ctx) {
+  if (event.providerMessageId) {
+    const byId = await ctx.collections.sends.findOne({ providerMessageId: event.providerMessageId });
+    if (byId) return byId;
+  }
+  if (!event.email) return null;
+  return ctx.collections.sends.findOne({ emailAtSend: event.email, sentAt: { $ne: null } }, { sort: { sentAt: -1 } });
+}
+function webhookEventsForMessageId(providerMessageId) {
+  const escaped = providerMessageId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return { $or: [{ providerMessageId }, { providerMessageId: { $regex: `^${escaped}\\.` } }] };
+}
 async function applyWebhookEvent(event, ctx) {
-  const send = await ctx.collections.sends.findOne(
-    event.providerMessageId ? { $or: [{ providerMessageId: event.providerMessageId }, { emailAtSend: event.email }] } : { emailAtSend: event.email },
-    { sort: { queuedAt: -1 } }
-  );
+  const send = await findSendForEvent(event, ctx);
   switch (event.type) {
     case "delivered":
       if (send) {
@@ -6466,7 +6514,7 @@ function createAdminApiRouter(mailer, opts = {}) {
       if (!ObjectId.isValid(id)) return res.status(400).json({ error: "bad_id" });
       const send = await c.sends.findOne({ _id: new ObjectId(id) });
       if (!send) return res.status(404).json({ error: "not_found" });
-      const events = send.providerMessageId ? await c.webhookEvents.find({ providerMessageId: send.providerMessageId }).sort({ receivedAt: -1 }).limit(100).toArray() : [];
+      const events = send.providerMessageId ? await c.webhookEvents.find(webhookEventsForMessageId(send.providerMessageId)).sort({ receivedAt: -1 }).limit(100).toArray() : [];
       return res.json({ send, webhookEvents: events });
     })
   );
@@ -8205,7 +8253,7 @@ function unitToMs2(value, unit) {
 }
 
 // src/server/api/agent.ts
-var VERSION = "0.16.0" ;
+var VERSION = "0.16.2" ;
 var MIN_AGENT_TOKEN_LENGTH = 24;
 function createAgentRouter(mailer, opts) {
   if (!opts || !Array.isArray(opts.tokens) || opts.tokens.length === 0) {
@@ -8408,7 +8456,7 @@ function createAgentRouter(mailer, opts) {
         if (reached || Date.now() - started >= timeoutMs) break;
         await sleep2(1e3);
       }
-      const webhookEvents = send.providerMessageId ? await c.webhookEvents.find({ providerMessageId: send.providerMessageId }).sort({ receivedAt: 1 }).limit(100).toArray() : [];
+      const webhookEvents = send.providerMessageId ? await c.webhookEvents.find(webhookEventsForMessageId(send.providerMessageId)).sort({ receivedAt: 1 }).limit(100).toArray() : [];
       res.json({ reached, target, waitedMs: Date.now() - started, send: sendSummary(send), webhookEvents });
     })
   );
@@ -9905,7 +9953,7 @@ var DEDUPE_POLICIES = [
 ];
 
 // src/server/index.ts
-var VERSION2 = "0.16.0" ;
+var VERSION2 = "0.16.2" ;
 
 export { DEDUPE_POLICIES, DEFAULT_BOT_UA_RE, FLOW_STEP_KINDS, FlowOperationError, MIN_AGENT_TOKEN_LENGTH, Mailer, MongoContactAdapter, NullProvider, PREDICATE_KINDS, RESERVED_VAR_KEYS, SEGMENT_FILTER_KINDS, SendGridProvider, TRACKING_SIG_LENGTH, VERSION2 as VERSION, applyTracking, applyWebhookEvent, armFlow, compileMailyTemplate, compileTemplate, computeDeliveryTime, createAdminApiRouter, createAdminRouter, createAgentRouter, createPublicRouter, defaultFlowStep, defaultPredicate, defaultSegmentFilter, defineVars, derivePlaintext, disarmFlow, dispatchSend, drainPendingUnsubscribes, ensureIndexes, gateFlow, getCollections, isCanaryGate, predicateKind, processNewlyFiredEventTriggers, processOneRunStep, referencedPaths, renderForContact, renderTemplate, runTick, sendgridInboundParser, sha256Hex, signTrackingToken, signUnsubscribeToken, simulateFlow, stampWatermarkIfNull, sweepStrandedFlowRuns, ungateFlow, validateSenderDomain, varsJsonSchema, verifyTemplate, verifyTrackingToken, verifyUnsubscribeToken };
 //# sourceMappingURL=index.js.map