@remit/api-openapi-types 0.0.26 → 0.0.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/api-openapi-types",
-  "version": "0.0.26",
+  "version": "0.0.28",
   "type": "module",
   "main": "types.d.ts",
   "types": "types.d.ts",

package/types.d.ts

@@ -157,6 +157,22 @@ current enum emitter anyway, so the wire contract uses the bare form.
      * Status of an outbox message in the send queue
      */
     export type OutboxMessageStatus = "draft" | "queued" | "sending" | "sent" | "failed" | "blocked";
+    /**
+     * Where an attachment is between being promised and being sendable.
+
+There is no third state and no absence: a row exists from the moment room is
+claimed, so the cap can be enforced against rows in one transaction rather
+than against bytes that may or may not have landed yet.
+     */
+    export type OutboxAttachmentState = "Pending" | "Stored";
+    /**
+     * Why the server refused to reserve, or to accept, a file for a draft.
+
+Closed rather than free text: the composer renders its own copy for each
+member (naming the file, the size and the cap), so a refusal must be
+distinguishable from a network failure without parsing prose.
+     */
+    export type OutboxAttachmentRejectionReason = "EmptyFile" | "UnusableFilename" | "FileTooLarge" | "MessageTooLarge" | "TooManyAttachments" | "ReservationExpired" | "UploadMissing" | "SizeMismatch";
     /**
      * Message lifecycle status for move/delete operations
      */
@@ -165,6 +181,10 @@ current enum emitter anyway, so the wire contract uses the bare form.
      * Sync status for message move/delete operations
      */
     export type MessageSyncStatus = "synced" | "pending" | "failed";
+    /**
+     * Sender-authenticity tier for a message, resolved at body-sync from the trusted Authentication-Results header and the sender's pair-keyed standing. First match wins, in tier order: `Impersonation`, `Aligned`, `Authenticated`, `Routine`, `NotChecked`, `Caution`. `NotEvaluated` is the sentinel for a message the derivation has never run on — it is the default and what every message written before this field existed carries, and it is distinct from `NotChecked`, which is a result.
+     */
+    export type AuthenticityVerdict = "NotEvaluated" | "NotChecked" | "Aligned" | "Authenticated" | "Routine" | "Caution" | "Impersonation";
     /**
      * Authentication verdict for a single auth mechanism, as reported in the Authentication-Results header.
      */
@@ -244,6 +264,7 @@ current enum emitter anyway, so the wire contract uses the bare form.
     export type String800 = string;
     export type String32 = string;
     export type String256 = string;
+    export type String2048 = string;
     /**
      * A semantic version string (e.g. "1.10.0"). See https://semver.org.
 
@@ -257,7 +278,6 @@ zero-pad width `@semanticVersion` encodes with — a segment beyond that is
 a compile-time error rather than a value that silently sorts incorrectly.
      */
     export type SemanticVersion = string;
-    export type String2048 = string;
     export type String200 = string;
     export interface CognitoAuthorizer {
       /**
@@ -2492,6 +2512,22 @@ standing to persist.
        * Registrable domains (eTLD+1) the body's links point at, excluding the From address's own registrable domain. Present only for a message the provider's own filter already classified as spam; an empty array means every link stayed on the sender's domain, absence means the comparison was never made.
        */
       offDomainLinkDomains?: string[];
+      /**
+       * Registrable domain of the first verified DKIM `header.d` in trusted Authentication-Results order, or the reserved literal `unverified` when no identity could be established. Unlike `dkimDomain`, which is the unverified `d=` claim the sender wrote, this is only set from a signature the trusted Authentication-Results reported as passing. Absent for messages classified before the field existed.
+       */
+      signerDomain?: string;
+      /**
+       * SPF-checked envelope-from domain (`smtp.mailfrom`, falling back to `smtp.helo`) from the trusted Authentication-Results. Absent when the trusted header carried no SPF clause, or for messages classified before the field existed.
+       */
+      envelopeDomain?: string;
+      /**
+       * Messages this account had already seen for the sender's standing key when this message arrived. A snapshot frozen at derivation time, deliberately not a live read — a message classified when the key stood at 340 always reads 340. Absent for messages classified before the field existed.
+       */
+      signerMessageCount?: number;
+      /**
+       * Epoch milliseconds this account first saw the sender's standing key, snapshotted at derivation time alongside `signerMessageCount`. Absent for messages classified before the field existed.
+       */
+      signerFirstSeenAt?: number;
     }
     /**
      * Present only when Remit auto-moved this message on body-sync. Two shapes share this model: a classifier placement move carries `action` + `fromPlacement` (Inbox/Junk direction); a standing-filter move carries `fromMailboxId` + `destinationMailboxId` + `filterId` (an arbitrary destination folder). Absent means the message was not auto-moved by Remit — clients treat absence as no indicator.
@@ -2795,11 +2831,100 @@ present only when `count=true`. Thread-specific so the shared `ResultList<T>`
       sentAt?: number;
       createdAt: number;
       updatedAt: number;
+      /**
+       * Files on this message. Empty when it carries none.
+       */
+      attachments: OutboxAttachmentResponse[];
+    }
+    /**
+     * A file on a draft, from the moment room is claimed for it.
+
+The row is the record: it is what the per-message cap is counted over, what
+says an object in storage belongs to a message, and what goes when the draft
+goes. Storage holds bytes and nothing else — an object no row names is
+garbage, which is the only thing the sweep needs to know.
+     */
+    export interface OutboxAttachment {
+      /**
+       * Primary identifier
+       */
+      outboxAttachmentId: UUID;
+      /**
+       * Draft this file belongs to
+       */
+      outboxMessageId: UUID;
+      /**
+       * Sending account, so the storage key can be rebuilt without a join
+       */
+      accountId: UUID;
+      /**
+       * Tenant scope, so every read can be scoped without a join
+       */
+      accountConfigId: UUID;
+      /**
+       * Filename as it will appear on the sent message, sanitized server-side
+       */
+      filename: String256;
+      /**
+       * Media type recorded at upload. Never trusted for rendering.
+       */
+      contentType: String256;
+      /**
+       * Bytes claimed at reservation, confirmed against storage once stored
+       */
+      sizeBytes: number;
+      /**
+       * Whether the bytes have arrived
+       */
+      state: OutboxAttachmentState;
+      /**
+       * Where the bytes live. Written at reservation so nothing has to derive it.
+       */
+      storageKey: String2048;
+      /**
+       * When a Pending reservation stops holding room. Zero once Stored.
+       */
+      reservationExpiresAt: number;
+      createdAt: number;
+      updatedAt: number;
+    }
+    /**
+     * A file on a draft, as the composer sees it
+     */
+    export interface OutboxAttachmentResponse {
+      /**
+       * Primary identifier
+       */
+      outboxAttachmentId: UUID;
+      /**
+       * Draft this file belongs to
+       */
+      outboxMessageId: UUID;
+      /**
+       * Filename as it will appear on the sent message, sanitized server-side
+       */
+      filename: String256;
+      /**
+       * Media type recorded at upload. Never trusted for rendering.
+       */
+      contentType: String256;
+      /**
+       * Bytes claimed at reservation, confirmed against storage once stored
+       */
+      sizeBytes: number;
+      /**
+       * Whether the bytes have arrived
+       */
+      state: OutboxAttachmentState;
     }
     /**
      * Input for updating a draft outbox message
      */
     export interface UpdateOutboxMessageInput {
+      /**
+       * The files this draft keeps. Anything left out is removed with its bytes.
+       */
+      attachmentIds?: UUID[];
       /**
        * Recipient addresses (To)
        */
@@ -2833,6 +2958,89 @@ present only when `count=true`. Thread-specific so the shared `ResultList<T>`
        */
       references?: string[];
     }
+    /**
+     * What the client intends to attach, before any bytes move
+     */
+    export interface MintOutboxAttachmentInput {
+      /**
+       * Filename as the sender picked it. Sanitized server-side.
+       */
+      filename: String256;
+      /**
+       * Media type the browser reported. Recorded, never trusted for rendering.
+       */
+      contentType: String256;
+      /**
+       * Exact size of the file. The upload is bound to this number.
+       */
+      sizeBytes: number;
+    }
+    /**
+     * A reservation and somewhere to put the bytes.
+
+`uploadUrl` is opaque: on a hosted deployment it addresses block storage
+directly and the bytes never traverse this API, on a self-hosted one it
+addresses this deployment's own upload route. A client PUTs the file to it
+either way and cannot tell which it received.
+     */
+    export interface MintOutboxAttachmentResponse {
+      /**
+       * Primary identifier, and the name the completion call uses
+       */
+      outboxAttachmentId: UUID;
+      /**
+       * Draft the file is reserved against
+       */
+      outboxMessageId: UUID;
+      /**
+       * Sanitized filename that will appear on the sent message
+       */
+      filename: String256;
+      /**
+       * Normalized media type
+       */
+      contentType: String256;
+      /**
+       * Reserved size. The upload must carry exactly this many bytes.
+       */
+      sizeBytes: number;
+      /**
+       * Where to PUT the raw bytes. Single use, one attachment, expires.
+       */
+      uploadUrl: String2048;
+      /**
+       * When the reservation and the upload URL both lapse
+       */
+      uploadExpiresAt: number;
+    }
+    /**
+     * Refusal response for an attachment
+     */
+    export interface OutboxAttachmentRejected {
+      statusCode: 400 | 413;
+      error: OutboxAttachmentRejection;
+    }
+    /**
+     * A file the server refused, with everything the composer needs to say why
+     */
+    export interface OutboxAttachmentRejection {
+      /**
+       * Machine-readable reason
+       */
+      reason: OutboxAttachmentRejectionReason;
+      /**
+       * Sentence naming the file, its size and the cap
+       */
+      message: String512;
+      /**
+       * Total bytes one message may carry
+       */
+      limitBytes: number;
+      /**
+       * Bytes already spoken for on this draft, uploaded or merely reserved
+       */
+      usedBytes: number;
+    }
     /**
      * Normalized email address per RFC 2822 Section 3.4.1. Addresses are deduplicated across messages within an account config.
      */
@@ -3233,6 +3441,10 @@ present only when `count=true`. Thread-specific so the shared `ResultList<T>`
        * Structured sender-authenticity signal derived from DKIM headers at classification time. Absent for messages classified before this field was introduced — absence means no signal.
        */
       authenticity?: MessageAuthenticity;
+      /**
+       * Sender-authenticity tier resolved at body-sync. Defaults to `NotEvaluated`, the named pending state every message written before the derivation existed carries. Top-level rather than a member of `authenticity` on purpose: that blob is absent for all unsigned mail, so a guard keyed on its absence cannot tell "never derived" from "nothing to derive" and would re-derive unsigned mail forever.
+       */
+      authenticityVerdict: AuthenticityVerdict;
       /**
        * Provider authentication-results signal parsed from Authentication-Results header. Absent for messages synced before this field was introduced.
        */
@@ -4139,6 +4351,56 @@ locally".
       createdAt: number;
       updatedAt: number;
     }
+    /**
+     * How often this account has seen mail from one sender arrive under one DKIM
+signing identity. A third-party signer is not suspicious in itself — an ESP
+signing for its own domain on behalf of a customer is the ordinary shape of
+bulk mail — so what the authenticity derivation asks is whether this sender
+has been seen arriving this way before.
+
+`senderKey` carries two scopes, disambiguated by `signerDomain`: the From
+domain when the signer is a real verified identity, and the full From address
+when `signerDomain` is the reserved literal `unverified`. Address granularity
+on the unverified pseudo-pair is a security boundary — a domain-wide key would
+let one unverifiable message from any address at a domain earn quiet treatment
+for every forged sender at it.
+
+Standing is a noise filter, not an anti-spoofing control. It narrows the
+attack from "rent any established relay" to "rent the relay this specific From
+domain already uses"; it does not close it.
+     */
+    export interface SenderSignerStanding {
+      /**
+       * Owning account configuration. Standing is never shared between accounts.
+       */
+      accountConfigId: UUID;
+      /**
+       * Lowercased From domain when `signerDomain` names a real verified signer; the full lowercased From address when `signerDomain` is the reserved literal `unverified`.
+       */
+      senderKey: String256;
+      /**
+       * Registrable domain of the first verified DKIM `header.d` in trusted Authentication-Results order, or the reserved literal `unverified` when no identity could be established. `unverified` is rejected as a real signer domain on write.
+       */
+      signerDomain: String256;
+      /**
+       * Messages observed for this key. One increment per message.
+       */
+      messageCount: number;
+      /**
+       * Epoch milliseconds of the first observation. Immutable after creation — the conflict path of the upsert deliberately omits it, so a later message can never reset the key's age.
+       */
+      firstSeenAt: number;
+      /**
+       * Epoch milliseconds of the most recent observation.
+       */
+      lastSeenAt: number;
+      /**
+       * Epoch milliseconds the user affirmed knowing this sender, promoting `Caution` to `Routine` for the pair. `0` means never affirmed, which is the state of every row until a user acts.
+       */
+      userAffirmedAt: number;
+      createdAt: number;
+      updatedAt: number;
+    }
     /**
      * Content-Type and other MIME parameters (CHARSET, BOUNDARY, NAME, etc.)
      */
@@ -4798,6 +5060,26 @@ declare namespace Paths {
       export type $200 = void;
     }
   }
+  namespace MintOutboxAttachment {
+    export interface PathParameters {
+      outboxMessageId: Components.Schemas.UUID;
+    }
+    export type RequestBody = Components.Schemas.MintOutboxAttachmentInput;
+    namespace Responses {
+      export type $200 = void;
+      export type $200 = void;
+    }
+  }
+  namespace CompleteOutboxAttachment {
+    export interface PathParameters {
+      outboxMessageId: Components.Schemas.UUID;
+      outboxAttachmentId: Components.Schemas.UUID;
+    }
+    namespace Responses {
+      export type $200 = void;
+      export type $200 = void;
+    }
+  }
   namespace SearchAddresses {
     export interface QueryParameters {
       q: string;
@@ -5286,6 +5568,22 @@ Callers that omit `query` are unaffected: the INBOX (and starred) listings behav
     data?: any,
     config?: AxiosRequestConfig
   ): OperationResponse<Paths.SendOutboxMessage.Responses.$200>;
+  /**
+   * mintOutboxAttachment - Reserve room on a draft for a file, and get somewhere to put it
+   */
+  'mintOutboxAttachment'(
+    parameters?: Parameters<Paths.MintOutboxAttachment.PathParameters> | null,
+    data?: Paths.MintOutboxAttachment.RequestBody,
+    config?: AxiosRequestConfig
+  ): OperationResponse<Paths.MintOutboxAttachment.Responses.$200 | Paths.MintOutboxAttachment.Responses.$200>;
+  /**
+   * completeOutboxAttachment - Confirm an uploaded file against the object storage now holds
+   */
+  'completeOutboxAttachment'(
+    parameters?: Parameters<Paths.CompleteOutboxAttachment.PathParameters> | null,
+    data?: any,
+    config?: AxiosRequestConfig
+  ): OperationResponse<Paths.CompleteOutboxAttachment.Responses.$200 | Paths.CompleteOutboxAttachment.Responses.$200>;
   /**
    * searchAddresses - Search addresses for autocomplete
    */
@@ -5851,6 +6149,26 @@ Callers that omit `query` are unaffected: the INBOX (and starred) listings behav
       config?: AxiosRequestConfig
     ): OperationResponse<Paths.SendOutboxMessage.Responses.$200>;
   };
+  ['/outbox/{outboxMessageId}/attachments']: {
+    /**
+     * mintOutboxAttachment - Reserve room on a draft for a file, and get somewhere to put it
+     */
+    'post'(
+      parameters?: Parameters<Paths.MintOutboxAttachment.PathParameters> | null,
+      data?: Paths.MintOutboxAttachment.RequestBody,
+      config?: AxiosRequestConfig
+    ): OperationResponse<Paths.MintOutboxAttachment.Responses.$200 | Paths.MintOutboxAttachment.Responses.$200>;
+  };
+  ['/outbox/{outboxMessageId}/attachments/{outboxAttachmentId}/complete']: {
+    /**
+     * completeOutboxAttachment - Confirm an uploaded file against the object storage now holds
+     */
+    'post'(
+      parameters?: Parameters<Paths.CompleteOutboxAttachment.PathParameters> | null,
+      data?: any,
+      config?: AxiosRequestConfig
+    ): OperationResponse<Paths.CompleteOutboxAttachment.Responses.$200 | Paths.CompleteOutboxAttachment.Responses.$200>;
+  };
   ['/addresses/search']: {
     /**
      * searchAddresses - Search addresses for autocomplete
@@ -6047,7 +6365,13 @@ export type SemanticSearchResult = Components.Schemas.SemanticSearchResult;
 export type CreateOutboxMessageInput = Components.Schemas.CreateOutboxMessageInput;
 export type OutboxMessage = Components.Schemas.OutboxMessage;
 export type OutboxMessageResponse = Components.Schemas.OutboxMessageResponse;
+export type OutboxAttachment = Components.Schemas.OutboxAttachment;
+export type OutboxAttachmentResponse = Components.Schemas.OutboxAttachmentResponse;
 export type UpdateOutboxMessageInput = Components.Schemas.UpdateOutboxMessageInput;
+export type MintOutboxAttachmentInput = Components.Schemas.MintOutboxAttachmentInput;
+export type MintOutboxAttachmentResponse = Components.Schemas.MintOutboxAttachmentResponse;
+export type OutboxAttachmentRejected = Components.Schemas.OutboxAttachmentRejected;
+export type OutboxAttachmentRejection = Components.Schemas.OutboxAttachmentRejection;
 export type Address = Components.Schemas.Address;
 export type AddressFlags = Components.Schemas.AddressFlags;
 export type TrustedFlag = Components.Schemas.TrustedFlag;
@@ -6101,6 +6425,7 @@ export type MessageFlag = Components.Schemas.MessageFlag;
 export type MessagePlacementMove = Components.Schemas.MessagePlacementMove;
 export type MessageFlagPush = Components.Schemas.MessageFlagPush;
 export type Envelope = Components.Schemas.Envelope;
+export type SenderSignerStanding = Components.Schemas.SenderSignerStanding;
 export type BodyPartParameter = Components.Schemas.BodyPartParameter;
 export type RawMessageStorage = Components.Schemas.RawMessageStorage;
 export type BodyPartStorage = Components.Schemas.BodyPartStorage;
@@ -6139,8 +6464,11 @@ export type DisplayNameCorrespondence = Components.Schemas.DisplayNameCorrespond
 export type PlacementAction = Components.Schemas.PlacementAction;
 export type SemanticSearchChunkType = Components.Schemas.SemanticSearchChunkType;
 export type OutboxMessageStatus = Components.Schemas.OutboxMessageStatus;
+export type OutboxAttachmentState = Components.Schemas.OutboxAttachmentState;
+export type OutboxAttachmentRejectionReason = Components.Schemas.OutboxAttachmentRejectionReason;
 export type MessageStatus = Components.Schemas.MessageStatus;
 export type MessageSyncStatus = Components.Schemas.MessageSyncStatus;
+export type AuthenticityVerdict = Components.Schemas.AuthenticityVerdict;
 export type AuthResultVerdict = Components.Schemas.AuthResultVerdict;
 export type PlacementConfidence = Components.Schemas.PlacementConfidence;
 export type AddressRole = Components.Schemas.AddressRole;
@@ -6166,6 +6494,6 @@ export type String64 = Components.Schemas.String64;
 export type String800 = Components.Schemas.String800;
 export type String32 = Components.Schemas.String32;
 export type String256 = Components.Schemas.String256;
-export type SemanticVersion = Components.Schemas.SemanticVersion;
 export type String2048 = Components.Schemas.String2048;
+export type SemanticVersion = Components.Schemas.SemanticVersion;
 export type String200 = Components.Schemas.String200;