sadasend 0.0.0-stage → 0.1.0

package/dist/retry.d.ts

@@ -0,0 +1,42 @@
+import { type SadaSendError } from './errors.js';
+/**
+ * When to try again, and how long to wait.
+ *
+ * Two rules, and the second is the one nobody implements:
+ *
+ * 1. **Exponential backoff with full jitter.** Fixed backoff synchronises every
+ *    client that was refused in the same second, so they all return together and
+ *    refuse together — the thundering herd that turns a brief limit into a long
+ *    one. Full jitter (a uniform draw from `[0, backoff]`) spreads them.
+ *
+ * 2. **`Retry-After` wins, always.** The API already sends it — it is the
+ *    server saying exactly when the window rolls over — and until this SDK
+ *    existed nothing read it. A client that guesses shorter makes the limit
+ *    worse; a client that guesses longer makes the customer wait for nothing.
+ *    The header is not advice.
+ */
+export type RetryPolicy = {
+    /** Attempts *after* the first. 0 disables retrying entirely. */
+    maxRetries: number;
+    /** First backoff, doubling each attempt. */
+    baseDelayMs: number;
+    /** Ceiling on the computed backoff. `Retry-After` is not capped by this. */
+    maxDelayMs: number;
+    /**
+     * How long a `Retry-After` may ask us to sleep before the client gives up
+     * and returns the error instead. An account throttled for reputation can be
+     * told to come back in an hour, and blocking a request handler for an hour is
+     * worse than returning an error the caller can schedule around.
+     */
+    maxRetryAfterMs: number;
+};
+export declare const DEFAULT_RETRY: RetryPolicy;
+/**
+ * The wait before attempt `n` (1-based), or `null` for "stop, return the error".
+ *
+ * Split out and pure so the policy can be tested without sleeping — a retry
+ * test that actually waits is a test nobody runs often enough to trust.
+ */
+export declare function delayFor(attempt: number, error: SadaSendError, policy: RetryPolicy, random?: () => number): number | null;
+export declare const sleep: (ms: number) => Promise<void>;
+//# sourceMappingURL=retry.d.ts.map

package/dist/retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.d.ts","sourceRoot":"","sources":["../src/retry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,MAAM,WAAW,GAAG;IACxB,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,WAK3B,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,QAAQ,CACtB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,aAAa,EACpB,MAAM,EAAE,WAAW,EACnB,MAAM,GAAE,MAAM,MAAoB,GACjC,MAAM,GAAG,IAAI,CAcf;AAED,eAAO,MAAM,KAAK,GAAI,IAAI,MAAM,kBAAgD,CAAC"}

package/dist/retry.js

@@ -0,0 +1,30 @@
+import { RateLimitError } from './errors.js';
+export const DEFAULT_RETRY = {
+    maxRetries: 3,
+    baseDelayMs: 500,
+    maxDelayMs: 8_000,
+    maxRetryAfterMs: 60_000,
+};
+/**
+ * The wait before attempt `n` (1-based), or `null` for "stop, return the error".
+ *
+ * Split out and pure so the policy can be tested without sleeping — a retry
+ * test that actually waits is a test nobody runs often enough to trust.
+ */
+export function delayFor(attempt, error, policy, random = Math.random) {
+    if (attempt > policy.maxRetries)
+        return null;
+    if (error instanceof RateLimitError && error.retryAfterSeconds !== undefined) {
+        const asked = error.retryAfterSeconds * 1000;
+        // Longer than we are willing to block: surface the error with the header
+        // intact so the caller can decide, rather than silently sleeping on it.
+        if (asked > policy.maxRetryAfterMs)
+            return null;
+        // Not jittered, and not backed off. The server named a time.
+        return asked;
+    }
+    const backoff = Math.min(policy.baseDelayMs * 2 ** (attempt - 1), policy.maxDelayMs);
+    return Math.floor(random() * backoff);
+}
+export const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+//# sourceMappingURL=retry.js.map

package/dist/retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.js","sourceRoot":"","sources":["../src/retry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAsB,MAAM,aAAa,CAAC;AAmCjE,MAAM,CAAC,MAAM,aAAa,GAAgB;IACxC,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,GAAG;IAChB,UAAU,EAAE,KAAK;IACjB,eAAe,EAAE,MAAM;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CACtB,OAAe,EACf,KAAoB,EACpB,MAAmB,EACnB,SAAuB,IAAI,CAAC,MAAM;IAElC,IAAI,OAAO,GAAG,MAAM,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7C,IAAI,KAAK,YAAY,cAAc,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC7C,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,KAAK,GAAG,MAAM,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAChD,6DAA6D;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACrF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC"}

package/dist/webhooks.d.ts

@@ -0,0 +1,71 @@
+/**
+ * The webhook signature verifier.
+ *
+ * This is the one piece of our security every customer has to reimplement, and
+ * the one most likely to be got subtly wrong — the usual mistakes are comparing
+ * with `===`, forgetting the timestamp is inside the signed material, and
+ * verifying the parsed object instead of the raw body. Shipping it means nobody
+ * has to make them.
+ *
+ * **WebCrypto, not `node:crypto`.** Webhook handlers live on Vercel Edge and
+ * Cloudflare Workers as often as they live on a Node server, and an
+ * unimportable verifier is a verifier those customers write themselves. The
+ * cost is that this is async; the handler already is.
+ */
+/** Matches the server: `t=<unix-seconds>,v1=<hex>`. */
+export declare const SIGNATURE_HEADER = "sadasend-signature";
+/**
+ * Five minutes, matching the server. Without a timestamp in the signed material
+ * a captured request is a permanent credential; with one, it expires.
+ */
+export declare const DEFAULT_TOLERANCE_MS: number;
+export type VerifyOptions = {
+    /** For tests, and for a handler that has its own clock. */
+    atMs?: number;
+    toleranceMs?: number;
+};
+/**
+ * Verify a webhook.
+ *
+ * `body` must be the **raw request body as a string**, byte for byte as it
+ * arrived. `JSON.stringify(await req.json())` is not the same string — key
+ * order and whitespace survive the wire and do not survive a round trip — and
+ * every signature will fail in a way that looks like a wrong secret.
+ *
+ * ```ts
+ * const raw = await req.text();
+ * if (!await verifyWebhook(process.env.SADASEND_WEBHOOK_SECRET!, raw, req.headers.get('sadasend-signature'))) {
+ *   return new Response('bad signature', { status: 400 });
+ * }
+ * const event = JSON.parse(raw);
+ * ```
+ */
+export declare function verifyWebhook(secret: string, body: string, header: string | null | undefined, opts?: VerifyOptions): Promise<boolean>;
+/**
+ * The events an endpoint can subscribe to — all of them, and only them.
+ *
+ * `email.opened` and `email.clicked` were listed here and are not subscribable:
+ * open and click tracking is not shipped, and `POST /webhooks` refuses both by
+ * name. A type that offers an event the API rejects sends the customer to write
+ * a handler for something they cannot receive.
+ */
+export type WebhookEventType = 'email.sent' | 'email.delivered' | 'email.bounced' | 'email.complained' | 'email.refused';
+export type WebhookEvent = {
+    id: string;
+    type: WebhookEventType;
+    createdAt: string;
+    data: {
+        messageId: string;
+        accountId: string;
+        to?: string[];
+        detail?: string;
+    };
+};
+/**
+ * Verify and parse in one call, returning the event or `null`.
+ *
+ * The shape most handlers want, and it makes the dangerous mistake harder: the
+ * raw body goes in, and there is no version of this that takes an object.
+ */
+export declare function parseWebhook(secret: string, body: string, header: string | null | undefined, opts?: VerifyOptions): Promise<WebhookEvent | null>;
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAErD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,QAAa,CAAC;AAE/C,MAAM,MAAM,aAAa,GAAG;IAC1B,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AA0BF;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB,YAAY,GAAG,iBAAiB,GAAG,eAAe,GAClD,kBAAkB,GAAG,eAAe,CAAC;AAEzC,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAChF,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAO9B"}

package/dist/webhooks.js

@@ -0,0 +1,96 @@
+/**
+ * The webhook signature verifier.
+ *
+ * This is the one piece of our security every customer has to reimplement, and
+ * the one most likely to be got subtly wrong — the usual mistakes are comparing
+ * with `===`, forgetting the timestamp is inside the signed material, and
+ * verifying the parsed object instead of the raw body. Shipping it means nobody
+ * has to make them.
+ *
+ * **WebCrypto, not `node:crypto`.** Webhook handlers live on Vercel Edge and
+ * Cloudflare Workers as often as they live on a Node server, and an
+ * unimportable verifier is a verifier those customers write themselves. The
+ * cost is that this is async; the handler already is.
+ */
+const encoder = new TextEncoder();
+/** Matches the server: `t=<unix-seconds>,v1=<hex>`. */
+export const SIGNATURE_HEADER = 'sadasend-signature';
+/**
+ * Five minutes, matching the server. Without a timestamp in the signed material
+ * a captured request is a permanent credential; with one, it expires.
+ */
+export const DEFAULT_TOLERANCE_MS = 5 * 60_000;
+async function hmacHex(secret, data) {
+    const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const sig = await crypto.subtle.sign('HMAC', key, encoder.encode(data));
+    return Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+/**
+ * Constant-time over the *content*.
+ *
+ * `===` on strings exits at the first differing byte, and how long that takes
+ * is enough to build a valid signature a byte at a time. The length is compared
+ * first and separately: both sides here are fixed-length SHA-256 hex, so a
+ * length mismatch is a malformed header rather than a guess in progress, and
+ * leaking that fact costs nothing.
+ */
+function timingSafeEqualHex(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+/**
+ * Verify a webhook.
+ *
+ * `body` must be the **raw request body as a string**, byte for byte as it
+ * arrived. `JSON.stringify(await req.json())` is not the same string — key
+ * order and whitespace survive the wire and do not survive a round trip — and
+ * every signature will fail in a way that looks like a wrong secret.
+ *
+ * ```ts
+ * const raw = await req.text();
+ * if (!await verifyWebhook(process.env.SADASEND_WEBHOOK_SECRET!, raw, req.headers.get('sadasend-signature'))) {
+ *   return new Response('bad signature', { status: 400 });
+ * }
+ * const event = JSON.parse(raw);
+ * ```
+ */
+export async function verifyWebhook(secret, body, header, opts = {}) {
+    if (!header)
+        return false;
+    const { atMs = Date.now(), toleranceMs = DEFAULT_TOLERANCE_MS } = opts;
+    const parts = new Map();
+    for (const part of header.split(',')) {
+        const i = part.indexOf('=');
+        if (i > 0)
+            parts.set(part.slice(0, i).trim(), part.slice(i + 1).trim());
+    }
+    const t = Number(parts.get('t'));
+    const given = parts.get('v1');
+    if (!Number.isFinite(t) || !given)
+        return false;
+    // Checked before the HMAC, so an expired signature costs no crypto at all.
+    if (Math.abs(atMs - t * 1000) > toleranceMs)
+        return false;
+    return timingSafeEqualHex(await hmacHex(secret, `${t}.${body}`), given);
+}
+/**
+ * Verify and parse in one call, returning the event or `null`.
+ *
+ * The shape most handlers want, and it makes the dangerous mistake harder: the
+ * raw body goes in, and there is no version of this that takes an object.
+ */
+export async function parseWebhook(secret, body, header, opts = {}) {
+    if (!await verifyWebhook(secret, body, header, opts))
+        return null;
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,uDAAuD;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,MAAM,CAAC;AAQ/C,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,IAAY;IACjD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAClF,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,IAAY,EACZ,MAAiC,EACjC,OAAsB,EAAE;IAExB,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,EAAE,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,WAAW,GAAG,oBAAoB,EAAE,GAAG,IAAI,CAAC;IAEvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEhD,2EAA2E;IAC3E,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,WAAW;QAAE,OAAO,KAAK,CAAC;IAE1D,OAAO,kBAAkB,CAAC,MAAM,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AAC1E,CAAC;AAqBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,IAAY,EACZ,MAAiC,EACjC,OAAsB,EAAE;IAExB,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,75 @@
 {
   "name": "sadasend",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Official TypeScript/JavaScript SDK for SadaSend. Transactional email with unbypassable server-enforced guardrails for human engineers and autonomous AI agents (Claude, Cursor, MCP). Zero dependencies, native fetch & WebCrypto, automatic idempotency, and constant-time webhook verification.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./webhooks": {
+      "types": "./dist/webhooks.d.ts",
+      "default": "./dist/webhooks.js"
+    }
+  },
+  "files": [
+    "dist",
+    "LICENSE",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "bun test",
+    "test:e2e": "bun test test/e2e.test.ts",
+    "prepublishOnly": "bun run build"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SadaSend/sadasend-sdk-ts.git"
+  },
+  "homepage": "https://sadasend.com",
+  "bugs": {
+    "url": "https://github.com/SadaSend/sadasend-sdk-ts/issues"
+  },
+  "author": "SadaSend <support@sadasend.com>",
+  "keywords": [
+    "sadasend",
+    "email",
+    "transactional-email",
+    "email-api",
+    "ai-agents",
+    "mcp",
+    "model-context-protocol",
+    "claude",
+    "cursor",
+    "langchain",
+    "crewai",
+    "agentic-ai",
+    "smtp",
+    "guardrails",
+    "idempotency",
+    "zero-dependencies",
+    "resend",
+    "sendgrid",
+    "postmark",
+    "webhooks",
+    "typescript"
+  ],
+  "devDependencies": {
+    "@types/bun": "^1.2.0",
+    "typescript": "^5.7.0"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "sideEffects": false,
+  "license": "MIT",
+  "funding": {
+    "type": "individual",
+    "url": "https://sadasend.com/pricing"
+  }
+}