@benclmnt/postmock 0.0.1

package/dist/src/api/messages/routes.js

@@ -0,0 +1,203 @@
+import { apiError } from "../../errors.js";
+import { paged, Unsupported } from "../../http/respond.js";
+import { defineRoute } from "../../http/routes.js";
+import { parseAddressList } from "../../pipeline/addresses.js";
+import { recipientsOf } from "../../recipients/transitions.js";
+import { findStream } from "../../state/servers.js";
+import { clickJson, inboundDetailsJson, inboundJson, openJson, outboundDetailsJson, outboundJson, } from "./json.js";
+import { dateRange, paging, retained, sameText, status } from "./query.js";
+const newestFirst = (items) => items.sort((a, b) => b.ReceivedAt.getTime() - a.ReceivedAt.getTime());
+// 701 is a summary row; the SDK live test expects "not found" in the text
+// (sdk/postmark.js/test/integration/Messages.test.ts:43-47). The exact text is INFERRED.
+const notFound = () => apiError(701, { message: "This message was not found." });
+/** An optional filter; each present value must match. */
+const filter = (query, name, matches) => {
+    const value = query.get(name);
+    return value === undefined || matches(value);
+};
+// Subject matches as a substring without case: the dotnet live test asserts that shape
+// (sdk/postmark-dotnet/src/Postmark.Tests/ClientMessageSearchingTests.cs:38-41). INFERRED otherwise.
+const subjectMatches = (subject, wanted) => (subject ?? "").toLowerCase().includes(wanted.toLowerCase());
+const OUTBOUND_STATUS = {
+    queued: ["Queued"],
+    // "sent and processed will return the same results" (refs/api_messages-api.md:39).
+    sent: ["Sent", "Processed"],
+    processed: ["Sent", "Processed"],
+};
+/**
+ * `messagestream`, default `outbound` (refs/api_messages-api.md:43, :634, :853). Postmark's answer
+ * for a stream the server lacks is not documented.
+ */
+function knownStream({ store, auth, query }) {
+    const stream = query.get("messagestream") ?? "outbound";
+    if (findStream(store.state, auth, stream) === undefined) {
+        throw new Unsupported(`messagestream '${stream}' does not exist on this server`);
+    }
+    return stream;
+}
+function outboundMessage({ store, clock, auth, params }) {
+    const message = store.state.outbound.get(params.id);
+    if (message === undefined ||
+        message.ServerID !== auth.server.ID ||
+        !retained(message.ReceivedAt, clock.now())) {
+        throw notFound();
+    }
+    return message;
+}
+defineRoute({
+    method: "GET",
+    path: "/messages/outbound",
+    auth: "server",
+    handler: (ctx) => {
+        const { store, clock, auth, query } = ctx;
+        const { count, offset } = paging(query);
+        const inRange = dateRange(query);
+        const statuses = status(query, OUTBOUND_STATUS);
+        const stream = knownStream(ctx);
+        const metadata = Object.entries(query.prefixed("metadata_"));
+        // "You can currently only search by a single metadata field at a time"
+        // (refs/api_messages-api.md:44). Postmark's answer to two is not known.
+        if (metadata.length > 1)
+            throw new Unsupported("more than one metadata_ filter");
+        const now = clock.now();
+        const matches = [...store.state.outbound.values()].filter((m) => m.ServerID === auth.server.ID &&
+            m.MessageStream === stream &&
+            retained(m.ReceivedAt, now) &&
+            inRange(m.ReceivedAt) &&
+            (statuses === undefined || statuses.includes(m.Status)) &&
+            filter(query, "recipient", (v) => recipientsOf(m).some((r) => sameText(r, v))) &&
+            filter(query, "fromemail", (v) => sameText(parseAddressList(m.From)?.[0]?.Email, v)) &&
+            filter(query, "tag", (v) => m.Tag === v) &&
+            filter(query, "subject", (v) => subjectMatches(m.Subject, v)) &&
+            metadata.every(([key, value]) => m.Metadata[key] === value));
+        return paged("Messages", newestFirst(matches).map(outboundJson), count, offset);
+    },
+});
+defineRoute({
+    method: "GET",
+    path: "/messages/outbound/:id/details",
+    auth: "server",
+    handler: (ctx) => outboundDetailsJson(outboundMessage(ctx)),
+});
+defineRoute({
+    method: "GET",
+    path: "/messages/outbound/:id/dump",
+    auth: "server",
+    handler: (ctx) => ({ Body: outboundMessage(ctx).rawSource }),
+});
+const INBOUND_STATUS = {
+    blocked: ["Blocked"],
+    processed: ["Processed"],
+    queued: ["Queued"],
+    failed: ["Failed"],
+    scheduled: ["Scheduled"],
+    // postmark.js sends `sent` (sdk/postmark.js/src/client/models/messages/MessageFilteringParameters.ts:9-16).
+    sent: ["Sent"],
+};
+function inboundMessage({ store, clock, auth, params }) {
+    const message = store.state.inbound.get(params.id);
+    if (message === undefined ||
+        message.ServerID !== auth.server.ID ||
+        !retained(message.ReceivedAt, clock.now())) {
+        throw notFound();
+    }
+    return message;
+}
+defineRoute({
+    method: "GET",
+    path: "/messages/inbound",
+    auth: "server",
+    handler: ({ store, clock, auth, query }) => {
+        const { count, offset } = paging(query);
+        const inRange = dateRange(query);
+        // "if no status is specified, only processed messages are returned" (refs/api_messages-api.md:315).
+        const statuses = status(query, INBOUND_STATUS) ?? ["Processed"];
+        const now = clock.now();
+        const matches = [...store.state.inbound.values()].filter((m) => m.ServerID === auth.server.ID &&
+            retained(m.ReceivedAt, now) &&
+            inRange(m.ReceivedAt) &&
+            statuses.includes(m.Status) &&
+            filter(query, "recipient", (v) => [
+                m.OriginalRecipient,
+                ...[...m.ToFull, ...m.CcFull, ...m.BccFull].map((a) => a.Email),
+            ].some((r) => sameText(r, v))) &&
+            filter(query, "fromemail", (v) => sameText(m.FromFull.Email, v)) &&
+            filter(query, "tag", (v) => m.Tag === v) &&
+            filter(query, "subject", (v) => subjectMatches(m.Subject, v)) &&
+            filter(query, "mailboxhash", (v) => m.MailboxHash === v));
+        return paged("InboundMessages", newestFirst(matches).map(inboundJson), count, offset);
+    },
+});
+defineRoute({
+    method: "GET",
+    path: "/messages/inbound/:id/details",
+    auth: "server",
+    handler: (ctx) => inboundDetailsJson(inboundMessage(ctx)),
+});
+// Opens and clicks (refs/api_messages-api.md:626-653, :835-853). Filter values match without case
+// (INFERRED, docs/06 Q10).
+function trackingFilters(ctx, events) {
+    const { query, auth, clock } = ctx;
+    const stream = knownStream(ctx);
+    const now = clock.now();
+    return events.filter((e) => e.ServerID === auth.server.ID &&
+        e.MessageStream === stream &&
+        retained(e.ReceivedAt, now) &&
+        filter(query, "recipient", (v) => sameText(e.Recipient, v)) &&
+        filter(query, "tag", (v) => e.Tag === v) &&
+        filter(query, "client_name", (v) => sameText(e.Client?.Name, v)) &&
+        filter(query, "client_company", (v) => sameText(e.Client?.Company, v)) &&
+        filter(query, "client_family", (v) => sameText(e.Client?.Family, v)) &&
+        filter(query, "os_name", (v) => sameText(e.OS?.Name, v)) &&
+        filter(query, "os_family", (v) => sameText(e.OS?.Family, v)) &&
+        filter(query, "os_company", (v) => sameText(e.OS?.Company, v)) &&
+        filter(query, "platform", (v) => sameText(e.Platform, v)) &&
+        filter(query, "country", (v) => sameText(e.Geo?.Country, v)) &&
+        filter(query, "region", (v) => sameText(e.Geo?.Region, v)) &&
+        filter(query, "city", (v) => sameText(e.Geo?.City, v)));
+}
+/** Events of one message. Single-message reads take only `count` and `offset` (docs/06 §1.7). */
+function ofMessage(ctx, events) {
+    const message = outboundMessage(ctx);
+    return events.filter((e) => e.MessageID === message.MessageID);
+}
+defineRoute({
+    method: "GET",
+    path: "/messages/outbound/opens",
+    auth: "server",
+    handler: (ctx) => {
+        const { count, offset } = paging(ctx.query);
+        const opens = newestFirst(trackingFilters(ctx, [...ctx.store.state.opens]));
+        return paged("Opens", opens.map((o) => openJson(o, false)), count, offset);
+    },
+});
+defineRoute({
+    method: "GET",
+    path: "/messages/outbound/opens/:id",
+    auth: "server",
+    handler: (ctx) => {
+        const { count, offset } = paging(ctx.query);
+        const opens = newestFirst(ofMessage(ctx, ctx.store.state.opens));
+        return paged("Opens", opens.map((o) => openJson(o, true)), count, offset);
+    },
+});
+defineRoute({
+    method: "GET",
+    path: "/messages/outbound/clicks",
+    auth: "server",
+    handler: (ctx) => {
+        const { count, offset } = paging(ctx.query);
+        const clicks = newestFirst(trackingFilters(ctx, [...ctx.store.state.clicks]));
+        return paged("Clicks", clicks.map((c) => clickJson(c, false)), count, offset);
+    },
+});
+defineRoute({
+    method: "GET",
+    path: "/messages/outbound/clicks/:id",
+    auth: "server",
+    handler: (ctx) => {
+        const { count, offset } = paging(ctx.query);
+        const clicks = newestFirst(ofMessage(ctx, ctx.store.state.clicks));
+        return paged("Clicks", clicks.map((c) => clickJson(c, true)), count, offset);
+    },
+});

package/dist/src/api/server/json.d.ts

@@ -0,0 +1,26 @@
+import type { Server } from "../../state/types.ts";
+/** The server object of `GET /server` and the Servers API, in doc field order (docs/06 §4.1). */
+export declare const serverJson: (s: Server) => {
+    ID: number;
+    Name: string;
+    ApiTokens: string[];
+    Color: "blue" | "green" | "grey" | "orange" | "purple" | "red" | "turquoise" | "yellow";
+    SmtpApiActivated: boolean;
+    RawEmailEnabled: boolean;
+    DeliveryType: "Live" | "Sandbox";
+    ServerLink: string;
+    InboundAddress: string;
+    InboundHookUrl: string;
+    BounceHookUrl: string;
+    OpenHookUrl: string;
+    DeliveryHookUrl: string;
+    PostFirstOpenOnly: boolean;
+    InboundDomain: string;
+    InboundHash: string;
+    InboundSpamThreshold: number;
+    TrackOpens: boolean;
+    TrackLinks: import("../../state/types.ts").TrackLinks;
+    IncludeBounceContentInHook: boolean;
+    ClickHookUrl: string;
+    EnableSmtpApiErrorHooks: boolean;
+};

package/dist/src/api/server/json.js

@@ -0,0 +1,25 @@
+/** The server object of `GET /server` and the Servers API, in doc field order (docs/06 §4.1). */
+export const serverJson = (s) => ({
+    ID: s.ID,
+    Name: s.Name,
+    ApiTokens: s.ApiTokens,
+    Color: s.Color,
+    SmtpApiActivated: s.SmtpApiActivated,
+    RawEmailEnabled: s.RawEmailEnabled,
+    DeliveryType: s.DeliveryType,
+    ServerLink: s.ServerLink,
+    InboundAddress: s.InboundAddress,
+    InboundHookUrl: s.InboundHookUrl,
+    BounceHookUrl: s.BounceHookUrl,
+    OpenHookUrl: s.OpenHookUrl,
+    DeliveryHookUrl: s.DeliveryHookUrl,
+    PostFirstOpenOnly: s.PostFirstOpenOnly,
+    InboundDomain: s.InboundDomain,
+    InboundHash: s.InboundHash,
+    InboundSpamThreshold: s.InboundSpamThreshold,
+    TrackOpens: s.TrackOpens,
+    TrackLinks: s.TrackLinks,
+    IncludeBounceContentInHook: s.IncludeBounceContentInHook,
+    ClickHookUrl: s.ClickHookUrl,
+    EnableSmtpApiErrorHooks: s.EnableSmtpApiErrorHooks,
+});

package/dist/src/api/server/routes.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/api/server/routes.js

@@ -0,0 +1,17 @@
+import { defineRoute } from "../../http/routes.js";
+import { editServer } from "../account/servers.js";
+import { serverJson } from "./json.js";
+// refs/api_server-api.md:10-80 (docs/06 §4.1). `PUT /server` below.
+defineRoute({
+    method: "GET",
+    path: "/server",
+    auth: "server",
+    handler: ({ auth }) => serverJson(auth.server),
+});
+// refs/api_server-api.md:93-200 (docs/06 §4.1). The Servers API edit takes the same body.
+defineRoute({
+    method: "PUT",
+    path: "/server",
+    auth: "server",
+    handler: ({ store, body, auth }) => serverJson(editServer(store.state, auth.server, body)),
+});

package/dist/src/api/stats/aggregate.d.ts

@@ -0,0 +1,58 @@
+import type { StatsFact } from "../../state/types.ts";
+type Fact<K extends StatsFact["kind"]> = Extract<StatsFact, {
+    kind: K;
+}>;
+export type Count = {
+    at: Date;
+    key: string;
+};
+export declare const ofKind: <K extends StatsFact["kind"]>(facts: StatsFact[], kind: K) => Fact<K>[];
+/** `{Days: [{Date, <key>: n}], <key>: total}`, days ascending. */
+export declare function series(counts: Count[], documentedKeys: readonly string[]): {
+    Days: {
+        Date: string;
+    }[];
+};
+export declare const uniqueOpens: (facts: StatsFact[]) => ({
+    ServerID: number;
+    MessageStream: string;
+    Tag: string | null;
+    at: Date;
+} & {
+    kind: "open";
+    MessageID: string;
+    Recipient: string;
+    first: boolean;
+    platform: import("../../state/types.ts").OpenEvent["Platform"];
+    client: string | null;
+    readSeconds: number;
+})[];
+export declare const opensCounts: (facts: StatsFact[]) => Count[];
+export declare const clicksCounts: (facts: StatsFact[]) => Count[];
+/**
+ * `/stats/outbound` (refs/api_stats-api.md:43-83). The example's arithmetic gives the rules:
+ * `Bounced` is hard + soft + transient without SMTP API errors (64 = 12 + 36 + 16, :209-232), and
+ * rates are percentages of `Sent` cut to 3 decimals (10.406 = 64 / 615). `WithReadTimeRecorded` comes
+ * from the SDK models (sdk/postmark.js/src/client/models/stats/Stats.ts:18). The `With*Recorded`
+ * keys count unique opens (INFERRED).
+ */
+export declare function overview(facts: StatsFact[]): {
+    Sent: number;
+    Bounced: number;
+    SMTPApiErrors: number;
+    BounceRate: number;
+    SpamComplaints: number;
+    SpamComplaintsRate: number;
+    Opens: number;
+    UniqueOpens: number;
+    Tracked: number;
+    WithLinkTracking: number;
+    WithOpenTracking: number;
+    TotalTrackedLinksSent: number;
+    UniqueLinksClicked: number;
+    TotalClicks: number;
+    WithClientRecorded: number;
+    WithPlatformRecorded: number;
+    WithReadTimeRecorded: number;
+};
+export {};

package/dist/src/api/stats/aggregate.js

@@ -0,0 +1,66 @@
+import { formatEasternDate } from "../../time.js";
+export const ofKind = (facts, kind) => facts.filter((f) => f.kind === kind);
+/** `{Days: [{Date, <key>: n}], <key>: total}`, days ascending. */
+export function series(counts, documentedKeys) {
+    const days = new Map();
+    const totals = new Map(documentedKeys.map((k) => [k, 0]));
+    for (const { at, key } of counts) {
+        const date = formatEasternDate(at);
+        const day = days.get(date) ?? new Map();
+        days.set(date, day);
+        day.set(key, (day.get(key) ?? 0) + 1);
+        totals.set(key, (totals.get(key) ?? 0) + 1);
+    }
+    return {
+        Days: [...days.keys()].sort().map((date) => ({
+            Date: date,
+            ...Object.fromEntries(days.get(date)),
+        })),
+        ...Object.fromEntries(totals),
+    };
+}
+// "Unique" opens are per recipient per message; unique clicks per recipient, message and link
+// (refs/api_stats-api.md:419, :648). A unique counts on the day of the first event ever, so a range
+// that starts after it has none (INFERRED).
+export const uniqueOpens = (facts) => ofKind(facts, "open").filter((o) => o.first);
+const withUnique = (facts, key) => facts.flatMap((f) => [{ at: f.at, key }, ...(f.first ? [{ at: f.at, key: "Unique" }] : [])]);
+export const opensCounts = (facts) => withUnique(ofKind(facts, "open"), "Opens");
+export const clicksCounts = (facts) => withUnique(ofKind(facts, "click"), "Clicks");
+// Truncated, not rounded: 64 / 615 is 10.4065 and the doc shows 10.406.
+const rate = (part, whole) => whole === 0 ? 0 : Math.floor((part * 100_000) / whole) / 1000;
+/**
+ * `/stats/outbound` (refs/api_stats-api.md:43-83). The example's arithmetic gives the rules:
+ * `Bounced` is hard + soft + transient without SMTP API errors (64 = 12 + 36 + 16, :209-232), and
+ * rates are percentages of `Sent` cut to 3 decimals (10.406 = 64 / 615). `WithReadTimeRecorded` comes
+ * from the SDK models (sdk/postmark.js/src/client/models/stats/Stats.ts:18). The `With*Recorded`
+ * keys count unique opens (INFERRED).
+ */
+export function overview(facts) {
+    const sent = ofKind(facts, "sent");
+    const bounces = ofKind(facts, "bounce");
+    const Sent = sent.length;
+    const Bounced = bounces.filter((b) => b.type !== "SMTPApiError").length;
+    const SpamComplaints = ofKind(facts, "spamComplaint").length;
+    const opens = uniqueOpens(facts);
+    const clicks = clicksCounts(facts);
+    return {
+        Sent,
+        Bounced,
+        SMTPApiErrors: bounces.length - Bounced,
+        BounceRate: rate(Bounced, Sent),
+        SpamComplaints,
+        SpamComplaintsRate: rate(SpamComplaints, Sent),
+        Opens: ofKind(facts, "open").length,
+        UniqueOpens: opens.length,
+        Tracked: sent.filter((s) => s.openTracking || s.linkTracking).length,
+        WithLinkTracking: sent.filter((s) => s.linkTracking).length,
+        WithOpenTracking: sent.filter((s) => s.openTracking).length,
+        TotalTrackedLinksSent: sent.reduce((sum, s) => sum + s.trackedLinks, 0),
+        UniqueLinksClicked: clicks.filter((c) => c.key === "Unique").length,
+        TotalClicks: clicks.filter((c) => c.key === "Clicks").length,
+        WithClientRecorded: opens.filter((o) => o.client !== null).length,
+        WithPlatformRecorded: opens.filter((o) => o.platform !== null && o.platform !== "Unknown")
+            .length,
+        WithReadTimeRecorded: opens.filter((o) => o.readSeconds > 0).length,
+    };
+}

package/dist/src/api/stats/routes.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/api/stats/routes.js

@@ -0,0 +1,72 @@
+import { apiError } from "../../errors.js";
+import { parseQueryDate } from "../../http/normalize.js";
+import { defineRoute } from "../../http/routes.js";
+import { findStream } from "../../state/servers.js";
+import { formatEasternDate } from "../../time.js";
+import { clicksCounts, ofKind, opensCounts, overview, series, uniqueOpens, } from "./aggregate.js";
+/**
+ * The server's facts that pass `tag`, `messagestream` (default: every stream) and the inclusive
+ * Eastern `fromdate`/`todate` days (refs/api_stats-api.md:34-37). Errors: refs/api_overview.md:197-201.
+ */
+function facts({ store, clock, auth, query }) {
+    const day = (name) => {
+        const raw = query.get(name);
+        if (raw === undefined)
+            return undefined;
+        const parsed = parseQueryDate(raw);
+        if (parsed === undefined)
+            throw apiError(900, { family: "stats" });
+        return formatEasternDate(parsed.instant);
+    };
+    const from = day("fromdate");
+    const to = day("todate");
+    const yearAgo = clock.now();
+    yearAgo.setUTCFullYear(yearAgo.getUTCFullYear() - 1);
+    if (from !== undefined && from < formatEasternDate(yearAgo)) {
+        throw apiError(1500, { family: "stats" });
+    }
+    if (from !== undefined && to !== undefined && from > to) {
+        throw apiError(1502, { family: "stats" });
+    }
+    const stream = query.get("messagestream");
+    if (stream !== undefined && findStream(store.state, auth, stream) === undefined) {
+        throw apiError(1226, { family: "stats" });
+    }
+    const tag = query.get("tag");
+    return store.state.stats.filter((f) => {
+        const date = formatEasternDate(f.at);
+        return (f.ServerID === auth.server.ID &&
+            (stream === undefined || f.MessageStream === stream) &&
+            (tag === undefined || f.Tag === tag) &&
+            (from === undefined || date >= from) &&
+            (to === undefined || date <= to));
+    });
+}
+const stat = (path, body) => defineRoute({
+    method: "GET",
+    path: `/stats/outbound${path}`,
+    auth: "server",
+    handler: (ctx) => body(facts(ctx)),
+});
+const each = (facts, key) => facts.flatMap((f) => {
+    const k = key(f);
+    return k === null ? [] : [{ at: f.at, key: k }];
+});
+stat("", overview);
+stat("/sends", (f) => series(each(ofKind(f, "sent"), () => "Sent"), ["Sent"]));
+stat("/bounces", (f) => series(each(ofKind(f, "bounce"), (b) => b.type), ["HardBounce", "SMTPApiError", "SoftBounce", "Transient"]));
+stat("/spam", (f) => series(each(ofKind(f, "spamComplaint"), () => "SpamComplaint"), ["SpamComplaint"]));
+stat("/tracked", (f) => series(each(ofKind(f, "sent"), (s) => (s.openTracking || s.linkTracking ? "Tracked" : null)), ["Tracked"]));
+stat("/opens", (f) => series(opensCounts(f), ["Opens", "Unique"]));
+// Platforms and email clients count unique opens; an open without a platform is `Unknown`
+// (INFERRED from "users that opened", refs/api_stats-api.md:500-503).
+stat("/opens/platforms", (f) => series(each(uniqueOpens(f), (o) => o.platform ?? "Unknown"), ["Desktop", "Mobile", "Unknown", "WebMail"]));
+stat("/opens/emailclients", (f) => series(each(uniqueOpens(f), (o) => o.client), []));
+// No doc gives this body. Its shape comes from the SDK clients (docs/06 §2.2). No source names the
+// buckets: postmock keys each unique open with a read time by its whole seconds, "5" (INFERRED).
+stat("/opens/readtimes", (f) => series(each(uniqueOpens(f), (o) => (o.readSeconds > 0 ? String(o.readSeconds) : null)), []));
+stat("/clicks", (f) => series(clicksCounts(f), ["Clicks", "Unique"]));
+// Browser, platform and location keys count every click (refs/api_stats-api.md:729, :800-802).
+stat("/clicks/browserfamilies", (f) => series(each(ofKind(f, "click"), (c) => c.browser), []));
+stat("/clicks/platforms", (f) => series(each(ofKind(f, "click"), (c) => c.platform ?? "Unknown"), ["Desktop", "Mobile", "Unknown"]));
+stat("/clicks/location", (f) => series(each(ofKind(f, "click"), (c) => c.location), ["HTML", "Text"]));

package/dist/src/api/suppressions/routes.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/api/suppressions/routes.js

@@ -0,0 +1,98 @@
+import { z } from "zod";
+import { apiError } from "../../errors.js";
+import { inclusiveUpperBound, parseBody, queryDate } from "../../http/normalize.js";
+import { Unsupported } from "../../http/respond.js";
+import { defineRoute } from "../../http/routes.js";
+import { deleteSuppression, suppressByCustomer, } from "../../recipients/transitions.js";
+import { formatTimestamp } from "../../time.js";
+import { liveStream } from "../message-streams/streams.js";
+/** The path stream, or 1226. Archived and inbound streams are not captured (Q15). */
+function streamOf(ctx) {
+    const stream = liveStream(ctx.store.state, ctx.auth.server.ID, ctx.params.stream);
+    if (stream.ArchivedAt !== null) {
+        throw new Unsupported("suppressions of an archived stream: not captured (docs/04 Q15)");
+    }
+    if (stream.MessageStreamType === "Inbound") {
+        throw new Unsupported("suppressions of an inbound stream: not captured");
+    }
+    return stream;
+}
+const REASONS = ["HardBounce", "SpamComplaint", "ManualSuppression"];
+const ORIGINS = ["Recipient", "Customer", "Admin"];
+const dumpQuery = z.object({
+    SuppressionReason: z.string().optional(),
+    Origin: z.string().optional(),
+    fromdate: queryDate.optional(),
+    todate: queryDate.optional(),
+    EmailAddress: z.string().optional(),
+});
+defineRoute({
+    method: "GET",
+    path: "/message-streams/:stream/suppressions/dump",
+    auth: "server",
+    handler: (ctx) => {
+        const stream = streamOf(ctx);
+        const parsed = ctx.query.pick(dumpQuery);
+        if (!parsed.success)
+            throw new Unsupported("invalid suppression dump date: error not captured");
+        const q = parsed.data;
+        // Enum values match with case kept (INFERRED); count and offset are ignored (docs/04 §2.2).
+        if (q.SuppressionReason !== undefined &&
+            !REASONS.includes(q.SuppressionReason)) {
+            throw apiError(1404);
+        }
+        if (q.Origin !== undefined && !ORIGINS.includes(q.Origin)) {
+            throw apiError(1405);
+        }
+        const from = q.fromdate?.instant.getTime();
+        const to = q.todate && inclusiveUpperBound(q.todate).getTime();
+        const rows = [...ctx.store.state.suppressions.values()].filter((s) => s.ServerID === stream.ServerID &&
+            s.MessageStream === stream.ID &&
+            (q.SuppressionReason === undefined || s.SuppressionReason === q.SuppressionReason) &&
+            (q.Origin === undefined || s.Origin === q.Origin) &&
+            (from === undefined || s.CreatedAt.getTime() >= from) &&
+            (to === undefined || s.CreatedAt.getTime() < to) &&
+            // Exact match without case (INFERRED, Q5).
+            (q.EmailAddress === undefined ||
+                s.EmailAddress.toLowerCase() === q.EmailAddress.toLowerCase()));
+        return {
+            Suppressions: rows.map((s) => ({
+                EmailAddress: s.EmailAddress,
+                SuppressionReason: s.SuppressionReason,
+                Origin: s.Origin,
+                CreatedAt: formatTimestamp(s.CreatedAt),
+            })),
+        };
+    },
+});
+const MAX_ITEMS = 50; // refs/api_suppressions-api.md:114
+const changeBody = z.object({
+    Suppressions: z.array(z.object({ EmailAddress: z.string() })),
+});
+/** Applies one change per item, in request order (docs/04 §2.4). */
+async function changeAll(ctx, change) {
+    const stream = streamOf(ctx);
+    const parsed = parseBody(changeBody, ctx.body);
+    if (!parsed.success)
+        throw apiError(1409);
+    const items = parsed.data.Suppressions;
+    if (items.length > MAX_ITEMS)
+        throw apiError(1410);
+    const Suppressions = [];
+    for (const { EmailAddress } of items) {
+        Suppressions.push(await change(ctx, stream.ServerID, stream.ID, EmailAddress));
+    }
+    return { Suppressions };
+}
+defineRoute({
+    method: "POST",
+    path: "/message-streams/:stream/suppressions",
+    auth: "server",
+    handler: (ctx) => changeAll(ctx, suppressByCustomer),
+});
+defineRoute({
+    method: "POST",
+    path: "/message-streams/:stream/suppressions/delete",
+    auth: "server",
+    handler: (ctx) => changeAll(ctx, deleteSuppression),
+});

package/dist/src/api/templates/content.d.ts

@@ -0,0 +1,21 @@
+import { type TemplateError } from "../../render/mustachio.ts";
+import type { Template } from "../../state/types.ts";
+import { type Content } from "./templates.ts";
+export type RenderOutcome = {
+    ok: true;
+    content: Content;
+} | {
+    ok: false;
+    errors: TemplateError[];
+};
+/**
+ * Renders message content with a model, inside a layout when given: each layout body gets the
+ * rendered template body at `{{{ @content }}}` (sdk/postmark-dotnet/src/Postmark.Tests/ClientTemplateTests.cs:219-221).
+ * A part the template lacks stays null; the layout alone renders nothing (INFERRED).
+ */
+export declare function renderContent(content: Content, layout: Template | null, model: Record<string, unknown>, inlineCss: boolean): RenderOutcome;
+/**
+ * `InlineCss` (default true) moves `<style>` rules into `style` attributes (refs/api_templates-api.md:47).
+ * The inliner's output is not captured, so HTML with a style block fails loudly.
+ */
+export declare function checkInlineCss(html: string | null, inlineCss: boolean): void;

package/dist/src/api/templates/content.js

@@ -0,0 +1,39 @@
+import { Unsupported } from "../../http/respond.js";
+import { parseTemplate, renderTemplate } from "../../render/mustachio.js";
+import { CONTENT_PARTS } from "./templates.js";
+/**
+ * Renders message content with a model, inside a layout when given: each layout body gets the
+ * rendered template body at `{{{ @content }}}` (sdk/postmark-dotnet/src/Postmark.Tests/ClientTemplateTests.cs:219-221).
+ * A part the template lacks stays null; the layout alone renders nothing (INFERRED).
+ */
+export function renderContent(content, layout, model, inlineCss) {
+    const out = { Subject: null, HtmlBody: null, TextBody: null };
+    for (const part of CONTENT_PARTS) {
+        const source = content[part];
+        if (source === null)
+            continue;
+        const parsed = parseTemplate(source);
+        if (!parsed.ok)
+            return parsed;
+        let rendered = renderTemplate(parsed.template, model);
+        const frame = part === "Subject" ? null : (layout?.[part] ?? null);
+        if (frame !== null) {
+            const parsedFrame = parseTemplate(frame);
+            if (!parsedFrame.ok)
+                return parsedFrame;
+            rendered = renderTemplate(parsedFrame.template, model, rendered);
+        }
+        out[part] = rendered;
+    }
+    checkInlineCss(out.HtmlBody, inlineCss);
+    return { ok: true, content: out };
+}
+/**
+ * `InlineCss` (default true) moves `<style>` rules into `style` attributes (refs/api_templates-api.md:47).
+ * The inliner's output is not captured, so HTML with a style block fails loudly.
+ */
+export function checkInlineCss(html, inlineCss) {
+    if (inlineCss && html !== null && /<style[\s>]/i.test(html)) {
+        throw new Unsupported("CSS inlining of <style> blocks is not built; send InlineCss: false");
+    }
+}

package/dist/src/api/templates/routes.d.ts

@@ -0,0 +1 @@
+export {};