@openemail/sdk 0.0.4 → 0.0.6

package/index.js

@@ -1,3 +1,8 @@
+const AUDIENCE_MEMBER_STATUSES = {
+    SUBSCRIBED: 'subscribed',
+    UNSUBSCRIBED: 'unsubscribed'
+};
+
 const BROADCAST_STATUSES = {
     SCHEDULED: 'scheduled',
     QUEUED: 'queued',
@@ -19,7 +24,7 @@ const BROADCAST_RECIPIENT_FILTERS = {
     UNSUBSCRIBED: 'unsubscribed'
 };
 
-var version = "0.0.4";
+var version = "0.0.6";
 
 const BUILD_BASE_URL = 'https://api.openemail.uk';
 
@@ -33,8 +38,8 @@ const DEFAULTS = {
 const BROWSER_REFUSAL = [
     'OpenEmail refused to start in a browser.',
     '',
-    '  This client carries a workspace API key that can send mail and read the mailbox. Anything',
-    '  you ship to a browser is readable by anyone who opens devtools.',
+    '  This client carries a workspace API key or an OAuth access token that can send mail and read',
+    '  the mailbox. Anything you ship to a browser is readable by anyone who opens devtools.',
     '',
     '  Call it from a server, a serverless function or a script instead. Disposable inboxes are',
     '  the exception: createTempMail() needs no API key and is safe to use in a browser.',
@@ -44,6 +49,7 @@ const BROWSER_REFUSAL = [
 ].join('\n');
 const ENV_VARS = {
     API_KEY: 'OPENEMAIL_API_KEY',
+    ACCESS_TOKEN: 'OPENEMAIL_ACCESS_TOKEN',
     BASE_URL: 'OPENEMAIL_BASE_URL'
 };
 const API_KEY_PREFIXES = {
@@ -54,10 +60,22 @@ const API_KEY_MODES = {
     LIVE: 'live',
     TEST: 'test'
 };
+const ACCESS_TOKEN_RULES = {
+    RESERVED_PREFIX: 'oe_',
+    MAX_LENGTH: 512
+};
+const CREDENTIAL_KINDS = {
+    API_KEY: 'apiKey',
+    OAUTH: 'oauth'
+};
 const CLIENT_MESSAGES = {
     API_KEY_REQUIRED: `An OpenEmail API key is required. Pass { apiKey } or set ${ENV_VARS.API_KEY}. Create one in OpenEmail under Settings, API keys.`,
-    API_KEY_SHAPE: 'is not an OpenEmail API key. The API accepts only keys beginning "oe_live_" or "oe_test_", so a session cookie, a session token or a key for another service is refused.',
-    BASE_URL_SHAPE: 'is not a usable base URL. Pass an origin such as "https://api.openemail.uk", or the http origin of a server you run yourself.',
+    CREDENTIAL_REQUIRED: `An OpenEmail API key or OAuth access token is required. Pass { apiKey } or { accessToken }, or set ${ENV_VARS.API_KEY} or ${ENV_VARS.ACCESS_TOKEN}. Create a key in OpenEmail under Settings, API keys.`,
+    CREDENTIAL_CONFLICT: 'Pass { apiKey } or { accessToken }, not both. Every request carries one credential, so the client cannot tell which of the two you meant.',
+    API_KEY_SHAPE: 'is not an OpenEmail API key. The API accepts only keys beginning "oe_live_" or "oe_test_", so a session cookie, a session token or a key for another service is refused. Pass an OAuth access token as { accessToken } instead.',
+    ACCESS_TOKEN_SHAPE: `is not an OAuth access token. Pass the access token OpenEmail issued when the app was connected: a string of 1 to ${ACCESS_TOKEN_RULES.MAX_LENGTH} characters that does not begin "${ACCESS_TOKEN_RULES.RESERVED_PREFIX}". An API key goes in { apiKey } instead.`,
+    ACCESS_TOKEN_PROVIDED: 'The value the { accessToken } function resolved to',
+    BASE_URL_SHAPE: 'is not a usable base URL. Pass an https origin such as "https://api.openemail.uk". Plain http is for a server on this machine only, at localhost, a 127.x.x.x address or ::1, because the client never sends a credential over plain http to any other host.',
     NO_FETCH: 'No global fetch is available. Pass one as { fetch }, or run on Node 20+, Bun, Deno, Cloudflare Workers or a browser.',
     EMPTY_SEGMENT: 'An id must not be empty.',
     FILENAME_REQUIRED: 'A file name is required. Pass it as { filename }, the name the file is stored and downloaded under.',
@@ -86,6 +104,18 @@ const CONTACT_PHOTO_TYPES = {
     GIF: 'image/gif'
 };
 
+const DOMAIN_RECORD_STATUSES = {
+    FOUND: 'found',
+    MISSING: 'missing'
+};
+const DOMAIN_DMARC_STAGES = {
+    MISSING: 'missing',
+    INVALID: 'invalid',
+    MONITOR: 'monitor',
+    QUARANTINE: 'quarantine',
+    REJECT: 'reject'
+};
+
 const MESSAGE_ENCRYPTION_FORMATS = {
     PGP_MIME: 'pgp-mime',
     PGP_SIGNED: 'pgp-signed',
@@ -151,6 +181,10 @@ const FILE_USAGES = {
     LINKED: 'linked',
     SCHEDULED: 'scheduled'
 };
+const FILE_VISIBILITIES = {
+    PUBLIC: 'public',
+    PRIVATE: 'private'
+};
 
 const HTTP_METHODS = {
     GET: 'GET',
@@ -531,6 +565,8 @@ const PATHS = {
     TRACKING_STATS: '/tracking/stats',
     CALENDAR_EVENTS: '/calendar/events',
     SETTINGS: '/settings',
+    SECURITY_STEP_UP: '/security/step-up',
+    SECURITY_STEP_UP_VERIFY: '/security/step-up/verify',
     ROLES: '/roles',
     ROLES_PERMISSIONS: '/roles/permissions',
     MEMBERS: '/members',
@@ -589,6 +625,7 @@ const SEGMENTS = {
     TRASH: 'trash',
     UNSNOOZE: 'unsnooze',
     UPLOAD: 'upload',
+    VERIFY: 'verify',
     VERSIONS: 'versions'
 };
 
@@ -685,6 +722,20 @@ const API_SCOPES = {
     KEYS_MANAGE: 'keys:manage'
 };
 
+const STEP_UP_METHODS = {
+    EMAIL: 'email',
+    TOTP: 'totp'
+};
+const STEP_UP_ERROR_CODES = {
+    STEP_UP_REQUIRED: 'step_up_required',
+    STEP_UP_NOT_APPLICABLE: 'step_up_not_applicable',
+    STEP_UP_THROTTLED: 'step_up_throttled',
+    STEP_UP_UNDELIVERABLE: 'step_up_undeliverable',
+    STEP_UP_CODE_INVALID: 'step_up_code_invalid',
+    STEP_UP_CODE_EXPIRED: 'step_up_code_expired',
+    STEP_UP_LOCKED: 'step_up_locked'
+};
+
 const SUPPRESSION_REASONS = {
     BOUNCE: 'bounce',
     COMPLAINT: 'complaint',
@@ -757,7 +808,12 @@ const WEBHOOK_SIGNATURE_HEADERS = WEBHOOK_HEADERS;
 const CLIENT_REGISTRY_KEY = Symbol.for('openemail.sdk.client.v1');
 const CLIENT_REGISTRY = globalThis;
 
-const LOCAL_HOSTS = ['localhost', '127.0.0.1', '0.0.0.0', '::1'];
+const LOOPBACK_HOSTNAMES = ['localhost', '::1', '[::1]'];
+const LOOPBACK_IPV4_PATTERN = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+const LOOPBACK_IPV4_ADDRESS = '127.0.0.1';
+const LOOPBACK_IPV6_ADDRESS = '[::1]';
+const UNSPECIFIED_HOSTNAMES = ['0.0.0.0', '::', '[::]'];
+const LOCAL_HOSTS = [...LOOPBACK_HOSTNAMES, LOOPBACK_IPV4_ADDRESS, ...UNSPECIFIED_HOSTNAMES];
 const ENDPOINT_SCHEME_PATTERN = /^[a-z][a-z0-9+.-]*:\/\//i;
 
 const RETRYABLE_STATUSES = new Set(RETRY.STATUSES);
@@ -866,13 +922,36 @@ const RETRYABLE_METHODS = new Set(RETRY.METHODS);
     scopes: [API_SCOPES.WEBHOOKS_READ]});
 
 const IsApiKey = (value) => typeof value === 'string' && (value.startsWith(API_KEY_PREFIXES.LIVE) || value.startsWith(API_KEY_PREFIXES.TEST));
-const ModeOf = (apiKey) => apiKey.startsWith(API_KEY_PREFIXES.TEST) ? API_KEY_MODES.TEST : API_KEY_MODES.LIVE;
+const IsAccessToken = (value) => typeof value === 'string'
+    && value.length > 0
+    && value.length <= ACCESS_TOKEN_RULES.MAX_LENGTH
+    && !value.startsWith(ACCESS_TOKEN_RULES.RESERVED_PREFIX);
+const IsPresent = (value) => value !== undefined && value !== null && value !== '';
+const ModeOf = (apiKey) => apiKey?.startsWith(API_KEY_PREFIXES.TEST) ? API_KEY_MODES.TEST : API_KEY_MODES.LIVE;
 const AssertApiKey = (apiKey, where) => {
     if (!apiKey)
         throw new Error(CLIENT_MESSAGES.API_KEY_REQUIRED);
     if (!IsApiKey(apiKey))
         throw new Error(`${where} ${CLIENT_MESSAGES.API_KEY_SHAPE}`);
 };
+const AssertAccessToken = (accessToken, where) => {
+    if (typeof accessToken === 'function')
+        return;
+    if (!IsAccessToken(accessToken))
+        throw new Error(`${where} ${CLIENT_MESSAGES.ACCESS_TOKEN_SHAPE}`);
+};
+const AssertCredential = (apiKey, accessToken, required) => {
+    const withKey = IsPresent(apiKey);
+    const withToken = IsPresent(accessToken);
+    if (withKey && withToken)
+        throw new Error(CLIENT_MESSAGES.CREDENTIAL_CONFLICT);
+    if (withKey)
+        AssertApiKey(apiKey, '{ apiKey }');
+    else if (withToken)
+        AssertAccessToken(accessToken, '{ accessToken }');
+    else if (required)
+        throw new Error(CLIENT_MESSAGES.CREDENTIAL_REQUIRED);
+};
 
 const IsBrowser = () => {
     const scope = globalThis;
@@ -910,6 +989,9 @@ class OpenEmailApiError extends Error {
     get isScopeMissing() {
         return this.code === ERROR_CODES.INSUFFICIENT_SCOPE;
     }
+    get isStepUpRequired() {
+        return this.code === STEP_UP_ERROR_CODES.STEP_UP_REQUIRED;
+    }
     get isInvalidRequest() {
         return this.type === ERROR_TYPES.INVALID_REQUEST_ERROR;
     }
@@ -1009,8 +1091,25 @@ const Backoff = (attempt) => {
     return Math.round(ceiling * (0.5 + Math.random() * 0.5));
 };
 
-const BuildUrl = (baseUrl, path, query) => {
+const PATH_SHAPE = 'is not a usable request path. Pass a path on the API that begins with a single "/", such as "/threads". Anything else could send the request, and the credential it carries, to another host.';
+const OFF_ORIGIN = 'leaves the API origin, so the request was not sent. Pass a path on the API that begins with a single "/", such as "/threads".';
+const ApiUrl = (baseUrl, path) => {
+    if (typeof path !== 'string' || !path.startsWith('/') || path.startsWith('//') || path.startsWith('/\\')) {
+        throw new Error(`${JSON.stringify(path)} ${PATH_SHAPE}`);
+    }
     const url = `${baseUrl.replace(/\/+$/, '')}${path}`;
+    let origin = null;
+    try {
+        origin = new URL(url).origin;
+    }
+    catch { }
+    if (origin === null || origin !== new URL(baseUrl).origin)
+        throw new Error(`${JSON.stringify(path)} ${OFF_ORIGIN}`);
+    return url;
+};
+
+const BuildUrl = (baseUrl, path, query) => {
+    const url = ApiUrl(baseUrl, path);
     if (!query)
         return url;
     const params = new URLSearchParams();
@@ -1023,6 +1122,8 @@ const BuildUrl = (baseUrl, path, query) => {
     return serialized ? `${url}?${serialized}` : url;
 };
 
+const CleartextCredentialMessage = (baseUrl) => `Refused to send a credential to ${baseUrl} over plain http, where anyone on the network can read it. Use an https base URL. Plain http is accepted only for a server on this machine: localhost, a 127.x.x.x address or ::1.`;
+
 const Deadline = (timeoutMs, signal) => {
     const controller = new AbortController();
     let expired = false;
@@ -1061,6 +1162,23 @@ const IdempotencyKey = () => {
     return `${IDEMPOTENCY_KEY_PREFIX}${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 14)}`;
 };
 
+const IsLoopbackHost = (hostname) => {
+    const host = hostname.toLowerCase();
+    return LOOPBACK_HOSTNAMES.includes(host) || LOOPBACK_IPV4_PATTERN.test(host);
+};
+
+const IsSecureOrigin = (url) => {
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === 'https:' || (parsed.protocol === 'http:' && IsLoopbackHost(parsed.hostname));
+    }
+    catch {
+        return false;
+    }
+};
+
+const IsUnspecifiedHost = (hostname) => UNSPECIFIED_HOSTNAMES.includes(hostname.toLowerCase());
+
 const RetryAfter = (value) => {
     if (!value)
         return undefined;
@@ -1119,6 +1237,13 @@ const ToErrorProps = (response, body, rawText, retryAfterSeconds) => {
     };
 };
 
+const Substitute = (url) => {
+    const suggestion = new URL(url.href);
+    suggestion.hostname = url.hostname.startsWith('[') ? LOOPBACK_IPV6_ADDRESS : LOOPBACK_IPV4_ADDRESS;
+    return suggestion.href.replace(/\/+$/, '');
+};
+const UnspecifiedHostMessage = (baseUrl, url) => `${JSON.stringify(baseUrl)} names ${url.hostname}, an address a server listens on, not one to send requests to. For a server on this machine, use ${Substitute(url)}.`;
+
 const Describe = (error) => error instanceof Error ? error.message : String(error);
 const ParseJson = (text) => {
     if (!text)
@@ -1130,34 +1255,45 @@ const ParseJson = (text) => {
         return undefined;
     }
 };
-const ValidBaseUrl = (value) => {
-    const trimmed = value.trim().replace(/\/+$/, '');
+const ParseBaseUrl = (value) => {
     try {
-        const parsed = new URL(trimmed);
-        if (parsed.protocol === 'https:' || parsed.protocol === 'http:')
-            return trimmed;
+        const parsed = new URL(value);
+        return parsed.protocol === 'https:' || parsed.protocol === 'http:' ? parsed : undefined;
+    }
+    catch {
+        return undefined;
     }
-    catch { }
-    throw new Error(`${JSON.stringify(value)} ${CLIENT_MESSAGES.BASE_URL_SHAPE}`);
+};
+const ValidBaseUrl = (value) => {
+    const trimmed = value.trim().replace(/\/+$/, '');
+    const parsed = ParseBaseUrl(trimmed);
+    if (!parsed)
+        throw new Error(`${JSON.stringify(value)} ${CLIENT_MESSAGES.BASE_URL_SHAPE}`);
+    if (IsUnspecifiedHost(parsed.hostname))
+        throw new Error(UnspecifiedHostMessage(value, parsed));
+    return trimmed;
 };
 class Transport {
     #apiKey;
+    #accessToken;
     #inboxToken;
     baseUrl;
+    #secureOrigin;
     fetchImpl;
     maxRetries;
     timeoutMs;
     userAgent;
     headers;
     constructor(options) {
-        if (options.apiKey !== undefined)
-            AssertApiKey(options.apiKey, '{ apiKey }');
+        AssertCredential(options.apiKey, options.accessToken, false);
         const fetchImpl = options.fetch ?? globalThis.fetch?.bind(globalThis);
         if (!fetchImpl)
             throw new Error(CLIENT_MESSAGES.NO_FETCH);
-        this.#apiKey = options.apiKey;
+        this.#apiKey = IsPresent(options.apiKey) ? options.apiKey : undefined;
+        this.#accessToken = IsPresent(options.accessToken) ? options.accessToken : undefined;
         this.#inboxToken = options.inboxToken;
         this.baseUrl = ValidBaseUrl(options.baseUrl ?? DEFAULTS.BASE_URL);
+        this.#secureOrigin = IsSecureOrigin(this.baseUrl);
         this.fetchImpl = fetchImpl;
         this.maxRetries = Math.max(0, options.maxRetries ?? DEFAULTS.MAX_RETRIES);
         this.timeoutMs = options.timeoutMs ?? DEFAULTS.TIMEOUT_MS;
@@ -1169,7 +1305,7 @@ class Transport {
     async request(path, options = {}) {
         const method = (options.method ?? HTTP_METHODS.GET).toUpperCase();
         const url = BuildUrl(this.baseUrl, path, options.query);
-        const headers = this.headersFor(options);
+        const headers = await this.headersFor(options);
         const body = options.raw !== undefined
             ? options.raw
             : options.body === undefined ? undefined : JSON.stringify(options.body);
@@ -1201,7 +1337,16 @@ class Transport {
             throw new OpenEmailApiError(ToErrorProps(response, ParseJson(text), text, retryAfter));
         }
     }
-    headersFor(options) {
+    async resolveAccessToken() {
+        const source = this.#accessToken;
+        if (typeof source !== 'function')
+            return source;
+        const token = await source();
+        if (!IsAccessToken(token))
+            throw new Error(`${CLIENT_MESSAGES.ACCESS_TOKEN_PROVIDED} ${CLIENT_MESSAGES.ACCESS_TOKEN_SHAPE}`);
+        return token;
+    }
+    async headersFor(options) {
         const headers = {
             ...this.headers,
             [HEADER_KEYS.ACCEPT]: options.accept ?? CONTENT_TYPES.JSON
@@ -1215,7 +1360,10 @@ class Transport {
         if (options.anonymous !== true) {
             if (options.apiKey !== undefined)
                 AssertApiKey(options.apiKey, '{ apiKey } on this call');
-            const credential = options.inboxToken ?? options.apiKey ?? this.#inboxToken ?? this.#apiKey;
+            const direct = options.inboxToken ?? options.apiKey ?? this.#inboxToken ?? this.#apiKey;
+            if ((direct ?? this.#accessToken) && !this.#secureOrigin)
+                throw new Error(CleartextCredentialMessage(this.baseUrl));
+            const credential = direct ?? await this.resolveAccessToken();
             if (credential)
                 headers[HEADER_KEYS.AUTHORIZATION] = `Bearer ${credential}`;
         }
@@ -1338,6 +1486,9 @@ const BroadcastPath = (id) => `${PATHS.BROADCASTS}/${Segment(id)}`;
 const BroadcastChildPath = (id, segment) => `${BroadcastPath(id)}/${segment}`;
 const BroadcastRecipientPath = (id, emailId) => `${BroadcastChildPath(id, SEGMENTS.RECIPIENTS)}/${Segment(emailId)}`;
 const DomainPath = (id) => `${PATHS.DOMAINS}/${Segment(id)}`;
+const DomainChildPath = (id, segment) => `${DomainPath(id)}/${segment}`;
+const DomainAddressesPath = (id) => `${DomainPath(id)}/${SEGMENTS.ADDRESSES}`;
+const DomainAddressPath = (id, addressId) => `${DomainAddressesPath(id)}/${Segment(addressId)}`;
 const WebhookPath = (id) => `${PATHS.WEBHOOKS}/${Segment(id)}`;
 const WebhookChildPath = (id, segment) => `${WebhookPath(id)}/${segment}`;
 const WebhookDeliveryPath = (id, deliveryId) => `${WebhookChildPath(id, SEGMENTS.DELIVERIES)}/${Segment(deliveryId)}`;
@@ -1410,7 +1561,8 @@ const Addresses = (transport) => {
 const MemberQuery = (options) => ({
     [QUERY_KEYS.Q]: options.q,
     [QUERY_KEYS.SOURCE]: options.source,
-    [QUERY_KEYS.SORT]: options.sort
+    [QUERY_KEYS.SORT]: options.sort,
+    [QUERY_KEYS.STATUS]: options.statuses?.length ? options.statuses.join(LIST_SEPARATOR) : undefined
 });
 const GrowthQuery = (options) => ({
     [QUERY_KEYS.AUDIENCE_IDS]: options.audienceIds?.join(LIST_SEPARATOR),
@@ -1728,12 +1880,52 @@ const Domains = (transport) => ({
     listAll: (options = {}) => CollectAll(transport, PATHS.DOMAINS, CURSOR_STYLES.CURSOR, options),
     iterate: (options = {}) => IteratePages(transport, PATHS.DOMAINS, CURSOR_STYLES.CURSOR, options),
     get: (id, options = {}) => transport.request(DomainPath(id), { signal: options.signal, apiKey: options.apiKey }),
+    create: (body, options = {}) => transport.request(PATHS.DOMAINS, {
+        method: HTTP_METHODS.POST,
+        body,
+        signal: options.signal,
+        apiKey: options.apiKey
+    }),
+    verify: (id, options = {}) => transport.request(DomainChildPath(id, SEGMENTS.VERIFY), {
+        method: HTTP_METHODS.POST,
+        repeatable: true,
+        signal: options.signal,
+        apiKey: options.apiKey
+    }),
     update: (id, patch, options = {}) => transport.request(DomainPath(id), {
         method: HTTP_METHODS.PATCH,
         body: patch,
         repeatable: true,
         signal: options.signal,
         apiKey: options.apiKey
+    }),
+    delete: (id, options = {}) => transport.request(DomainPath(id), {
+        method: HTTP_METHODS.DELETE,
+        signal: options.signal,
+        apiKey: options.apiKey
+    }),
+    listAddresses: (id, options = {}) => FetchPage(transport, DomainAddressesPath(id), CURSOR_STYLES.CURSOR, options),
+    listAllAddresses: (id, options = {}) => CollectAll(transport, DomainAddressesPath(id), CURSOR_STYLES.CURSOR, options),
+    iterateAddresses: (id, options = {}) => IteratePages(transport, DomainAddressesPath(id), CURSOR_STYLES.CURSOR, options),
+    createAddress: (id, body, options = {}) => transport.request(DomainAddressesPath(id), {
+        method: HTTP_METHODS.POST,
+        body,
+        repeatable: true,
+        signal: options.signal,
+        apiKey: options.apiKey
+    }),
+    getAddress: (id, addressId, options = {}) => transport.request(DomainAddressPath(id, addressId), { signal: options.signal, apiKey: options.apiKey }),
+    updateAddress: (id, addressId, patch, options = {}) => transport.request(DomainAddressPath(id, addressId), {
+        method: HTTP_METHODS.PATCH,
+        body: patch,
+        repeatable: true,
+        signal: options.signal,
+        apiKey: options.apiKey
+    }),
+    deleteAddress: (id, addressId, options = {}) => transport.request(DomainAddressPath(id, addressId), {
+        method: HTTP_METHODS.DELETE,
+        signal: options.signal,
+        apiKey: options.apiKey
     })
 });
 
@@ -2229,6 +2421,22 @@ const Rules = (transport) => ({
     iterateRuns: (options = {}) => IteratePages(transport, PATHS.RULES_RUNS, CURSOR_STYLES.CURSOR, options, RunsQuery(options))
 });
 
+const Security = (transport) => ({
+    stepUpStatus: (options = {}) => transport.request(PATHS.SECURITY_STEP_UP, { signal: options.signal, apiKey: options.apiKey }),
+    beginStepUp: (body = {}, options = {}) => transport.request(PATHS.SECURITY_STEP_UP, {
+        method: HTTP_METHODS.POST,
+        body,
+        signal: options.signal,
+        apiKey: options.apiKey
+    }),
+    verifyStepUp: (body, options = {}) => transport.request(PATHS.SECURITY_STEP_UP_VERIFY, {
+        method: HTTP_METHODS.POST,
+        body,
+        signal: options.signal,
+        apiKey: options.apiKey
+    })
+});
+
 const Settings = (transport) => ({
     get: (options = {}) => transport.request(PATHS.SETTINGS, {
         query: { [QUERY_KEYS.ADDRESS]: options.address },
@@ -2617,6 +2825,7 @@ class OpenEmail {
     transport;
     mode;
     me;
+    security;
     keys;
     addresses;
     languages;
@@ -2643,12 +2852,13 @@ class OpenEmail {
     tempMail;
     constructor(configuration) {
         const options = typeof configuration === 'string' ? { apiKey: configuration } : configuration;
-        AssertApiKey(options.apiKey, '{ apiKey }');
+        AssertCredential(options.apiKey, options.accessToken, true);
         if (IsBrowser() && options.dangerouslyAllowBrowser !== true)
             throw new Error(BROWSER_REFUSAL);
         this.transport = new Transport(options);
         this.mode = ModeOf(options.apiKey);
         this.me = Me(this.transport);
+        this.security = Security(this.transport);
         this.keys = Keys(this.transport);
         this.addresses = Addresses(this.transport);
         this.languages = Languages(this.transport);
@@ -2690,6 +2900,19 @@ const FromEnvironment = (name) => {
     }
 };
 
+const IsLocalHost = (hostname) => {
+    const host = hostname.toLowerCase();
+    return LOCAL_HOSTS.includes(host) || LOOPBACK_IPV4_PATTERN.test(host);
+};
+
+const HostnameOf = (authority) => {
+    try {
+        return new URL(`http://${authority}`).hostname;
+    }
+    catch {
+        return '';
+    }
+};
 const NormaliseEndpoint = (value) => {
     if (!value)
         return undefined;
@@ -2698,15 +2921,18 @@ const NormaliseEndpoint = (value) => {
         return undefined;
     if (ENDPOINT_SCHEME_PATTERN.test(trimmed))
         return trimmed;
-    const host = trimmed.split(':')[0];
-    return `${LOCAL_HOSTS.includes(host) ? 'http' : 'https'}://${trimmed}`;
+    return `${IsLocalHost(HostnameOf(trimmed)) ? 'http' : 'https'}://${trimmed}`;
 };
 
 const CreateClient = (configuration = {}) => {
     const options = typeof configuration === 'string' ? { apiKey: configuration } : configuration;
+    const explicit = options.apiKey !== undefined || options.accessToken !== undefined;
+    const apiKey = explicit ? options.apiKey : FromEnvironment(ENV_VARS.API_KEY);
+    const accessToken = explicit || apiKey !== undefined ? options.accessToken : FromEnvironment(ENV_VARS.ACCESS_TOKEN);
     return new OpenEmail({
         ...options,
-        apiKey: options.apiKey ?? FromEnvironment(ENV_VARS.API_KEY),
+        apiKey,
+        accessToken,
         baseUrl: NormaliseEndpoint(options.baseUrl ?? FromEnvironment(ENV_VARS.BASE_URL))
     });
 };
@@ -2714,6 +2940,7 @@ const CreateClient = (configuration = {}) => {
 const CreateTempMail = (options = {}) => TempMail(new Transport({
     ...options,
     apiKey: undefined,
+    accessToken: undefined,
     baseUrl: NormaliseEndpoint(options.baseUrl ?? FromEnvironment(ENV_VARS.BASE_URL))
 }));
 
@@ -2841,9 +3068,10 @@ const createTempMail = CreateTempMail;
 const verifyWebhookSignature = VerifyWebhookSignature;
 const toBase64 = ToBase64;
 const isApiKey = IsApiKey;
+const isAccessToken = IsAccessToken;
 const isSealed = IsSealed;
 const resolveLanguage = ResolveLanguage;
 const languageByCode = LanguageByCode;
 const isRtlLanguage = IsRtlLanguage;
 
-export { API_SCOPES, BROADCAST_RECIPIENT_FILTERS, BROADCAST_STATUSES, CONTACT_BLOCK_LISTS, CONTACT_PHOTO_TYPES, CONTACT_THREAD_SORTS, ERROR_TYPES, FILE_DIRECTIONS, FILE_KINDS, FILE_SORTS, FILE_USAGES, LANGUAGES, MESSAGE_ENCRYPTION_FORMATS, OpenEmail, OpenEmailApiError, OpenEmailNetworkError, PAGE_LIMITS, PEOPLE_SORTS, PROVIDER_IMPORT_DOMAIN_STATES, PROVIDER_IMPORT_RESOURCES, PROVIDER_IMPORT_STATUSES, RULE_ACTIONS, RULE_FIELDS, RULE_OPERATORS, SUPPRESSION_REASONS, THREAD_SORTS, VERSION, WEBHOOK_EVENTS, WEBHOOK_REPLAY_ERROR_CODES, WEBHOOK_SIGNATURE_HEADERS, createClient, createOpenEmail, createTempMail, OpenEmail as default, getClient, init, isApiKey, isRtlLanguage, isSealed, languageByCode, openemail, resetClient, resolveLanguage, toBase64, verifyWebhookSignature };
+export { API_SCOPES, AUDIENCE_MEMBER_STATUSES, BROADCAST_RECIPIENT_FILTERS, BROADCAST_STATUSES, CONTACT_BLOCK_LISTS, CONTACT_PHOTO_TYPES, CONTACT_THREAD_SORTS, CREDENTIAL_KINDS, DOMAIN_DMARC_STAGES, DOMAIN_RECORD_STATUSES, ERROR_TYPES, FILE_DIRECTIONS, FILE_KINDS, FILE_SORTS, FILE_USAGES, FILE_VISIBILITIES, LANGUAGES, MESSAGE_ENCRYPTION_FORMATS, OpenEmail, OpenEmailApiError, OpenEmailNetworkError, PAGE_LIMITS, PEOPLE_SORTS, PROVIDER_IMPORT_DOMAIN_STATES, PROVIDER_IMPORT_RESOURCES, PROVIDER_IMPORT_STATUSES, RULE_ACTIONS, RULE_FIELDS, RULE_OPERATORS, STEP_UP_ERROR_CODES, STEP_UP_METHODS, SUPPRESSION_REASONS, THREAD_SORTS, VERSION, WEBHOOK_EVENTS, WEBHOOK_REPLAY_ERROR_CODES, WEBHOOK_SIGNATURE_HEADERS, createClient, createOpenEmail, createTempMail, OpenEmail as default, getClient, init, isAccessToken, isApiKey, isRtlLanguage, isSealed, languageByCode, openemail, resetClient, resolveLanguage, toBase64, verifyWebhookSignature };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@openemail/sdk",
-    "version": "0.0.4",
+    "version": "0.0.6",
     "author": "OpenEmail",
     "license": "UNLICENSED",
     "description": "The official TypeScript SDK for the OpenEmail API. Send email and broadcasts, work with threads, drafts, labels, templates, rules, webhooks, tracking, contacts, audiences, domains, suppressions, files, API keys, roles, members, mailbox imports and disposable inboxes from code.",
@@ -39,7 +39,7 @@
     "sideEffects": false,
     "homepage": "https://openemail.uk/docs/sdk",
     "bugs": {
-        "url": "https://openemail.uk/support"
+        "url": "https://openemail.uk/contact"
     },
     "keywords": [
         "openemail",