typedmailer 1.1.0 → 1.3.0

package/dist/testing.d.ts

@@ -2,7 +2,7 @@ import type { Mailer, SendMailInput } from './types.js';
 export interface CapturedMail extends SendMailInput {
     readonly from: NonNullable<SendMailInput['from']>;
 }
-export interface TestMailer extends Mailer {
+export interface TestMailer extends Mailer<'test'> {
     readonly sent: CapturedMail[];
     clear(): void;
 }

package/dist/types.d.ts

@@ -1,6 +1,6 @@
 export type MailAddress = string | {
     readonly email: string;
-    readonly name?: string;
+    readonly name?: string | undefined;
 };
 export interface MailAttachment {
     readonly filename: string;
@@ -24,18 +24,29 @@ export interface SendMailInput {
     readonly metadata?: Readonly<Record<string, string>>;
 }
 export type ProviderName = 'resend' | 'brevo' | 'smtp' | 'postmark' | 'sendgrid' | 'mailgun' | 'ses';
-export interface SendMailResult {
-    readonly provider: ProviderName | 'test';
+export interface SendMailResult<TProvider extends string = ProviderName | 'test'> {
+    readonly provider: TProvider;
     readonly messageId: string;
     /** Time when the provider accepted the request. This does not confirm inbox delivery. */
     readonly acceptedAt: Date;
 }
-export interface Mailer {
-    send(input: SendMailInput): Promise<SendMailResult>;
+export interface Mailer<TProvider extends string = ProviderName | 'test'> {
+    send(input: SendMailInput): Promise<SendMailResult<TProvider>>;
     verifyConnection(): Promise<void>;
     /** Rejects new operations, waits for active operations, and closes the provider at most once. */
     close(): Promise<void>;
 }
+export interface ProviderAdapter<TProvider extends string = string> {
+    readonly name: TProvider;
+    send(input: NormalizedMailInput): Promise<ProviderSendResult>;
+    verifyConnection?(): Promise<void>;
+    close?(): Promise<void> | void;
+}
+export interface CustomMailerOptions<TProvider extends string = string> {
+    readonly provider: ProviderAdapter<TProvider>;
+    readonly from: MailAddress;
+    readonly maxAttachmentBytes?: number;
+}
 export interface NormalizedMailInput extends Omit<SendMailInput, 'from' | 'to' | 'cc' | 'bcc' | 'replyTo'> {
     readonly from: MailAddress;
     readonly to: readonly MailAddress[];

package/dist/webhooks/normalize.d.ts

@@ -0,0 +1,6 @@
+import type { EmailWebhookEvent } from './types.js';
+export declare function normalizeResend(payload: unknown): readonly EmailWebhookEvent[];
+export declare function normalizeMailgun(payload: unknown): readonly EmailWebhookEvent[];
+export declare function normalizeSendGrid(payload: unknown): readonly EmailWebhookEvent[];
+export declare function normalizeSes(payload: unknown): readonly EmailWebhookEvent[];
+export declare function normalizeProviderEvents(provider: 'brevo' | 'postmark', payload: unknown): readonly EmailWebhookEvent[];

package/dist/webhooks/normalize.js

@@ -0,0 +1,154 @@
+import { WebhookVerificationError } from './types.js';
+import { asId, asOptionalRecord, asRecord, asString, asStringArray, firstString, isString, parseDate, } from './shared.js';
+export function normalizeResend(payload) {
+    const root = asRecord(payload);
+    const data = asRecord(root.data);
+    return [
+        makeEvent('resend', root, {
+            id: asString(root.id),
+            eventType: asString(root.type),
+            type: mapEventType(asString(root.type)),
+            messageId: asString(data.email_id),
+            recipient: firstString(data.to),
+            occurredAt: parseDate(root.created_at),
+        }),
+    ];
+}
+export function normalizeMailgun(payload) {
+    const root = asRecord(payload);
+    const event = asRecord(root['event-data']);
+    const message = asRecord(event.message);
+    const headers = asRecord(message.headers);
+    const eventName = asString(event.event);
+    return [
+        makeEvent('mailgun', event, {
+            id: asId(event.id),
+            eventType: eventName,
+            type: mapEventType(eventName),
+            messageId: asString(headers['message-id']),
+            recipient: asString(event.recipient),
+            occurredAt: parseDate(event.timestamp),
+        }),
+    ];
+}
+export function normalizeSendGrid(payload) {
+    if (!Array.isArray(payload))
+        throw new WebhookVerificationError('invalid_payload');
+    return payload.map((item) => {
+        const event = asRecord(item);
+        const eventName = asString(event.event);
+        return makeEvent('sendgrid', event, {
+            id: asString(event.sg_event_id),
+            eventType: eventName,
+            type: mapEventType(eventName),
+            messageId: asString(event.sg_message_id),
+            recipient: asString(event.email),
+            occurredAt: parseDate(event.timestamp),
+        });
+    });
+}
+export function normalizeSes(payload) {
+    const message = asRecord(payload);
+    const eventName = asString(message.eventType) ?? asString(message.notificationType);
+    const mail = asRecord(message.mail);
+    const bounce = asOptionalRecord(message.bounce);
+    const complaint = asOptionalRecord(message.complaint);
+    const delivery = asOptionalRecord(message.delivery);
+    const recipients = Array.isArray(bounce?.bouncedRecipients)
+        ? bounce.bouncedRecipients
+        : Array.isArray(complaint?.complainedRecipients)
+            ? complaint.complainedRecipients
+            : [];
+    const to = recipients.map((recipient) => asString(asRecord(recipient).emailAddress)).filter(isString);
+    const emails = to.length > 0 ? to : asStringArray(mail.destination);
+    return emails.length > 0
+        ? emails.map((recipient) => makeEvent('ses', message, {
+            id: asString(message.messageId),
+            eventType: eventName,
+            type: mapEventType(eventName),
+            messageId: asString(mail.messageId),
+            recipient,
+            occurredAt: parseDate(delivery?.timestamp) ?? parseDate(bounce?.timestamp),
+        }))
+        : [
+            makeEvent('ses', message, {
+                id: asString(message.messageId),
+                eventType: eventName,
+                type: mapEventType(eventName),
+                messageId: asString(mail.messageId),
+                occurredAt: parseDate(asRecord(message.delivery).timestamp),
+            }),
+        ];
+}
+export function normalizeProviderEvents(provider, payload) {
+    const items = Array.isArray(payload) ? payload : [payload];
+    return items.map((item) => {
+        const event = asRecord(item);
+        const eventName = provider === 'brevo' ? asString(event.event) : asString(event.RecordType);
+        return makeEvent(provider, event, {
+            id: provider === 'brevo'
+                ? (asId(event.id) ?? asString(event['message-id']))
+                : (asId(event.ID) ?? asString(event.MessageID)),
+            eventType: eventName,
+            type: mapEventType(eventName),
+            messageId: provider === 'brevo' ? asString(event['message-id']) : asString(event.MessageID),
+            recipient: provider === 'brevo' ? asString(event.email) : asString(event.Recipient),
+            occurredAt: parseDate(provider === 'brevo' ? (event.ts_epoch ?? event.date) : (event.DeliveredAt ?? event.BouncedAt)),
+        });
+    });
+}
+function makeEvent(provider, raw, fields) {
+    if (!fields.eventType)
+        throw new WebhookVerificationError('invalid_payload');
+    return {
+        provider,
+        raw,
+        eventType: fields.eventType,
+        type: fields.type,
+        ...(fields.id ? { id: fields.id } : {}),
+        ...(fields.messageId ? { messageId: fields.messageId } : {}),
+        ...(fields.recipient ? { recipient: fields.recipient } : {}),
+        ...(fields.occurredAt ? { occurredAt: fields.occurredAt } : {}),
+    };
+}
+function mapEventType(eventType) {
+    const event = eventType?.toLowerCase().replaceAll(/[._ -]/g, '') ?? '';
+    const mappings = {
+        accepted: 'accepted',
+        sent: 'accepted',
+        request: 'accepted',
+        emailsent: 'accepted',
+        delivery: 'delivered',
+        delivered: 'delivered',
+        emaildelivered: 'delivered',
+        bounce: 'bounced',
+        bounced: 'bounced',
+        emailbounced: 'bounced',
+        hardbounce: 'bounced',
+        softbounce: 'bounced',
+        spamcomplaint: 'complained',
+        complaint: 'complained',
+        complained: 'complained',
+        emailcomplained: 'complained',
+        spamreport: 'complained',
+        deferred: 'delayed',
+        deliverydelayed: 'delayed',
+        deliverydelay: 'delayed',
+        emaildeliverydelayed: 'delayed',
+        open: 'opened',
+        opened: 'opened',
+        emailopened: 'opened',
+        click: 'clicked',
+        clicked: 'clicked',
+        emailclicked: 'clicked',
+        unsubscribed: 'unsubscribed',
+        groupunsubscribe: 'unsubscribed',
+        reject: 'rejected',
+        rejected: 'rejected',
+        dropped: 'failed',
+        failed: 'failed',
+        emailfailed: 'failed',
+        renderingfailure: 'failed',
+    };
+    return mappings[event] ?? 'other';
+}

package/dist/webhooks/shared.d.ts

@@ -0,0 +1,14 @@
+import type { WebhookHeaders } from './types.js';
+export declare function assertRecentTimestamp(value: string | undefined, now: Date | undefined, toleranceSeconds: number | undefined): void;
+export declare function getHeader(headers: WebhookHeaders, name: string): string | undefined;
+export declare function safeEqual(left: Uint8Array, right: Uint8Array): boolean;
+export declare function decodeBase64(value: string): Buffer;
+export declare function decodeHex(value: string): Buffer;
+export declare function parseDate(value: unknown): Date | undefined;
+export declare function asRecord(value: unknown): Record<string, unknown>;
+export declare function asOptionalRecord(value: unknown): Record<string, unknown> | undefined;
+export declare function asString(value: unknown): string | undefined;
+export declare function asId(value: unknown): string | undefined;
+export declare function isString(value: unknown): value is string;
+export declare function asStringArray(value: unknown): string[];
+export declare function firstString(value: unknown): string | undefined;

package/dist/webhooks/shared.js

@@ -0,0 +1,69 @@
+import { timingSafeEqual } from 'node:crypto';
+import { WebhookVerificationError, defaultTimestampToleranceSeconds } from './types.js';
+export function assertRecentTimestamp(value, now, toleranceSeconds) {
+    if (!value || !/^\d+$/.test(value))
+        throw new WebhookVerificationError('invalid_signature');
+    const timestamp = Number(value);
+    const tolerance = toleranceSeconds ?? defaultTimestampToleranceSeconds;
+    if (!Number.isSafeInteger(timestamp) || !Number.isSafeInteger(tolerance) || tolerance < 1) {
+        throw new WebhookVerificationError('invalid_signature');
+    }
+    const seconds = Math.floor((now ?? new Date()).getTime() / 1000);
+    if (Math.abs(seconds - timestamp) > tolerance)
+        throw new WebhookVerificationError('invalid_signature');
+}
+export function getHeader(headers, name) {
+    const entry = Object.entries(headers).find(([key]) => key.toLowerCase() === name.toLowerCase())?.[1];
+    return typeof entry === 'string' ? entry : Array.isArray(entry) ? entry.join(' ') : undefined;
+}
+export function safeEqual(left, right) {
+    return left.byteLength === right.byteLength && timingSafeEqual(left, right);
+}
+export function decodeBase64(value) {
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(value))
+        return Buffer.alloc(0);
+    return Buffer.from(value, 'base64');
+}
+export function decodeHex(value) {
+    if (!/^(?:[a-fA-F0-9]{2})+$/.test(value))
+        return Buffer.alloc(0);
+    return Buffer.from(value, 'hex');
+}
+export function parseDate(value) {
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        const milliseconds = value < 10_000_000_000 ? value * 1000 : value;
+        const result = new Date(milliseconds);
+        return Number.isNaN(result.getTime()) ? undefined : result;
+    }
+    if (typeof value === 'string' && value.length > 0) {
+        const result = new Date(value);
+        return Number.isNaN(result.getTime()) ? undefined : result;
+    }
+    return undefined;
+}
+export function asRecord(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new WebhookVerificationError('invalid_payload');
+    }
+    return value;
+}
+export function asOptionalRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+export function asString(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+export function asId(value) {
+    return typeof value === 'string' || typeof value === 'number' ? String(value) : undefined;
+}
+export function isString(value) {
+    return typeof value === 'string';
+}
+export function asStringArray(value) {
+    return Array.isArray(value) ? value.filter(isString) : [];
+}
+export function firstString(value) {
+    return asString(value) ?? asStringArray(value)[0];
+}

package/dist/webhooks/signatures.d.ts

@@ -0,0 +1,16 @@
+import type { VerifyWebhookInput } from './types.js';
+export declare function verifyResend(input: Extract<VerifyWebhookInput, {
+    provider: 'resend';
+}>, rawBody: Uint8Array): void;
+export declare function verifyMailgun(input: Extract<VerifyWebhookInput, {
+    provider: 'mailgun';
+}>, payload: unknown): void;
+export declare function verifySendGrid(input: Extract<VerifyWebhookInput, {
+    provider: 'sendgrid';
+}>, rawBody: Uint8Array): void;
+export declare function verifyAuthorization(input: Extract<VerifyWebhookInput, {
+    provider: 'brevo' | 'postmark';
+}>, headerName: string): void;
+export declare function verifySnsNotification(input: Extract<VerifyWebhookInput, {
+    provider: 'ses';
+}>, payload: unknown): Promise<unknown>;

package/dist/webhooks/signatures.js

@@ -0,0 +1,159 @@
+import { createHmac, createVerify, X509Certificate } from 'node:crypto';
+import { WebhookVerificationError } from './types.js';
+import { asRecord, asString, assertRecentTimestamp, decodeBase64, decodeHex, getHeader, safeEqual } from './shared.js';
+export function verifyResend(input, rawBody) {
+    const messageId = getHeader(input.headers, 'svix-id');
+    const timestamp = getHeader(input.headers, 'svix-timestamp');
+    const signatures = getHeader(input.headers, 'svix-signature');
+    assertRecentTimestamp(timestamp, input.now, input.toleranceSeconds);
+    if (!messageId || !signatures || !input.webhookSecret.startsWith('whsec_')) {
+        throw new WebhookVerificationError('invalid_signature');
+    }
+    let key;
+    try {
+        key = Buffer.from(input.webhookSecret.slice('whsec_'.length), 'base64');
+    }
+    catch {
+        throw new WebhookVerificationError('invalid_signature');
+    }
+    if (key.length === 0)
+        throw new WebhookVerificationError('invalid_signature');
+    const expected = createHmac('sha256', key).update(`${messageId}.${timestamp}.`).update(rawBody).digest();
+    const matches = signatures
+        .split(' ')
+        .some((item) => item.startsWith('v1,') && safeEqual(expected, decodeBase64(item.slice(3))));
+    if (!matches)
+        throw new WebhookVerificationError('invalid_signature');
+}
+export function verifyMailgun(input, payload) {
+    const root = asRecord(payload);
+    const signature = asRecord(root.signature);
+    const timestamp = asString(signature.timestamp);
+    const token = asString(signature.token);
+    const received = asString(signature.signature);
+    assertRecentTimestamp(timestamp, input.now, input.toleranceSeconds);
+    if (!timestamp || !token || !received || !input.signingKey) {
+        throw new WebhookVerificationError('invalid_signature');
+    }
+    const expected = createHmac('sha256', input.signingKey).update(`${timestamp}${token}`).digest('hex');
+    if (!safeEqual(Buffer.from(expected, 'hex'), decodeHex(received))) {
+        throw new WebhookVerificationError('invalid_signature');
+    }
+}
+export function verifySendGrid(input, rawBody) {
+    const timestamp = getHeader(input.headers, 'x-twilio-email-event-webhook-timestamp');
+    const signature = getHeader(input.headers, 'x-twilio-email-event-webhook-signature');
+    assertRecentTimestamp(timestamp, input.now, input.toleranceSeconds);
+    if (!timestamp || !signature || !input.publicKey)
+        throw new WebhookVerificationError('invalid_signature');
+    try {
+        const verifier = createVerify('sha256');
+        verifier.update(timestamp);
+        verifier.update(rawBody);
+        verifier.end();
+        if (!verifier.verify(input.publicKey, signature, 'base64')) {
+            throw new WebhookVerificationError('invalid_signature');
+        }
+    }
+    catch (error) {
+        if (error instanceof WebhookVerificationError)
+            throw error;
+        throw new WebhookVerificationError('invalid_signature');
+    }
+}
+export function verifyAuthorization(input, headerName) {
+    const received = getHeader(input.headers, headerName);
+    if (!received || !input.authorization || !safeEqual(Buffer.from(received), Buffer.from(input.authorization))) {
+        throw new WebhookVerificationError('invalid_signature');
+    }
+}
+export async function verifySnsNotification(input, payload) {
+    const envelope = asRecord(payload);
+    const topicArn = asString(envelope.TopicArn);
+    const signingCertUrl = asString(envelope.SigningCertURL);
+    const signature = asString(envelope.Signature);
+    const signatureVersion = asString(envelope.SignatureVersion);
+    if (envelope.Type !== 'Notification' ||
+        topicArn !== input.topicArn ||
+        !signingCertUrl ||
+        !signature ||
+        (signatureVersion !== '1' && signatureVersion !== '2')) {
+        throw new WebhookVerificationError('invalid_signature');
+    }
+    let certificateUrl;
+    try {
+        certificateUrl = new URL(signingCertUrl);
+    }
+    catch {
+        throw new WebhookVerificationError('invalid_signature');
+    }
+    const topicMatch = /^arn:(aws|aws-us-gov|aws-cn):sns:([a-z0-9-]+):\d{12}:[^:]+$/.exec(input.topicArn);
+    const expectedHost = topicMatch
+        ? topicMatch[1] === 'aws-cn'
+            ? `sns.${topicMatch[2]}.amazonaws.com.cn`
+            : `sns.${topicMatch[2]}.amazonaws.com`
+        : undefined;
+    if (certificateUrl.protocol !== 'https:' ||
+        certificateUrl.username ||
+        certificateUrl.password ||
+        certificateUrl.port ||
+        certificateUrl.search ||
+        certificateUrl.hash ||
+        certificateUrl.hostname !== expectedHost ||
+        !/^\/SimpleNotificationService-[A-Za-z0-9_-]+\.pem$/.test(certificateUrl.pathname)) {
+        throw new WebhookVerificationError('invalid_signature');
+    }
+    let response;
+    try {
+        response = await fetch(certificateUrl, { redirect: 'error', signal: AbortSignal.timeout(5_000) });
+    }
+    catch {
+        throw new WebhookVerificationError('invalid_signature');
+    }
+    if (!response.ok)
+        throw new WebhookVerificationError('invalid_signature');
+    let certificateBody;
+    try {
+        certificateBody = await response.text();
+    }
+    catch {
+        throw new WebhookVerificationError('invalid_signature');
+    }
+    if (certificateBody.length > 32_768)
+        throw new WebhookVerificationError('invalid_signature');
+    try {
+        const certificate = new X509Certificate(certificateBody);
+        const now = input.now ?? new Date();
+        if (!certificate.subject.split('\n').some((line) => line === 'CN=Amazon SNS') ||
+            now < new Date(certificate.validFrom) ||
+            now > new Date(certificate.validTo)) {
+            throw new WebhookVerificationError('invalid_signature');
+        }
+        const fields = snsFields(envelope);
+        const verifier = createVerify(signatureVersion === '2' ? 'sha256' : 'sha1');
+        verifier.update(fields);
+        verifier.end();
+        if (!verifier.verify(certificate.publicKey, signature, 'base64')) {
+            throw new WebhookVerificationError('invalid_signature');
+        }
+    }
+    catch (error) {
+        if (error instanceof WebhookVerificationError)
+            throw error;
+        throw new WebhookVerificationError('invalid_signature');
+    }
+    try {
+        const message = JSON.parse(asString(envelope.Message) ?? '');
+        return message;
+    }
+    catch {
+        throw new WebhookVerificationError('invalid_payload');
+    }
+}
+function snsFields(envelope) {
+    const fields = ['Message', 'MessageId'];
+    if (envelope.Subject !== undefined)
+        fields.push('Subject');
+    fields.push('Timestamp', 'TopicArn', 'Type');
+    return fields.map((field) => `${field}\n${asString(envelope[field]) ?? ''}\n`).join('');
+}

package/dist/webhooks/types.d.ts

@@ -0,0 +1,44 @@
+export type ProviderName = import('../types.js').ProviderName;
+export type EmailWebhookEventType = 'accepted' | 'delivered' | 'bounced' | 'complained' | 'delayed' | 'opened' | 'clicked' | 'unsubscribed' | 'rejected' | 'failed' | 'other';
+export interface EmailWebhookEvent {
+    readonly provider: Exclude<ProviderName, 'smtp'>;
+    readonly id?: string;
+    readonly type: EmailWebhookEventType;
+    readonly eventType: string;
+    readonly messageId?: string;
+    readonly recipient?: string;
+    readonly occurredAt?: Date;
+    /** Original provider data. It can contain message metadata and personal information. */
+    readonly raw: unknown;
+}
+export type WebhookHeaders = Readonly<Record<string, string | readonly string[] | undefined>>;
+interface RawWebhookInput {
+    readonly rawBody: string | Uint8Array;
+    readonly headers: WebhookHeaders;
+    readonly maxBodyBytes?: number;
+    readonly now?: Date;
+    readonly toleranceSeconds?: number;
+}
+export type VerifyWebhookInput = (RawWebhookInput & {
+    readonly provider: 'resend';
+    readonly webhookSecret: string;
+}) | (RawWebhookInput & {
+    readonly provider: 'mailgun';
+    readonly signingKey: string;
+}) | (RawWebhookInput & {
+    readonly provider: 'sendgrid';
+    readonly publicKey: string;
+}) | (RawWebhookInput & {
+    readonly provider: 'brevo' | 'postmark';
+    readonly authorization: string;
+    readonly authorizationHeader?: string;
+}) | (RawWebhookInput & {
+    readonly provider: 'ses';
+    readonly topicArn: string;
+});
+export declare class WebhookVerificationError extends Error {
+    readonly code: 'invalid_signature' | 'invalid_payload' | 'unsupported_event';
+    constructor(code: 'invalid_signature' | 'invalid_payload' | 'unsupported_event');
+}
+export declare const defaultTimestampToleranceSeconds = 300;
+export {};

package/dist/webhooks/types.js

@@ -0,0 +1,13 @@
+export class WebhookVerificationError extends Error {
+    code;
+    constructor(code) {
+        super(code === 'invalid_signature'
+            ? 'The webhook request could not be authenticated.'
+            : code === 'unsupported_event'
+                ? 'The provider webhook event is not supported.'
+                : 'The provider webhook payload is invalid.');
+        this.code = code;
+        this.name = 'WebhookVerificationError';
+    }
+}
+export const defaultTimestampToleranceSeconds = 300;

package/dist/webhooks.d.ts

@@ -1,44 +1,5 @@
-import type { ProviderName } from './types.js';
-export type EmailWebhookEventType = 'accepted' | 'delivered' | 'bounced' | 'complained' | 'delayed' | 'opened' | 'clicked' | 'unsubscribed' | 'rejected' | 'failed' | 'other';
-export interface EmailWebhookEvent {
-    readonly provider: Exclude<ProviderName, 'smtp'>;
-    readonly id?: string;
-    readonly type: EmailWebhookEventType;
-    readonly eventType: string;
-    readonly messageId?: string;
-    readonly recipient?: string;
-    readonly occurredAt?: Date;
-    /** Original provider data. It can contain message metadata and personal information. */
-    readonly raw: unknown;
-}
-export type WebhookHeaders = Readonly<Record<string, string | readonly string[] | undefined>>;
-interface RawWebhookInput {
-    readonly rawBody: string | Uint8Array;
-    readonly headers: WebhookHeaders;
-    readonly now?: Date;
-    readonly toleranceSeconds?: number;
-}
-export type VerifyWebhookInput = (RawWebhookInput & {
-    readonly provider: 'resend';
-    readonly webhookSecret: string;
-}) | (RawWebhookInput & {
-    readonly provider: 'mailgun';
-    readonly signingKey: string;
-}) | (RawWebhookInput & {
-    readonly provider: 'sendgrid';
-    readonly publicKey: string;
-}) | (RawWebhookInput & {
-    readonly provider: 'brevo' | 'postmark';
-    readonly authorization: string;
-    readonly authorizationHeader?: string;
-}) | (RawWebhookInput & {
-    readonly provider: 'ses';
-    readonly topicArn: string;
-});
-export declare class WebhookVerificationError extends Error {
-    readonly code: 'invalid_signature' | 'invalid_payload' | 'unsupported_event';
-    constructor(code: 'invalid_signature' | 'invalid_payload' | 'unsupported_event');
-}
+import type { EmailWebhookEvent, VerifyWebhookInput } from './webhooks/types.js';
+export type { EmailWebhookEvent, EmailWebhookEventType, VerifyWebhookInput, WebhookHeaders } from './webhooks/types.js';
+export { WebhookVerificationError } from './webhooks/types.js';
 /** Authenticates a provider webhook before returning normalized, typed email events. */
 export declare function verifyWebhook(input: VerifyWebhookInput): Promise<readonly EmailWebhookEvent[]>;
-export {};