Evolve Inbox developer kit

Install and run

Client 0.3.0 · Node 22+ · dependency-free · downloadable npm-compatible tarball

npm install https://www.evolvetech.dev/developers/downloads/evolve-inbox-client-0.3.0.tgz
npx evolve-inbox --demo list

This release is a versioned tarball, not a package published to the npm registry. The offline CLI needs no account or server. Its messages use reserved example domains.

Try the client here

These controls use the packaged Fetch client with fictional responses. They make no mailbox API requests and cannot access or modify the private EvolveTech inbox.

Use it from JavaScript or TypeScript

import { createDemoClient } from 'evolve-inbox-client/demo';

const inbox = createDemoClient();
const messages = await inbox.list();
console.log(messages.map(message => message.subject));

The package includes TypeScript declarations. Live access uses createClient({ site, password }) from evolve-inbox-client. Set credentials on your server through the environment; keep them out of public browser bundles and committed code. Browser access to the live inbox is same-origin.

API and failure behavior

Each method accepts { signal }. Requests have a timeout, refuse redirects and use a Bearer header. There are no automatic retries. InboxError carries a stable code, HTTP status and an optional retryAfter in seconds. Treat a lost deletion response as an uncertain outcome. The client parses JSON but does not fully validate an untrusted response schema.

Operate your own inbox

The CLI reads MAIL_SITE and MAIL_PASSWORD from its process environment. It accepts status, list and get ID, returns JSON, and exits nonzero on failure. Credentials are not accepted as command-line flags. Live list/get output contains private mail; keep it out of public logs.

Full client contract → · Deploy and verify delivery →

Security and test evidence

The server already has shared authentication throttling, credential-rotation grace deadlines, audit events that omit message content, and conditional index writes for concurrent deliveries. It is a single-owner inbox with a shared credential. Scoped per-agent keys and tenant isolation are not implemented.

Threat model and failure cases → · Fresh-install and offline CLI tests → · Continuous integration →

Download checksums and source commits →