@vibiz/cli 0.1.0 → 0.2.1

package/dist/{chunk-NWL4LVVI.js → chunk-J4RTAA72.js}

@@ -1,6 +1,16 @@
 #!/usr/bin/env node
 
 // packages/sdk/src/client.ts
+function noBodyMessage(status) {
+  if (status === 401) return "Not signed in (401): the API key is missing or was revoked.";
+  if (status === 404) return "Not found (404): check the API URL and the id.";
+  if (status === 413) return "Too large (413): send less at once.";
+  if (status === 429) return "Too many requests (429): wait a moment and retry.";
+  if (status >= 500) {
+    return `The Vibiz API did not answer properly (${status}). It is usually brief: retry in a minute.`;
+  }
+  return `The request failed with ${status} and no explanation from the API.`;
+}
 var VibizApiError = class extends Error {
   constructor(status, code, message, details) {
     super(message);
@@ -32,6 +42,7 @@ var Vibiz = class {
     if (init.raw) headers["content-type"] = init.contentType ?? "application/octet-stream";
     if (init.idempotencyKey) headers["idempotency-key"] = init.idempotencyKey;
     if (this.options.user) headers["x-vibiz-user"] = endUserHeader(this.options.user);
+    if (this.options.client) headers["x-vibiz-client"] = this.options.client;
     return this.fetchImpl(`${this.baseUrl}/v1${path}`, {
       method: init.method ?? "GET",
       headers,
@@ -44,7 +55,7 @@ var Vibiz = class {
     throw new VibizApiError(
       res.status,
       e?.code ?? "http_error",
-      e?.message ?? `HTTP ${res.status}`,
+      e?.message ?? noBodyMessage(res.status),
       e?.details
     );
   }
@@ -63,7 +74,7 @@ var Vibiz = class {
       throw new VibizApiError(
         res.status,
         e?.code ?? "http_error",
-        e?.message ?? `HTTP ${res.status}`,
+        e?.message ?? noBodyMessage(res.status),
         e?.details
       );
     }
@@ -104,10 +115,17 @@ var Vibiz = class {
       `/projects/${id}/actions/${name}`,
       { method: "POST", body: { input }, ...opts }
     ),
-    /** The production env. Owner keys only: an agent key gets `forbidden` (use `dev`). */
+    /** The production env. Full-access keys only: a Limited key gets `forbidden` (use `dev`). */
     env: (id) => this.request(`/projects/${id}/env`).then((r) => r.env),
     /** The production env's variable names, without values. Any key. */
     envNames: (id) => this.request(`/projects/${id}/env?names=1`).then((r) => r.names),
+    /**
+     * The names plus the console links where an owner copies the values
+     * (`console_url`) or just the production app key (`app_key_console_url`).
+     */
+    envLinks: (id) => this.request(
+      `/projects/${id}/env?names=1`
+    ),
     /**
      * The development environment: its own database branch (schema, no
      * production rows), its own sign-in and AI key. What agents and laptops use.
@@ -149,10 +167,10 @@ var Vibiz = class {
     /** The app key (`vz_app_…`), per environment. The secret itself only ever travels in the env. */
     appKeys: {
       list: (id) => this.request(`/projects/${id}/app-keys`).then((r) => r.data),
-      /** Production's needs an owner key. The old key works for `grace_seconds` (default 3600). */
+      /** Production's needs a full-access key. The old key works for `grace_seconds` (default 3600). */
       rotate: (id, opts = {}) => this.request(`/projects/${id}/app-keys/rotate`, { method: "POST", body: opts })
     },
-    /** Hosts outside Vibiz that receive the env server to server. Connecting needs an owner key. */
+    /** Hosts outside Vibiz that receive the env server to server. Connecting needs a full-access key. */
     hosts: {
       list: (id) => this.request(`/projects/${id}/hosts`).then((r) => r.data),
       add: (id, input) => this.request(`/projects/${id}/hosts`, { method: "POST", body: input }),
@@ -166,7 +184,7 @@ var Vibiz = class {
       )
     },
     /**
-     * The app's own database. `production` needs an owner key (it holds the
+     * The app's own database. `production` needs a full-access key (it holds the
      * app's users' data); agents read `development`, the default for them.
      */
     database: {
@@ -181,7 +199,7 @@ var Vibiz = class {
     },
     /**
      * How people sign in to the app (docs/SIGN-IN.md). `production` needs an
-     * owner key; agents work on `development`, the default for them.
+     * full-access key; agents work on `development`, the default for them.
      */
     auth: {
       get: (id, env) => this.request(`/projects/${id}/auth/settings${env ? `?env=${env}` : ""}`),
@@ -207,7 +225,7 @@ var Vibiz = class {
     /**
      * The business behind the project (docs/COMPANY.md). `env` defaults like
      * the API: production for owners, development for agents. Production
-     * submit, signing, actions and documents need an owner key.
+     * submit, signing, actions and documents need a full-access key.
      */
     company: {
       get: (id, env) => this.request(`/projects/${id}/company${envQuery(env)}`),
@@ -226,7 +244,7 @@ var Vibiz = class {
         { method: "DELETE" }
       ),
       /**
-       * Production files for real and charges the price: an owner key, `confirm: true`,
+       * Production files for real and charges the price: a full-access key, `confirm: true`,
        * and the `quote.total_cents` and `updated_at` of the draft that was reviewed
        * (a draft or price changed since is refused with a 409, not filed).
        */
@@ -235,7 +253,7 @@ var Vibiz = class {
         body: input
       }),
       /**
-       * Pay a live filing by card instead of from the balance (owner keys): the same
+       * Pay a live filing by card instead of from the balance (full-access keys): the same
        * body as `submit`; it is filed when the payment arrives (docs/BILLING.md "Company").
        */
       checkout: (id, input) => this.request(`/projects/${id}/company/checkout?env=production`, {
@@ -278,11 +296,17 @@ var Vibiz = class {
       accounts: (id, opts = {}) => this.request(
         `/projects/${id}/social/accounts${qs({ env: opts.env, kind: opts.kind, platform: opts.platform })}`
       ),
-      /** A link (1 h) for the owner to open and sign in to the platform. */
-      connect: (id, platform, opts = {}) => this.request(`/projects/${id}/social/connect${envQuery(opts.env)}`, {
-        method: "POST",
-        body: { platform, ...opts.ads ? { ads: true } : {} }
-      }),
+      /**
+       * Production (the default): a link (1 h) for the owner to open, approve and
+       * sign in to the platform. Development: the test account, made at once.
+       */
+      connect: (id, platform, opts = {}) => this.request(
+        `/projects/${id}/social/connect${envQuery(opts.env)}`,
+        {
+          method: "POST",
+          body: { platform, ...opts.ads ? { ads: true } : {} }
+        }
+      ),
       refreshAccounts: (id, env) => this.request(
         `/projects/${id}/social/accounts/refresh${envQuery(env)}`,
         { method: "POST", body: {} }
@@ -343,7 +367,7 @@ var Vibiz = class {
      * Payments (docs/PAYMENTS.md): Vibiz is the merchant, so an app sells from
      * its first call. `env` defaults like the API: production for owners,
      * development for agents. On production, refunds, cancels, withdrawing,
-     * payout setup and webhook settings need an owner key.
+     * payout setup and webhook settings need a full-access key.
      */
     payments: {
       get: (id, env) => this.request(`/projects/${id}/payments${envQuery(env)}`),
@@ -434,13 +458,28 @@ var Vibiz = class {
       simulate: (id, input) => this.request(
         `/projects/${id}/payments/simulate?env=development`,
         { method: "POST", body: input }
-      )
+      ),
+      /**
+       * The owner's own Stripe account instead of payments through Vibiz
+       * (docs/PAYMENTS.md "Your own account"). `link` makes a link for the
+       * owner (any key; production unless `env` says): give them `url`, only
+       * they can complete it. `disconnect` (owner only) goes back to Vibiz.
+       */
+      ownAccount: {
+        link: (id, env = "production") => this.request(`/projects/${id}/payments/own-account/link?env=${env}`, {
+          method: "POST",
+          body: {}
+        }),
+        disconnect: (id, env) => this.request(`/projects/${id}/payments/own-account${envQuery(env)}`, {
+          method: "DELETE"
+        })
+      }
     },
     /**
      * Custom connectors (docs/CONNECTORS.md): any HTTP API from one manifest,
      * called through Vibiz, which holds the key. `env` defaults like the API:
      * production for owners, development for agents. Production keys, and
-     * approving an agent's dangerous call, need an owner key.
+     * approving an agent's dangerous call, need a full-access key.
      */
     connectors: {
       list: (id) => this.request(`/projects/${id}/connectors`).then((r) => r.data),
@@ -459,7 +498,7 @@ var Vibiz = class {
       delete: (id, name) => this.request(`/projects/${id}/connectors/${encodeURIComponent(name)}`, {
         method: "DELETE"
       }),
-      /** Set values (`null` removes). Production: owner keys. Values are never read back. */
+      /** Set values (`null` removes). Production: full-access keys. Values are never read back. */
       setSecrets: (id, name, values, env) => this.request(
         `/projects/${id}/connectors/${encodeURIComponent(name)}/secrets${envQuery(env)}`,
         { method: "PUT", body: { values } }
@@ -468,7 +507,7 @@ var Vibiz = class {
         `/projects/${id}/connectors/${encodeURIComponent(name)}/check${envQuery(env)}`,
         { method: "POST", body: {} }
       ),
-      /** One operation. A dangerous one (or a production write) by an agent key answers 403 approval_required. */
+      /** One operation. A dangerous one (or a production write) by a Limited key answers 403 approval_required. */
       call: (id, name, input, opts = {}) => this.request(
         `/projects/${id}/connectors/${encodeURIComponent(name)}/call${envQuery(opts.env)}`,
         {
@@ -486,28 +525,43 @@ var Vibiz = class {
       approval: (id, approvalId) => this.request(
         `/projects/${id}/connectors/approvals/${encodeURIComponent(approvalId)}`
       ),
-      /** Owner keys. */
+      /** Full-access keys. */
       approve: (id, approvalId) => this.request(
         `/projects/${id}/connectors/approvals/${encodeURIComponent(approvalId)}/approve`,
         { method: "POST", body: {} }
       ),
-      /** Owner keys. */
+      /** Full-access keys. */
       deny: (id, approvalId) => this.request(
         `/projects/${id}/connectors/approvals/${encodeURIComponent(approvalId)}/deny`,
         { method: "POST", body: {} }
       )
     },
-    /** Where the app also runs outside Vibiz hosting. Adding and removing need an owner key. */
+    /**
+     * The owner's own domains: served by Vibiz hosting (with HTTPS once DNS
+     * points at it) or trusted for a host elsewhere. Adding and removing need
+     * a full-access key; any key reads status and asks for a re-check.
+     */
     domains: {
-      list: (id) => this.request(`/projects/${id}/domains`).then((r) => r.domains),
-      add: (id, domain) => this.request(`/projects/${id}/domains`, {
+      list: (id) => this.request(`/projects/${id}/domains`),
+      /** `hosting` defaults to `vibiz` when the project has Vibiz hosting, else `elsewhere`. */
+      add: (id, domain, opts = {}) => this.request(`/projects/${id}/domains`, {
         method: "POST",
-        body: { domain }
-      }).then((r) => r.domains),
-      remove: (id, domain) => this.request(
-        `/projects/${id}/domains/${encodeURIComponent(domain)}`,
-        { method: "DELETE" }
-      ).then((r) => r.domains)
+        body: { domain, ...opts }
+      }),
+      /** Check DNS and ownership again now. */
+      verify: (id, domain) => this.request(`/projects/${id}/domains/${encodeURIComponent(domain)}/verify`, {
+        method: "POST",
+        body: {}
+      }),
+      remove: (id, domain) => this.request(`/projects/${id}/domains/${encodeURIComponent(domain)}`, {
+        method: "DELETE"
+      }),
+      /**
+       * Full-access keys: buy a domain from the account's credits; it serves on this
+       * project once registered. A Limited key answers `owner_only` with the
+       * console link to hand the owner.
+       */
+      buy: (id, input) => this.request(`/projects/${id}/domains/buy`, { method: "POST", body: input })
     },
     /** Poll until every resource is ready, or throw on the first failure. */
     waitUntilReady: async (id, opts = {}) => {
@@ -536,6 +590,92 @@ var Vibiz = class {
     }).then((r) => r.missing),
     upload: (sha, bytes) => this.request(`/files/${sha}`, { method: "PUT", raw: bytes })
   };
+  /**
+   * A project's Files (docs: files): uploads and every AI-generated image,
+   * video and speech, kept permanently with a stable link. `env` defaults to
+   * production. (`files` above is the deploy upload cache.)
+   */
+  projectFiles = {
+    list: (projectId, opts = {}) => this.request(`/projects/${projectId}/files${qs({ ...opts })}`),
+    /** The newest file matching the filters (404 `not_found` when none). */
+    latest: (projectId, opts = {}) => this.request(`/projects/${projectId}/files/latest${qs({ ...opts })}`),
+    get: (projectId, fileId, opts = {}) => this.request(
+      `/projects/${projectId}/files/${encodeURIComponent(fileId)}${envQuery(opts.env)}`
+    ),
+    /** Upload bytes (or a Blob) as one file; at most 50 MB. */
+    upload: async (projectId, file, opts) => {
+      const bytes = file instanceof Uint8Array ? file : new Uint8Array(await file.arrayBuffer());
+      const contentType = opts.contentType ?? (file instanceof Blob && file.type ? file.type : "application/octet-stream");
+      return this.request(
+        `/projects/${projectId}/files${qs({
+          env: opts.env,
+          name: opts.name,
+          folder: opts.folder,
+          private: opts.private ? 1 : void 0
+        })}`,
+        { method: "POST", raw: bytes, contentType }
+      );
+    },
+    /** Save a file from a public URL (at most 50 MB). */
+    import: (projectId, input, opts = {}) => this.request(`/projects/${projectId}/files/import${envQuery(opts.env)}`, {
+      method: "POST",
+      body: input
+    }),
+    /** Rename, move to a folder (`null`: none), make private, tag or note. */
+    update: (projectId, fileId, patch, opts = {}) => this.request(
+      `/projects/${projectId}/files/${encodeURIComponent(fileId)}${envQuery(opts.env)}`,
+      { method: "PATCH", body: patch }
+    ),
+    /** Delete a file: its link stops working. */
+    delete: (projectId, fileId, opts = {}) => this.request(
+      `/projects/${projectId}/files/${encodeURIComponent(fileId)}${envQuery(opts.env)}`,
+      { method: "DELETE" }
+    ),
+    /** The file's bytes (private files too). */
+    download: async (projectId, fileId, opts = {}) => {
+      const res = await this.stream(
+        `/projects/${projectId}/files/${encodeURIComponent(fileId)}/content${envQuery(opts.env)}`
+      );
+      return new Uint8Array(await res.arrayBuffer());
+    }
+  };
+  /** Take a project elsewhere, or keep a backup (docs: export). */
+  exports = {
+    /** Start packing: `202` with the export `queued`. */
+    create: (projectId, input = {}) => this.request(`/projects/${projectId}/exports`, {
+      method: "POST",
+      body: input
+    }),
+    list: (projectId) => this.request(`/projects/${projectId}/exports`).then((r) => r.data),
+    get: (projectId, exportId) => this.request(`/projects/${projectId}/exports/${encodeURIComponent(exportId)}`),
+    waitUntilDone: async (projectId, exportId, opts = {}) => {
+      const deadline = Date.now() + (opts.timeoutMs ?? 30 * 6e4);
+      for (; ; ) {
+        const e = await this.exports.get(projectId, exportId);
+        opts.onProgress?.(e);
+        if (e.status !== "queued" && e.status !== "running") return e;
+        if (Date.now() > deadline)
+          throw new VibizApiError(408, "timeout", "Timed out waiting for the export.");
+        await sleep(opts.intervalMs ?? 2e3);
+      }
+    },
+    /** One of its files, from its signed link (no key sent). */
+    download: async (url) => {
+      const res = await this.fetchImpl(url);
+      if (!res.ok) return this.fail(res);
+      return res;
+    },
+    /**
+     * The environment's secret values as `.env` text. Full-access keys only; the
+     * call itself is the confirmation, so only make it when the person asked.
+     */
+    envFile: async (projectId, exportId) => {
+      const res = await this.stream(
+        `/projects/${projectId}/exports/${encodeURIComponent(exportId)}/env?confirm=1`
+      );
+      return res.text();
+    }
+  };
   deployments = {
     create: (projectId, input, opts = {}) => this.request(
       `/projects/${projectId}/deployments`,
@@ -611,11 +751,188 @@ var Vibiz = class {
     run: (name, input) => this.request(`/actions/${name}`, {
       method: "POST",
       body: { input }
-    })
+    }),
+    /** The web data actions (scrape, crawl, search, ads library…) with their inputs. */
+    list: () => this.request("/actions").then((r) => r.data),
+    /** Past runs, newest first, and one run with its output. */
+    runs: {
+      list: (q = {}) => this.request(
+        `/actions/runs${qs({ project: q.project, action: q.action, since: q.since, cursor: q.cursor, limit: q.limit })}`
+      ),
+      get: (id) => this.request(`/actions/runs/${encodeURIComponent(id)}`)
+    }
+  };
+  /**
+   * A site's design (docs: design): tokens, component styles, layout,
+   * screenshots and exports (Tailwind v4, shadcn/ui, CSS variables, a brief).
+   * With `projectId` the spec, brief and screenshots are saved to its Files.
+   */
+  design = {
+    extract: (input, opts = {}) => opts.projectId ? this.projects.runAction(opts.projectId, "web.design", input) : this.actions.run("web.design", input)
   };
   email = {
     /** Send from the project's address (`info@<slug>.vibiz.app` by default). */
-    send: (projectId, input, opts = {}) => this.projects.runAction(projectId, "email.send", input, opts)
+    send: (projectId, input, opts = {}) => this.projects.runAction(projectId, "email.send", input, opts),
+    /**
+     * Business email's settings (docs: email ▸ Broadcasts): the sending address
+     * (`news.<slug>`), footer, double opt-in, tracking, signup form, and the
+     * owner's monthly allowance for agent-sent mail. `setup` starts the sender.
+     */
+    marketing: {
+      get: (projectId) => this.request(`${mkt(projectId)}/marketing`),
+      update: (projectId, input) => this.request(`${mkt(projectId)}/marketing`, {
+        method: "PATCH",
+        body: input
+      }),
+      setup: (projectId) => this.request(`${mkt(projectId)}/marketing/setup`, {
+        method: "POST",
+        body: {}
+      })
+    },
+    lists: {
+      list: (projectId) => this.request(`${mkt(projectId)}/lists`),
+      create: (projectId, input) => this.request(`${mkt(projectId)}/lists`, { method: "POST", body: input }),
+      update: (projectId, list, input) => this.request(`${mkt(projectId)}/lists/${encodeURIComponent(list)}`, {
+        method: "PATCH",
+        body: input
+      }),
+      delete: (projectId, list) => this.request(
+        `${mkt(projectId)}/lists/${encodeURIComponent(list)}`,
+        { method: "DELETE" }
+      )
+    },
+    /** Contacts: by id or email. Upserting never re-subscribes someone who left. */
+    contacts: {
+      list: (projectId, q = {}) => this.request(`${mkt(projectId)}/contacts${qs(q)}`),
+      get: (projectId, contact) => this.request(`${mkt(projectId)}/contacts/${encodeURIComponent(contact)}`),
+      upsert: (projectId, input) => this.request(`${mkt(projectId)}/contacts`, { method: "POST", body: input }),
+      update: (projectId, contact, input) => this.request(`${mkt(projectId)}/contacts/${encodeURIComponent(contact)}`, {
+        method: "PATCH",
+        body: input
+      }),
+      delete: (projectId, contact) => this.request(
+        `${mkt(projectId)}/contacts/${encodeURIComponent(contact)}`,
+        { method: "DELETE" }
+      ),
+      /** A CSV from any newsletter tool. `dry_run` first: it reports, writes nothing. */
+      import: (projectId, input) => this.request(`${mkt(projectId)}/contacts/import`, {
+        method: "POST",
+        body: input
+      }),
+      imports: (projectId) => this.request(
+        `${mkt(projectId)}/contacts/imports`
+      ),
+      /** Contacts as CSV text. */
+      export: async (projectId, q = {}) => {
+        const res = await this.stream(`${mkt(projectId)}/contacts/export${qs(q)}`);
+        return res.text();
+      },
+      /** Something the contact did: segments and automations read it. */
+      track: (projectId, input) => this.request(`${mkt(projectId)}/events`, { method: "POST", body: input })
+    },
+    segments: {
+      list: (projectId) => this.request(`${mkt(projectId)}/segments`),
+      create: (projectId, input) => this.request(`${mkt(projectId)}/segments`, { method: "POST", body: input }),
+      update: (projectId, segment, input) => this.request(`${mkt(projectId)}/segments/${encodeURIComponent(segment)}`, {
+        method: "PATCH",
+        body: input
+      }),
+      delete: (projectId, segment) => this.request(
+        `${mkt(projectId)}/segments/${encodeURIComponent(segment)}`,
+        { method: "DELETE" }
+      ),
+      /** How many subscribed contacts a filter matches, and ten of them. */
+      preview: (projectId, filter) => this.request(
+        `${mkt(projectId)}/segments/preview`,
+        { method: "POST", body: { filter } }
+      )
+    },
+    /** An email as a contact would get it (a sample contact, or `contact_id`), untracked. */
+    render: (projectId, input) => this.request(`${mkt(projectId)}/render`, { method: "POST", body: input }),
+    /**
+     * Newsletters and announcements. Anyone drafts, reviews and sends tests (an
+     * agent's go to the owners); sending is the owner's, or an agent's within the
+     * owner's monthly allowance (otherwise `owner_only` with the review link).
+     */
+    broadcasts: {
+      list: (projectId, q = {}) => this.request(`${mkt(projectId)}/broadcasts${qs(q)}`),
+      get: (projectId, id) => this.request(`${mkt(projectId)}/broadcasts/${encodeURIComponent(id)}`),
+      create: (projectId, input) => this.request(`${mkt(projectId)}/broadcasts`, { method: "POST", body: input }),
+      update: (projectId, id, input) => this.request(`${mkt(projectId)}/broadcasts/${encodeURIComponent(id)}`, {
+        method: "PATCH",
+        body: input
+      }),
+      delete: (projectId, id) => this.request(
+        `${mkt(projectId)}/broadcasts/${encodeURIComponent(id)}`,
+        { method: "DELETE" }
+      ),
+      /** Everything to fix before sending, the audience, and the cost against the balance. */
+      review: (projectId, id) => this.request(
+        `${mkt(projectId)}/broadcasts/${encodeURIComponent(id)}/review`
+      ),
+      /** A free, untracked `[Test]` (default: to the account's owners). */
+      test: (projectId, id, input = {}) => this.request(
+        `${mkt(projectId)}/broadcasts/${encodeURIComponent(id)}/test`,
+        {
+          method: "POST",
+          body: input
+        }
+      ),
+      /** Now, or at `scheduled_at` (ISO). */
+      send: (projectId, id, input = {}) => this.request(`${mkt(projectId)}/broadcasts/${encodeURIComponent(id)}/send`, {
+        method: "POST",
+        body: input
+      }),
+      cancel: (projectId, id) => this.request(`${mkt(projectId)}/broadcasts/${encodeURIComponent(id)}/cancel`, {
+        method: "POST",
+        body: {}
+      }),
+      /** Owner only, after a pause. */
+      resume: (projectId, id) => this.request(`${mkt(projectId)}/broadcasts/${encodeURIComponent(id)}/resume`, {
+        method: "POST",
+        body: {}
+      }),
+      /** `status`: a send status, or `opened`, `clicked`, `unsubscribed`; `mailbox`: gmail, outlook… */
+      recipients: (projectId, id, q = {}) => this.request(
+        `${mkt(projectId)}/broadcasts/${encodeURIComponent(id)}/recipients${qs(q)}`
+      )
+    },
+    /** Onboarding sequences and the like: a trigger, then waits, emails and branches. */
+    automations: {
+      list: (projectId) => this.request(`${mkt(projectId)}/automations`),
+      get: (projectId, id) => this.request(`${mkt(projectId)}/automations/${encodeURIComponent(id)}`),
+      create: (projectId, input) => this.request(`${mkt(projectId)}/automations`, { method: "POST", body: input }),
+      update: (projectId, id, input) => this.request(`${mkt(projectId)}/automations/${encodeURIComponent(id)}`, {
+        method: "PATCH",
+        body: input
+      }),
+      delete: (projectId, id) => this.request(
+        `${mkt(projectId)}/automations/${encodeURIComponent(id)}`,
+        { method: "DELETE" }
+      ),
+      activate: (projectId, id) => this.request(
+        `${mkt(projectId)}/automations/${encodeURIComponent(id)}/activate`,
+        {
+          method: "POST",
+          body: {}
+        }
+      ),
+      pause: (projectId, id) => this.request(`${mkt(projectId)}/automations/${encodeURIComponent(id)}/pause`, {
+        method: "POST",
+        body: {}
+      }),
+      enrollments: (projectId, id, q = {}) => this.request(
+        `${mkt(projectId)}/automations/${encodeURIComponent(id)}/enrollments${qs(q)}`
+      ),
+      /** One email step as a free `[Test]` (default: to the owners). */
+      test: (projectId, id, input) => this.request(
+        `${mkt(projectId)}/automations/${encodeURIComponent(id)}/test`,
+        {
+          method: "POST",
+          body: input
+        }
+      )
+    }
   };
   /**
    * The AI gateway: chat, images, speech and transcription, metered against
@@ -730,7 +1047,7 @@ var Vibiz = class {
    * Your own AI provider keys (docs/AI.md "Your own keys"): calls they can
    * serve run only on them (never falling back to Vibiz) and cost 0 here.
    * Pass `projectId` for a project's override. Setting and removing need an
-   * owner key. Secrets are write-only: no method returns one.
+   * full-access key. Secrets are write-only: no method returns one.
    */
   aiKeys = {
     list: (opts = {}) => this.request(`${aiKeysBase(opts.projectId)}`),
@@ -758,18 +1075,138 @@ var Vibiz = class {
     get: (opts = {}) => this.request(`/usage${usageQuery(opts)}`),
     project: (projectId, opts = {}) => this.request(`/projects/${projectId}/usage${usageQuery(opts)}`)
   };
+  /**
+   * Buying domains (docs: buying a domain): search and quote with any key;
+   * the domains the account owns, auto-renew, renewals, the transfer code and
+   * the owner details (the registrant, saved once) need a full-access key.
+   */
+  domains = {
+    search: (q, opts = {}) => this.request(`/domains/search${qs({ q, project_id: opts.projectId })}`),
+    quote: (domain, opts = {}) => this.request(
+      `/domains/quote${qs({ domain, years: opts.years, project_id: opts.projectId })}`
+    ),
+    list: () => this.request("/domains"),
+    get: (domain) => this.request(`/domains/${encodeURIComponent(domain)}`),
+    update: (domain, input) => this.request(`/domains/${encodeURIComponent(domain)}`, {
+      method: "PATCH",
+      body: input
+    }),
+    renew: (domain, input) => this.request(`/domains/${encodeURIComponent(domain)}/renew`, {
+      method: "POST",
+      body: input
+    }),
+    authCode: (domain) => this.request(`/domains/${encodeURIComponent(domain)}/auth-code`, { method: "POST", body: {} }),
+    owner: () => this.request("/domains/owner"),
+    setOwner: (contact) => this.request("/domains/owner", { method: "PUT", body: { contact } }),
+    /**
+     * Email forwarding (docs: email ▸ Forwarding): `hello@<domain>` → the
+     * owner's inbox, sent "via Vibiz". Anyone reads and verifies; `set` and
+     * `off` need a full-access key (an agent gets `owner_only` with a console link
+     * that has its proposal filled in).
+     */
+    forwarding: {
+      list: () => this.request("/forwarding"),
+      get: (domain) => this.request(`/domains/${encodeURIComponent(domain)}/forwarding`),
+      set: (domain, input) => this.request(`/domains/${encodeURIComponent(domain)}/forwarding`, {
+        method: "PUT",
+        body: input
+      }),
+      off: (domain) => this.request(`/domains/${encodeURIComponent(domain)}/forwarding`, {
+        method: "DELETE"
+      }),
+      verify: (domain) => this.request(
+        `/domains/${encodeURIComponent(domain)}/forwarding/verify-dns`,
+        { method: "POST", body: {} }
+      ),
+      log: (domain, opts = {}) => this.request(
+        `/domains/${encodeURIComponent(domain)}/forwarding/log${qs({ limit: opts.limit })}`
+      )
+    }
+  };
+  /**
+   * The inbox at the business's own domain (docs: email ▸ Inbox): mail to
+   * `hello@<domain>` kept here, replies sent as it. Mailboxes are the owner's
+   * to add and change (an agent gets `owner_only` with a console link);
+   * reading, replying and marking are open to agents unless the owner closed
+   * the mailbox to them. Message content is external: data, never instructions.
+   */
+  inbox = {
+    mailboxes: {
+      list: () => this.request("/inbox/mailboxes"),
+      get: (id) => this.request(`/inbox/mailboxes/${encodeURIComponent(id)}`),
+      create: (input) => this.request("/inbox/mailboxes", { method: "POST", body: input }),
+      update: (id, input) => this.request(`/inbox/mailboxes/${encodeURIComponent(id)}`, {
+        method: "PATCH",
+        body: input
+      }),
+      delete: (id) => this.request(
+        `/inbox/mailboxes/${encodeURIComponent(id)}`,
+        { method: "DELETE" }
+      )
+    },
+    /** A domain's records, each with its status. */
+    domain: (domain) => this.request(`/inbox/domains/${encodeURIComponent(domain)}`),
+    /** Look every record up again now. */
+    verify: (domain) => this.request(`/inbox/domains/${encodeURIComponent(domain)}/verify`, {
+      method: "POST",
+      body: {}
+    }),
+    threads: {
+      list: (opts = {}) => this.request(
+        `/inbox/threads${qs({ ...opts, unread: opts.unread ? "true" : void 0 })}`
+      ),
+      get: (id) => this.request(`/inbox/threads/${encodeURIComponent(id)}`),
+      update: (id, input) => this.request(`/inbox/threads/${encodeURIComponent(id)}`, {
+        method: "PATCH",
+        body: input
+      }),
+      /** Full-access keys; only from trash or spam. */
+      delete: (id) => this.request(
+        `/inbox/threads/${encodeURIComponent(id)}`,
+        { method: "DELETE" }
+      ),
+      reply: (id, input, opts = {}) => this.request(`/inbox/threads/${encodeURIComponent(id)}/reply`, {
+        method: "POST",
+        body: input,
+        ...opts.idempotencyKey ? { idempotencyKey: opts.idempotencyKey } : {}
+      })
+    },
+    messages: {
+      update: (id, input) => this.request(`/inbox/messages/${encodeURIComponent(id)}`, {
+        method: "PATCH",
+        body: input
+      })
+    },
+    /** A new message (or a forward, with `forward_message_id`) from a mailbox. */
+    send: (input, opts = {}) => this.request("/inbox/send", {
+      method: "POST",
+      body: input,
+      ...opts.idempotencyKey ? { idempotencyKey: opts.idempotencyKey } : {}
+    }),
+    /** A file to attach (kept a day until sent); returns its id. */
+    upload: (file) => this.request(`/inbox/files${qs({ name: file.filename })}`, {
+      method: "POST",
+      raw: file.bytes,
+      contentType: file.contentType
+    }),
+    settings: {
+      get: () => this.request("/inbox/settings"),
+      /** Full-access keys: the new-mail digest. */
+      update: (input) => this.request("/inbox/settings", { method: "PATCH", body: input })
+    }
+  };
   /**
    * The account's own credits (docs/BILLING.md): the balance, the card,
    * auto-recharge and history. A top-up is a hosted page a person pays on.
    */
   billing = {
     get: () => this.request("/billing"),
-    /** Owner keys: auto-recharge and the daily safety cap. */
+    /** Full-access keys: auto-recharge and the daily safety cap. */
     update: (input) => this.request("/billing", { method: "PATCH", body: input }),
     /** A payment page for `amount_cents` (500–100000); hand its `url` to a person. */
     checkout: (input) => this.request("/billing/checkout", { method: "POST", body: input }),
     checkoutStatus: (id) => this.request(`/billing/checkout/${encodeURIComponent(id)}`),
-    /** Owner keys: a page to save or replace the card. */
+    /** Full-access keys: a page to save or replace the card. */
     saveCard: () => this.request("/billing/card", { method: "POST", body: {} }),
     removeCard: () => this.request("/billing/card", { method: "DELETE" }),
     ledger: (opts = {}) => this.request(
@@ -784,12 +1221,20 @@ var Vibiz = class {
   /** Named keys, one per teammate or agent, so spend shows per person. */
   apiKeys = {
     list: () => this.request("/api-keys").then((r) => r.data),
-    /** The secret is returned once, here. */
-    /** `agent` by default: builds and runs, never reads production secrets. Needs an owner key. */
+    /**
+     * The secret is returned once, here. Full access (`owner`) by default;
+     * `access: 'agent'` makes it Limited (builds and runs, never reads
+     * production secrets nor moves live money). Needs a full-access key.
+     */
     create: (name, opts = {}) => this.request("/api-keys", {
       method: "POST",
       body: { name, ...opts.access ? { access: opts.access } : {} }
     }),
+    /** Full access (`owner`) or Limited (`agent`), afterwards. Needs a full-access key, not this one. */
+    setAccess: (id, access) => this.request(`/api-keys/${encodeURIComponent(id)}`, {
+      method: "PATCH",
+      body: { access }
+    }),
     revoke: (id) => this.request(`/api-keys/${id}`, { method: "DELETE" })
   };
   /** A short-lived link to the hosted usage dashboard (admin scope needs an admin key). */
@@ -811,9 +1256,7 @@ var Vibiz = class {
     return this.request("/hosts").then((r) => r.data);
   }
   capabilities() {
-    return this.request(
-      "/capabilities"
-    );
+    return this.request("/capabilities");
   }
   /** The account and key this client acts as. */
   whoami() {
@@ -826,6 +1269,7 @@ var Vibiz = class {
     });
   }
 };
+var mkt = (projectId) => `/projects/${encodeURIComponent(projectId)}/email`;
 var envQuery = (env) => env ? `?env=${env}` : "";
 var qs = (q) => {
   const p = new URLSearchParams();