@marlinjai/mail-contract 0.2.0 → 0.3.0

package/dist/index.js

@@ -49,6 +49,7 @@ __export(index_exports, {
   ApiKeyScope: () => ApiKeyScope,
   Asset: () => Asset,
   AssetContentType: () => AssetContentType,
+  AssetHost: () => AssetHost,
   AssetImport: () => AssetImport,
   AssetPolicy: () => AssetPolicy,
   AuditAction: () => AuditAction,
@@ -203,6 +204,7 @@ __export(index_exports, {
   MAILING_KINDS: () => MAILING_KINDS,
   MAILING_STATUSES: () => MAILING_STATUSES,
   MAILING_TRANSITIONS: () => MAILING_TRANSITIONS,
+  MAX_ALLOWED_ASSET_HOSTS: () => MAX_ALLOWED_ASSET_HOSTS,
   MAX_ASSET_BYTES: () => MAX_ASSET_BYTES,
   MAX_DELAY_SECONDS: () => MAX_DELAY_SECONDS,
   MAX_DOCUMENT_BYTES: () => MAX_DOCUMENT_BYTES,
@@ -215,6 +217,8 @@ __export(index_exports, {
   MAX_IMPORT_URL_LENGTH: () => MAX_IMPORT_URL_LENGTH,
   MAX_INVITE_TTL_DAYS: () => MAX_INVITE_TTL_DAYS,
   MAX_IN_LIST: () => MAX_IN_LIST,
+  MAX_MERGE_DEFAULTS: () => MAX_MERGE_DEFAULTS,
+  MAX_MERGE_DEFAULT_LENGTH: () => MAX_MERGE_DEFAULT_LENGTH,
   MAX_MJML_DEPTH: () => MAX_MJML_DEPTH,
   MAX_MJML_ELEMENTS: () => MAX_MJML_ELEMENTS,
   MAX_MJML_IMPORT_BYTES: () => MAX_MJML_IMPORT_BYTES,
@@ -259,6 +263,9 @@ __export(index_exports, {
   MemberCreate: () => MemberCreate,
   MemberRole: () => MemberRole,
   MemberUpdate: () => MemberUpdate,
+  MergeDefaultValue: () => MergeDefaultValue,
+  MergeDefaults: () => MergeDefaults,
+  MergeFieldName: () => MergeFieldName,
   Message: () => Message,
   MessageFailedData: () => MessageFailedData,
   MessageListQuery: () => MessageListQuery,
@@ -267,6 +274,8 @@ __export(index_exports, {
   MessageSummary: () => MessageSummary,
   NotifyRecipients: () => NotifyRecipients,
   NotifyStep: () => NotifyStep,
+  ON_BEHALF_OF_HEADER: () => ON_BEHALF_OF_HEADER,
+  ON_BEHALF_OF_MAX_LENGTH: () => ON_BEHALF_OF_MAX_LENGTH,
   OffsetDays: () => OffsetDays,
   Ok: () => Ok,
   PLAN_FEATURES: () => PLAN_FEATURES,
@@ -344,6 +353,8 @@ __export(index_exports, {
   Template: () => Template,
   TemplateCompileRequest: () => TemplateCompileRequest,
   TemplateCreate: () => TemplateCreate,
+  TemplateCreatedData: () => TemplateCreatedData,
+  TemplateDeletedData: () => TemplateDeletedData,
   TemplateDocument: () => TemplateDocument,
   TemplateExportQuery: () => TemplateExportQuery,
   TemplateImport: () => TemplateImport,
@@ -353,6 +364,7 @@ __export(index_exports, {
   TemplateListQuery: () => TemplateListQuery,
   TemplateSummary: () => TemplateSummary,
   TemplateUpdate: () => TemplateUpdate,
+  TemplateUpdatedData: () => TemplateUpdatedData,
   TemplateVersion: () => TemplateVersion,
   TemplateVersionParams: () => TemplateVersionParams,
   TimeOfDay: () => TimeOfDay,
@@ -429,6 +441,7 @@ __export(index_exports, {
   matchRoute: () => matchRoute,
   missingRequiredMergeFields: () => missingRequiredMergeFields,
   nowSeconds: () => nowSeconds,
+  operationsWithAccess: () => operationsWithAccess,
   page: () => page,
   parseExportWarningsHeader: () => parseExportWarningsHeader,
   parseUsageWarningHeader: () => parseUsageWarningHeader,
@@ -566,6 +579,8 @@ var IDEMPOTENCY_KEY_MAX_LENGTH = 255;
 var IDEMPOTENCY_KEY_RETENTION_HOURS = 24;
 var SUBJECT_HEADER = "x-mail-subject";
 var WORKSPACE_HEADER = "x-mail-workspace";
+var ON_BEHALF_OF_HEADER = "x-mail-on-behalf-of";
+var ON_BEHALF_OF_MAX_LENGTH = 200;
 var REQUEST_ID_HEADER = "x-request-id";
 var RETRY_AFTER_HEADER = "retry-after";
 var API_VERSION_PREFIX = "/v1";
@@ -2358,10 +2373,45 @@ var EventListQuery = PageQuery.extend({
   contact_id: Id.optional()
 });
 
+// src/unsubscribe.ts
+var UNSUBSCRIBE_PATH_PREFIX = "/u/";
+var LIST_UNSUBSCRIBE_POST_VALUE = "List-Unsubscribe=One-Click";
+var RESERVED_MERGE_FIELDS = {
+  /** From the recipient's merge values, else the contact. Supports a fallback. */
+  first_name: { source: "contact", fallback: true, required_for_broadcast: false },
+  last_name: { source: "contact", fallback: true, required_for_broadcast: false },
+  email: { source: "contact", fallback: false, required_for_broadcast: false },
+  /** The hosted unsubscribe page for this recipient. A broadcast without it is refused. */
+  unsubscribe_url: { source: "service", fallback: false, required_for_broadcast: true }
+};
+var MERGE_FIELD_PATTERN = /\{\{\s*([a-z][a-z0-9_]*)\s*(?:\|([^}]*))?\}\}/g;
+function findMergeFields(html) {
+  const uses = [];
+  for (const match of html.matchAll(MERGE_FIELD_PATTERN)) {
+    uses.push({ name: match[1], fallback: match[2] === void 0 ? null : match[2].trim() });
+  }
+  return uses;
+}
+function missingRequiredMergeFields(html) {
+  const used = new Set(findMergeFields(html).map((u) => u.name));
+  return Object.keys(RESERVED_MERGE_FIELDS).filter(
+    (name) => RESERVED_MERGE_FIELDS[name].required_for_broadcast && !used.has(name)
+  );
+}
+
 // src/workspace.ts
 var CompanyId = import_zod8.z.string().min(1).max(64);
 var ASSET_POLICIES = ["any", "service_only"];
 var AssetPolicy = import_zod8.z.enum(ASSET_POLICIES);
+var MAX_ALLOWED_ASSET_HOSTS = 20;
+var AssetHost = import_zod8.z.string().trim().toLowerCase().min(1).max(253).regex(/^(?=.{1,253}(?::\d{1,5})?$)[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+(:\d{1,5})?$/, "a host name such as example.com");
+var MAX_MERGE_DEFAULTS = 50;
+var MAX_MERGE_DEFAULT_LENGTH = 2e3;
+var MergeFieldName = import_zod8.z.string().regex(/^[a-z][a-z0-9_]*$/, "a merge-field name: lowercase letters, digits and underscores, starting with a letter").max(64);
+var MergeDefaultValue = import_zod8.z.union([import_zod8.z.string().max(MAX_MERGE_DEFAULT_LENGTH), import_zod8.z.number().finite(), import_zod8.z.boolean()]);
+var MergeDefaults = import_zod8.z.record(MergeFieldName, MergeDefaultValue).refine((m) => Object.keys(m).length <= MAX_MERGE_DEFAULTS, `at most ${MAX_MERGE_DEFAULTS} merge defaults`).refine((m) => !Object.keys(m).some((k) => k in RESERVED_MERGE_FIELDS), {
+  message: `a reserved merge field (${Object.keys(RESERVED_MERGE_FIELDS).join(", ")}) cannot have a workspace default`
+});
 var WorkspaceSettings = import_zod8.z.object({
   /** Default language of the hosted unsubscribe page (BCP 47 tag, e.g. "de"). */
   default_locale: import_zod8.z.string().min(2).max(35),
@@ -2371,6 +2421,14 @@ var WorkspaceSettings = import_zod8.z.object({
   tracking_enabled: import_zod8.z.boolean(),
   /** Where images, stylesheets and fonts in a mail may load from. `any` by default. */
   asset_policy: AssetPolicy,
+  /**
+   * Hosts a `service_only` workspace also allows, besides the service's own:
+   * the workspace's website, typically. Empty by default. Ignored under `any`,
+   * which allows everything already.
+   */
+  allowed_asset_hosts: import_zod8.z.array(AssetHost).max(MAX_ALLOWED_ASSET_HOSTS),
+  /** Merge values every mail of the workspace can use (see `MergeDefaults`). Empty by default. */
+  merge_defaults: MergeDefaults,
   /**
    * The time zone an automation reads a wall clock in for a contact who has
    * none of their own (A1). Null falls back to UTC.
@@ -2539,7 +2597,16 @@ var AUDIT_ACTIONS = [
 var AuditAction = import_zod8.z.enum(AUDIT_ACTIONS);
 var AuditActor = import_zod8.z.discriminatedUnion("type", [
   import_zod8.z.object({ type: import_zod8.z.literal("member"), member_id: Id, subject: import_zod8.z.string().min(1) }),
-  import_zod8.z.object({ type: import_zod8.z.literal("api_key"), api_key_id: Id }),
+  import_zod8.z.object({
+    type: import_zod8.z.literal("api_key"),
+    api_key_id: Id,
+    /**
+     * Who the client's application said it was acting for, from
+     * `ON_BEHALF_OF_HEADER`: reported by that application, never verified.
+     * Absent when the call carried no label.
+     */
+    on_behalf_of: import_zod8.z.string().min(1).max(ON_BEHALF_OF_MAX_LENGTH).optional()
+  }),
   /** The service itself (the worker, a bounce, the hosted unsubscribe page). */
   import_zod8.z.object({ type: import_zod8.z.literal("system"), reason: import_zod8.z.string().min(1).max(200) })
 ]);
@@ -2867,7 +2934,16 @@ var WEBHOOK_EVENT_TYPES = [
    * `webhook_events.type` is checked against it, not because an endpoint can ask
    * to receive everybody's.
    */
-  "automation.webhook"
+  "automation.webhook",
+  /**
+   * E4 of the embeddable-mail plan: a template changed, so a client that
+   * caches or mirrors templates (an app embedding the editor beside the
+   * hosted dashboard) can invalidate. The service stays the source of truth:
+   * the event carries the new version, never the document.
+   */
+  "template.created",
+  "template.updated",
+  "template.deleted"
 ];
 var WebhookEventType = import_zod12.z.enum(WEBHOOK_EVENT_TYPES);
 var MessageEventBase = import_zod12.z.object({
@@ -3029,6 +3105,15 @@ var AutomationWebhookData = AutomationRunEventBase.extend({
   payload: JsonValue.nullable(),
   fired_at: Timestamp
 });
+var TemplateEventBase = import_zod12.z.object({
+  template_id: Id,
+  name: import_zod12.z.string().min(1).max(200),
+  version: import_zod12.z.number().int().min(1),
+  source: import_zod12.z.enum(["api", "dashboard", "mjml_import"])
+});
+var TemplateCreatedData = TemplateEventBase.extend({ created_at: Timestamp });
+var TemplateUpdatedData = TemplateEventBase.extend({ archived: import_zod12.z.boolean(), updated_at: Timestamp });
+var TemplateDeletedData = TemplateEventBase.extend({ deleted_at: Timestamp });
 var envelope = (type, data) => import_zod12.z.object({
   /** Unique per event: a receiver deduplicates on it (deliveries may repeat). */
   id: Id,
@@ -3056,7 +3141,10 @@ var WebhookEvent = import_zod12.z.discriminatedUnion("type", [
   envelope("automation.run_completed", AutomationRunCompletedData),
   envelope("automation.run_exited", AutomationRunExitedData),
   envelope("automation.run_failed", AutomationRunFailedData),
-  envelope("automation.webhook", AutomationWebhookData)
+  envelope("automation.webhook", AutomationWebhookData),
+  envelope("template.created", TemplateCreatedData),
+  envelope("template.updated", TemplateUpdatedData),
+  envelope("template.deleted", TemplateDeletedData)
 ]);
 var WebhookEndpoint = import_zod12.z.object({
   id: Id,
@@ -3179,32 +3267,6 @@ async function verifyWebhook(input) {
   return matched ? { ok: true, timestamp } : { ok: false, reason: "signature_mismatch" };
 }
 
-// src/unsubscribe.ts
-var UNSUBSCRIBE_PATH_PREFIX = "/u/";
-var LIST_UNSUBSCRIBE_POST_VALUE = "List-Unsubscribe=One-Click";
-var RESERVED_MERGE_FIELDS = {
-  /** From the recipient's merge values, else the contact. Supports a fallback. */
-  first_name: { source: "contact", fallback: true, required_for_broadcast: false },
-  last_name: { source: "contact", fallback: true, required_for_broadcast: false },
-  email: { source: "contact", fallback: false, required_for_broadcast: false },
-  /** The hosted unsubscribe page for this recipient. A broadcast without it is refused. */
-  unsubscribe_url: { source: "service", fallback: false, required_for_broadcast: true }
-};
-var MERGE_FIELD_PATTERN = /\{\{\s*([a-z][a-z0-9_]*)\s*(?:\|([^}]*))?\}\}/g;
-function findMergeFields(html) {
-  const uses = [];
-  for (const match of html.matchAll(MERGE_FIELD_PATTERN)) {
-    uses.push({ name: match[1], fallback: match[2] === void 0 ? null : match[2].trim() });
-  }
-  return uses;
-}
-function missingRequiredMergeFields(html) {
-  const used = new Set(findMergeFields(html).map((u) => u.name));
-  return Object.keys(RESERVED_MERGE_FIELDS).filter(
-    (name) => RESERVED_MERGE_FIELDS[name].required_for_broadcast && !used.has(name)
-  );
-}
-
 // src/billing.ts
 var import_zod13 = require("zod");
 var PLAN_IDS = ["free", "starter", "growth", "design_partner"];
@@ -4632,6 +4694,9 @@ function buildPath(path, params = {}) {
     return encodeURIComponent(String(value));
   });
 }
+function operationsWithAccess(access) {
+  return Object.entries(routes).filter(([, route]) => route.access === access).map(([id]) => id).sort();
+}
 function matchRoute(method, pathname) {
   for (const [id, route] of Object.entries(routes)) {
     if (route.method !== method) continue;
@@ -4683,6 +4748,7 @@ function matchRoute(method, pathname) {
   ApiKeyScope,
   Asset,
   AssetContentType,
+  AssetHost,
   AssetImport,
   AssetPolicy,
   AuditAction,
@@ -4837,6 +4903,7 @@ function matchRoute(method, pathname) {
   MAILING_KINDS,
   MAILING_STATUSES,
   MAILING_TRANSITIONS,
+  MAX_ALLOWED_ASSET_HOSTS,
   MAX_ASSET_BYTES,
   MAX_DELAY_SECONDS,
   MAX_DOCUMENT_BYTES,
@@ -4849,6 +4916,8 @@ function matchRoute(method, pathname) {
   MAX_IMPORT_URL_LENGTH,
   MAX_INVITE_TTL_DAYS,
   MAX_IN_LIST,
+  MAX_MERGE_DEFAULTS,
+  MAX_MERGE_DEFAULT_LENGTH,
   MAX_MJML_DEPTH,
   MAX_MJML_ELEMENTS,
   MAX_MJML_IMPORT_BYTES,
@@ -4893,6 +4962,9 @@ function matchRoute(method, pathname) {
   MemberCreate,
   MemberRole,
   MemberUpdate,
+  MergeDefaultValue,
+  MergeDefaults,
+  MergeFieldName,
   Message,
   MessageFailedData,
   MessageListQuery,
@@ -4901,6 +4973,8 @@ function matchRoute(method, pathname) {
   MessageSummary,
   NotifyRecipients,
   NotifyStep,
+  ON_BEHALF_OF_HEADER,
+  ON_BEHALF_OF_MAX_LENGTH,
   OffsetDays,
   Ok,
   PLAN_FEATURES,
@@ -4978,6 +5052,8 @@ function matchRoute(method, pathname) {
   Template,
   TemplateCompileRequest,
   TemplateCreate,
+  TemplateCreatedData,
+  TemplateDeletedData,
   TemplateDocument,
   TemplateExportQuery,
   TemplateImport,
@@ -4987,6 +5063,7 @@ function matchRoute(method, pathname) {
   TemplateListQuery,
   TemplateSummary,
   TemplateUpdate,
+  TemplateUpdatedData,
   TemplateVersion,
   TemplateVersionParams,
   TimeOfDay,
@@ -5063,6 +5140,7 @@ function matchRoute(method, pathname) {
   matchRoute,
   missingRequiredMergeFields,
   nowSeconds,
+  operationsWithAccess,
   page,
   parseExportWarningsHeader,
   parseUsageWarningHeader,

package/dist/index.mjs

@@ -114,6 +114,8 @@ var IDEMPOTENCY_KEY_MAX_LENGTH = 255;
 var IDEMPOTENCY_KEY_RETENTION_HOURS = 24;
 var SUBJECT_HEADER = "x-mail-subject";
 var WORKSPACE_HEADER = "x-mail-workspace";
+var ON_BEHALF_OF_HEADER = "x-mail-on-behalf-of";
+var ON_BEHALF_OF_MAX_LENGTH = 200;
 var REQUEST_ID_HEADER = "x-request-id";
 var RETRY_AFTER_HEADER = "retry-after";
 var API_VERSION_PREFIX = "/v1";
@@ -1906,10 +1908,45 @@ var EventListQuery = PageQuery.extend({
   contact_id: Id.optional()
 });
 
+// src/unsubscribe.ts
+var UNSUBSCRIBE_PATH_PREFIX = "/u/";
+var LIST_UNSUBSCRIBE_POST_VALUE = "List-Unsubscribe=One-Click";
+var RESERVED_MERGE_FIELDS = {
+  /** From the recipient's merge values, else the contact. Supports a fallback. */
+  first_name: { source: "contact", fallback: true, required_for_broadcast: false },
+  last_name: { source: "contact", fallback: true, required_for_broadcast: false },
+  email: { source: "contact", fallback: false, required_for_broadcast: false },
+  /** The hosted unsubscribe page for this recipient. A broadcast without it is refused. */
+  unsubscribe_url: { source: "service", fallback: false, required_for_broadcast: true }
+};
+var MERGE_FIELD_PATTERN = /\{\{\s*([a-z][a-z0-9_]*)\s*(?:\|([^}]*))?\}\}/g;
+function findMergeFields(html) {
+  const uses = [];
+  for (const match of html.matchAll(MERGE_FIELD_PATTERN)) {
+    uses.push({ name: match[1], fallback: match[2] === void 0 ? null : match[2].trim() });
+  }
+  return uses;
+}
+function missingRequiredMergeFields(html) {
+  const used = new Set(findMergeFields(html).map((u) => u.name));
+  return Object.keys(RESERVED_MERGE_FIELDS).filter(
+    (name) => RESERVED_MERGE_FIELDS[name].required_for_broadcast && !used.has(name)
+  );
+}
+
 // src/workspace.ts
 var CompanyId = z8.string().min(1).max(64);
 var ASSET_POLICIES = ["any", "service_only"];
 var AssetPolicy = z8.enum(ASSET_POLICIES);
+var MAX_ALLOWED_ASSET_HOSTS = 20;
+var AssetHost = z8.string().trim().toLowerCase().min(1).max(253).regex(/^(?=.{1,253}(?::\d{1,5})?$)[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+(:\d{1,5})?$/, "a host name such as example.com");
+var MAX_MERGE_DEFAULTS = 50;
+var MAX_MERGE_DEFAULT_LENGTH = 2e3;
+var MergeFieldName = z8.string().regex(/^[a-z][a-z0-9_]*$/, "a merge-field name: lowercase letters, digits and underscores, starting with a letter").max(64);
+var MergeDefaultValue = z8.union([z8.string().max(MAX_MERGE_DEFAULT_LENGTH), z8.number().finite(), z8.boolean()]);
+var MergeDefaults = z8.record(MergeFieldName, MergeDefaultValue).refine((m) => Object.keys(m).length <= MAX_MERGE_DEFAULTS, `at most ${MAX_MERGE_DEFAULTS} merge defaults`).refine((m) => !Object.keys(m).some((k) => k in RESERVED_MERGE_FIELDS), {
+  message: `a reserved merge field (${Object.keys(RESERVED_MERGE_FIELDS).join(", ")}) cannot have a workspace default`
+});
 var WorkspaceSettings = z8.object({
   /** Default language of the hosted unsubscribe page (BCP 47 tag, e.g. "de"). */
   default_locale: z8.string().min(2).max(35),
@@ -1919,6 +1956,14 @@ var WorkspaceSettings = z8.object({
   tracking_enabled: z8.boolean(),
   /** Where images, stylesheets and fonts in a mail may load from. `any` by default. */
   asset_policy: AssetPolicy,
+  /**
+   * Hosts a `service_only` workspace also allows, besides the service's own:
+   * the workspace's website, typically. Empty by default. Ignored under `any`,
+   * which allows everything already.
+   */
+  allowed_asset_hosts: z8.array(AssetHost).max(MAX_ALLOWED_ASSET_HOSTS),
+  /** Merge values every mail of the workspace can use (see `MergeDefaults`). Empty by default. */
+  merge_defaults: MergeDefaults,
   /**
    * The time zone an automation reads a wall clock in for a contact who has
    * none of their own (A1). Null falls back to UTC.
@@ -2087,7 +2132,16 @@ var AUDIT_ACTIONS = [
 var AuditAction = z8.enum(AUDIT_ACTIONS);
 var AuditActor = z8.discriminatedUnion("type", [
   z8.object({ type: z8.literal("member"), member_id: Id, subject: z8.string().min(1) }),
-  z8.object({ type: z8.literal("api_key"), api_key_id: Id }),
+  z8.object({
+    type: z8.literal("api_key"),
+    api_key_id: Id,
+    /**
+     * Who the client's application said it was acting for, from
+     * `ON_BEHALF_OF_HEADER`: reported by that application, never verified.
+     * Absent when the call carried no label.
+     */
+    on_behalf_of: z8.string().min(1).max(ON_BEHALF_OF_MAX_LENGTH).optional()
+  }),
   /** The service itself (the worker, a bounce, the hosted unsubscribe page). */
   z8.object({ type: z8.literal("system"), reason: z8.string().min(1).max(200) })
 ]);
@@ -2415,7 +2469,16 @@ var WEBHOOK_EVENT_TYPES = [
    * `webhook_events.type` is checked against it, not because an endpoint can ask
    * to receive everybody's.
    */
-  "automation.webhook"
+  "automation.webhook",
+  /**
+   * E4 of the embeddable-mail plan: a template changed, so a client that
+   * caches or mirrors templates (an app embedding the editor beside the
+   * hosted dashboard) can invalidate. The service stays the source of truth:
+   * the event carries the new version, never the document.
+   */
+  "template.created",
+  "template.updated",
+  "template.deleted"
 ];
 var WebhookEventType = z12.enum(WEBHOOK_EVENT_TYPES);
 var MessageEventBase = z12.object({
@@ -2577,6 +2640,15 @@ var AutomationWebhookData = AutomationRunEventBase.extend({
   payload: JsonValue.nullable(),
   fired_at: Timestamp
 });
+var TemplateEventBase = z12.object({
+  template_id: Id,
+  name: z12.string().min(1).max(200),
+  version: z12.number().int().min(1),
+  source: z12.enum(["api", "dashboard", "mjml_import"])
+});
+var TemplateCreatedData = TemplateEventBase.extend({ created_at: Timestamp });
+var TemplateUpdatedData = TemplateEventBase.extend({ archived: z12.boolean(), updated_at: Timestamp });
+var TemplateDeletedData = TemplateEventBase.extend({ deleted_at: Timestamp });
 var envelope = (type, data) => z12.object({
   /** Unique per event: a receiver deduplicates on it (deliveries may repeat). */
   id: Id,
@@ -2604,7 +2676,10 @@ var WebhookEvent = z12.discriminatedUnion("type", [
   envelope("automation.run_completed", AutomationRunCompletedData),
   envelope("automation.run_exited", AutomationRunExitedData),
   envelope("automation.run_failed", AutomationRunFailedData),
-  envelope("automation.webhook", AutomationWebhookData)
+  envelope("automation.webhook", AutomationWebhookData),
+  envelope("template.created", TemplateCreatedData),
+  envelope("template.updated", TemplateUpdatedData),
+  envelope("template.deleted", TemplateDeletedData)
 ]);
 var WebhookEndpoint = z12.object({
   id: Id,
@@ -2727,32 +2802,6 @@ async function verifyWebhook(input) {
   return matched ? { ok: true, timestamp } : { ok: false, reason: "signature_mismatch" };
 }
 
-// src/unsubscribe.ts
-var UNSUBSCRIBE_PATH_PREFIX = "/u/";
-var LIST_UNSUBSCRIBE_POST_VALUE = "List-Unsubscribe=One-Click";
-var RESERVED_MERGE_FIELDS = {
-  /** From the recipient's merge values, else the contact. Supports a fallback. */
-  first_name: { source: "contact", fallback: true, required_for_broadcast: false },
-  last_name: { source: "contact", fallback: true, required_for_broadcast: false },
-  email: { source: "contact", fallback: false, required_for_broadcast: false },
-  /** The hosted unsubscribe page for this recipient. A broadcast without it is refused. */
-  unsubscribe_url: { source: "service", fallback: false, required_for_broadcast: true }
-};
-var MERGE_FIELD_PATTERN = /\{\{\s*([a-z][a-z0-9_]*)\s*(?:\|([^}]*))?\}\}/g;
-function findMergeFields(html) {
-  const uses = [];
-  for (const match of html.matchAll(MERGE_FIELD_PATTERN)) {
-    uses.push({ name: match[1], fallback: match[2] === void 0 ? null : match[2].trim() });
-  }
-  return uses;
-}
-function missingRequiredMergeFields(html) {
-  const used = new Set(findMergeFields(html).map((u) => u.name));
-  return Object.keys(RESERVED_MERGE_FIELDS).filter(
-    (name) => RESERVED_MERGE_FIELDS[name].required_for_broadcast && !used.has(name)
-  );
-}
-
 // src/billing.ts
 import { z as z13 } from "zod";
 var PLAN_IDS = ["free", "starter", "growth", "design_partner"];
@@ -4180,6 +4229,9 @@ function buildPath(path, params = {}) {
     return encodeURIComponent(String(value));
   });
 }
+function operationsWithAccess(access) {
+  return Object.entries(routes).filter(([, route]) => route.access === access).map(([id]) => id).sort();
+}
 function matchRoute(method, pathname) {
   for (const [id, route] of Object.entries(routes)) {
     if (route.method !== method) continue;
@@ -4230,6 +4282,7 @@ export {
   ApiKeyScope,
   Asset,
   AssetContentType,
+  AssetHost,
   AssetImport,
   AssetPolicy,
   AuditAction,
@@ -4384,6 +4437,7 @@ export {
   MAILING_KINDS,
   MAILING_STATUSES,
   MAILING_TRANSITIONS,
+  MAX_ALLOWED_ASSET_HOSTS,
   MAX_ASSET_BYTES,
   MAX_DELAY_SECONDS,
   MAX_DOCUMENT_BYTES,
@@ -4396,6 +4450,8 @@ export {
   MAX_IMPORT_URL_LENGTH,
   MAX_INVITE_TTL_DAYS,
   MAX_IN_LIST,
+  MAX_MERGE_DEFAULTS,
+  MAX_MERGE_DEFAULT_LENGTH,
   MAX_MJML_DEPTH,
   MAX_MJML_ELEMENTS,
   MAX_MJML_IMPORT_BYTES,
@@ -4440,6 +4496,9 @@ export {
   MemberCreate,
   MemberRole,
   MemberUpdate,
+  MergeDefaultValue,
+  MergeDefaults,
+  MergeFieldName,
   Message,
   MessageFailedData,
   MessageListQuery,
@@ -4448,6 +4507,8 @@ export {
   MessageSummary,
   NotifyRecipients,
   NotifyStep,
+  ON_BEHALF_OF_HEADER,
+  ON_BEHALF_OF_MAX_LENGTH,
   OffsetDays,
   Ok,
   PLAN_FEATURES,
@@ -4525,6 +4586,8 @@ export {
   Template,
   TemplateCompileRequest,
   TemplateCreate,
+  TemplateCreatedData,
+  TemplateDeletedData,
   TemplateDocument,
   TemplateExportQuery,
   TemplateImport,
@@ -4534,6 +4597,7 @@ export {
   TemplateListQuery,
   TemplateSummary,
   TemplateUpdate,
+  TemplateUpdatedData,
   TemplateVersion,
   TemplateVersionParams,
   TimeOfDay,
@@ -4610,6 +4674,7 @@ export {
   matchRoute,
   missingRequiredMergeFields,
   nowSeconds,
+  operationsWithAccess,
   page,
   parseExportWarningsHeader,
   parseUsageWarningHeader,

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "The v1 API contract of the mail service: zod schemas and types for every request, response, error and webhook, the route table, and webhook signing helpers",
   "license": "MIT",
   "repository": {