@nateq/sdk 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nateq
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,289 @@
+# @nateq/sdk
+
+[![npm](https://img.shields.io/npm/v/@nateq/sdk.svg)](https://www.npmjs.com/package/@nateq/sdk)
+[![CI](https://github.com/nateq-ai/sdk-node/actions/workflows/ci.yml/badge.svg)](https://github.com/nateq-ai/sdk-node/actions/workflows/ci.yml)
+[![license](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
+
+Official Node.js SDK for the [Nateq](https://nateq.io) API.
+
+Works with any Node.js server framework — Express, Fastify, NestJS, Next.js route handlers, background workers. Zero runtime dependencies, ESM + CommonJS, fully typed.
+
+> **Server-side only.** Your API key grants access to your whole organization. Never ship it to a browser, a mobile app, or any client bundle.
+
+## Contents
+
+- [Install](#install)
+- [Quick start](#quick-start)
+- [Authentication](#authentication) — keys, scopes, and how the SDK protects them
+- [Sending email](#sending-email)
+- [Reading email](#reading-email)
+- [Errors](#errors)
+- [Retries and duplicate sends](#retries-and-duplicate-sends)
+- [Configuration](#configuration)
+- [Framework usage](#framework-usage) — Express, NestJS, Next.js
+- [License](#license)
+
+## Install
+
+```bash
+npm install @nateq/sdk
+```
+
+Requires Node.js 18 or newer (it uses the built-in `fetch`).
+
+## Quick start
+
+```ts
+import { Nateq } from "@nateq/sdk";
+
+const nateq = new Nateq(); // reads process.env.NATEQ_API_KEY
+
+const email = await nateq.emails.send({
+  toEmails: ["customer@example.com"],
+  subject: "Welcome aboard",
+  htmlBody: "<p>Thanks for signing up.</p>",
+});
+
+console.log(email.id, email.status);
+```
+
+## Authentication
+
+Create an API key in the Nateq developer portal and grant it the scopes it needs:
+
+| Scope | Allows |
+| --- | --- |
+| `emails:send` | `emails.send()` |
+| `emails:read` | `emails.get()`, `emails.list()` |
+
+Grant only what the key needs — a key that just sends mail should not carry `emails:read`.
+
+The SDK reads `NATEQ_API_KEY` from the environment by default, which keeps the key out of your source:
+
+```bash
+# .env — never commit this
+NATEQ_API_KEY=tg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+```
+
+Or pass it explicitly, ideally from a secret manager:
+
+```ts
+const nateq = new Nateq({ apiKey: await secrets.get("nateq-api-key") });
+```
+
+Keys are environment-scoped by prefix: `tg_live_` for production, `tg_test_` for sandbox.
+
+### How the SDK protects your key
+
+- **Header only.** The key is sent as an `Authorization: Bearer` header, never in a URL, where it would be captured by server logs, proxies, and browser history.
+- **HTTPS enforced.** Configuring a plaintext `http://` base URL throws rather than putting your key on the wire in cleartext. `localhost` is exempt for local development.
+- **Never printed.** `console.log(nateq)`, `JSON.stringify(nateq)`, and `util.inspect` all redact the key. It is held in a private field, so it will not appear via property enumeration.
+- **Never in errors.** Every error message is scrubbed of the key before it is thrown, so it cannot reach your logs through a stack trace.
+- **Validated locally.** A malformed key throws immediately, without a network round-trip that would transmit it.
+
+## Sending email
+
+`toEmails` and `subject` are required, plus at least one of `htmlBody` / `plainTextBody`. Everything else is optional:
+
+```ts
+await nateq.emails.send({
+  toEmails: ["a@example.com", "b@example.com"],
+  ccEmails: ["cc@example.com"],
+  bccEmails: ["bcc@example.com"],
+  replyTo: "support@yourcompany.com",
+  subject: "Your order shipped",
+  htmlBody: "<p>Tracking: <b>ABC123</b></p>",
+  plainTextBody: "Tracking: ABC123",
+  fromName: "Acme Support",
+  attachmentIds: ["6f1c…"], // ids of files already uploaded to Nateq
+  headers: { "X-Campaign": "shipping" },
+});
+```
+
+The From address defaults to your organization's default verified address. Override it with `emailAddressId` (preferred) or `fromEmail` — both must already be verified for your organization.
+
+`send()` resolves once Nateq has **accepted** the email. Delivery happens asynchronously, so the returned `status` is usually `pending` or `sent`, not `delivered`.
+
+### Threading and linking
+
+Attach an email to a ticket, conversation, or contact, or thread it onto an existing message:
+
+```ts
+await nateq.emails.send({
+  toEmails: ["customer@example.com"],
+  subject: "Re: Invoice #42",
+  htmlBody: "<p>Attached.</p>",
+  ticketId: "…",
+  inReplyTo: "<message-id@nateq.io>",
+});
+```
+
+## Reading email
+
+```ts
+const email = await nateq.emails.get("email-id");
+console.log(email.status, email.deliveredAt, email.bounceReason);
+
+const { emails, total } = await nateq.emails.list({
+  status: "bounced",
+  limit: 50,
+});
+```
+
+`list()` returns newest first. `limit` defaults to 50 and is capped at 100 by the API; page with `offset`.
+
+## Errors
+
+Every failure is an instance of `NateqError`, with a specific subclass you can branch on:
+
+```ts
+import { NateqError, NateqRateLimitError, NateqPermissionError } from "@nateq/sdk";
+
+try {
+  await nateq.emails.send({ /* … */ });
+} catch (err) {
+  if (err instanceof NateqRateLimitError) {
+    await sleep((err.retryAfter ?? 60) * 1000);
+  } else if (err instanceof NateqPermissionError) {
+    // key is missing the emails:send scope
+    console.error(err.code, err.details);
+  } else if (err instanceof NateqError) {
+    console.error(err.status, err.message, err.requestId);
+  }
+  throw err;
+}
+```
+
+| Class | When |
+| --- | --- |
+| `NateqConfigurationError` | Bad SDK setup. Thrown before any network call. |
+| `NateqValidationError` | 400/422, or params rejected locally. |
+| `NateqAuthenticationError` | 401 — key missing, malformed, revoked, or unknown. |
+| `NateqPermissionError` | 403 — missing scope, or IP outside the key's allow-list. |
+| `NateqNotFoundError` | 404. |
+| `NateqRateLimitError` | 429. Carries `retryAfter`. |
+| `NateqServerError` | 5xx. |
+| `NateqConnectionError` | No response: DNS, TLS, socket, offline. |
+| `NateqTimeoutError` | Timed out or aborted. |
+
+Errors carry `requestId` (from `X-Request-Id`) whenever the API supplies one — include it when contacting support.
+
+## Retries and duplicate sends
+
+Reads (`get`, `list`) retry automatically on 429, 408, 5xx, and network errors, with exponential backoff and full jitter, honouring `Retry-After`.
+
+**`send()` is deliberately different.** Because the API has no idempotency key, a send that fails *after* reaching the server may already have delivered the mail — replaying it would send twice. So `send()` is only retried on **429**, which the API rejects during validation before any mail leaves, and is therefore provably safe.
+
+On a timeout or 5xx from `send()`, the SDK throws rather than guessing. If you must recover, check before resending:
+
+```ts
+try {
+  await nateq.emails.send(params);
+} catch (err) {
+  if (err instanceof NateqServerError || err instanceof NateqTimeoutError) {
+    // Ambiguous: it may or may not have sent. Confirm first.
+    const { emails } = await nateq.emails.list({ toEmail: params.toEmails[0], limit: 5 });
+    const alreadySent = emails.some((e) => e.subject === params.subject);
+    if (!alreadySent) await nateq.emails.send(params);
+  }
+}
+```
+
+## Configuration
+
+```ts
+const nateq = new Nateq({
+  apiKey: process.env.NATEQ_API_KEY,
+  baseUrl: "https://api.nateq.io/api", // or NATEQ_BASE_URL
+  timeout: 30_000,                     // per attempt, ms
+  maxRetries: 2,                       // 0 disables retries
+  fetch: customFetch,                  // for proxies or tests
+});
+```
+
+Cancel a request with an `AbortSignal`:
+
+```ts
+await nateq.emails.send(params, { signal: AbortSignal.timeout(5000) });
+```
+
+## Framework usage
+
+The client is a plain class with no framework coupling, so it drops into anything running on Node 18+. Create one instance and share it — it is stateless and safe to reuse across requests.
+
+**Express / Fastify** — build the client once at startup, not per request:
+
+```ts
+const nateq = new Nateq();
+
+app.post("/signup", async (req, res, next) => {
+  try {
+    await nateq.emails.send({
+      toEmails: [req.body.email],
+      subject: "Welcome",
+      htmlBody: "<p>Thanks for signing up.</p>",
+    });
+    res.sendStatus(202);
+  } catch (err) {
+    next(err);
+  }
+});
+```
+
+**NestJS** — provide the client through DI so services can inject it and tests can swap it:
+
+```ts
+// nateq.module.ts
+import { Global, Module } from "@nestjs/common";
+import { Nateq } from "@nateq/sdk";
+
+export const NATEQ_CLIENT = "NATEQ_CLIENT";
+
+@Global()
+@Module({
+  providers: [
+    {
+      provide: NATEQ_CLIENT,
+      useFactory: () => new Nateq({ apiKey: process.env.NATEQ_API_KEY }),
+    },
+  ],
+  exports: [NATEQ_CLIENT],
+})
+export class NateqModule {}
+```
+
+```ts
+// mail.service.ts
+import { Inject, Injectable } from "@nestjs/common";
+import { Nateq } from "@nateq/sdk";
+
+@Injectable()
+export class MailService {
+  constructor(@Inject(NATEQ_CLIENT) private readonly nateq: Nateq) {}
+
+  sendWelcome(to: string) {
+    return this.nateq.emails.send({
+      toEmails: [to],
+      subject: "Welcome",
+      htmlBody: "<p>Hi there</p>",
+    });
+  }
+}
+```
+
+In tests, override the provider with a stub — or pass a fake `fetch`:
+
+```ts
+const module = await Test.createTestingModule({ providers: [MailService] })
+  .overrideProvider(NATEQ_CLIENT)
+  .useValue(new Nateq({ apiKey: TEST_KEY, fetch: fakeFetch }))
+  .compile();
+```
+
+**Next.js** — use it in route handlers, server actions, or any server-only module. Never import it into a client component: `NATEQ_API_KEY` must stay server-side (do not prefix it with `NEXT_PUBLIC_`).
+
+**Module systems.** ESM and CommonJS are both supported, with correct types for `node10`, `node16`/`nodenext`, and bundler resolution — so `import` and `require` both work, whatever your `tsconfig` says.
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,353 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/errors.ts
+var NateqError = class extends Error {
+	/** HTTP status, when the failure came from a response. */
+	status;
+	/** API error code, when the response carried one. */
+	code;
+	/** Extra context from the API (validation details, scope lists, ...). */
+	details;
+	/** Value of the `X-Request-Id` response header, useful for support tickets. */
+	requestId;
+	constructor(message, opts = {}) {
+		super(message, opts.cause !== void 0 ? { cause: opts.cause } : void 0);
+		this.name = new.target.name;
+		this.status = opts.status;
+		this.code = opts.code;
+		this.details = opts.details;
+		this.requestId = opts.requestId;
+		Error.captureStackTrace?.(this, new.target);
+	}
+};
+/** The key is missing, malformed, revoked, or unknown (401). */
+var NateqAuthenticationError = class extends NateqError {};
+/**
+* The key is valid but not allowed to do this (403).
+*
+* Common causes: the key lacks the `emails:send` scope, the endpoint is not
+* exposed to API keys, or the caller's IP is outside the key's allow-list.
+*/
+var NateqPermissionError = class extends NateqError {};
+/** The request body failed validation (400/422). */
+var NateqValidationError = class extends NateqError {};
+/** The requested resource does not exist, or is not visible to this key (404). */
+var NateqNotFoundError = class extends NateqError {};
+/** A rate limit was hit (429). Nothing was sent — this is safe to retry. */
+var NateqRateLimitError = class extends NateqError {
+	/** Seconds to wait before retrying, when the API supplies `Retry-After`. */
+	retryAfter;
+	constructor(message, opts = {}) {
+		super(message, opts);
+		this.retryAfter = opts.retryAfter;
+	}
+};
+/** The API failed to handle the request (5xx). */
+var NateqServerError = class extends NateqError {};
+/** The request never produced a response: DNS, TLS, socket, or offline. */
+var NateqConnectionError = class extends NateqError {};
+/** The request exceeded the configured timeout, or was aborted by the caller. */
+var NateqTimeoutError = class extends NateqError {};
+/** Bad SDK usage — thrown before any network call (never carries a status). */
+var NateqConfigurationError = class extends NateqError {};
+//#endregion
+//#region src/emails.ts
+/** Outbound email operations. Reachable at `client.emails`. */
+var Emails = class {
+	transport;
+	constructor(transport) {
+		this.transport = transport;
+	}
+	/**
+	* Sends an email, returning once the API has accepted it. Delivery itself is
+	* asynchronous — poll {@link get} or subscribe to a webhook for the outcome.
+	*
+	* Requires an API key with the `emails:send` scope.
+	*
+	* A failed send is **not** replayed automatically unless the API rejected it
+	* outright (429), because a request that fails after reaching the server may
+	* already have sent the mail. On a timeout or 5xx, look the email up with
+	* {@link list} before retrying, or you risk sending twice.
+	*
+	* @throws {NateqValidationError} if the params are unusable, before any call.
+	* @throws {NateqPermissionError} if the key lacks the `emails:send` scope.
+	*/
+	async send(params, opts = {}) {
+		if (!params.toEmails?.length) throw new NateqValidationError("`toEmails` must contain at least one recipient.");
+		if (!params.subject?.trim()) throw new NateqValidationError("`subject` is required.");
+		if (!params.htmlBody?.trim() && !params.plainTextBody?.trim()) throw new NateqValidationError("Provide `htmlBody`, `plainTextBody`, or both.");
+		return this.transport.request({
+			method: "POST",
+			path: "/outbound-emails",
+			body: params,
+			signal: opts.signal,
+			retryOnAmbiguousFailure: false
+		});
+	}
+	/**
+	* Fetches a single sent email by id, including delivery status.
+	*
+	* Requires an API key with the `emails:read` scope.
+	*/
+	async get(id, opts = {}) {
+		if (!id?.trim()) throw new NateqValidationError("`id` is required.");
+		return this.transport.request({
+			method: "GET",
+			path: `/outbound-emails/${encodeURIComponent(id)}`,
+			signal: opts.signal,
+			retryOnAmbiguousFailure: true
+		});
+	}
+	/**
+	* Lists sent emails, newest first. `limit` defaults to 50 and is capped at 100.
+	*
+	* Requires an API key with the `emails:read` scope.
+	*/
+	async list(params = {}, opts = {}) {
+		return this.transport.request({
+			method: "GET",
+			path: "/outbound-emails",
+			query: params,
+			signal: opts.signal,
+			retryOnAmbiguousFailure: true
+		});
+	}
+};
+//#endregion
+//#region src/http.ts
+/**
+* Removes the API key from a string. Applied to every message the SDK raises so
+* a leaked stack trace or log line can never reveal the credential.
+*/
+function redact(text, apiKey) {
+	return apiKey ? text.split(apiKey).join("[REDACTED]") : text;
+}
+function isAbortError(err) {
+	return err instanceof Error && err.name === "AbortError";
+}
+function parseRetryAfter(headers) {
+	const raw = headers.get("retry-after");
+	if (!raw) return void 0;
+	const seconds = Number(raw);
+	if (Number.isFinite(seconds) && seconds >= 0) return seconds;
+	const date = Date.parse(raw);
+	if (Number.isNaN(date)) return void 0;
+	return Math.max(0, (date - Date.now()) / 1e3);
+}
+function buildUrl(baseUrl, path, query) {
+	const url = new URL(baseUrl.replace(/\/+$/, "") + path);
+	for (const [key, value] of Object.entries(query ?? {})) {
+		if (value === void 0 || value === null) continue;
+		url.searchParams.set(key, String(value));
+	}
+	return url.toString();
+}
+/** Maps a failed response onto the matching error class. */
+function toError(status, payload, headers, apiKey) {
+	let code;
+	let message;
+	let details;
+	const err = payload?.error;
+	if (typeof err === "string") {
+		message = err;
+		details = payload?.details;
+	} else if (err && typeof err === "object") {
+		code = err.code;
+		message = err.message;
+		details = err.details;
+	}
+	const requestId = headers.get("x-request-id") ?? void 0;
+	const text = redact(message ?? `Request failed with status ${status}`, apiKey);
+	const opts = {
+		status,
+		code,
+		details,
+		requestId
+	};
+	if (status === 401) return new NateqAuthenticationError(text, opts);
+	if (status === 403) return new NateqPermissionError(text, opts);
+	if (status === 404) return new NateqNotFoundError(text, opts);
+	if (status === 400 || status === 422) return new NateqValidationError(text, opts);
+	if (status === 429) return new NateqRateLimitError(text, {
+		...opts,
+		retryAfter: parseRetryAfter(headers)
+	});
+	if (status >= 500) return new NateqServerError(text, opts);
+	return new NateqError(text, opts);
+}
+/** Full-jitter exponential backoff, capped at 8s, honouring `Retry-After`. */
+function backoffDelay(attempt, retryAfter) {
+	if (retryAfter !== void 0) return Math.min(retryAfter * 1e3, 6e4);
+	const ceiling = Math.min(500 * 2 ** attempt, 8e3);
+	return Math.random() * ceiling;
+}
+function sleep(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(new NateqTimeoutError("Request aborted by caller"));
+			return;
+		}
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		const onAbort = () => {
+			clearTimeout(timer);
+			reject(new NateqTimeoutError("Request aborted by caller"));
+		};
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+var Transport = class {
+	options;
+	constructor(options) {
+		this.options = options;
+	}
+	async request(req) {
+		const { apiKey, baseUrl, timeout, maxRetries, fetch: doFetch, userAgent } = this.options;
+		const url = buildUrl(baseUrl, req.path, req.query);
+		let lastError;
+		for (let attempt = 0; attempt <= maxRetries; attempt++) {
+			if (attempt > 0) {
+				const retryAfter = lastError instanceof NateqRateLimitError ? lastError.retryAfter : void 0;
+				await sleep(backoffDelay(attempt - 1, retryAfter), req.signal);
+			}
+			const timeoutSignal = AbortSignal.timeout(timeout);
+			const signal = req.signal ? AbortSignal.any([req.signal, timeoutSignal]) : timeoutSignal;
+			let response;
+			try {
+				response = await doFetch(url, {
+					method: req.method,
+					signal,
+					headers: {
+						Authorization: `Bearer ${apiKey}`,
+						Accept: "application/json",
+						"User-Agent": userAgent,
+						...req.body !== void 0 ? { "Content-Type": "application/json" } : {}
+					},
+					...req.body !== void 0 ? { body: JSON.stringify(req.body) } : {}
+				});
+			} catch (err) {
+				const caller = req.signal?.aborted === true;
+				lastError = caller ? new NateqTimeoutError("Request aborted by caller", { cause: err }) : isAbortError(err) || err?.name === "TimeoutError" ? new NateqTimeoutError(`Request timed out after ${timeout}ms`, { cause: err }) : new NateqConnectionError(redact(`Could not reach the Nateq API: ${err?.message ?? err}`, apiKey), { cause: err });
+				if (caller) throw lastError;
+				if (req.retryOnAmbiguousFailure && attempt < maxRetries) continue;
+				throw lastError;
+			}
+			if (response.ok) {
+				if (response.status === 204) return void 0;
+				return await response.json();
+			}
+			let payload;
+			try {
+				payload = await response.json();
+			} catch {
+				payload = void 0;
+			}
+			lastError = toError(response.status, payload, response.headers, apiKey);
+			if ((lastError instanceof NateqRateLimitError || req.retryOnAmbiguousFailure && (lastError instanceof NateqServerError || response.status === 408)) && attempt < maxRetries) continue;
+			throw lastError;
+		}
+		/* istanbul ignore next — the loop always returns or throws. */
+		throw lastError ?? new NateqError("Request failed");
+	}
+};
+//#endregion
+//#region src/client.ts
+const VERSION = "0.1.0";
+/** Recognised API-key prefixes, mirroring the API's own validation. */
+const KEY_PREFIXES = ["tg_live_", "tg_test_"];
+const MIN_KEY_LENGTH = 50;
+function resolveApiKey(explicit) {
+	const key = explicit ?? process.env["NATEQ_API_KEY"];
+	if (!key) throw new NateqConfigurationError("No API key provided. Pass `new Nateq({ apiKey })` or set the NATEQ_API_KEY environment variable.");
+	if (key !== key.trim()) throw new NateqConfigurationError("The API key has leading or trailing whitespace, which usually means it was copied incorrectly.");
+	if (!KEY_PREFIXES.some((p) => key.startsWith(p))) throw new NateqConfigurationError(`Invalid API key format: expected it to start with ${KEY_PREFIXES.join(" or ")}.`);
+	if (key.length < MIN_KEY_LENGTH) throw new NateqConfigurationError("Invalid API key format: the key is too short.");
+	return key;
+}
+function resolveBaseUrl(explicit) {
+	const raw = explicit ?? process.env["NATEQ_BASE_URL"] ?? "https://api.nateq.io/api/v1";
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		throw new NateqConfigurationError(`Invalid baseUrl: ${raw}`);
+	}
+	const isLoopback = [
+		"localhost",
+		"127.0.0.1",
+		"[::1]",
+		"::1"
+	].includes(url.hostname);
+	if (url.protocol !== "https:" && !isLoopback) throw new NateqConfigurationError(`Refusing to send an API key over ${url.protocol}// to ${url.hostname}. Use https, or a localhost address for local development.`);
+	return url.toString().replace(/\/+$/, "");
+}
+/**
+* The Nateq API client.
+*
+* ```ts
+* import { Nateq } from "@nateq/sdk";
+*
+* const nateq = new Nateq(); // reads NATEQ_API_KEY
+*
+* await nateq.emails.send({
+*   toEmails: ["customer@example.com"],
+*   subject: "Welcome aboard",
+*   htmlBody: "<p>Thanks for signing up.</p>",
+* });
+* ```
+*
+* The instance holds your API key, so it is never safe to serialise: `console.log`,
+* `JSON.stringify`, and util.inspect all render it with the key redacted.
+*/
+var Nateq = class {
+	/** Outbound email: send, get, list. */
+	emails;
+	baseUrl;
+	/** Stored non-enumerably so the key cannot leak via property enumeration. */
+	#apiKey;
+	constructor(options = {}) {
+		this.#apiKey = resolveApiKey(options.apiKey);
+		this.baseUrl = resolveBaseUrl(options.baseUrl);
+		const fetchImpl = options.fetch ?? globalThis.fetch;
+		if (typeof fetchImpl !== "function") throw new NateqConfigurationError("No global fetch available. Use Node 18+, or pass a fetch implementation via `new Nateq({ fetch })`.");
+		const transport = new Transport({
+			apiKey: this.#apiKey,
+			baseUrl: this.baseUrl,
+			timeout: options.timeout ?? 3e4,
+			maxRetries: options.maxRetries ?? 2,
+			fetch: fetchImpl.bind(globalThis),
+			userAgent: `nateq-node/${VERSION} (node ${process.versions.node})`
+		});
+		this.emails = new Emails(transport);
+	}
+	/** Last four characters of the key, for logging which key is in use. */
+	get apiKeyLast4() {
+		return this.#apiKey.slice(-4);
+	}
+	toJSON() {
+		return {
+			baseUrl: this.baseUrl,
+			apiKey: `[REDACTED:...${this.apiKeyLast4}]`
+		};
+	}
+	/** Keeps the key out of `console.log(client)` and util.inspect output. */
+	[Symbol.for("nodejs.util.inspect.custom")]() {
+		return `Nateq { baseUrl: '${this.baseUrl}', apiKey: '[REDACTED:...${this.apiKeyLast4}]' }`;
+	}
+};
+//#endregion
+exports.Emails = Emails;
+exports.Nateq = Nateq;
+exports.NateqAuthenticationError = NateqAuthenticationError;
+exports.NateqConfigurationError = NateqConfigurationError;
+exports.NateqConnectionError = NateqConnectionError;
+exports.NateqError = NateqError;
+exports.NateqNotFoundError = NateqNotFoundError;
+exports.NateqPermissionError = NateqPermissionError;
+exports.NateqRateLimitError = NateqRateLimitError;
+exports.NateqServerError = NateqServerError;
+exports.NateqTimeoutError = NateqTimeoutError;
+exports.NateqValidationError = NateqValidationError;
+
+//# sourceMappingURL=index.cjs.map