@workwae/sdk 0.0.0-stage → 0.1.0-alpha.1

package/index.js

@@ -0,0 +1,4334 @@
+// ../contract/src/accounts/models.ts
+import * as z3 from "zod";
+
+// ../contract/src/limits.ts
+var MAX_EMAIL_LENGTH = 320;
+var MAX_NAME_LENGTH = 100;
+var MAX_EXTERNAL_REF_LENGTH = 255;
+var MAX_DISPLAY_NAME_LENGTH = 255;
+var MAX_ADDRESS_NAME_LENGTH = 256;
+var MAX_SECRET_LENGTH = 1024;
+var MAX_NOTE_LENGTH = 500;
+var MAX_FILTER_QUERY_LENGTH = 200;
+var MAX_URL_LENGTH = 2048;
+var MAX_TIME_ZONE_LENGTH = 64;
+var MAX_CURSOR_LENGTH = 512;
+var MAX_PAGE_SIZE = 200;
+var DEFAULT_PAGE_SIZE = 50;
+var MAX_PROVIDER_ID_LENGTH = 1024;
+var MAX_HOST_LENGTH = 253;
+var MAX_PORT = 65535;
+var MAX_STATE_LENGTH = 1024;
+var MIN_TOKEN_TTL_SECONDS = 60;
+var MAX_TOKEN_TTL_SECONDS = 86400;
+var MAX_REDIRECT_URIS = 50;
+var MAX_UNDO_SEND_SECONDS = 60;
+var MIN_EVENT_RETENTION_DAYS = 7;
+var MAX_EVENT_RETENTION_DAYS = 30;
+var MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
+var MAX_SUBJECT_LENGTH = 998;
+var MAX_MESSAGE_ID_LENGTH = 998;
+var MAX_BODY_LENGTH = 2 * 1024 * 1024;
+var MAX_RECIPIENTS = 500;
+var MAX_REPLY_TO = 10;
+var MAX_ATTACHMENTS = 50;
+var MAX_FILENAME_LENGTH = 255;
+var MAX_CONTENT_TYPE_LENGTH = 255;
+var MAX_CONTENT_ID_LENGTH = 255;
+var MAX_SEND_REFERENCE_LENGTH = 255;
+var MAX_MAILBOX_CHANGES = 50;
+var MAX_SEARCH_QUERY_LENGTH = 500;
+var MAX_SEARCH_PAGE_SIZE = 100;
+var DEFAULT_SEARCH_PAGE_SIZE = 25;
+var MAX_THREAD_PAGE_SIZE = 100;
+var DEFAULT_THREAD_PAGE_SIZE = 25;
+var MAX_SIGNATURE_HTML_LENGTH = 1e5;
+var MAX_SIGNATURE_TEXT_LENGTH = 20000;
+var MAX_TEMPLATE_NAME_LENGTH = 255;
+var MAX_TEMPLATE_DESCRIPTION_LENGTH = 1000;
+var MAX_TEMPLATE_SUBJECT_LENGTH = 2000;
+var MAX_TEMPLATE_PREVIEW_TEXT_LENGTH = 2000;
+var MAX_TEMPLATE_BODY_LENGTH = 1e6;
+var MAX_MAIL_MERGE_ENTRIES = 100;
+var MAX_MAIL_MERGE_ATTACHMENT_BYTES = 50 * 1024 * 1024;
+var MAX_RENDER_PARAMS_BYTES = 256 * 1024;
+var MAX_RENDER_ITERATIONS = 1e4;
+var MAX_MARKDOWN_LENGTH = 1e5;
+var MAX_SUPPRESSION_BATCH = 1000;
+var MAX_SUPPRESSION_LIST_DESCRIPTION_LENGTH = 500;
+var MAX_SUPPRESSION_REASON_LENGTH = 200;
+var MAX_EVENT_ATTENDEES = 500;
+var MAX_EVENT_SUBJECT_LENGTH = 255;
+var MAX_EVENT_LOCATION_LENGTH = 255;
+var MAX_EVENT_BODY_LENGTH = 1e6;
+var MAX_EVENT_COMMENT_LENGTH = 2000;
+var MAX_RECURRENCE_LINES = 20;
+var MAX_RECURRENCE_LINE_LENGTH = 1000;
+var MAX_REMINDER_MINUTES = 40320;
+var MAX_AVAILABILITY_ATTENDEES = 20;
+var MAX_AVAILABILITY_DAYS = 62;
+var MIN_SLOT_MINUTES = 5;
+var MAX_SLOT_MINUTES = 1440;
+var MAX_SUGGESTIONS = 100;
+var MAX_EVENT_RANGE_DAYS = 400;
+var MAX_CALENDAR_EVENT_PAGE_SIZE = 500;
+var DEFAULT_CALENDAR_EVENT_PAGE_SIZE = 100;
+var MAX_CONTACT_ENTRIES = 20;
+var MAX_CONTACT_FIELD_LENGTH = 256;
+var MAX_CONTACT_PHONE_LENGTH = 64;
+var MAX_CONTACT_NOTES_LENGTH = 1e4;
+var MAX_CONTACT_PAGE_SIZE = 500;
+var DEFAULT_CONTACT_PAGE_SIZE = 100;
+var MAX_WEBHOOK_FILTER_VALUES = 100;
+var MAX_SUBJECT_FILTER_LENGTH = 200;
+var MAX_REPLAY_EVENTS = 1000;
+var MAX_WEBHOOK_ATTEMPT_PAGE_SIZE = 500;
+var DEFAULT_WEBHOOK_ATTEMPT_PAGE_SIZE = 50;
+var MAX_SIGNATURE_CANDIDATES = 8;
+var DEFAULT_WEBHOOK_SECRET_GRACE_SECONDS = 24 * 60 * 60;
+var MAX_WEBHOOK_SECRET_GRACE_SECONDS = 7 * 24 * 60 * 60;
+var MAX_DRAFT_INSTRUCTIONS_LENGTH = 2000;
+var MAX_DRAFT_CONTEXT_LENGTH = 20000;
+var MAX_MEETING_APP_ID_LENGTH = 200;
+var MAX_REFRESH_TOKEN_LENGTH = 4096;
+var MAX_KEY_FILE_LENGTH = 20000;
+var MAX_DIRECTORY_QUERY_LENGTH = 100;
+var MAX_DIRECTORY_PAGE_SIZE = 200;
+var DEFAULT_DIRECTORY_PAGE_SIZE = 100;
+var MAX_ADD_MAILBOXES = 100;
+var MAX_ENTRA_ID_LENGTH = 100;
+var MAX_STRIPE_ID_LENGTH = 255;
+var MAX_USAGE_RANGE_DAYS = 366;
+
+// ../contract/src/primitives.ts
+import * as z from "zod";
+var openApiComponents = new Map;
+var componentNames = new WeakMap;
+function named(name, schema) {
+  if (openApiComponents.has(name))
+    throw new Error(`OpenAPI component ${name} registered twice`);
+  openApiComponents.set(name, schema);
+  componentNames.set(schema, name);
+  return schema;
+}
+function componentName(schema, wrapper) {
+  const name = componentNames.get(schema);
+  if (name === undefined)
+    throw new Error(`${wrapper}() of a schema that is not named()`);
+  return name;
+}
+var Id = z.uuid();
+var ProviderId = z.string().min(1).max(MAX_PROVIDER_ID_LENGTH);
+var EventId = named("EventId", z.string().regex(/^[0-9]{1,19}$/, "Expected an event id"));
+var Cursor = z.string().min(1).max(MAX_CURSOR_LENGTH);
+var Email = z.email().max(MAX_EMAIL_LENGTH);
+var Timestamp = z.preprocess((value) => typeof value === "string" ? new Date(value) : value, z.date());
+var QueryTimestamp = z.preprocess((value) => typeof value === "string" ? new Date(value) : value, z.date());
+var DateOnly = z.iso.date();
+function trimmed(max) {
+  return z.string().trim().min(1).max(max);
+}
+var Name = z.string().min(1).max(MAX_NAME_LENGTH);
+var ExternalRef = z.string().max(MAX_EXTERNAL_REF_LENGTH);
+var Address = named("Address", z.object({ name: z.string().nullable(), address: z.string() }));
+var AddressInput = named("AddressInput", z.object({ name: z.string().max(MAX_ADDRESS_NAME_LENGTH).optional(), address: Email }));
+var QueryBoolean = z.union([z.boolean(), z.enum(["true", "false"])]).transform((v) => v === true || v === "true");
+var pageFields = (item) => ({
+  items: z.array(item),
+  nextCursor: Cursor.nullable()
+});
+var Page = (item) => named(`${componentName(item, "Page")}Page`, z.object(pageFields(item)));
+async function* followCursor(fetch2, cursor, next) {
+  let at = cursor;
+  for (;; ) {
+    const page = await fetch2(at);
+    yield page;
+    at = next(page);
+    if (at === undefined)
+      return;
+  }
+}
+var listFields = (item) => ({ items: z.array(item) });
+var List = (item) => named(`${componentName(item, "List")}List`, z.object(listFields(item)));
+var DAY_MS = 86400000;
+function instant(value) {
+  if (value instanceof Date)
+    return value.getTime();
+  if (typeof value !== "string")
+    return null;
+  const ms = Date.parse(value);
+  return Number.isNaN(ms) ? null : ms;
+}
+function withDateRange(schema, range) {
+  return schema.superRefine((value, ctx) => {
+    const from = instant(value[range.from]);
+    const to = instant(value[range.to]);
+    if (from === null || to === null)
+      return;
+    const span = to - from;
+    const params = { reason: "invalid_range" };
+    if (span < 0 || span === 0 && !range.inclusive)
+      ctx.addIssue({
+        code: "custom",
+        path: [range.to],
+        message: `${range.to} must be ${range.inclusive ? "on or after" : "after"} ${range.from}`,
+        params
+      });
+    else if (range.maxSpanMs !== undefined && span > range.maxSpanMs)
+      ctx.addIssue({
+        code: "custom",
+        path: [range.to],
+        message: range.maxSpanMs % DAY_MS === 0 ? `The range may span at most ${range.maxSpanMs / DAY_MS} days` : `The range may span at most ${range.maxSpanMs} ms`,
+        params
+      });
+  });
+}
+function pageLimit(max, fallback) {
+  return z.coerce.number().int().min(1).max(max).default(fallback);
+}
+var Limit = pageLimit(MAX_PAGE_SIZE, DEFAULT_PAGE_SIZE);
+var Paged = { limit: Limit, cursor: Cursor.optional() };
+var AccountIdInput = named("AccountIdInput", z.object({ accountId: Id }));
+var StreamedFile = z.custom((value) => value instanceof ReadableStream || value instanceof Blob).transform((stream) => stream);
+var publicOperation = (operation) => ({
+  ...operation,
+  security: []
+});
+function fileResponse(file) {
+  return (operation) => {
+    const ok = operation.responses?.["200"];
+    if (!ok || "$ref" in ok)
+      throw new Error(`OpenAPI: no 200 response for ${operation.operationId}`);
+    return {
+      ...operation,
+      responses: {
+        ...operation.responses,
+        200: {
+          ...ok,
+          description: file.description,
+          content: {
+            [file.mediaType]: { schema: { type: "string", contentMediaType: file.mediaType } }
+          },
+          headers: {
+            "content-disposition": {
+              description: `Always \`${file.disposition}; filename="..."\``,
+              schema: { type: "string" }
+            },
+            ...file.headers
+          }
+        }
+      }
+    };
+  };
+}
+
+// ../contract/src/settings/models.ts
+import * as z2 from "zod";
+var BodyStorage = named("BodyStorage", z2.enum(["none", "cache", "full"]));
+var EffectiveSettings = named("EffectiveSettings", z2.object({
+  bodyStorage: BodyStorage,
+  syncWindowDays: z2.number().int().positive().nullable(),
+  calendarEnabled: z2.boolean(),
+  contactsEnabled: z2.boolean(),
+  undoSendSeconds: z2.number().int().min(0).max(MAX_UNDO_SEND_SECONDS),
+  trackOpens: z2.boolean(),
+  trackClicks: z2.boolean(),
+  trackingHoneypot: z2.boolean()
+}));
+var SettingsOverride = named("SettingsOverride", EffectiveSettings.partial());
+var LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1"]);
+var OptOutHandling = named("OptOutHandling", z2.enum(["off", "review", "suppress"]));
+var TenantSettings = named("TenantSettings", EffectiveSettings.extend({
+  optOutHandling: OptOutHandling,
+  eventRetentionDays: z2.number().int().min(MIN_EVENT_RETENTION_DAYS).max(MAX_EVENT_RETENTION_DAYS),
+  redirectUris: z2.array(z2.url()).max(MAX_REDIRECT_URIS),
+  aiReplyClassification: z2.boolean()
+}));
+var UpdateTenantSettings = named("UpdateTenantSettings", TenantSettings.partial());
+
+// ../contract/src/accounts/models.ts
+var OAuthProvider = named("OAuthProvider", z3.enum(["google", "microsoft"]));
+var MicrosoftCloud = named("MicrosoftCloud", z3.enum(["global", "gcc-high", "dod", "china"]));
+var AccountProvider = named("AccountProvider", z3.enum(["gmail", "graph", "imap"]));
+var AccountStatus = named("AccountStatus", z3.enum(["active", "paused", "reauth_required", "disabled"]));
+var SettableAccountStatus = named("SettableAccountStatus", AccountStatus.extract(["active", "paused"]));
+var RuntimeState = named("RuntimeState", z3.enum(["pending", "connecting", "connected", "error", "stopped"]));
+var AccountRuntime = named("AccountRuntime", z3.object({
+  state: RuntimeState,
+  detail: z3.string().nullable(),
+  ownerInstanceId: Id.nullable(),
+  updatedAt: Timestamp
+}));
+var MailSecurity = named("MailSecurity", z3.enum(["tls", "starttls", "none"]));
+var MailServer = named("MailServer", z3.object({
+  host: z3.string(),
+  port: z3.number().int(),
+  security: MailSecurity,
+  user: z3.string()
+}));
+var DavAuth = named("DavAuth", z3.enum(["imap_password", "dav_password"]));
+var DavSettings = named("DavSettings", z3.object({
+  calendarUrl: z3.string().nullable(),
+  contactsUrl: z3.string().nullable(),
+  user: z3.string(),
+  auth: DavAuth
+}));
+var ImapAuth = named("ImapAuth", z3.enum(["password", "google", "microsoft"]));
+var ImapSettings = named("ImapSettings", z3.object({
+  imap: MailServer,
+  smtp: MailServer.nullable(),
+  auth: ImapAuth,
+  appendSent: z3.boolean(),
+  dav: DavSettings.nullable()
+}));
+var AccountAuthMethod = named("AccountAuthMethod", z3.enum(["oauth", "password", "google_delegation", "microsoft_app", "shared_mailbox"]));
+var AccountAuth = named("AccountAuth", z3.object({
+  method: AccountAuthMethod,
+  orgConnectionId: Id.nullable(),
+  delegateAccountId: Id.nullable()
+}));
+var Account = named("Account", z3.object({
+  id: Id,
+  externalRef: z3.string().nullable(),
+  provider: AccountProvider,
+  email: z3.string(),
+  displayName: z3.string().nullable(),
+  oauthAppId: Id.nullable(),
+  cloud: MicrosoftCloud.nullable(),
+  status: AccountStatus,
+  statusReason: z3.string().nullable(),
+  settings: EffectiveSettings,
+  settingsOverride: SettingsOverride,
+  runtime: AccountRuntime.nullable(),
+  imap: ImapSettings.nullable(),
+  auth: AccountAuth,
+  initializedAt: Timestamp.nullable(),
+  calendarInitializedAt: Timestamp.nullable(),
+  contactsInitializedAt: Timestamp.nullable(),
+  createdAt: Timestamp,
+  updatedAt: Timestamp
+}));
+var AccountPage = Page(Account);
+var ListAccountsQuery = named("ListAccountsQuery", z3.object({
+  ...Paged,
+  externalRef: z3.string().optional(),
+  q: trimmed(MAX_FILTER_QUERY_LENGTH).optional(),
+  status: AccountStatus.optional(),
+  orgConnectionId: Id.optional(),
+  delegateAccountId: Id.optional()
+}));
+var CreateAccount = named("CreateAccount", z3.object({
+  provider: OAuthProvider,
+  microsoftCloud: MicrosoftCloud.default("global"),
+  refreshToken: z3.string().min(1),
+  oauthAppId: Id.optional(),
+  externalRef: ExternalRef.optional(),
+  settings: SettingsOverride.optional(),
+  sharedMailboxesEnabled: z3.boolean().optional()
+}));
+var UpdateAccount = named("UpdateAccount", z3.object({
+  externalRef: ExternalRef.nullable().optional(),
+  status: SettableAccountStatus.optional(),
+  settings: SettingsOverride.optional()
+}));
+var DeleteAccountQuery = named("DeleteAccountQuery", z3.object({ purge: QueryBoolean.default(false) }));
+var DeleteAccountInput = named("DeleteAccountInput", z3.object({ params: AccountIdInput, query: DeleteAccountQuery }));
+var MintAccountTokenRequest = named("MintAccountTokenRequest", z3.object({
+  ttlSeconds: z3.number().int().min(MIN_TOKEN_TTL_SECONDS).max(MAX_TOKEN_TTL_SECONDS).default(900)
+}));
+var AccountToken = named("AccountToken", z3.object({ token: z3.string(), expiresAt: Timestamp }));
+var MailServerInput = named("MailServerInput", z3.object({
+  host: z3.string().min(1).max(MAX_HOST_LENGTH),
+  port: z3.number().int().min(1).max(MAX_PORT),
+  security: MailSecurity,
+  user: z3.string().min(1).max(MAX_EMAIL_LENGTH).optional()
+}));
+var Password = z3.string().min(1).max(MAX_SECRET_LENGTH);
+var DavUrl = z3.url({ protocol: /^https?$/ }).max(MAX_URL_LENGTH);
+var DavInput = named("DavInput", z3.object({
+  calendarUrl: DavUrl.nullable().optional(),
+  contactsUrl: DavUrl.nullable().optional(),
+  user: z3.string().min(1).max(MAX_EMAIL_LENGTH).optional(),
+  password: Password.nullable().optional()
+}));
+var ImapAccountInput = named("ImapAccountInput", z3.object({
+  email: Email,
+  displayName: z3.string().max(MAX_DISPLAY_NAME_LENGTH).optional(),
+  password: Password,
+  smtpPassword: Password.optional(),
+  imap: MailServerInput.optional(),
+  smtp: MailServerInput.nullable().optional(),
+  appendSent: z3.boolean().optional(),
+  dav: DavInput.optional()
+}));
+var CreateImapAccount = named("CreateImapAccount", ImapAccountInput.extend({
+  externalRef: ExternalRef.optional(),
+  settings: SettingsOverride.optional()
+}));
+var UpdateImapSettings = named("UpdateImapSettings", z3.object({
+  password: Password.optional(),
+  smtpPassword: Password.nullable().optional(),
+  imap: MailServerInput.optional(),
+  smtp: MailServerInput.nullable().optional(),
+  appendSent: z3.boolean().optional(),
+  dav: DavInput.nullable().optional()
+}));
+var DavDiscoverySource = named("DavDiscoverySource", z3.enum(["provider", "well-known", "srv"]));
+var DiscoveredDav = named("DiscoveredDav", z3.object({
+  source: DavDiscoverySource,
+  calendarUrl: z3.string().nullable(),
+  contactsUrl: z3.string().nullable()
+}));
+var AutoconfigSource = named("AutoconfigSource", z3.enum(["provider", "autoconfig", "ispdb", "srv", "mx"]));
+var DiscoveredSettings = named("DiscoveredSettings", z3.object({
+  source: AutoconfigSource,
+  imap: MailServer,
+  smtp: MailServer.nullable(),
+  oauth: OAuthProvider.nullable(),
+  dav: DiscoveredDav.nullable()
+}));
+var AutoconfigQuery = named("AutoconfigQuery", z3.object({ email: Email }));
+
+// ../contract/src/ai/models.ts
+import * as z4 from "zod";
+var AiDraftFormat = named("AiDraftFormat", z4.enum(["text", "markdown"]));
+var AiDraftContext = named("AiDraftContext", z4.object({
+  accountId: Id.optional(),
+  replyToMessageId: Id.optional(),
+  currentDraft: z4.string().max(MAX_DRAFT_CONTEXT_LENGTH).optional()
+}).refine((c) => !c.replyToMessageId || c.accountId, {
+  message: "replyToMessageId needs accountId",
+  path: ["accountId"]
+}));
+var CreateAiDraft = named("CreateAiDraft", z4.object({
+  instructions: trimmed(MAX_DRAFT_INSTRUCTIONS_LENGTH),
+  context: AiDraftContext.optional(),
+  format: AiDraftFormat
+}));
+var AiDraft = named("AiDraft", z4.object({ text: z4.string() }));
+
+// ../contract/src/audit-log/models.ts
+import * as z5 from "zod";
+var AuditActorType = named("AuditActorType", z5.enum(["user", "apiKey", "accountToken", "connectSession"]));
+var AuditActor = named("AuditActor", z5.object({
+  type: AuditActorType,
+  id: Id,
+  label: z5.string().nullable()
+}));
+var AuditSurface = named("AuditSurface", z5.enum(["v1", "rpc"]));
+var AuditOutcome = named("AuditOutcome", z5.enum(["success", "failure"]));
+var AuditEntry = named("AuditEntry", z5.object({
+  id: Id,
+  createdAt: Timestamp,
+  actor: AuditActor,
+  action: z5.string(),
+  surface: AuditSurface,
+  targets: z5.record(z5.string(), z5.union([z5.string(), z5.array(z5.string())])),
+  ip: z5.string().nullable(),
+  userAgent: z5.string().nullable(),
+  status: z5.number().int(),
+  errorReason: z5.string().nullable(),
+  requestId: z5.string().nullable()
+}));
+var AuditEntryPage = Page(AuditEntry);
+var ListAuditLogQuery = named("ListAuditLogQuery", withDateRange(z5.object({
+  ...Paged,
+  actorType: AuditActorType.optional(),
+  actorId: Id.optional(),
+  action: z5.string().min(1).max(MAX_FILTER_QUERY_LENGTH).optional(),
+  accountId: Id.optional(),
+  outcome: AuditOutcome.optional(),
+  from: QueryTimestamp.optional(),
+  to: QueryTimestamp.optional()
+}), { from: "from", to: "to", inclusive: true }));
+
+// ../contract/src/calendar/models.ts
+import * as z8 from "zod";
+
+// ../contract/src/meetings/models.ts
+import * as z7 from "zod";
+
+// ../contract/src/connect/models.ts
+import * as z6 from "zod";
+var MailAccess = named("MailAccess", z6.enum(["api", "imap"]));
+var ConnectOptions = named("ConnectOptions", z6.object({
+  calendarEnabled: z6.boolean().optional(),
+  contactsEnabled: z6.boolean().optional(),
+  bodyStorage: BodyStorage.optional(),
+  mailAccess: MailAccess.optional(),
+  sharedMailboxesEnabled: z6.boolean().optional()
+}));
+var ConnectProvider = named("ConnectProvider", z6.enum(["google", "microsoft", "imap"]));
+var ConnectSessionStatus = named("ConnectSessionStatus", z6.enum(["pending", "completed", "failed"]));
+var ConnectErrorCode = named("ConnectErrorCode", z6.enum([
+  "session_used",
+  "session_expired",
+  "provider_not_allowed",
+  "access_denied",
+  "access_token_rejected",
+  "provider_error",
+  "provider_unavailable",
+  "provider_not_configured",
+  "unsupported_provider",
+  "token_exchange_failed",
+  "invalid_client",
+  "invalid_grant",
+  "missing_refresh_token",
+  "scope_denied",
+  "identity_failed",
+  "identity_unavailable",
+  "credential_conflict",
+  "credential_missing",
+  "delegate_missing",
+  "account_exists",
+  "account_mismatch",
+  "account_not_found",
+  "unknown_oauth_app",
+  "oauth_app_mismatch",
+  "oauth_app_secret_unreadable",
+  "google_imap_requires_own_app",
+  "unknown_meeting_app",
+  "meeting_app_mismatch",
+  "meeting_app_secret_unreadable",
+  "consent_failed",
+  "consent_required",
+  "consent_revoked",
+  "consent_unverified",
+  "directory_already_connected",
+  "directory_mismatch",
+  "directory_unavailable",
+  "invalid_certificate",
+  "invalid_service_account_key",
+  "org_connection_not_found",
+  "org_connection_secret_unreadable",
+  "plan_limit_accounts",
+  "plan_module_unavailable",
+  "billing_past_due",
+  "internal_error"
+]));
+var ConnectSessionPublic = named("ConnectSessionPublic", z6.object({
+  tenantName: z6.string(),
+  providers: z6.array(ConnectProvider),
+  microsoftCloud: MicrosoftCloud,
+  status: ConnectSessionStatus,
+  reauthEmail: z6.string().nullable(),
+  loginHint: z6.string().nullable(),
+  expiresAt: Timestamp
+}));
+var ConnectSession = named("ConnectSession", z6.object({
+  id: Id,
+  status: ConnectSessionStatus,
+  error: ConnectErrorCode.nullable(),
+  accountId: Id.nullable(),
+  email: z6.string().nullable(),
+  expiresAt: Timestamp,
+  createdAt: Timestamp
+}));
+var RedirectState = z6.string().max(MAX_STATE_LENGTH);
+var SessionTtlSeconds = z6.number().int().min(MIN_TOKEN_TTL_SECONDS).max(MAX_TOKEN_TTL_SECONDS).default(3600);
+var CreateConnectSession = named("CreateConnectSession", z6.object({
+  redirectUri: z6.url().optional(),
+  providers: z6.array(ConnectProvider).min(1).default(["google", "microsoft"]),
+  microsoftCloud: MicrosoftCloud.default("global"),
+  oauthAppIds: z6.object({ google: Id.optional(), microsoft: Id.optional() }).optional(),
+  externalRef: ExternalRef.optional(),
+  loginHint: Email.optional(),
+  state: RedirectState.optional(),
+  accountId: Id.optional(),
+  options: ConnectOptions.optional(),
+  ttlSeconds: SessionTtlSeconds
+}));
+var SessionLink = named("SessionLink", z6.object({ id: Id, url: z6.url(), expiresAt: Timestamp }));
+var ConnectSessionIdInput = named("ConnectSessionIdInput", z6.object({ sessionId: Id }));
+var StartOAuthRequest = named("StartOAuthRequest", z6.object({
+  provider: OAuthProvider,
+  redirectUri: z6.url(),
+  microsoftCloud: MicrosoftCloud.default("global"),
+  oauthAppId: Id.optional(),
+  externalRef: ExternalRef.optional(),
+  state: RedirectState.optional(),
+  accountId: Id.optional(),
+  options: ConnectOptions.optional()
+}));
+var OAuthAuthorization = named("OAuthAuthorization", z6.object({ authorizeUrl: z6.url() }));
+var SessionTokenInput = named("SessionTokenInput", z6.object({ token: z6.string().min(1) }));
+var HostedImapResult = named("HostedImapResult", z6.object({ redirectUrl: z6.url() }));
+
+// ../contract/src/meetings/models.ts
+var MeetingService = named("MeetingService", z7.enum(["zoom", "webex"]));
+var MeetingConnectionStatus = named("MeetingConnectionStatus", z7.enum(["active", "reauth_required"]));
+var MeetingConnection = named("MeetingConnection", z7.object({
+  service: MeetingService,
+  email: z7.string(),
+  displayName: z7.string().nullable(),
+  meetingAppId: Id.nullable(),
+  status: MeetingConnectionStatus,
+  statusReason: z7.string().nullable(),
+  createdAt: Timestamp,
+  updatedAt: Timestamp
+}));
+var MeetingConnectionList = List(MeetingConnection);
+var MeetingAppKind = named("MeetingAppKind", z7.enum(["zoom_oauth", "zoom_s2s", "webex_oauth", "webex_service_app"]));
+var MeetingAppStatus = named("MeetingAppStatus", z7.enum(["unverified", "active", "failing"]));
+var MeetingApp = named("MeetingApp", z7.object({
+  id: Id,
+  kind: MeetingAppKind,
+  service: MeetingService,
+  name: z7.string(),
+  clientId: z7.string(),
+  zoomAccountId: z7.string().nullable(),
+  status: MeetingAppStatus.nullable(),
+  statusDetail: z7.string().nullable(),
+  checkedAt: Timestamp.nullable(),
+  scopes: z7.array(z7.string()),
+  redirectUri: z7.string().nullable(),
+  createdAt: Timestamp
+}));
+var MeetingAppList = List(MeetingApp);
+var ClientId = z7.string().min(1).max(MAX_MEETING_APP_ID_LENGTH);
+var ClientSecret = z7.string().min(1).max(MAX_SECRET_LENGTH);
+var CreateMeetingApp = named("CreateMeetingApp", z7.discriminatedUnion("kind", [
+  z7.object({
+    kind: z7.literal("zoom_oauth"),
+    name: Name,
+    clientId: ClientId,
+    clientSecret: ClientSecret
+  }),
+  z7.object({
+    kind: z7.literal("zoom_s2s"),
+    name: Name,
+    accountId: z7.string().min(1).max(MAX_MEETING_APP_ID_LENGTH),
+    clientId: ClientId,
+    clientSecret: ClientSecret
+  }),
+  z7.object({
+    kind: z7.literal("webex_oauth"),
+    name: Name,
+    clientId: ClientId,
+    clientSecret: ClientSecret
+  }),
+  z7.object({
+    kind: z7.literal("webex_service_app"),
+    name: Name,
+    clientId: ClientId,
+    clientSecret: ClientSecret,
+    refreshToken: z7.string().min(1).max(MAX_REFRESH_TOKEN_LENGTH)
+  })
+]));
+var MeetingAppCheck = named("MeetingAppCheck", z7.object({ name: z7.string(), isOk: z7.boolean(), detail: z7.string() }));
+var MeetingAppTestResult = named("MeetingAppTestResult", z7.object({ app: MeetingApp, checks: z7.array(MeetingAppCheck) }));
+var MeetingConnectSessionPublic = named("MeetingConnectSessionPublic", z7.object({
+  tenantName: z7.string(),
+  service: MeetingService,
+  accountEmail: z7.string(),
+  status: ConnectSessionStatus,
+  expiresAt: Timestamp
+}));
+var MeetingAppIdInput = named("MeetingAppIdInput", z7.object({ appId: Id }));
+var TestMeetingAppRequest = named("TestMeetingAppRequest", z7.object({ user: Email.optional() }));
+var MeetingConnectionInput = named("MeetingConnectionInput", AccountIdInput.extend({ service: MeetingService }));
+var CreateMeetingConnectSession = named("CreateMeetingConnectSession", z7.object({
+  service: MeetingService,
+  redirectUri: z7.url().optional(),
+  meetingAppId: Id.optional(),
+  state: RedirectState.optional(),
+  ttlSeconds: SessionTtlSeconds
+}));
+
+// ../contract/src/calendar/models.ts
+var CalendarAccess = named("CalendarAccess", z8.enum(["owner", "writer", "reader", "freebusy"]));
+var Calendar = named("Calendar", z8.object({
+  id: Id,
+  name: z8.string(),
+  description: z8.string().nullable(),
+  owner: Address.nullable(),
+  isPrimary: z8.boolean(),
+  access: CalendarAccess,
+  canEdit: z8.boolean(),
+  color: z8.string().nullable(),
+  timeZone: z8.string().nullable(),
+  isHidden: z8.boolean()
+}));
+var CalendarList = List(Calendar);
+var CalendarChangedField = named("CalendarChangedField", Calendar.keyof().exclude(["id"]));
+var EventKind = named("EventKind", z8.enum(["single", "series", "occurrence", "exception"]));
+var AttendeeType = named("AttendeeType", z8.enum(["required", "optional", "resource"]));
+var ResponseStatus = named("ResponseStatus", z8.enum(["none", "organizer", "accepted", "tentative", "declined", "needs_action"]));
+var EventStatus = named("EventStatus", z8.enum(["confirmed", "tentative", "cancelled"]));
+var ShowAs = named("ShowAs", z8.enum(["free", "busy", "tentative", "oof", "working_elsewhere", "unknown"]));
+var Sensitivity = named("Sensitivity", z8.enum(["normal", "personal", "private", "confidential"]));
+var Attendee = named("Attendee", Address.extend({ type: AttendeeType, response: ResponseStatus }));
+var EventTime = named("EventTime", z8.object({
+  dateTime: Timestamp,
+  date: DateOnly.nullable(),
+  timeZone: z8.string().nullable()
+}));
+var CalendarEvent = named("CalendarEvent", z8.object({
+  id: Id,
+  calendarId: Id,
+  kind: EventKind,
+  seriesId: Id.nullable(),
+  originalStart: Timestamp.nullable(),
+  subject: z8.string().nullable(),
+  snippet: z8.string().nullable(),
+  location: z8.string().nullable(),
+  start: EventTime,
+  end: EventTime,
+  isAllDay: z8.boolean(),
+  organizer: Address.nullable(),
+  attendees: z8.array(Attendee),
+  isOrganizer: z8.boolean(),
+  selfResponse: ResponseStatus,
+  status: EventStatus,
+  showAs: ShowAs,
+  sensitivity: Sensitivity,
+  onlineMeetingUrl: z8.string().nullable(),
+  onlineMeetingProvider: z8.string().nullable(),
+  iCalUid: z8.string().nullable(),
+  recurrence: z8.array(z8.string()).nullable(),
+  recurrenceTimeZone: z8.string().nullable(),
+  cancelledStarts: z8.array(Timestamp).nullable(),
+  categories: z8.array(z8.string()),
+  hasAttachments: z8.boolean(),
+  reminderMinutes: z8.number().int().nullable(),
+  webLink: z8.string().nullable(),
+  updatedAt: Timestamp
+}));
+var CalendarEventPage = Page(CalendarEvent);
+var CalendarEventChangedField = named("CalendarEventChangedField", CalendarEvent.keyof().exclude(["id", "calendarId", "seriesId", "updatedAt"]));
+var BodyContentType = named("BodyContentType", z8.enum(["text", "html"]));
+var EventBody = named("EventBody", z8.object({ contentType: BodyContentType, content: z8.string() }));
+var CalendarEventDetail = named("CalendarEventDetail", CalendarEvent.extend({
+  body: EventBody.nullable()
+}));
+var EventTimeInput = named("EventTimeInput", z8.union([
+  z8.object({
+    dateTime: z8.iso.datetime({ local: true }),
+    timeZone: z8.string().min(1).max(MAX_TIME_ZONE_LENGTH)
+  }),
+  z8.object({ date: DateOnly })
+]));
+var AttendeeInput = named("AttendeeInput", AddressInput.extend({ type: AttendeeType.default("required") }));
+var RecurrenceLine = z8.string().max(MAX_RECURRENCE_LINE_LENGTH).regex(/^(RRULE|RDATE|EXDATE)[:;]/, "Expected an RRULE, RDATE or EXDATE line");
+var EventFields = {
+  subject: z8.string().max(MAX_EVENT_SUBJECT_LENGTH),
+  body: EventBody.extend({ content: z8.string().max(MAX_EVENT_BODY_LENGTH) }),
+  location: z8.string().max(MAX_EVENT_LOCATION_LENGTH),
+  start: EventTimeInput,
+  end: EventTimeInput,
+  attendees: z8.array(AttendeeInput).max(MAX_EVENT_ATTENDEES),
+  recurrence: z8.array(RecurrenceLine).min(1).max(MAX_RECURRENCE_LINES),
+  showAs: ShowAs.exclude(["unknown"]),
+  sensitivity: Sensitivity,
+  reminderMinutes: z8.number().int().min(0).max(MAX_REMINDER_MINUTES).nullable(),
+  onlineMeetingUrl: z8.url({ protocol: /^https$/ }).max(MAX_URL_LENGTH)
+};
+var Notify = z8.boolean().default(true);
+var CreateCalendarEvent = named("CreateCalendarEvent", z8.object({
+  calendarId: Id,
+  subject: EventFields.subject.optional(),
+  body: EventFields.body.optional(),
+  location: EventFields.location.optional(),
+  start: EventFields.start,
+  end: EventFields.end,
+  attendees: EventFields.attendees.default([]),
+  recurrence: EventFields.recurrence.optional(),
+  showAs: EventFields.showAs.optional(),
+  sensitivity: EventFields.sensitivity.optional(),
+  reminderMinutes: EventFields.reminderMinutes.optional(),
+  onlineMeeting: z8.boolean().default(false),
+  onlineMeetingUrl: EventFields.onlineMeetingUrl.optional(),
+  onlineMeetingService: MeetingService.optional(),
+  notify: Notify
+}));
+var CreateCalendarEventInput = AccountIdInput.extend(CreateCalendarEvent.shape).superRefine((input, ctx) => {
+  const options = [
+    input.onlineMeeting,
+    input.onlineMeetingUrl !== undefined,
+    input.onlineMeetingService !== undefined
+  ].filter(Boolean).length;
+  if (options > 1)
+    ctx.addIssue({
+      code: "custom",
+      path: ["onlineMeetingService"],
+      message: "Give one of onlineMeeting, onlineMeetingUrl and onlineMeetingService",
+      params: { reason: "multiple_meeting_options" }
+    });
+});
+var UpdateCalendarEvent = named("UpdateCalendarEvent", z8.object({
+  subject: EventFields.subject.optional(),
+  body: EventFields.body.optional(),
+  location: EventFields.location.optional(),
+  start: EventFields.start.optional(),
+  end: EventFields.end.optional(),
+  attendees: EventFields.attendees.optional(),
+  recurrence: EventFields.recurrence.optional(),
+  showAs: EventFields.showAs.optional(),
+  sensitivity: EventFields.sensitivity.optional(),
+  reminderMinutes: EventFields.reminderMinutes.optional(),
+  onlineMeetingUrl: EventFields.onlineMeetingUrl.nullable().optional(),
+  notify: Notify
+}));
+var DeleteCalendarEventQuery = named("DeleteCalendarEventQuery", z8.object({
+  notify: QueryBoolean.default(true),
+  comment: z8.string().max(MAX_EVENT_COMMENT_LENGTH).optional()
+}));
+var RsvpResponse = named("RsvpResponse", z8.enum(["accepted", "tentative", "declined"]));
+var RespondToCalendarEventRequest = named("RespondToCalendarEventRequest", z8.object({
+  response: RsvpResponse,
+  comment: z8.string().max(MAX_EVENT_COMMENT_LENGTH).optional(),
+  notify: z8.boolean().default(true)
+}));
+var CalendarEventIdInput = named("CalendarEventIdInput", AccountIdInput.extend({ eventId: Id }));
+var DeleteCalendarEventInput = named("DeleteCalendarEventInput", z8.object({ params: CalendarEventIdInput, query: DeleteCalendarEventQuery }));
+var ListCalendarEventsQuery = named("ListCalendarEventsQuery", z8.object({
+  start: QueryTimestamp,
+  end: QueryTimestamp,
+  calendarId: Id.optional(),
+  limit: pageLimit(MAX_CALENDAR_EVENT_PAGE_SIZE, DEFAULT_CALENDAR_EVENT_PAGE_SIZE),
+  cursor: Cursor.optional()
+}));
+var ListCalendarEventsInput = withDateRange(AccountIdInput.extend(ListCalendarEventsQuery.shape), { from: "start", to: "end", maxSpanMs: MAX_EVENT_RANGE_DAYS * DAY_MS });
+var BusyStatus = named("BusyStatus", z8.enum(["busy", "tentative", "oof", "working_elsewhere", "unknown"]));
+var BusyBlock = named("BusyBlock", z8.object({ start: Timestamp, end: Timestamp, status: BusyStatus }));
+var AttendeeAvailability = named("AttendeeAvailability", z8.object({
+  address: z8.string(),
+  busy: z8.array(BusyBlock),
+  error: z8.string().nullable()
+}));
+var Weekday = named("Weekday", z8.enum(["mon", "tue", "wed", "thu", "fri", "sat", "sun"]));
+var TimeOfDay = z8.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/, "Expected HH:MM");
+var WorkingHours = named("WorkingHours", z8.object({
+  start: TimeOfDay,
+  end: TimeOfDay,
+  days: z8.array(Weekday).min(1).default(["mon", "tue", "wed", "thu", "fri"])
+}).refine((hours) => hours.end > hours.start, {
+  message: "workingHours end must be after start",
+  path: ["end"],
+  params: { reason: "invalid_working_hours" }
+}));
+var SlotMinutes = z8.number().int().min(MIN_SLOT_MINUTES).max(MAX_SLOT_MINUTES).default(30);
+var FindAvailabilityRequest = named("FindAvailabilityRequest", z8.object({
+  attendees: z8.array(Email).min(1).max(MAX_AVAILABILITY_ATTENDEES),
+  start: QueryTimestamp,
+  end: QueryTimestamp,
+  durationMinutes: SlotMinutes,
+  stepMinutes: SlotMinutes,
+  timeZone: z8.string().min(1).max(MAX_TIME_ZONE_LENGTH).default("UTC"),
+  workingHours: WorkingHours.optional(),
+  maxSuggestions: z8.number().int().min(0).max(MAX_SUGGESTIONS).default(10),
+  includeAccount: z8.boolean().default(true)
+}));
+var FindAvailabilityInput = withDateRange(AccountIdInput.extend(FindAvailabilityRequest.shape), { from: "start", to: "end", maxSpanMs: MAX_AVAILABILITY_DAYS * DAY_MS });
+var TimeSlot = named("TimeSlot", z8.object({ start: Timestamp, end: Timestamp }));
+var Availability = named("Availability", z8.object({
+  attendees: z8.array(AttendeeAvailability),
+  suggestions: z8.array(TimeSlot)
+}));
+
+// ../contract/src/contacts/models.ts
+import * as z9 from "zod";
+var ContactEmailType = named("ContactEmailType", z9.enum(["home", "work", "other"]));
+var ContactPhoneType = named("ContactPhoneType", z9.enum(["mobile", "home", "work", "other"]));
+var ContactEmail = named("ContactEmail", Address.pick({ address: true }).extend({ type: ContactEmailType.nullable() }));
+var ContactPhone = named("ContactPhone", z9.object({ number: z9.string(), type: ContactPhoneType.nullable() }));
+var ContactFolder = named("ContactFolder", z9.object({
+  id: Id,
+  name: z9.string(),
+  isDefault: z9.boolean()
+}));
+var ContactFolderList = List(ContactFolder);
+var Birthday = z9.string().regex(/^(\d{4}|--)-\d{2}-\d{2}$/, "Expected YYYY-MM-DD or --MM-DD");
+var Contact = named("Contact", z9.object({
+  id: Id,
+  folderId: Id.nullable(),
+  displayName: z9.string().nullable(),
+  givenName: z9.string().nullable(),
+  middleName: z9.string().nullable(),
+  familyName: z9.string().nullable(),
+  nickname: z9.string().nullable(),
+  emails: z9.array(ContactEmail),
+  phones: z9.array(ContactPhone),
+  organization: z9.string().nullable(),
+  jobTitle: z9.string().nullable(),
+  department: z9.string().nullable(),
+  birthday: z9.string().nullable(),
+  notes: z9.string().nullable(),
+  hasPhoto: z9.boolean().nullable(),
+  updatedAt: Timestamp
+}));
+var ContactPage = Page(Contact);
+var ContactChangedField = named("ContactChangedField", z9.enum([...Contact.keyof().exclude(["id", "updatedAt"]).options, "photo"]));
+var ContactEmailInput = named("ContactEmailInput", AddressInput.pick({ address: true }).extend({ type: ContactEmailType.optional() }));
+var ContactPhoneInput = named("ContactPhoneInput", z9.object({
+  number: trimmed(MAX_CONTACT_PHONE_LENGTH),
+  type: ContactPhoneType.optional()
+}));
+var ContactFields = {
+  displayName: trimmed(MAX_CONTACT_FIELD_LENGTH),
+  givenName: trimmed(MAX_CONTACT_FIELD_LENGTH),
+  middleName: trimmed(MAX_CONTACT_FIELD_LENGTH),
+  familyName: trimmed(MAX_CONTACT_FIELD_LENGTH),
+  nickname: trimmed(MAX_CONTACT_FIELD_LENGTH),
+  organization: trimmed(MAX_CONTACT_FIELD_LENGTH),
+  jobTitle: trimmed(MAX_CONTACT_FIELD_LENGTH),
+  department: trimmed(MAX_CONTACT_FIELD_LENGTH),
+  birthday: Birthday,
+  notes: z9.string().max(MAX_CONTACT_NOTES_LENGTH)
+};
+var CreateContact = named("CreateContact", z9.object({
+  folderId: Id.optional(),
+  displayName: ContactFields.displayName.optional(),
+  givenName: ContactFields.givenName.optional(),
+  middleName: ContactFields.middleName.optional(),
+  familyName: ContactFields.familyName.optional(),
+  nickname: ContactFields.nickname.optional(),
+  emails: z9.array(ContactEmailInput).max(MAX_CONTACT_ENTRIES).optional(),
+  phones: z9.array(ContactPhoneInput).max(MAX_CONTACT_ENTRIES).optional(),
+  organization: ContactFields.organization.optional(),
+  jobTitle: ContactFields.jobTitle.optional(),
+  department: ContactFields.department.optional(),
+  birthday: ContactFields.birthday.optional(),
+  notes: ContactFields.notes.optional()
+}));
+var CreateContactInput = AccountIdInput.extend(CreateContact.shape).refine((c) => c.displayName !== undefined || c.givenName !== undefined || c.familyName !== undefined || c.organization !== undefined || (c.emails?.length ?? 0) > 0 || (c.phones?.length ?? 0) > 0, {
+  message: "A contact needs a name, an organization, an email address or a phone number",
+  params: { reason: "contact_unidentifiable" }
+});
+var UpdateContact = named("UpdateContact", z9.object({
+  displayName: ContactFields.displayName.nullable().optional(),
+  givenName: ContactFields.givenName.nullable().optional(),
+  middleName: ContactFields.middleName.nullable().optional(),
+  familyName: ContactFields.familyName.nullable().optional(),
+  nickname: ContactFields.nickname.nullable().optional(),
+  emails: z9.array(ContactEmailInput).max(MAX_CONTACT_ENTRIES).optional(),
+  phones: z9.array(ContactPhoneInput).max(MAX_CONTACT_ENTRIES).optional(),
+  organization: ContactFields.organization.nullable().optional(),
+  jobTitle: ContactFields.jobTitle.nullable().optional(),
+  department: ContactFields.department.nullable().optional(),
+  birthday: ContactFields.birthday.nullable().optional(),
+  notes: ContactFields.notes.nullable().optional()
+}));
+var ContactIdInput = named("ContactIdInput", AccountIdInput.extend({ contactId: Id }));
+var ListContactsQuery = named("ListContactsQuery", z9.object({
+  q: trimmed(MAX_FILTER_QUERY_LENGTH).optional(),
+  folderId: Id.optional(),
+  limit: pageLimit(MAX_CONTACT_PAGE_SIZE, DEFAULT_CONTACT_PAGE_SIZE),
+  cursor: Cursor.optional()
+}));
+
+// ../contract/src/errors.ts
+import { oc } from "@orpc/contract";
+
+// ../contract/src/reasons.ts
+import * as z11 from "zod";
+
+// ../contract/src/templates/models.ts
+import * as z10 from "zod";
+var TemplateSource = named("TemplateSource", z10.enum(["handlebars", "react-email"]));
+var TemplateFormat = named("TemplateFormat", z10.enum(["html", "markdown"]));
+var TemplateField = named("TemplateField", z10.enum(["subject", "html", "text", "previewText"]));
+var TemplateFields = named("TemplateFields", z10.object({
+  subject: z10.string().max(MAX_TEMPLATE_SUBJECT_LENGTH).nullable(),
+  html: z10.string().max(MAX_TEMPLATE_BODY_LENGTH).nullable(),
+  text: z10.string().max(MAX_TEMPLATE_BODY_LENGTH).nullable(),
+  previewText: z10.string().max(MAX_TEMPLATE_PREVIEW_TEXT_LENGTH).nullable(),
+  format: TemplateFormat
+}));
+var TemplateSummary = named("TemplateSummary", z10.object({
+  id: Id,
+  accountId: Id.nullable(),
+  name: z10.string(),
+  description: z10.string().nullable(),
+  source: TemplateSource,
+  externalRef: z10.string().nullable(),
+  createdAt: Timestamp,
+  updatedAt: Timestamp
+}));
+var Template = named("Template", TemplateSummary.extend(TemplateFields.shape));
+var TemplateSummaryPage = Page(TemplateSummary);
+var RenderParams = named("RenderParams", z10.record(z10.string(), z10.unknown()));
+var RenderedTemplate = named("RenderedTemplate", z10.object({
+  subject: z10.string().nullable(),
+  html: z10.string().nullable(),
+  text: z10.string().nullable(),
+  previewText: z10.string().nullable()
+}));
+var TemplateIdInput = named("TemplateIdInput", z10.object({ templateId: Id }));
+var TemplateName = trimmed(MAX_TEMPLATE_NAME_LENGTH);
+var TemplateDescription = z10.string().max(MAX_TEMPLATE_DESCRIPTION_LENGTH);
+var ListTemplatesQuery = named("ListTemplatesQuery", z10.object({
+  ...Paged,
+  accountId: Id.optional(),
+  usableBy: Id.optional(),
+  name: z10.string().max(MAX_TEMPLATE_NAME_LENGTH).optional(),
+  query: z10.string().trim().max(MAX_TEMPLATE_NAME_LENGTH).optional()
+}));
+var CreateTemplate = named("CreateTemplate", z10.object({
+  accountId: Id.optional(),
+  name: TemplateName,
+  description: TemplateDescription.optional(),
+  subject: TemplateFields.shape.subject.unwrap().optional(),
+  html: TemplateFields.shape.html.unwrap().optional(),
+  text: TemplateFields.shape.text.unwrap().optional(),
+  previewText: TemplateFields.shape.previewText.unwrap().optional(),
+  format: TemplateFormat.default("html"),
+  source: TemplateSource.default("handlebars"),
+  externalRef: ExternalRef.optional()
+}));
+var UpdateTemplate = named("UpdateTemplate", z10.object({
+  name: TemplateName.optional(),
+  description: TemplateDescription.nullable().optional(),
+  subject: TemplateFields.shape.subject.optional(),
+  html: TemplateFields.shape.html.optional(),
+  text: TemplateFields.shape.text.optional(),
+  previewText: TemplateFields.shape.previewText.optional(),
+  format: TemplateFormat.optional(),
+  source: TemplateSource.optional(),
+  externalRef: ExternalRef.nullable().optional()
+}));
+var RenderTemplateRequest = named("RenderTemplateRequest", z10.object({
+  templateId: Id.optional(),
+  accountId: Id.optional(),
+  subject: z10.string().max(MAX_TEMPLATE_SUBJECT_LENGTH).optional(),
+  html: z10.string().max(MAX_TEMPLATE_BODY_LENGTH).optional(),
+  text: z10.string().max(MAX_TEMPLATE_BODY_LENGTH).optional(),
+  previewText: z10.string().max(MAX_TEMPLATE_PREVIEW_TEXT_LENGTH).optional(),
+  format: TemplateFormat.optional(),
+  params: RenderParams.default({})
+}).superRefine((request, ctx) => {
+  const { templateId, subject, html, text, previewText, format } = request;
+  if (templateId === undefined)
+    return;
+  if ([subject, html, text, previewText, format].some((field) => field !== undefined))
+    ctx.addIssue({
+      code: "custom",
+      path: ["templateId"],
+      message: "Render either a template or inline fields, not both",
+      params: { reason: "template_and_inline_fields" }
+    });
+}));
+
+// ../contract/src/reasons.ts
+var InputIssue = named("InputIssue", z11.object({ path: z11.array(z11.union([z11.string(), z11.number()])), message: z11.string() }));
+var InvalidInputData = named("InvalidInputData", z11.object({ issues: z11.array(InputIssue) }));
+var UnknownIdsData = named("UnknownIdsData", z11.object({ ids: z11.array(Id) }));
+var TemplateFieldData = named("TemplateFieldData", z11.object({ field: TemplateField }));
+var REASONS = {
+  invalid_input: { status: 400, data: InvalidInputData },
+  invalid_cursor: { status: 400 },
+  invalid_range: { status: 400 },
+  payload_too_large: { status: 413 },
+  invalid_payload: { status: 400 },
+  invalid_signature: { status: 400 },
+  route_not_found: { status: 404 },
+  internal_error: { status: 500 },
+  invalid_idempotency_key: { status: 400 },
+  idempotency_key_reused: { status: 422 },
+  idempotency_key_in_progress: { status: 409 },
+  rate_limited: { status: 429 },
+  too_many_requests: { status: 429 },
+  overloaded: { status: 503 },
+  unauthenticated: { status: 401 },
+  api_key_expired: { status: 401 },
+  missing_scope: { status: 403 },
+  role_forbidden: { status: 403 },
+  account_token_forbidden: { status: 403 },
+  session_required: { status: 403 },
+  owner_required: { status: 403 },
+  platform_admin_required: { status: 403 },
+  email_verification_required: { status: 403 },
+  console_only: { status: 403 },
+  plan_limit_accounts: { status: 403 },
+  plan_limit_sends: { status: 403 },
+  plan_limit_webhooks: { status: 403 },
+  plan_limit_storage: { status: 403 },
+  plan_module_unavailable: { status: 403 },
+  storage_unavailable: { status: 400 },
+  tenant_not_found: { status: 404 },
+  billing_past_due: { status: 402 },
+  billing_disabled: { status: 404 },
+  billing_unavailable: { status: 502 },
+  billing_subscription_exists: { status: 409 },
+  billing_customer_missing: { status: 409 },
+  plan_not_billable: { status: 409 },
+  account_not_found: { status: 404 },
+  unknown_account: { status: 422, data: UnknownIdsData },
+  account_paused: { status: 409 },
+  account_disabled: { status: 409 },
+  account_reauth_required: { status: 409 },
+  account_misconfigured: { status: 409 },
+  calendar_disabled: { status: 409 },
+  contacts_disabled: { status: 409 },
+  provider_not_found: { status: 404 },
+  provider_throttled: { status: 429 },
+  provider_unavailable: { status: 502 },
+  provider_forbidden: { status: 403 },
+  provider_conflict: { status: 409 },
+  provider_unsupported: { status: 400 },
+  provider_rejected: { status: 400 },
+  outcome_unknown: { status: 502 },
+  message_not_found: { status: 404 },
+  unknown_mailbox: { status: 422, data: UnknownIdsData },
+  mailbox_not_label: { status: 400 },
+  thread_not_found: { status: 404 },
+  identity_not_found: { status: 404 },
+  identities_managed_by_provider: { status: 400 },
+  identity_exists: { status: 409 },
+  identity_not_custom: { status: 400 },
+  draft_not_found: { status: 404 },
+  draft_lost: { status: 502 },
+  send_not_found: { status: 404 },
+  attachments_too_large: { status: 400 },
+  not_a_draft: { status: 400 },
+  unknown_reply_target: { status: 422 },
+  from_not_allowed: { status: 400 },
+  tracking_unsupported: { status: 400 },
+  honeypot_needs_click_tracking: { status: 400 },
+  list_send_recipients: { status: 400 },
+  suppressed: { status: 400 },
+  no_recipients: { status: 400 },
+  list_unsubscribe_unavailable: { status: 400 },
+  send_not_reschedulable: { status: 409 },
+  send_not_cancellable: { status: 409 },
+  suppression_list_not_found: { status: 404 },
+  suppression_entry_not_found: { status: 404 },
+  suppression_review_not_found: { status: 404 },
+  suppression_list_exists: { status: 409 },
+  suppression_list_not_empty: { status: 409 },
+  template_not_found: { status: 404 },
+  unknown_template: { status: 422 },
+  template_and_inline_fields: { status: 400 },
+  invalid_template: { status: 400, data: TemplateFieldData },
+  template_account_mismatch: { status: 400 },
+  template_render_failed: { status: 400, data: TemplateFieldData },
+  params_too_large: { status: 400 },
+  template_name_taken: { status: 409 },
+  calendar_not_found: { status: 404 },
+  calendar_event_not_found: { status: 404 },
+  contact_not_found: { status: 404 },
+  photo_not_found: { status: 404 },
+  unknown_calendar: { status: 422 },
+  unknown_contact_folder: { status: 422 },
+  calendar_read_only: { status: 403 },
+  organizer_cannot_respond: { status: 409 },
+  invalid_time_zone: { status: 400 },
+  invalid_working_hours: { status: 400 },
+  mixed_event_times: { status: 400 },
+  invalid_recurrence: { status: 400 },
+  recurrence_on_instance: { status: 400 },
+  contact_unidentifiable: { status: 400 },
+  multiple_meeting_options: { status: 400 },
+  meeting_service_not_connected: { status: 409 },
+  meeting_service_reauth_required: { status: 409 },
+  meeting_host_missing: { status: 409 },
+  meeting_recurrence_unsupported: { status: 400 },
+  meeting_service_rejected: { status: 400 },
+  meeting_deleted: { status: 409 },
+  meeting_service_unavailable: { status: 502 },
+  meeting_app_not_found: { status: 404 },
+  unknown_meeting_app: { status: 422 },
+  meeting_connection_not_found: { status: 404 },
+  meeting_connect_session_not_found: { status: 404 },
+  meeting_app_exists: { status: 409 },
+  meeting_app_in_use: { status: 409 },
+  meeting_app_mismatch: { status: 400 },
+  meeting_app_secret_unreadable: { status: 400 },
+  not_testable: { status: 400 },
+  autodiscovery_failed: { status: 422 },
+  password_required: { status: 400 },
+  oauth_servers_fixed: { status: 400 },
+  dav_discovery_failed: { status: 400 },
+  dav_unsupported: { status: 400 },
+  login_failed: { status: 400 },
+  server_not_allowed: { status: 400 },
+  plaintext_not_allowed: { status: 400 },
+  not_dav_server: { status: 400 },
+  not_imap_account: { status: 400 },
+  password_not_stored: { status: 400 },
+  password_unsupported: { status: 400 },
+  connect_session_not_found: { status: 404 },
+  session_used: { status: 409 },
+  session_expired: { status: 400 },
+  provider_not_allowed: { status: 400 },
+  redirect_uri_not_allowed: { status: 400 },
+  access_denied: { status: 400 },
+  access_token_rejected: { status: 400 },
+  account_exists: { status: 409 },
+  account_mismatch: { status: 409 },
+  consent_failed: { status: 400 },
+  consent_revoked: { status: 400 },
+  consent_unverified: { status: 400 },
+  credential_conflict: { status: 400 },
+  credential_missing: { status: 400 },
+  identity_failed: { status: 400 },
+  identity_unavailable: { status: 400 },
+  invalid_client: { status: 400 },
+  invalid_grant: { status: 400 },
+  missing_refresh_token: { status: 400 },
+  unknown_oauth_app: { status: 422 },
+  oauth_app_not_found: { status: 404 },
+  oauth_app_mismatch: { status: 400 },
+  oauth_app_in_use: { status: 409 },
+  oauth_app_secret_unreadable: { status: 400 },
+  google_imap_requires_own_app: { status: 400 },
+  org_connection_account: { status: 400 },
+  shared_mailbox_account: { status: 400 },
+  gmail_push_unsupported: { status: 400 },
+  push_unavailable: { status: 400 },
+  cloud_required: { status: 400 },
+  provider_error: { status: 400 },
+  provider_not_configured: { status: 400 },
+  unsupported_provider: { status: 400 },
+  scope_denied: { status: 400 },
+  token_exchange_failed: { status: 400 },
+  org_connection_not_found: { status: 404 },
+  org_connection_secret_unreadable: { status: 400 },
+  consent_required: { status: 409 },
+  delegate_missing: { status: 400 },
+  directory_unavailable: { status: 409 },
+  directory_already_connected: { status: 409 },
+  directory_mismatch: { status: 400 },
+  directory_id_not_allowed: { status: 400 },
+  credential_mismatch: { status: 400 },
+  connection_in_use: { status: 409 },
+  invalid_certificate: { status: 400 },
+  invalid_service_account_key: { status: 400 },
+  not_microsoft: { status: 400 },
+  user_required: { status: 400 },
+  shared_mailbox_unsupported: { status: 400 },
+  scope_missing: { status: 400 },
+  shared_mailbox_inaccessible: { status: 422 },
+  webhook_endpoint_not_found: { status: 404 },
+  endpoint_disabled: { status: 409 },
+  event_not_found: { status: 404 },
+  replay_range_too_large: { status: 400 },
+  mailbox_outside_accounts: { status: 400 },
+  https_required: { status: 400 },
+  export_not_found: { status: 404 },
+  export_not_ready: { status: 409 },
+  export_failed: { status: 409 },
+  export_running: { status: 409 },
+  export_in_progress: { status: 409 },
+  export_expired: { status: 410 },
+  export_corrupt: { status: 500 },
+  confirmation_mismatch: { status: 400 },
+  erase_scheduled: { status: 409 },
+  erase_started: { status: 409 },
+  erase_not_found: { status: 404 },
+  ai_disabled: { status: 400 },
+  ai_unavailable: { status: 502 },
+  ai_suspended: { status: 502 },
+  ai_refused: { status: 400 },
+  unknown_message: { status: 422 }
+};
+function reasonGuards(table) {
+  const isReason = (code) => typeof code === "string" && Object.hasOwn(table, code);
+  return {
+    isReason,
+    reasonOf(error) {
+      if (typeof error !== "object" || error === null || !("code" in error))
+        return null;
+      return isReason(error.code) ? error.code : null;
+    }
+  };
+}
+var v1Guards = reasonGuards(REASONS);
+var isErrorReason = v1Guards.isReason;
+var reasonOf = v1Guards.reasonOf;
+
+// ../contract/src/errors.ts
+function errorMap(table, conditions) {
+  const map = {};
+  for (const [reason, message] of Object.entries(conditions)) {
+    const definition = table[reason];
+    map[reason] = {
+      status: definition.status,
+      message,
+      ...definition.data !== undefined && { data: definition.data }
+    };
+  }
+  return map;
+}
+function errors(conditions) {
+  return errorMap(REASONS, conditions);
+}
+var GLOBAL_ERRORS = errors({
+  invalid_input: "The request does not match the operation's input schema (a malformed body included); data.issues names each problem.",
+  unauthenticated: "No usable credential: none was sent, or it is malformed, unknown, revoked or an expired account token.",
+  api_key_expired: "The API key is past its expiry (or the grace of the rotation that replaced it).",
+  missing_scope: "The API key lacks the scope the operation needs.",
+  role_forbidden: "The member's role does not allow the operation.",
+  account_token_forbidden: "An account token called an operation account tokens cannot call.",
+  rate_limited: "The tenant used up its plan's request rate; Retry-After says when the window ends.",
+  too_many_requests: "The credential has too many requests in flight at once; retry after Retry-After.",
+  overloaded: "The API is shedding load; retry after Retry-After.",
+  payload_too_large: "The request body is larger than the API accepts.",
+  internal_error: "An unexpected failure on our side.",
+  invalid_idempotency_key: "POST only: the Idempotency-Key header is not 1 to 255 printable ASCII characters.",
+  idempotency_key_reused: "POST only: the Idempotency-Key was used in the last 24 hours with another method, path or body.",
+  idempotency_key_in_progress: "POST only: the request first sent with this Idempotency-Key has not been answered yet."
+});
+var base = oc.errors(GLOBAL_ERRORS);
+var BOARD_SESSION_ONLY = "The caller is not a board session (only board sessions may call this).";
+var SESSION_ONLY = errors({ session_required: BOARD_SESSION_ONLY });
+var OWNER_ONLY = errors({
+  session_required: BOARD_SESSION_ONLY,
+  owner_required: "The caller does not own the organization."
+});
+var PLATFORM_ONLY = errors({
+  session_required: BOARD_SESSION_ONLY,
+  platform_admin_required: "The caller is not a platform administrator.",
+  email_verification_required: "The platform administrator has not verified their email address yet."
+});
+var ACCOUNT_NOT_FOUND = errors({
+  account_not_found: "The account does not exist, or the caller is an account token for another account."
+});
+function accountState(account = "The account") {
+  return errors({
+    account_paused: `${account} is paused.`,
+    account_disabled: `${account} is disabled.`,
+    account_reauth_required: `${account} must be reconnected: its stored grant or login no longer works.`,
+    account_misconfigured: `${account}'s stored grant cannot be used until an administrator fixes what it relies on (the tenant's OAuth app or organization connection is refused, missing or unreadable).`
+  });
+}
+var PROVIDER_FAILURES = errors({
+  provider_throttled: "The provider asked us to slow down (with Retry-After when it named a wait).",
+  provider_unavailable: "The provider could not be reached (with Retry-After when it named a wait)."
+});
+function bodyStorage(field) {
+  return errors({
+    storage_unavailable: `${field} is cache or full and no object store is configured.`,
+    plan_limit_storage: `${field} is cache or full and the tenant's plan does not include body storage.`
+  });
+}
+function planModule(module) {
+  return errors({ plan_module_unavailable: `The tenant's plan does not include ${module}.` });
+}
+var PLAN_LIMIT_ACCOUNTS = errors({
+  plan_limit_accounts: "The tenant already has as many accounts as its plan allows."
+});
+var BILLING_PAST_DUE = errors({
+  billing_past_due: "The tenant's payment is past due beyond the grace period (sends already queued or scheduled still go out)."
+});
+var INVALID_CURSOR = errors({ invalid_cursor: "The cursor is not one this list issued." });
+
+// ../contract/src/events/models.ts
+import * as z15 from "zod";
+
+// ../contract/src/mail/models.ts
+import * as z12 from "zod";
+var MailboxRole = named("MailboxRole", z12.enum(["inbox", "sent", "drafts", "trash", "junk", "archive", "all", "important", "custom"]));
+var MailboxKind = named("MailboxKind", z12.enum(["folder", "label"]));
+var Mailbox = named("Mailbox", z12.object({
+  id: Id,
+  name: z12.string(),
+  path: z12.string(),
+  parentId: Id.nullable(),
+  role: MailboxRole,
+  kind: MailboxKind,
+  totalCount: z12.number().int().nullable(),
+  unreadCount: z12.number().int().nullable()
+}));
+var MailboxList = List(Mailbox);
+var MailboxChangedField = named("MailboxChangedField", z12.enum(["name", "path", "parentId", "role", "kind"]));
+var MessageDirection = named("MessageDirection", z12.enum(["inbound", "outbound"]));
+var MessagePriority = named("MessagePriority", z12.enum(["high", "normal", "low"]));
+var MessageSummary = named("MessageSummary", z12.object({
+  id: Id,
+  threadId: ProviderId.nullable(),
+  internetMessageId: z12.string().nullable(),
+  mailboxIds: z12.array(Id),
+  subject: z12.string().nullable(),
+  from: Address.nullable(),
+  to: z12.array(Address),
+  cc: z12.array(Address),
+  snippet: z12.string().nullable(),
+  receivedAt: Timestamp.nullable(),
+  sentAt: Timestamp.nullable(),
+  isRead: z12.boolean(),
+  isFlagged: z12.boolean(),
+  isDraft: z12.boolean(),
+  hasAttachments: z12.boolean(),
+  categories: z12.array(z12.string()),
+  direction: MessageDirection,
+  outboxId: Id.nullable(),
+  reference: z12.string().nullable(),
+  importance: MessagePriority.nullable()
+}));
+var MessageChangedField = named("MessageChangedField", z12.enum([
+  "threadId",
+  "internetMessageId",
+  "subject",
+  "from",
+  "to",
+  "cc",
+  "bcc",
+  "replyTo",
+  "snippet",
+  "receivedAt",
+  "sentAt",
+  "isRead",
+  "isFlagged",
+  "isDraft",
+  "hasAttachments",
+  "categories",
+  "mailboxIds",
+  "direction",
+  "outboxId",
+  "importance"
+]));
+var MessageSummaryPage = Page(MessageSummary);
+var Attachment = named("Attachment", z12.object({
+  id: ProviderId,
+  filename: z12.string().nullable(),
+  contentType: z12.string(),
+  size: z12.number().int().nullable(),
+  isInline: z12.boolean(),
+  contentId: z12.string().nullable()
+}));
+var ReplyKind = named("ReplyKind", z12.enum(["opt_out", "auto_reply", "bounce", "human_reply"]));
+var AutoReplyCategory = named("AutoReplyCategory", z12.enum([
+  "out_of_office",
+  "left_company",
+  "address_changed",
+  "ticket_acknowledgment",
+  "challenge_response",
+  "other"
+]));
+var MessageClassification = named("MessageClassification", z12.object({
+  kind: ReplyKind,
+  probabilities: z12.record(z12.string(), z12.number()),
+  optOutProbability: z12.number(),
+  autoReplyCategory: AutoReplyCategory.nullable(),
+  returnDate: DateOnly.nullable(),
+  alternateContacts: z12.array(z12.string()),
+  outboxId: Id.nullable(),
+  model: z12.string(),
+  classifiedAt: Timestamp
+}));
+var MessageBody = named("MessageBody", z12.object({ text: z12.string().nullable(), html: z12.string().nullable() }));
+var Message = named("Message", MessageSummary.extend({
+  bcc: z12.array(Address),
+  replyTo: z12.array(Address),
+  body: MessageBody,
+  attachments: z12.array(Attachment),
+  classification: MessageClassification.nullable()
+}));
+var SearchSource = named("SearchSource", z12.enum(["auto", "index", "provider"]));
+var SearchResultSource = named("SearchResultSource", SearchSource.exclude(["auto"]));
+var SearchHit = named("SearchHit", MessageSummary.extend({ id: Id.nullable() }));
+var SearchPage = named("SearchPage", z12.object({ ...pageFields(SearchHit), source: SearchResultSource }));
+var BodyStorageUsage = named("BodyStorageUsage", z12.object({
+  available: z12.boolean(),
+  storedMessages: z12.number().int(),
+  storedBytes: z12.number().int(),
+  cachedBytes: z12.number().int(),
+  cacheBudgetBytes: z12.number().int(),
+  cacheMaxAgeDays: z12.number().int()
+}));
+var MessageIdInput = named("MessageIdInput", AccountIdInput.extend({ messageId: Id }));
+var AttachmentIdInput = named("AttachmentIdInput", MessageIdInput.extend({ attachmentId: ProviderId }));
+var ListMessagesQuery = named("ListMessagesQuery", z12.object({
+  mailboxId: Id.optional(),
+  unread: QueryBoolean.optional(),
+  importance: MessagePriority.optional(),
+  ...Paged
+}));
+var SearchMessagesQuery = named("SearchMessagesQuery", z12.object({
+  q: trimmed(MAX_SEARCH_QUERY_LENGTH),
+  mailboxId: Id.optional(),
+  after: QueryTimestamp.optional(),
+  before: QueryTimestamp.optional(),
+  source: SearchSource.default("auto"),
+  limit: pageLimit(MAX_SEARCH_PAGE_SIZE, DEFAULT_SEARCH_PAGE_SIZE),
+  cursor: Cursor.optional()
+}));
+var UpdateMessage = named("UpdateMessage", z12.object({
+  isRead: z12.boolean().optional(),
+  isFlagged: z12.boolean().optional(),
+  mailboxId: Id.optional(),
+  addMailboxIds: z12.array(Id).max(MAX_MAILBOX_CHANGES).optional(),
+  removeMailboxIds: z12.array(Id).max(MAX_MAILBOX_CHANGES).optional()
+}));
+var DeleteMessageQuery = named("DeleteMessageQuery", z12.object({
+  permanent: QueryBoolean.default(false)
+}));
+var DeleteMessageInput = named("DeleteMessageInput", z12.object({ params: MessageIdInput, query: DeleteMessageQuery }));
+
+// ../contract/src/send/models.ts
+import * as z14 from "zod";
+
+// ../contract/src/suppressions/models.ts
+import * as z13 from "zod";
+var GLOBAL_LIST_ID = "global";
+var LIST_ID_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+var SuppressionListId = z13.string().trim().toLowerCase().regex(LIST_ID_PATTERN);
+var ListId = SuppressionListId.refine((id) => id !== GLOBAL_LIST_ID, {
+  message: `"${GLOBAL_LIST_ID}" is reserved`
+});
+var Reason = trimmed(MAX_SUPPRESSION_REASON_LENGTH);
+var ListName = Name.trim().min(1);
+var ListDescription = z13.string().trim().max(MAX_SUPPRESSION_LIST_DESCRIPTION_LENGTH);
+var SuppressionSource = named("SuppressionSource", z13.enum(["unsubscribe", "bounce", "api", "reply", "complaint", "inactive"]));
+var DetectedOptOutSource = named("DetectedOptOutSource", SuppressionSource.extract(["reply", "complaint", "inactive"]));
+var SuppressionEntry = named("SuppressionEntry", z13.object({
+  address: z13.string(),
+  source: SuppressionSource,
+  reason: z13.string().nullable(),
+  createdAt: Timestamp
+}));
+var SuppressionEntryPage = Page(SuppressionEntry);
+var SuppressionCounts = named("SuppressionCounts", z13.object({
+  unsubscribe: z13.number().int(),
+  bounce: z13.number().int(),
+  api: z13.number().int(),
+  reply: z13.number().int(),
+  complaint: z13.number().int(),
+  inactive: z13.number().int()
+}));
+var SuppressionList = named("SuppressionList", z13.object({
+  id: z13.string(),
+  name: z13.string(),
+  description: z13.string().nullable(),
+  count: z13.number().int(),
+  counts: SuppressionCounts,
+  createdAt: Timestamp.nullable()
+}));
+var SuppressionListList = List(SuppressionList);
+var SuppressionReview = named("SuppressionReview", z13.object({
+  id: Id,
+  listId: z13.string(),
+  address: z13.string(),
+  source: DetectedOptOutSource,
+  accountId: Id,
+  messageId: Id,
+  probability: z13.number(),
+  alternateContacts: z13.array(z13.string()),
+  createdAt: Timestamp
+}));
+var SuppressionReviewPage = Page(SuppressionReview);
+var ListIdInput = named("ListIdInput", z13.object({ listId: ListId }));
+var SuppressionListIdInput = named("SuppressionListIdInput", z13.object({ listId: SuppressionListId }));
+var ReviewIdInput = named("ReviewIdInput", z13.object({ reviewId: Id }));
+var CreateSuppressionList = named("CreateSuppressionList", z13.object({
+  id: ListId,
+  name: ListName,
+  description: ListDescription.nullable().optional()
+}));
+var UpdateSuppressionList = named("UpdateSuppressionList", z13.object({
+  name: ListName.optional(),
+  description: ListDescription.nullable().optional()
+}));
+var DeleteSuppressionListQuery = named("DeleteSuppressionListQuery", z13.object({ withEntries: QueryBoolean.default(false) }));
+var DeleteSuppressionListInput = named("DeleteSuppressionListInput", z13.object({ params: ListIdInput, query: DeleteSuppressionListQuery }));
+var ListSuppressionEntriesQuery = named("ListSuppressionEntriesQuery", z13.object({
+  address: z13.string().trim().max(MAX_EMAIL_LENGTH).optional(),
+  source: SuppressionSource.optional(),
+  ...Paged
+}));
+var AddSuppressionEntriesRequest = named("AddSuppressionEntriesRequest", z13.object({
+  addresses: z13.array(Email).min(1).max(MAX_SUPPRESSION_BATCH),
+  reason: Reason.optional()
+}));
+var SuppressionEntryInput = named("SuppressionEntryInput", SuppressionListIdInput.extend({ address: trimmed(MAX_EMAIL_LENGTH) }));
+var ListSuppressionReviewsQuery = named("ListSuppressionReviewsQuery", z13.object({ listId: SuppressionListId.optional(), ...Paged }));
+var SuppressionAdded = named("SuppressionAdded", z13.object({ added: z13.boolean() }));
+var SuppressionEntriesAdded = named("SuppressionEntriesAdded", z13.object({ added: z13.number().int(), alreadyListed: z13.number().int() }));
+
+// ../contract/src/send/models.ts
+var AttachmentInput = named("AttachmentInput", z14.object({
+  filename: z14.string().min(1).max(MAX_FILENAME_LENGTH),
+  contentType: z14.string().min(1).max(MAX_CONTENT_TYPE_LENGTH),
+  content: z14.base64(),
+  contentId: z14.string().max(MAX_CONTENT_ID_LENGTH).optional()
+}));
+var Compose = named("Compose", z14.object({
+  to: z14.array(AddressInput).max(MAX_RECIPIENTS).default([]),
+  cc: z14.array(AddressInput).max(MAX_RECIPIENTS).default([]),
+  bcc: z14.array(AddressInput).max(MAX_RECIPIENTS).default([]),
+  replyTo: z14.array(AddressInput).max(MAX_REPLY_TO).default([]),
+  subject: z14.string().max(MAX_SUBJECT_LENGTH).optional(),
+  text: z14.string().max(MAX_BODY_LENGTH).optional(),
+  html: z14.string().max(MAX_BODY_LENGTH).optional(),
+  attachments: z14.array(AttachmentInput).max(MAX_ATTACHMENTS).default([]),
+  inReplyToMessageId: Id.optional(),
+  from: AddressInput.optional(),
+  signature: z14.boolean().optional(),
+  priority: MessagePriority.default("normal")
+}));
+var ComposeWithTemplate = named("ComposeWithTemplate", Compose.extend({
+  template: Id.optional(),
+  render: z14.object({ params: RenderParams.default({}) }).optional(),
+  previewText: z14.string().max(MAX_TEMPLATE_PREVIEW_TEXT_LENGTH).optional(),
+  format: TemplateFormat.optional()
+}));
+var OutboxStatus = named("OutboxStatus", z14.enum(["queued", "sending", "sent", "failed", "cancelled"]));
+var OutboxEntry = named("OutboxEntry", z14.object({
+  id: Id,
+  accountId: Id,
+  status: OutboxStatus,
+  reference: z14.string().nullable(),
+  sendAt: Timestamp,
+  attempt: z14.number().int(),
+  lastError: z14.string().nullable(),
+  providerMessageId: ProviderId.nullable(),
+  internetMessageId: z14.string().nullable(),
+  sentAt: Timestamp.nullable(),
+  createdAt: Timestamp,
+  trackOpens: z14.boolean(),
+  trackClicks: z14.boolean(),
+  trackHoneypot: z14.boolean(),
+  humanOpenCount: z14.number().int(),
+  machineOpenCount: z14.number().int(),
+  humanClickCount: z14.number().int(),
+  machineClickCount: z14.number().int(),
+  firstOpenedAt: Timestamp.nullable(),
+  lastOpenedAt: Timestamp.nullable()
+}));
+var QueuedSend = named("QueuedSend", OutboxEntry.extend({
+  undoUntil: Timestamp.nullable()
+}));
+var SendTracking = named("SendTracking", z14.object({
+  opens: z14.boolean().optional(),
+  clicks: z14.boolean().optional(),
+  honeypot: z14.boolean().optional()
+}));
+var SendOptions = named("SendOptions", z14.object({
+  sendAt: QueryTimestamp.optional(),
+  reference: z14.string().max(MAX_SEND_REFERENCE_LENGTH).optional(),
+  tracking: SendTracking.optional()
+}));
+var ListOption = {
+  listId: ListId.optional()
+};
+var MailMergeEntry = named("MailMergeEntry", z14.object({
+  to: AddressInput.extend({ address: z14.string().max(MAX_EMAIL_LENGTH) }),
+  params: RenderParams.optional(),
+  messageId: z14.string().max(MAX_MESSAGE_ID_LENGTH).optional(),
+  sendAt: QueryTimestamp.optional()
+}));
+var SendMessageRequest = named("SendMessageRequest", ComposeWithTemplate.extend(SendOptions.shape).extend(ListOption));
+var MailMergeRequest = named("MailMergeRequest", ComposeWithTemplate.omit({ to: true, cc: true, bcc: true, render: true }).extend(SendOptions.shape).extend({
+  ...ListOption,
+  entries: z14.array(MailMergeEntry).min(1).max(MAX_MAIL_MERGE_ENTRIES)
+}).strict());
+var MailMergeSuccess = named("MailMergeSuccess", z14.object({
+  success: z14.literal(true),
+  to: Address,
+  outboxId: Id,
+  messageId: z14.string(),
+  sendAt: Timestamp,
+  undoUntil: Timestamp.nullable()
+}));
+var MailMergeFailure = named("MailMergeFailure", z14.object({
+  success: z14.literal(false),
+  to: Address,
+  reason: z14.string(),
+  error: z14.string(),
+  status: z14.number().int()
+}));
+var MailMergeResult = named("MailMergeResult", z14.discriminatedUnion("success", [MailMergeSuccess, MailMergeFailure]));
+var MailMergeResultList = List(MailMergeResult);
+var OutboxIdInput = named("OutboxIdInput", AccountIdInput.extend({ outboxId: Id }));
+var OutboxEntryPage = Page(OutboxEntry);
+var ListOutboxQuery = named("ListOutboxQuery", z14.object({ status: OutboxStatus.optional(), ...Paged }));
+var RescheduleSendRequest = named("RescheduleSendRequest", z14.object({ sendAt: QueryTimestamp }));
+var ListTrackingEventsQuery = named("ListTrackingEventsQuery", z14.object(Paged));
+var TrackingEventKind = named("TrackingEventKind", z14.enum(["open", "click"]));
+var TrackingActor = named("TrackingActor", z14.enum(["human", "proxy", "prefetch", "scanner", "unknown"]));
+var TrackingClient = named("TrackingClient", z14.enum([
+  "gmail_proxy",
+  "gmail_web",
+  "gmail_app",
+  "outlook_web",
+  "outlook_desktop",
+  "outlook_mobile",
+  "apple_mail",
+  "apple_mail_privacy",
+  "yahoo",
+  "aol",
+  "thunderbird",
+  "proton",
+  "fastmail",
+  "zoho",
+  "icloud_web",
+  "webmail",
+  "unknown"
+]));
+var TrackingDevice = named("TrackingDevice", z14.enum(["desktop", "mobile", "tablet", "bot", "unknown"]));
+var TrackingOs = named("TrackingOs", z14.enum(["windows", "macos", "ios", "ipados", "android", "linux", "chromeos"]));
+var TrackingBrowser = named("TrackingBrowser", z14.enum(["chrome", "edge", "firefox", "safari", "opera", "samsung"]));
+var TrackingSecFetch = named("TrackingSecFetch", z14.object({
+  dest: z14.string().nullable(),
+  mode: z14.string().nullable(),
+  site: z14.string().nullable(),
+  user: z14.boolean().nullable()
+}));
+var TrackingSignals = named("TrackingSignals", z14.object({
+  method: z14.string(),
+  refererHost: z14.string().nullable(),
+  originHost: z14.string().nullable(),
+  client: TrackingClient,
+  device: TrackingDevice,
+  os: TrackingOs.nullable(),
+  browser: TrackingBrowser.nullable(),
+  country: z14.string().nullable(),
+  region: z14.string().nullable(),
+  city: z14.string().nullable(),
+  timezone: z14.string().nullable(),
+  latitude: z14.number().nullable(),
+  longitude: z14.number().nullable(),
+  secondsAfterSend: z14.number().nullable(),
+  secondsSincePrevious: z14.number().nullable(),
+  sequence: z14.number().int(),
+  isConditional: z14.boolean(),
+  isRange: z14.boolean(),
+  isPrefetch: z14.boolean(),
+  secFetch: TrackingSecFetch
+}));
+var TrackingEvent = named("TrackingEvent", z14.object({
+  id: Id,
+  kind: TrackingEventKind,
+  linkIndex: z14.number().int().nullable(),
+  url: z14.string().nullable(),
+  occurredAt: Timestamp,
+  userAgent: z14.string().nullable(),
+  ip: z14.string().nullable(),
+  actor: TrackingActor,
+  reasons: z14.array(z14.string()),
+  isMachine: z14.boolean(),
+  ...TrackingSignals.shape,
+  headers: z14.record(z14.string(), z14.string())
+}));
+var TrackingEventPage = Page(TrackingEvent);
+
+// ../contract/src/events/models.ts
+var AccountConnectedData = named("AccountConnectedData", z15.object({
+  email: z15.string(),
+  provider: AccountProvider,
+  cloud: MicrosoftCloud.nullable(),
+  externalRef: z15.string().nullable(),
+  reauthorized: z15.boolean()
+}));
+var AccountUpdatedField = named("AccountUpdatedField", z15.enum(["status", "externalRef", "settings", "imap", "dav", "credentials"]));
+var AccountUpdatedData = named("AccountUpdatedData", z15.object({ fields: z15.array(AccountUpdatedField) }));
+var AccountDeletedData = named("AccountDeletedData", z15.object({
+  email: z15.string(),
+  externalRef: z15.string().nullable(),
+  purge: z15.boolean()
+}));
+var AccountReauthRequiredData = named("AccountReauthRequiredData", AccountConnectedData.omit({ reauthorized: true }).extend({
+  reason: z15.string()
+}));
+var AccountInitializedData = named("AccountInitializedData", z15.object({ mailboxes: z15.number().int(), messages: z15.number().int() }));
+var AccountPurgedData = named("AccountPurgedData", z15.object({
+  accountId: Id,
+  externalRef: z15.string().nullable()
+}));
+var MailboxData = named("MailboxData", z15.object({ mailbox: Mailbox }));
+var MailboxUpdatedData = named("MailboxUpdatedData", MailboxData.extend({ changes: z15.array(MailboxChangedField) }));
+var MailboxRef = named("MailboxRef", Mailbox.pick({ id: true, name: true, role: true }));
+var MessageData = named("MessageData", z15.object({ message: MessageSummary, mailboxes: z15.array(MailboxRef) }));
+var MessageUpdatedData = named("MessageUpdatedData", MessageData.extend({ changes: z15.array(MessageChangedField) }));
+var MessageDeletedData = named("MessageDeletedData", MessageData.extend({
+  messageId: Id,
+  providerMessageId: ProviderId
+}));
+var MessageClassifiedData = named("MessageClassifiedData", MessageData.extend({ classification: MessageClassification }));
+var BounceRecipient = named("BounceRecipient", z15.object({
+  address: z15.string(),
+  status: z15.string().nullable(),
+  diagnostic: z15.string().nullable()
+}));
+var MessageBouncedData = named("MessageBouncedData", z15.object({
+  messageId: Id,
+  outboxId: Id.nullable(),
+  reference: z15.string().nullable(),
+  originalMessageId: z15.string().nullable(),
+  recipients: z15.array(BounceRecipient)
+}));
+var TrackingHitData = named("TrackingHitData", TrackingEvent.omit({ id: true, kind: true, linkIndex: true, ip: true, headers: true }).extend({
+  outboxId: Id,
+  reference: z15.string().nullable(),
+  messageId: Id.nullable()
+}));
+var SendError = named("SendError", z15.object({ code: z15.string(), message: z15.string() }));
+var SendFields = {
+  outboxId: Id,
+  reference: z15.string().nullable()
+};
+var SendSentData = named("SendSentData", z15.object({
+  ...SendFields,
+  attempt: z15.number().int(),
+  providerMessageId: ProviderId.nullable(),
+  internetMessageId: z15.string().nullable(),
+  sentAt: Timestamp
+}));
+var SendRetryingData = named("SendRetryingData", z15.object({
+  ...SendFields,
+  attempt: z15.number().int(),
+  nextAttemptAt: Timestamp,
+  error: SendError
+}));
+var SendFailedData = named("SendFailedData", z15.object({ ...SendFields, attempt: z15.number().int(), error: SendError }));
+var SendRescheduledData = named("SendRescheduledData", z15.object({ ...SendFields, sendAt: Timestamp, previousSendAt: Timestamp }));
+var SuppressionCreatedData = named("SuppressionCreatedData", z15.object({ listId: z15.string(), address: z15.string(), source: SuppressionSource }));
+var CalendarInitializedData = named("CalendarInitializedData", z15.object({ calendars: z15.number().int(), events: z15.number().int() }));
+var CalendarData = named("CalendarData", z15.object({ calendar: Calendar }));
+var CalendarUpdatedData = named("CalendarUpdatedData", CalendarData.extend({ changes: z15.array(CalendarChangedField) }));
+var CalendarEventData = named("CalendarEventData", z15.object({ event: CalendarEvent }));
+var CalendarEventUpdatedData = named("CalendarEventUpdatedData", CalendarEventData.extend({ changes: z15.array(CalendarEventChangedField) }));
+var CalendarEventDeletedData = named("CalendarEventDeletedData", z15.object({ eventId: Id, calendarId: Id, kind: EventKind, seriesId: Id.nullable() }));
+var ContactsInitializedData = named("ContactsInitializedData", z15.object({ contacts: z15.number().int() }));
+var ContactData = named("ContactData", z15.object({ contact: Contact }));
+var ContactUpdatedData = named("ContactUpdatedData", ContactData.extend({ changes: z15.array(ContactChangedField) }));
+var ContactDeletedData = named("ContactDeletedData", z15.object({ contactId: Id, folderId: Id.nullable() }));
+var WebhookTestData = named("WebhookTestData", z15.object({ endpointId: Id }));
+var ExportCompletedData = named("ExportCompletedData", z15.object({
+  exportId: Id,
+  bytes: z15.number().int(),
+  sha256: z15.string(),
+  expiresAt: Timestamp
+}));
+var ExportFailedData = named("ExportFailedData", z15.object({ exportId: Id, error: z15.string() }));
+var MeetingConnectionConnectedData = named("MeetingConnectionConnectedData", z15.object({
+  service: MeetingService,
+  email: z15.string(),
+  reconnected: z15.boolean()
+}));
+var MeetingConnectionReauthRequiredData = named("MeetingConnectionReauthRequiredData", MeetingConnectionConnectedData.omit({ reconnected: true }).extend({
+  reason: z15.string()
+}));
+function defineEvent(scope, data, description) {
+  return { scope, data, description };
+}
+var EVENTS = {
+  "account.connected": defineEvent("account", AccountConnectedData, "An account was connected, or an existing account signed in again (reauthorized)."),
+  "account.updated": defineEvent("account", AccountUpdatedData, "An account's status, externalRef, settings or connection changed."),
+  "account.deleted": defineEvent("account", AccountDeletedData, "An account was deleted; its data is purged after the retention period, or at once with purge."),
+  "account.reauth_required": defineEvent("account", AccountReauthRequiredData, "The provider refused the account's grant: the account must sign in again."),
+  "account.initialized": defineEvent("account", AccountInitializedData, "The account's first mail sync finished; nothing before it is announced message by message."),
+  "account.purged": defineEvent("tenant", AccountPurgedData, "A deleted account's data is gone for good (retention, or an immediate purge). The event names no account, since it outlives the account it reports on."),
+  "mailbox.created": defineEvent("account", MailboxData, "A mailbox (folder or label) appeared."),
+  "mailbox.updated": defineEvent("account", MailboxUpdatedData, "A mailbox was renamed, moved or given another role. Counts change silently."),
+  "mailbox.deleted": defineEvent("account", MailboxData, "A mailbox went away."),
+  "message.created": defineEvent("account", MessageData, "A message was indexed: received, sent, drafted or moved in from outside the sync window."),
+  "message.updated": defineEvent("account", MessageUpdatedData, "A message changed: read, flagged, moved, or linked to the outbox entry it is a copy of."),
+  "message.deleted": defineEvent("account", MessageDeletedData, "A message was removed; carries it and its mailboxes as last indexed."),
+  "message.bounced": defineEvent("account", MessageBouncedData, "A delivery status notification reporting failed recipients reached the account; carries the outbox id when it answers one of our sends."),
+  "message.classified": defineEvent("account", MessageClassifiedData, "AI classified a reply to one of our sends (tenant setting aiReplyClassification): carries the message, its mailboxes and the classification."),
+  "message.opened": defineEvent("account", TrackingHitData, "A recipient's client (or a proxy fetching for it) loaded the open-tracking pixel of a send. Carries the actor, its reasons and the derived signals (client, device, location, referer host, sec-fetch tuple, timing); the raw headers are only on the tracking list."),
+  "message.clicked": defineEvent("account", TrackingHitData, "A tracked link of a send was followed; carries the same as message.opened."),
+  "send.sent": defineEvent("account", SendSentData, "The provider accepted a queued send."),
+  "send.retrying": defineEvent("account", SendRetryingData, "An attempt failed and the send is queued again for nextAttemptAt."),
+  "send.failed": defineEvent("account", SendFailedData, "The send failed for good: refused, or out of attempts."),
+  "send.rescheduled": defineEvent("account", SendRescheduledData, "A queued send got a new sendAt before its first attempt."),
+  "suppression.created": defineEvent("account", SuppressionCreatedData, "An address went onto a suppression list: the recipient unsubscribed (source unsubscribe, listId the send's), a permanent bounce said the address is gone (source bounce, listId global), or a detected opt-out was suppressed, at once or on approval (source reply or complaint, listId the send's or global; source inactive, on approval only, listId global). Only a change is announced; API adds are audited instead. The account is the one whose send it concerns."),
+  "calendar.initialized": defineEvent("account", CalendarInitializedData, "The account's first calendar sync finished; nothing before it is announced event by event."),
+  "calendar.created": defineEvent("account", CalendarData, "A calendar appeared."),
+  "calendar.updated": defineEvent("account", CalendarUpdatedData, "A calendar changed."),
+  "calendar.deleted": defineEvent("account", CalendarData, "A calendar went away."),
+  "calendar_event.created": defineEvent("account", CalendarEventData, "A single event, series or exception appeared. Unmodified occurrences of a series are never announced; an occurrence changed on its own is announced as a new exception."),
+  "calendar_event.updated": defineEvent("account", CalendarEventUpdatedData, "A single event, series or exception changed; a change to a series is one update of the series."),
+  "calendar_event.deleted": defineEvent("account", CalendarEventDeletedData, "A single event, series or exception went away."),
+  "contacts.initialized": defineEvent("account", ContactsInitializedData, "The account's first contacts sync finished; nothing before it is announced contact by contact."),
+  "contact.created": defineEvent("account", ContactData, "A contact appeared."),
+  "contact.updated": defineEvent("account", ContactUpdatedData, "A contact changed."),
+  "contact.deleted": defineEvent("account", ContactDeletedData, "A contact went away."),
+  "export.completed": defineEvent("either", ExportCompletedData, "A data export finished and can be downloaded until data.expiresAt. accountId is null for an export of the whole tenant."),
+  "export.failed": defineEvent("either", ExportFailedData, "A data export failed. accountId is null for an export of the whole tenant."),
+  "meeting_connection.connected": defineEvent("account", MeetingConnectionConnectedData, "An account connected (or reconnected) its own grant at a meeting service (Zoom, Webex)."),
+  "meeting_connection.reauth_required": defineEvent("account", MeetingConnectionReauthRequiredData, "The service refused the account's meeting grant; meetings need a new connect. Mail and calendar sync go on."),
+  "webhook.test": defineEvent("tenant", WebhookTestData, "Sent by the test action to the endpoint it names, whatever that endpoint's filters.")
+};
+var EVENT_TYPES = Object.keys(EVENTS);
+var EventType = named("EventType", z15.enum(EVENT_TYPES));
+var TEST_EVENT_TYPE = "webhook.test";
+var ENVELOPE_ACCOUNT_ID = { account: Id, tenant: z15.null(), either: Id.nullable() };
+function envelope(type) {
+  const { scope, data, description } = EVENTS[type];
+  const name = type.replace(/(?:^|[._])([a-z])/g, (_, letter) => letter.toUpperCase());
+  return named(`${name}Event`, z15.object({
+    id: EventId,
+    type: z15.literal(type),
+    accountId: ENVELOPE_ACCOUNT_ID[scope],
+    createdAt: Timestamp,
+    data,
+    isTest: z15.literal(true).exactOptional()
+  }).meta({ description }));
+}
+var Event = named("Event", z15.discriminatedUnion("type", EVENT_TYPES.map(envelope)));
+var ListChangesQuery = named("ListChangesQuery", z15.object({
+  cursor: Cursor.optional(),
+  limit: Limit,
+  types: z15.union([z15.string(), z15.array(EventType)]).transform((v) => Array.isArray(v) ? v : v.split(",")).pipe(z15.array(EventType)).optional()
+}));
+var EventFeedPage = named("EventFeedPage", z15.object({ items: z15.array(Event), nextCursor: Cursor }));
+
+// ../contract/src/exports/models.ts
+import * as z16 from "zod";
+var ExportStatus = named("ExportStatus", z16.enum(["queued", "running", "completed", "failed", "expired"]));
+var DataExport = named("DataExport", z16.object({
+  id: Id,
+  accountId: Id.nullable(),
+  accountEmail: z16.string().nullable(),
+  status: ExportStatus,
+  bytes: z16.number().int(),
+  sha256: z16.string().nullable(),
+  contents: z16.record(z16.string(), z16.number().int()),
+  error: z16.string().nullable(),
+  createdAt: Timestamp,
+  startedAt: Timestamp.nullable(),
+  completedAt: Timestamp.nullable(),
+  expiresAt: Timestamp.nullable()
+}));
+var DataExportPage = Page(DataExport);
+var CreateDataExport = named("CreateDataExport", z16.object({
+  accountId: Id.optional()
+}));
+var ListDataExportsQuery = named("ListDataExportsQuery", z16.object(Paged));
+var DataExportIdInput = named("DataExportIdInput", z16.object({ exportId: Id }));
+
+// ../contract/src/identities/models.ts
+import * as z17 from "zod";
+var IdentitySource = named("IdentitySource", z17.enum(["primary", "provider", "custom"]));
+var Signature = named("Signature", z17.object({ html: z17.string().nullable(), text: z17.string().nullable() }));
+var SignatureInput = named("SignatureInput", z17.object({
+  html: z17.string().max(MAX_SIGNATURE_HTML_LENGTH).optional(),
+  text: z17.string().max(MAX_SIGNATURE_TEXT_LENGTH).optional()
+}).refine((s) => s.html !== undefined || s.text !== undefined, {
+  message: "A signature needs html or text"
+}));
+var Identity = named("Identity", Address.extend({
+  id: Id,
+  source: IdentitySource,
+  signature: Signature.nullable(),
+  providerSignature: Signature.nullable()
+}));
+var IdentityList = named("IdentityList", z17.object({ ...listFields(Identity), refreshedAt: Timestamp.nullable() }));
+var MailSettings = named("MailSettings", z17.object({
+  signByDefault: z17.boolean()
+}));
+var UpdateMailSettings = named("UpdateMailSettings", MailSettings.partial());
+var IdentityIdInput = named("IdentityIdInput", AccountIdInput.extend({ identityId: Id }));
+var ListIdentitiesQuery = named("ListIdentitiesQuery", z17.object({ refresh: QueryBoolean.optional() }));
+var CreateIdentity = named("CreateIdentity", AddressInput.extend({ signature: SignatureInput.optional() }));
+var UpdateIdentity = named("UpdateIdentity", z17.object({
+  name: z17.string().max(MAX_ADDRESS_NAME_LENGTH).nullable().optional(),
+  signature: SignatureInput.nullable().optional()
+}));
+
+// ../contract/src/oauth-apps/models.ts
+import * as z18 from "zod";
+var PUBSUB_TOPIC_PATTERN = /^projects\/[a-z][a-z0-9.:-]{4,61}[a-z0-9]\/topics\/(?!goog)[A-Za-z][A-Za-z0-9._~+%-]{2,254}$/;
+var GmailPushSettings = named("GmailPushSettings", z18.object({
+  topic: z18.string().regex(PUBSUB_TOPIC_PATTERN, "Expected projects/<project>/topics/<topic>"),
+  serviceAccount: z18.email().regex(/\.gserviceaccount\.com$/i, "Expected a Google service account email")
+}));
+var OAuthApp = named("OAuthApp", z18.object({
+  id: Id,
+  provider: OAuthProvider,
+  name: z18.string(),
+  clientId: z18.string(),
+  cloud: MicrosoftCloud.nullable(),
+  authority: z18.string().nullable(),
+  gmailPush: GmailPushSettings.nullable(),
+  gmailPushEndpoint: z18.url().nullable(),
+  createdAt: Timestamp
+}));
+var OAuthAppList = List(OAuthApp);
+var CreateOAuthApp = named("CreateOAuthApp", z18.object({
+  provider: OAuthProvider,
+  cloud: MicrosoftCloud.optional(),
+  name: Name,
+  clientId: z18.string().min(1),
+  clientSecret: z18.string().min(1),
+  authority: z18.string().optional()
+}));
+var UpdateOAuthApp = named("UpdateOAuthApp", z18.object({
+  name: Name.optional(),
+  clientSecret: z18.string().min(1).optional(),
+  authority: z18.string().min(1).optional(),
+  gmailPush: GmailPushSettings.nullable().optional()
+}));
+var OAuthAppIdInput = named("OAuthAppIdInput", z18.object({ appId: Id }));
+
+// ../contract/src/org-connections/models.ts
+import * as z19 from "zod";
+var OrgConnectionKind = named("OrgConnectionKind", z19.enum(["google_delegation", "microsoft_app"]));
+var OrgConnectionStatus = named("OrgConnectionStatus", z19.enum(["pending_consent", "unverified", "active", "failing"]));
+var MicrosoftAppCredential = named("MicrosoftAppCredential", z19.enum(["platform", "client_secret", "certificate"]));
+var GoogleDelegation = named("GoogleDelegation", z19.object({
+  domain: z19.string(),
+  serviceAccountEmail: z19.string(),
+  directoryAdmin: z19.string().nullable(),
+  scopes: z19.array(z19.string())
+}));
+var GraphPermission = named("GraphPermission", z19.object({ name: z19.string(), isRequired: z19.boolean() }));
+var MicrosoftAppAccess = named("MicrosoftAppAccess", z19.object({
+  cloud: MicrosoftCloud,
+  credentialType: MicrosoftAppCredential,
+  directoryId: z19.string().nullable(),
+  permissions: z19.array(GraphPermission)
+}));
+var OrgConnection = named("OrgConnection", z19.object({
+  id: Id,
+  kind: OrgConnectionKind,
+  name: z19.string(),
+  clientId: z19.string(),
+  status: OrgConnectionStatus,
+  statusDetail: z19.string().nullable(),
+  checkedAt: Timestamp.nullable(),
+  google: GoogleDelegation.nullable(),
+  microsoft: MicrosoftAppAccess.nullable(),
+  accounts: z19.number().int(),
+  createdAt: Timestamp,
+  updatedAt: Timestamp
+}));
+var OrgConnectionList = List(OrgConnection);
+var Pem = z19.string().min(1).max(MAX_KEY_FILE_LENGTH);
+var ServiceAccountKey = z19.string().min(2).max(MAX_KEY_FILE_LENGTH);
+var EntraId = z19.string().min(1).max(MAX_ENTRA_ID_LENGTH);
+var ClientSecret2 = z19.string().min(1).max(MAX_SECRET_LENGTH);
+var CreateOrgConnection = named("CreateOrgConnection", z19.discriminatedUnion("kind", [
+  z19.object({
+    kind: z19.literal("google_delegation"),
+    name: Name,
+    serviceAccountKey: ServiceAccountKey,
+    domain: z19.string().min(3).max(MAX_HOST_LENGTH),
+    calendarEnabled: z19.boolean().default(true),
+    contactsEnabled: z19.boolean().default(false),
+    directoryAdmin: Email.optional()
+  }),
+  z19.object({
+    kind: z19.literal("microsoft_app"),
+    name: Name,
+    cloud: MicrosoftCloud.default("global"),
+    credential: z19.discriminatedUnion("type", [
+      z19.object({ type: z19.literal("platform") }),
+      z19.object({
+        type: z19.literal("client_secret"),
+        clientId: EntraId,
+        clientSecret: ClientSecret2
+      }),
+      z19.object({
+        type: z19.literal("certificate"),
+        clientId: EntraId,
+        certificate: Pem,
+        privateKey: Pem
+      })
+    ]),
+    directoryId: EntraId.optional()
+  })
+]));
+var UpdateOrgConnection = named("UpdateOrgConnection", z19.object({
+  name: Name.optional(),
+  serviceAccountKey: ServiceAccountKey.optional(),
+  calendarEnabled: z19.boolean().optional(),
+  contactsEnabled: z19.boolean().optional(),
+  directoryAdmin: Email.nullable().optional(),
+  clientSecret: ClientSecret2.optional(),
+  certificate: Pem.optional(),
+  privateKey: Pem.optional(),
+  directoryId: EntraId.optional()
+}));
+var OrgConnectionCheck = named("OrgConnectionCheck", z19.object({
+  name: z19.string(),
+  isOk: z19.boolean(),
+  isRequired: z19.boolean(),
+  detail: z19.string()
+}));
+var OrgConnectionTestResult = named("OrgConnectionTestResult", z19.object({ connection: OrgConnection, checks: z19.array(OrgConnectionCheck) }));
+var DirectoryEntry = named("DirectoryEntry", z19.object({
+  id: ProviderId,
+  email: z19.string(),
+  displayName: z19.string().nullable(),
+  accountId: Id.nullable()
+}));
+var DirectoryEntryPage = Page(DirectoryEntry);
+var AddMailboxInput = named("AddMailboxInput", z19.object({
+  email: Email,
+  displayName: z19.string().max(MAX_DISPLAY_NAME_LENGTH).optional(),
+  externalRef: ExternalRef.optional()
+}));
+var AddMailboxesRequest = named("AddMailboxesRequest", z19.object({
+  mailboxes: z19.array(AddMailboxInput).min(1).max(MAX_ADD_MAILBOXES),
+  settings: SettingsOverride.optional()
+}));
+var AddedMailboxStatus = named("AddedMailboxStatus", z19.enum(["created", "exists", "failed"]));
+var AddedMailboxError = named("AddedMailboxError", z19.object({ reason: z19.string(), message: z19.string() }));
+var AddedMailbox = named("AddedMailbox", z19.object({
+  email: z19.string(),
+  status: AddedMailboxStatus,
+  accountId: Id.nullable(),
+  error: AddedMailboxError.nullable()
+}));
+var AddedMailboxList = List(AddedMailbox);
+var OrgConnectionIdInput = named("OrgConnectionIdInput", z19.object({ connectionId: Id }));
+var StartConsentRequest = named("StartConsentRequest", z19.object({ redirectUri: z19.url(), state: RedirectState.optional() }));
+var ConsentLink = named("ConsentLink", z19.object({ consentUrl: z19.url() }));
+var TestOrgConnectionRequest = named("TestOrgConnectionRequest", z19.object({ user: Email.optional() }));
+var ListDirectoryEntriesQuery = named("ListDirectoryEntriesQuery", z19.object({
+  cursor: Cursor.optional(),
+  limit: pageLimit(MAX_DIRECTORY_PAGE_SIZE, DEFAULT_DIRECTORY_PAGE_SIZE),
+  query: z19.string().max(MAX_DIRECTORY_QUERY_LENGTH).optional()
+}));
+var OpenSharedMailboxRequest = named("OpenSharedMailboxRequest", z19.object({
+  email: Email,
+  displayName: z19.string().max(MAX_DISPLAY_NAME_LENGTH).optional(),
+  externalRef: ExternalRef.optional(),
+  settings: SettingsOverride.optional()
+}));
+
+// ../contract/src/accounts/routes.ts
+import * as z20 from "zod";
+var MAIL_SETTINGS_CHECK = errors({
+  login_failed: "A server (IMAP, SMTP, CalDAV or CardDAV) refuses the login.",
+  server_not_allowed: "A server resolves to a private or loopback address.",
+  plaintext_not_allowed: "A server is named with security none (a plaintext login)."
+});
+var AUTODISCOVERY_FAILED = errors({
+  autodiscovery_failed: "imap was left out and autodiscovery found no IMAP server for the address."
+});
+var DAV_SETTINGS_CHECK = errors({
+  dav_discovery_failed: "Neither a CalDAV nor a CardDAV server was found or answered.",
+  not_dav_server: "A named CalDAV or CardDAV URL is no DAV server (it answers 404, 403, or not as one)."
+});
+var OAUTH_CLIENT = errors({
+  unknown_oauth_app: "oauthAppId names no OAuth app of the tenant.",
+  oauth_app_mismatch: "The OAuth app is for the other provider.",
+  oauth_app_secret_unreadable: "The OAuth app's client secret cannot be decrypted; replace it.",
+  provider_not_configured: "No OAuth app is given and the platform has none for the provider (and cloud)."
+});
+var accounts = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/accounts",
+    tags: ["Accounts"],
+    summary: "List accounts",
+    description: "Newest first. q matches part of the email address or the external reference, case-insensitively; externalRef matches it exactly."
+  }).errors(INVALID_CURSOR).input(ListAccountsQuery).output(AccountPage),
+  get: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}",
+    tags: ["Accounts"],
+    summary: "Get an account"
+  }).errors(ACCOUNT_NOT_FOUND).input(AccountIdInput).output(Account),
+  create: base.route({
+    method: "POST",
+    path: "/v1/accounts",
+    tags: ["Accounts"],
+    summary: "Connect an account from an existing refresh token",
+    description: "The address is the provider's (Google's userinfo, Graph's /me).",
+    successStatus: 201
+  }).errors({
+    ...bodyStorage("settings.bodyStorage"),
+    ...planModule("shared mailboxes (sharedMailboxesEnabled: true)"),
+    ...PLAN_LIMIT_ACCOUNTS,
+    ...BILLING_PAST_DUE,
+    ...OAUTH_CLIENT,
+    ...errors({
+      invalid_grant: "The provider refuses the refresh token (revoked, expired or never valid).",
+      invalid_client: "The provider refuses the OAuth app's client credentials.",
+      token_exchange_failed: "The provider's token endpoint refuses the refresh for another reason.",
+      scope_denied: "The grant lacks a scope the account needs.",
+      access_token_rejected: "The provider refuses the access token the refresh returned.",
+      identity_failed: "The provider's identity answer names no address.",
+      identity_unavailable: "Google has not verified the account's address.",
+      provider_unavailable: "The provider's token or identity endpoint could not be reached."
+    })
+  }).input(CreateAccount).output(Account),
+  update: base.route({
+    method: "PATCH",
+    path: "/v1/accounts/{accountId}",
+    tags: ["Accounts"],
+    summary: "Update an account",
+    description: "Changing settings.bodyStorage, calendarEnabled or syncWindowDays restarts the account's syncs: full stores every indexed message and backfills, none deletes stored content. status only moves between active and paused; only a new grant clears reauth_required and disabled."
+  }).errors({
+    ...ACCOUNT_NOT_FOUND,
+    ...bodyStorage("settings.bodyStorage"),
+    ...errors({
+      account_reauth_required: "status is changed on an account that must be reconnected.",
+      account_disabled: "status is changed on a disabled account."
+    })
+  }).input(AccountIdInput.extend(UpdateAccount.shape)).output(Account),
+  delete: base.route({
+    method: "DELETE",
+    path: "/v1/accounts/{accountId}",
+    tags: ["Accounts"],
+    summary: "Delete an account",
+    description: "Stops syncing and removes the credential at once. The account's data is purged for good after the retention period (default 30 days), or as soon as the maintenance role gets to it with ?purge=true; account.purged announces it. Its events are left to age out of the event log (within 31 days). purge=true also purges an account that is already deleted.",
+    successStatus: 204,
+    inputStructure: "detailed"
+  }).errors(errors({
+    account_not_found: "The account does not exist, or (without purge) is already deleted."
+  })).input(DeleteAccountInput).output(z20.void()),
+  mintToken: base.route({
+    method: "POST",
+    path: "/v1/accounts/{accountId}/tokens",
+    tags: ["Accounts"],
+    summary: "Mint an account-scoped token",
+    description: "The token is returned once; it is not retrievable later."
+  }).errors(ACCOUNT_NOT_FOUND).input(AccountIdInput.extend(MintAccountTokenRequest.shape)).output(AccountToken)
+};
+var imapAccounts = {
+  create: base.route({
+    method: "POST",
+    path: "/v1/imap-accounts",
+    tags: ["Accounts"],
+    summary: "Connect an IMAP/SMTP account with a password",
+    description: "The login is checked before anything is stored, for DAV too. Giving dav switches settings.calendarEnabled and contactsEnabled on for the halves found unless settings names them.",
+    successStatus: 201
+  }).errors({
+    ...MAIL_SETTINGS_CHECK,
+    ...AUTODISCOVERY_FAILED,
+    ...DAV_SETTINGS_CHECK,
+    ...PROVIDER_FAILURES,
+    ...bodyStorage("settings.bodyStorage"),
+    ...PLAN_LIMIT_ACCOUNTS,
+    ...BILLING_PAST_DUE
+  }).input(CreateImapAccount).output(Account)
+};
+var imapSettings = {
+  update: base.route({
+    method: "PATCH",
+    path: "/v1/accounts/{accountId}/imap-settings",
+    tags: ["Accounts"],
+    summary: "Change an IMAP account's servers or password",
+    description: "Present fields replace the stored ones and the result is checked like a new account. An account in reauth_required becomes active again. A stored password is never sent to a new server or tried for another login: changing the IMAP server (host, port, security or user) needs password in the same request, changing the SMTP server (host, port, security or user) needs smtpPassword (or password when SMTP uses the IMAP password), switching SMTP from its own password to the IMAP one (smtpPassword: null) needs password, and adding DAV settings or changing their URLs, user or password source needs the password DAV logs in with (dav.password, or password when DAV uses the IMAP password). Sending dav: null removes the calendar and contacts; a CalDAV or CardDAV half the account did not have before switches settings.calendarEnabled or contactsEnabled on, unless the account's settings already name that key (an earlier opt-out stays); dav fields left out keep their stored values, or are discovered for an account without DAV settings. An account that signs in with OAuth always uses its provider's servers."
+  }).errors({
+    ...ACCOUNT_NOT_FOUND,
+    ...MAIL_SETTINGS_CHECK,
+    ...DAV_SETTINGS_CHECK,
+    ...PROVIDER_FAILURES,
+    ...errors({
+      not_imap_account: "The account reads mail through a provider's API, not IMAP.",
+      password_required: "A server, login user or password source changes without its password.",
+      password_not_stored: "The account has no stored password and none is sent.",
+      dav_unsupported: "dav is given for an account that signs in with OAuth.",
+      oauth_servers_fixed: "The servers of an account that signs in with OAuth are changed.",
+      password_unsupported: "A password is sent for an account that signs in with OAuth.",
+      account_reauth_required: "The OAuth account's stored grant no longer works, so its servers cannot be checked.",
+      credential_missing: "The OAuth account has no stored credential.",
+      credential_conflict: "The OAuth account's credential kept changing while it was refreshed.",
+      invalid_client: "The provider refuses the OAuth account's client credentials.",
+      token_exchange_failed: "The provider's token endpoint refuses the OAuth account's refresh.",
+      provider_not_configured: "The platform OAuth app the account signed in with is gone.",
+      oauth_app_secret_unreadable: "The client secret of the account's OAuth app cannot be decrypted; replace it."
+    })
+  }).input(AccountIdInput.extend(UpdateImapSettings.shape)).output(Account)
+};
+var autoconfig = {
+  lookup: base.route({
+    method: "GET",
+    path: "/v1/autoconfig",
+    tags: ["Accounts"],
+    summary: "Find IMAP, SMTP and DAV settings for an address",
+    description: "dav carries CalDAV and CardDAV context URLs when a source names them; they need the login to resolve to the account's home sets, which creating the account does."
+  }).errors(errors({
+    autodiscovery_failed: "No IMAP settings were found for the address; ask the user for the servers then."
+  })).input(AutoconfigQuery).output(DiscoveredSettings)
+};
+
+// ../contract/src/ai/routes.ts
+var ai = {
+  draft: base.route({
+    method: "POST",
+    path: "/v1/ai/draft",
+    tags: ["AI"],
+    summary: "Draft email text with AI",
+    description: "Writes an email body from instructions, optionally answering a message or reworking a draft, in plain text or Markdown. Nothing is sent or saved: the text is for a person to edit. Needs the write scope; the tenant may ask for AI_DRAFTS_PER_MINUTE drafts a minute (beyond that, rate_limited with Retry-After)."
+  }).errors({
+    ...planModule("AI"),
+    ...accountState("The account of the message being answered"),
+    ...PROVIDER_FAILURES,
+    ...errors({
+      ai_disabled: "The deployment has no AI gateway configured.",
+      unknown_account: "context.accountId names an account the tenant does not have; data.ids lists it.",
+      unknown_message: "context.replyToMessageId names a message the account does not have.",
+      provider_not_found: "The provider no longer has the message being answered.",
+      provider_forbidden: "The provider refused to read the message being answered.",
+      ai_refused: "The model declines the instructions.",
+      ai_unavailable: "The AI gateway fails or does not answer in time.",
+      ai_suspended: "The AI gateway refuses the deployment's key or account, until an operator fixes it."
+    })
+  }).input(CreateAiDraft).output(AiDraft)
+};
+
+// ../contract/src/audit-log/routes.ts
+var auditLog = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/audit-log",
+    tags: ["Audit log"],
+    summary: "Read the audit log",
+    description: "Every mutating request on /v1 and from the board, newest first. Needs the admin scope. action matches exactly, or as a prefix when it ends with a dot (accounts.). outcome success is a 2xx status."
+  }).errors({
+    ...INVALID_CURSOR,
+    ...errors({ invalid_range: "to is before from." })
+  }).input(ListAuditLogQuery).output(AuditEntryPage)
+};
+
+// ../contract/src/calendar/routes.ts
+import * as z21 from "zod";
+var CALENDAR_ACCOUNT = {
+  ...planModule("calendar"),
+  ...ACCOUNT_NOT_FOUND,
+  ...errors({
+    calendar_disabled: "The account's calendar sync is off, or it is an IMAP account without CalDAV settings."
+  })
+};
+var CALENDAR_PROVIDER = {
+  ...accountState(),
+  ...PROVIDER_FAILURES,
+  ...errors({
+    provider_forbidden: "The provider refused the account access (e.g. the grant lacks calendar access).",
+    provider_not_found: "The event or calendar is gone at the provider.",
+    provider_unsupported: "The provider cannot express the request (e.g. a rule Microsoft has no pattern for), or an IMAP account whose CalDAV server does not schedule has no SMTP server to mail the iTIP message from.",
+    provider_rejected: `The provider refused the request, or more than ${MAX_EVENT_ATTENDEES} attendees would be mailed an iTIP message.`
+  })
+};
+var CALENDAR_WRITE = {
+  ...CALENDAR_PROVIDER,
+  ...errors({
+    provider_conflict: "The event changed at the provider meanwhile.",
+    calendar_read_only: "The account can only read the event's calendar."
+  })
+};
+var EVENT_TIMES = errors({
+  invalid_time_zone: "A timed start or end names an unknown time zone.",
+  mixed_event_times: "One end is timed and the other all-day.",
+  invalid_range: "end is not after start.",
+  invalid_recurrence: "recurrence has no RRULE or RDATE line, or does not parse as RFC 5545."
+});
+var EVENT_NOT_FOUND = errors({
+  calendar_event_not_found: "The event does not exist in the account's synced calendars."
+});
+var MEETING_SERVICE = errors({
+  meeting_service_not_connected: "The account has no connection to the service and the tenant no server app it may use (a password IMAP account may not use one).",
+  meeting_service_reauth_required: "The account's connection or the tenant's server app was refused and must be connected or fixed again.",
+  meeting_recurrence_unsupported: "The service cannot repeat a meeting by the event's rule.",
+  meeting_service_rejected: "The service refused the meeting.",
+  meeting_service_unavailable: "The service could not be reached."
+});
+var calendars = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/calendars",
+    tags: ["Calendar"],
+    summary: "List calendars"
+  }).errors(CALENDAR_ACCOUNT).input(AccountIdInput).output(CalendarList)
+};
+var calendarEvents = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/calendar-events",
+    tags: ["Calendar"],
+    summary: "List events in a time range, by start",
+    description: "Returns singles, occurrences and exceptions overlapping [start, end), not series definitions. Only the sync window (by default 90 days back to 365 days ahead) is indexed."
+  }).errors({
+    ...CALENDAR_ACCOUNT,
+    ...INVALID_CURSOR,
+    ...errors({
+      invalid_range: `end is not after start, or the range spans more than ${MAX_EVENT_RANGE_DAYS} days.`,
+      unknown_calendar: "calendarId names no synced calendar of the account."
+    })
+  }).input(ListCalendarEventsInput).output(CalendarEventPage),
+  get: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/calendar-events/{eventId}",
+    tags: ["Calendar"],
+    summary: "Get an event with its body",
+    description: "Works for every kind, including a series (its recurrence rule)."
+  }).errors({ ...CALENDAR_ACCOUNT, ...EVENT_NOT_FOUND, ...CALENDAR_PROVIDER }).input(CalendarEventIdInput).output(CalendarEventDetail),
+  create: base.route({
+    method: "POST",
+    path: "/v1/accounts/{accountId}/calendar-events",
+    tags: ["Calendar"],
+    summary: "Create an event or a recurring series",
+    description: "onlineMeeting asks the provider for a Teams (Microsoft) or Meet (Google) link; onlineMeetingUrl attaches a link from another service (Zoom, Webex, ...), read back as onlineMeetingUrl. On Microsoft that link is the location's link (location defaults to the URL) and a join line is added to a body sent along. onlineMeetingService has workwae create a Zoom or Webex meeting (recurring for a series) hosted by the account's own grant at the service, else by the tenant's server app as the service user with the mailbox's address, and attaches its join link the same way. The server app hosts only accounts whose address the provider verified (Gmail, Microsoft, IMAP signed in with OAuth): a password IMAP account's address is whatever was typed, so it needs its own grant. The meeting is created only once the account is active, and deleted again if anything fails before its link is saved. On an IMAP account whose CalDAV server does not schedule, the invitation is mailed from the account's SMTP server when notify is true and there are attendees; a missing SMTP server is refused before anything is created, and a send that fails after the event is created is logged and the event stands.",
+    successStatus: 201
+  }).errors({
+    ...CALENDAR_ACCOUNT,
+    ...CALENDAR_WRITE,
+    ...EVENT_TIMES,
+    ...MEETING_SERVICE,
+    ...errors({
+      plan_module_unavailable: "The tenant's plan does not include calendar, or onlineMeetingService is given and it does not include meetings.",
+      calendar_not_found: "calendarId names no synced calendar of the account.",
+      calendar_event_not_found: "The provider no longer has the event when it is read back.",
+      multiple_meeting_options: "More than one of onlineMeeting, onlineMeetingUrl and onlineMeetingService is given.",
+      meeting_host_missing: "The tenant's server app has no user with the mailbox's address."
+    })
+  }).input(CreateCalendarEventInput).output(CalendarEventDetail),
+  update: base.route({
+    method: "PATCH",
+    path: "/v1/accounts/{accountId}/calendar-events/{eventId}",
+    tags: ["Calendar"],
+    summary: "Change an event, one occurrence, or a whole series",
+    description: "Addressing an occurrence changes only that instance; addressing the series changes every occurrence. onlineMeetingUrl replaces a link from another service (as on create); null removes it (on Google, whatever conference the event has; on Microsoft, the location's link, leaving a Teams meeting alone). For an event whose Zoom or Webex meeting workwae created, a new subject, start, end or recurrence moves that meeting too, and an onlineMeetingUrl other than its own join link deletes it (sending that link back replaces nothing); changing one occurrence leaves the meeting's series as it is. A missing or refused meeting connection is reported before anything changes; a service failure after the event changed is reported with the event changed (repeat the request). On an IMAP account whose CalDAV server does not schedule, an update of a meeting the account organizes is mailed from its SMTP server when it changes start, end, recurrence, location or attendees, to the attendees workwae has indexed for it and those the request names; a missing SMTP server or too many attendees is refused before anything changes, and a send that fails after the change is logged and the change stands."
+  }).errors({
+    ...CALENDAR_ACCOUNT,
+    ...EVENT_NOT_FOUND,
+    ...CALENDAR_WRITE,
+    ...EVENT_TIMES,
+    ...MEETING_SERVICE,
+    ...errors({
+      recurrence_on_instance: "recurrence is given for an occurrence or exception.",
+      meeting_deleted: "The event's meeting is gone at the service when it is moved."
+    })
+  }).input(CalendarEventIdInput.extend(UpdateCalendarEvent.shape)).output(CalendarEventDetail),
+  delete: base.route({
+    method: "DELETE",
+    path: "/v1/accounts/{accountId}/calendar-events/{eventId}",
+    tags: ["Calendar"],
+    summary: "Delete an event, one occurrence, or a whole series",
+    description: "Cancels the meeting for its attendees when the account organizes it. A Zoom or Webex meeting workwae created for the event (a series, not one occurrence) is deleted after the provider event: a provider refusal leaves both, and once the event is gone a meeting the service cannot delete (connection gone or refused, service unreachable) is logged and stays at the service while the request still succeeds. On an IMAP account whose CalDAV server does not schedule, the cancellation is mailed from the account's SMTP server to the attendees workwae has indexed; a missing SMTP server or too many attendees is refused before anything is deleted, and a send that fails after the deletion is logged.",
+    successStatus: 204,
+    inputStructure: "detailed"
+  }).errors({ ...CALENDAR_ACCOUNT, ...EVENT_NOT_FOUND, ...CALENDAR_WRITE }).input(DeleteCalendarEventInput).output(z21.void()),
+  respond: base.route({
+    method: "POST",
+    path: "/v1/accounts/{accountId}/calendar-events/{eventId}/respond",
+    tags: ["Calendar"],
+    summary: "Accept, tentatively accept or decline an invitation",
+    description: "Addressing an occurrence answers that instance; the series answers all of them. On an IMAP account whose CalDAV server does not schedule, the answer is mailed to the organizer from the account's SMTP server; a missing SMTP server is refused before anything changes, and a send that fails after the answer is recorded is logged."
+  }).errors({
+    ...CALENDAR_ACCOUNT,
+    ...EVENT_NOT_FOUND,
+    ...CALENDAR_PROVIDER,
+    ...errors({
+      provider_conflict: "The event changed at the provider meanwhile.",
+      organizer_cannot_respond: "The account organizes the event, so there is no invitation to answer."
+    })
+  }).input(CalendarEventIdInput.extend(RespondToCalendarEventRequest.shape)).output(CalendarEvent)
+};
+var availability = {
+  find: base.route({
+    method: "POST",
+    path: "/v1/accounts/{accountId}/availability/find",
+    tags: ["Calendar"],
+    summary: "Find busy times and common free slots",
+    description: "A read sent as a POST, the question not fitting a URL. One provider request covers every attendee (Microsoft getSchedule, Google freeBusy.query); the answer is cached briefly per account, attendees and range."
+  }).errors({
+    ...CALENDAR_ACCOUNT,
+    ...CALENDAR_PROVIDER,
+    ...errors({
+      invalid_range: `end is not after start, or the range spans more than ${MAX_AVAILABILITY_DAYS} days.`,
+      invalid_time_zone: "timeZone is unknown.",
+      invalid_working_hours: "workingHours does not end after it starts."
+    })
+  }).input(FindAvailabilityInput).output(Availability)
+};
+
+// ../contract/src/connect/routes.ts
+var CONNECT_REQUEST = errors({
+  redirect_uri_not_allowed: "redirectUri is not on the tenant allowlist (settings.redirectUris).",
+  billing_past_due: "accountId is not given and the tenant's payment is past due beyond the grace period.",
+  unknown_account: "accountId names no live account of the tenant; data.ids names it.",
+  org_connection_account: "accountId names an account that authenticates through an organization connection (test the connection to restore it).",
+  shared_mailbox_account: "accountId names a shared mailbox (reconnect the account that opened it)."
+});
+var CONNECT_SESSION_NOT_FOUND = errors({
+  connect_session_not_found: "No session has this id (or token)."
+});
+var HOSTED_IMAP_SESSION = {
+  ...CONNECT_SESSION_NOT_FOUND,
+  ...errors({
+    session_used: "The session already completed or failed.",
+    session_expired: "The session is past expiresAt.",
+    redirect_uri_not_allowed: "The session's return address is no longer on the tenant allowlist.",
+    provider_not_allowed: "The session does not offer the IMAP form."
+  })
+};
+var connectSessions = {
+  create: base.route({
+    method: "POST",
+    path: "/v1/connect-sessions",
+    tags: ["Connect"],
+    summary: "Create a hosted connect session",
+    description: "Returns a link to the hosted connect page. Its OAuth sign-ins pass a Continue page on the API origin naming the tenant and provider, and must finish in the browser that pressed Continue (an HttpOnly cookie on the API origin); a callback in any other browser renders an error page and connects nothing. Without redirectUri the owner ends on workwae's own confirmation page, which needs no allowlist entry; follow the outcome with GET /v1/connect-sessions/{sessionId} or the account.connected event. A failed sign-in returns with status=error and error set to a ConnectErrorCode.",
+    successStatus: 201
+  }).errors({
+    ...CONNECT_REQUEST,
+    ...bodyStorage("options.bodyStorage"),
+    ...errors({
+      unknown_oauth_app: "oauthAppIds names no OAuth app of the tenant.",
+      oauth_app_mismatch: "An OAuth app in oauthAppIds is for the other provider.",
+      account_mismatch: "providers leaves out the sign-in the account reconnects with.",
+      google_imap_requires_own_app: "providers includes google with options.mailAccess imap (given, or kept by the account being reconnected) and no Google app (oauthAppIds, or the reconnected account's own): Google over IMAP needs the tenant's own Google OAuth app."
+    })
+  }).input(CreateConnectSession).output(SessionLink),
+  get: base.route({
+    method: "GET",
+    path: "/v1/connect-sessions/{sessionId}",
+    tags: ["Connect"],
+    summary: "Read a hosted connect session's outcome"
+  }).errors(CONNECT_SESSION_NOT_FOUND).input(ConnectSessionIdInput).output(ConnectSession)
+};
+var oauthAuthorizations = {
+  create: base.route({
+    method: "POST",
+    path: "/v1/oauth-authorizations",
+    tags: ["Connect"],
+    summary: "Start a headless OAuth connect",
+    description: "authorizeUrl is a page on the API origin naming the tenant and the provider; only its Continue button (a form POST, accepted only from the API or board origin) leads on to the provider. Continuing works once and binds the sign-in to that browser with an HttpOnly cookie scoped to the callback; a callback arriving in any other browser renders an error page and connects nothing, so send the user's own browser to it. A failed sign-in returns with status=error and error set to a ConnectErrorCode."
+  }).errors({
+    ...CONNECT_REQUEST,
+    ...bodyStorage("options.bodyStorage"),
+    ...planModule("shared mailboxes (options.sharedMailboxesEnabled: true)"),
+    ...OAUTH_CLIENT,
+    ...errors({
+      account_mismatch: "The account given as accountId signs in with another provider, or with a password.",
+      google_imap_requires_own_app: "provider google with options.mailAccess imap (given, or kept by the account being reconnected) and no Google app (oauthAppId, or the reconnected account's own): Google over IMAP needs the tenant's own Google OAuth app."
+    })
+  }).input(StartOAuthRequest).output(OAuthAuthorization)
+};
+var HOSTED_TAGS = ["Hosted pages"];
+var hostedConnectSessions = {
+  get: base.route({
+    method: "GET",
+    path: "/v1/hosted/connect-sessions/{token}",
+    tags: HOSTED_TAGS,
+    summary: "Read a hosted connect session",
+    spec: publicOperation
+  }).errors(CONNECT_SESSION_NOT_FOUND).input(SessionTokenInput).output(ConnectSessionPublic),
+  createImapAccount: base.route({
+    method: "POST",
+    path: "/v1/hosted/connect-sessions/{token}/imap-accounts",
+    tags: HOSTED_TAGS,
+    summary: "Connect an IMAP account from the hosted page",
+    description: "When the tenant's plan allows no more accounts, or its payment is past due beyond the grace period, the session fails and redirectUrl carries status=error&error=plan_limit_accounts (or billing_past_due), as the OAuth callback does. Giving dav switches settings.calendarEnabled and contactsEnabled on for the halves found unless the session's options name them, as POST /v1/imap-accounts does. A reconnect session replaces the password only: the account keeps its stored servers and DAV settings, and any sent here are ignored. Its DAV login is checked again: with the new password when DAV uses the IMAP password, otherwise with dav.password when given (which then replaces the stored DAV password) or the stored one.",
+    spec: publicOperation
+  }).errors({
+    ...HOSTED_IMAP_SESSION,
+    ...MAIL_SETTINGS_CHECK,
+    ...AUTODISCOVERY_FAILED,
+    ...DAV_SETTINGS_CHECK,
+    ...PROVIDER_FAILURES,
+    ...errors({
+      account_exists: "The tenant already has a live IMAP account with this address and the session was not created to reconnect it (accountId).",
+      account_not_found: "The account a reconnect session was created for was deleted.",
+      account_mismatch: "A reconnect session's account has another address, or is not an IMAP account.",
+      password_required: "A reconnect session's DAV has a password of its own, none is stored and dav.password is left out."
+    })
+  }).input(SessionTokenInput.extend(ImapAccountInput.shape)).output(HostedImapResult),
+  autoconfig: base.route({
+    method: "GET",
+    path: "/v1/hosted/connect-sessions/{token}/autoconfig",
+    tags: HOSTED_TAGS,
+    summary: "Find IMAP and SMTP settings from the hosted page",
+    spec: publicOperation
+  }).errors({
+    ...HOSTED_IMAP_SESSION,
+    ...errors({ autodiscovery_failed: "No IMAP settings were found for the address." })
+  }).input(SessionTokenInput.extend(AutoconfigQuery.shape)).output(DiscoveredSettings)
+};
+
+// ../contract/src/contacts/routes.ts
+import * as z22 from "zod";
+var CONTACTS_ACCOUNT = {
+  ...planModule("contacts"),
+  ...ACCOUNT_NOT_FOUND,
+  ...errors({
+    contacts_disabled: "The account's contacts sync is off, or it is an IMAP account without CardDAV settings."
+  })
+};
+var CONTACT_NOT_FOUND = errors({ contact_not_found: "The contact does not exist." });
+var CONTACTS_PROVIDER = {
+  ...accountState(),
+  ...PROVIDER_FAILURES,
+  ...errors({
+    provider_forbidden: "The provider refused the account access (e.g. the grant lacks contacts access).",
+    provider_not_found: "The contact is gone at the provider (the index drops it).",
+    provider_conflict: "The contact changed at the provider meanwhile.",
+    provider_rejected: "The provider refused the request."
+  })
+};
+var CONTACT_WRITE = {
+  ...CONTACTS_PROVIDER,
+  ...errors({
+    contact_unidentifiable: "The contact would have no name, organization, email address or phone number.",
+    provider_unsupported: 'The provider cannot store what was given (a folder on Google, or on Microsoft 365 more than 3 email addresses, more than one mobile number or an "other" number).'
+  })
+};
+var contactFolders = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/contact-folders",
+    tags: ["Contacts"],
+    summary: "List contact folders",
+    description: "Microsoft 365 contact folders, the default folder first; empty for Google accounts."
+  }).errors(CONTACTS_ACCOUNT).input(AccountIdInput).output(ContactFolderList)
+};
+var contacts = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/contacts",
+    tags: ["Contacts"],
+    summary: "List or search contacts, by name",
+    description: "Reads the index. q matches part of any name, the organization or any email address, case-insensitively."
+  }).errors({
+    ...CONTACTS_ACCOUNT,
+    ...INVALID_CURSOR,
+    ...errors({ unknown_contact_folder: "folderId names no contact folder of the account." })
+  }).input(AccountIdInput.extend(ListContactsQuery.shape)).output(ContactPage),
+  get: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/contacts/{contactId}",
+    tags: ["Contacts"],
+    summary: "Get a contact",
+    description: "Reads the index."
+  }).errors({ ...CONTACTS_ACCOUNT, ...CONTACT_NOT_FOUND }).input(ContactIdInput).output(Contact),
+  photo: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/contacts/{contactId}/photo",
+    tags: ["Contacts"],
+    summary: "Download a contact's photo",
+    description: "Fetched from the provider on first request and cached until the photo changes.",
+    spec: fileResponse({
+      mediaType: "image/*",
+      description: "The photo as the provider stores it (image/jpeg, image/png, ...)",
+      disposition: "inline"
+    })
+  }).errors({
+    ...CONTACTS_ACCOUNT,
+    ...CONTACT_NOT_FOUND,
+    ...CONTACTS_PROVIDER,
+    ...errors({ photo_not_found: "The contact has no photo." })
+  }).input(ContactIdInput).output(z22.file()),
+  create: base.route({
+    method: "POST",
+    path: "/v1/accounts/{accountId}/contacts",
+    tags: ["Contacts"],
+    summary: "Create a contact",
+    description: "Written to the provider, then to the index, so it is listed at once.",
+    successStatus: 201
+  }).errors({
+    ...CONTACTS_ACCOUNT,
+    ...CONTACT_WRITE,
+    ...errors({
+      unknown_contact_folder: "folderId names no contact folder of the account.",
+      contact_not_found: "The provider's answer could not be read back into the index."
+    })
+  }).input(CreateContactInput).output(Contact),
+  update: base.route({
+    method: "PATCH",
+    path: "/v1/accounts/{accountId}/contacts/{contactId}",
+    tags: ["Contacts"],
+    summary: "Change a contact",
+    description: "Fields present change (null clears); emails and phones replace the whole list."
+  }).errors({ ...CONTACTS_ACCOUNT, ...CONTACT_NOT_FOUND, ...CONTACT_WRITE }).input(ContactIdInput.extend(UpdateContact.shape)).output(Contact),
+  delete: base.route({
+    method: "DELETE",
+    path: "/v1/accounts/{accountId}/contacts/{contactId}",
+    tags: ["Contacts"],
+    summary: "Delete a contact",
+    successStatus: 204
+  }).errors({ ...CONTACTS_ACCOUNT, ...CONTACT_NOT_FOUND, ...CONTACTS_PROVIDER }).input(ContactIdInput).output(z22.void())
+};
+
+// ../contract/src/events/routes.ts
+var changes = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/changes",
+    tags: ["Changes"],
+    summary: "Read the change feed",
+    description: "Events oldest first. Pass nextCursor back as cursor to continue; it is never null, since the feed has no end, only a present: an empty page means caught up, so poll again from the same cursor later."
+  }).errors(INVALID_CURSOR).input(ListChangesQuery).output(EventFeedPage)
+};
+
+// ../contract/src/exports/routes.ts
+import * as z23 from "zod";
+var EXPORT_NOT_FOUND = errors({ export_not_found: "The export does not exist." });
+var exports = {
+  create: base.route({
+    method: "POST",
+    path: "/v1/exports",
+    tags: ["Exports"],
+    summary: "Export the tenant or one account",
+    description: `Builds a gzip-compressed tar in the background: accounts without secrets, mailboxes, message metadata (JSON lines), stored message bodies as .eml, calendars and events as JSON and .ics, and for a tenant export its webhooks (without signing secrets), templates and settings. Follow it with GET /v1/exports/{exportId}, or the export.completed and export.failed events. Requires the admin scope.`,
+    successStatus: 202
+  }).errors(errors({
+    storage_unavailable: "No object store is configured.",
+    unknown_account: "accountId names an account the tenant does not have; data.ids lists it.",
+    export_in_progress: "An export of the same scope (the tenant, or the same account) is queued or running."
+  })).input(CreateDataExport).output(DataExport),
+  list: base.route({
+    method: "GET",
+    path: "/v1/exports",
+    tags: ["Exports"],
+    summary: "List exports, newest first",
+    description: "Requires the admin scope."
+  }).errors(INVALID_CURSOR).input(ListDataExportsQuery).output(DataExportPage),
+  get: base.route({
+    method: "GET",
+    path: "/v1/exports/{exportId}",
+    tags: ["Exports"],
+    summary: "Get an export",
+    description: "Requires the admin scope."
+  }).errors(EXPORT_NOT_FOUND).input(DataExportIdInput).output(DataExport),
+  download: base.route({
+    method: "GET",
+    path: "/v1/exports/{exportId}/download",
+    tags: ["Exports"],
+    summary: "Download an export (application/gzip)",
+    description: `Streams the decrypted .tar.gz; compare it with the export's sha256. Requires the admin scope.`,
+    spec: fileResponse({
+      mediaType: "application/gzip",
+      description: "The export as a gzip-compressed tar",
+      disposition: "attachment",
+      headers: {
+        "x-export-sha256": {
+          description: "sha256 hex of the body, the export's sha256",
+          schema: { type: "string" }
+        }
+      }
+    })
+  }).errors({
+    ...EXPORT_NOT_FOUND,
+    ...errors({
+      export_not_ready: "The export is queued or running.",
+      export_failed: "The export failed.",
+      export_expired: "The export's file was deleted.",
+      storage_unavailable: "No object store is configured.",
+      export_corrupt: "A stored part of the export fails its integrity check."
+    })
+  }).input(DataExportIdInput).output(StreamedFile),
+  delete: base.route({
+    method: "DELETE",
+    path: "/v1/exports/{exportId}",
+    tags: ["Exports"],
+    summary: "Delete an export and its file",
+    description: "Requires the admin scope.",
+    successStatus: 204
+  }).errors({ ...EXPORT_NOT_FOUND, ...errors({ export_running: "The export is being built." }) }).input(DataExportIdInput).output(z23.void())
+};
+
+// ../contract/src/identities/routes.ts
+import * as z24 from "zod";
+var IDENTITY_NOT_FOUND = errors({ identity_not_found: "The identity does not exist." });
+var identities = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/identities",
+    tags: ["Identities"],
+    summary: "List the addresses the account may send as",
+    description: "The account's own address, the provider's (Gmail send-as addresses with their Gmail signatures in one users.settings.sendAs request; Microsoft proxy addresses from /me) and custom ones. The provider's list is read when the cached one is a day old, or with refresh=true at most once a minute; a paused or disconnected account serves the cached list."
+  }).errors({
+    ...ACCOUNT_NOT_FOUND,
+    ...errors({
+      account_reauth_required: "Reading the provider's list found that the account must be reconnected."
+    }),
+    ...PROVIDER_FAILURES
+  }).input(AccountIdInput.extend(ListIdentitiesQuery.shape)).output(IdentityList),
+  create: base.route({
+    method: "POST",
+    path: "/v1/accounts/{accountId}/identities",
+    tags: ["Identities"],
+    summary: "Add a custom identity",
+    description: "For IMAP aliases, and Microsoft mailboxes the account has Send As permission on (Graph cannot list those). Sending as it is checked by the provider when the message goes out.",
+    successStatus: 201
+  }).errors({
+    ...ACCOUNT_NOT_FOUND,
+    ...errors({
+      identities_managed_by_provider: "The account is a Gmail account (add send-as addresses in Gmail).",
+      identity_exists: "The address is already an identity of the account."
+    })
+  }).input(AccountIdInput.extend(CreateIdentity.shape)).output(Identity),
+  update: base.route({
+    method: "PATCH",
+    path: "/v1/accounts/{accountId}/identities/{identityId}",
+    tags: ["Identities"],
+    summary: "Change an identity's signature or name",
+    description: "signature: null removes ours (Gmail's own then applies again). Only custom identities take a name; the others carry the provider's."
+  }).errors({
+    ...ACCOUNT_NOT_FOUND,
+    ...IDENTITY_NOT_FOUND,
+    ...errors({
+      identity_not_custom: "A name is given for a primary or provider identity."
+    })
+  }).input(IdentityIdInput.extend(UpdateIdentity.shape)).output(Identity),
+  delete: base.route({
+    method: "DELETE",
+    path: "/v1/accounts/{accountId}/identities/{identityId}",
+    tags: ["Identities"],
+    summary: "Remove a custom identity",
+    successStatus: 204
+  }).errors({
+    ...ACCOUNT_NOT_FOUND,
+    ...IDENTITY_NOT_FOUND,
+    ...errors({
+      identity_not_custom: "The identity is the primary or a provider identity (those follow the provider)."
+    })
+  }).input(IdentityIdInput).output(z24.void())
+};
+var mailSettings = {
+  get: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/mail-settings",
+    tags: ["Identities"],
+    summary: "Get the account's mail settings"
+  }).errors(ACCOUNT_NOT_FOUND).input(AccountIdInput).output(MailSettings),
+  update: base.route({
+    method: "PATCH",
+    path: "/v1/accounts/{accountId}/mail-settings",
+    tags: ["Identities"],
+    summary: "Update the account's mail settings"
+  }).errors(ACCOUNT_NOT_FOUND).input(AccountIdInput.extend(UpdateMailSettings.shape)).output(MailSettings)
+};
+
+// ../contract/src/mail/routes.ts
+import * as z25 from "zod";
+var UNKNOWN_MAILBOX = errors({
+  unknown_mailbox: "A mailbox id names no live mailbox of the account; data.ids lists them."
+});
+var PROVIDER_CHANGE = {
+  ...PROVIDER_FAILURES,
+  ...errors({
+    provider_not_found: "The provider no longer has the item.",
+    provider_forbidden: "The provider refused the change for lack of permission.",
+    provider_rejected: "The provider rejected the change as invalid.",
+    provider_unsupported: "The provider does not support the change.",
+    provider_conflict: "The provider refused the change because of the item's state."
+  })
+};
+var MESSAGE_READ = {
+  ...ACCOUNT_NOT_FOUND,
+  ...errors({ message_not_found: "The message does not exist." }),
+  ...accountState("The provider is needed and the account"),
+  ...PROVIDER_FAILURES,
+  ...errors({
+    provider_not_found: "The provider no longer has the message or the attachment.",
+    provider_forbidden: "The provider refused to serve the message."
+  })
+};
+var mailboxes = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/mailboxes",
+    tags: ["Mail"],
+    summary: "List mailboxes (folders or labels)"
+  }).errors(ACCOUNT_NOT_FOUND).input(AccountIdInput).output(MailboxList)
+};
+var messages = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/messages",
+    tags: ["Mail"],
+    summary: "List messages, newest first",
+    description: "Covers the account's sync window. Without mailboxId, lists every mailbox. importance keeps the messages with that priority; messages indexed before priorities were read (importance null) match none."
+  }).errors({ ...ACCOUNT_NOT_FOUND, ...INVALID_CURSOR, ...UNKNOWN_MAILBOX }).input(AccountIdInput.extend(ListMessagesQuery.shape)).output(MessageSummaryPage),
+  get: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/messages/{messageId}",
+    tags: ["Mail"],
+    summary: "Get a message with its body",
+    description: 'With bodyStorage cache or full the body comes from stored content (cache fetches and stores the raw message on a miss), and attachment ids are MIME part numbers ("1.2"); otherwise it is read from the provider. Drafts are always read from the provider.'
+  }).errors(MESSAGE_READ).input(MessageIdInput).output(Message),
+  raw: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/messages/{messageId}/raw",
+    tags: ["Mail"],
+    summary: "Download the message as RFC 5322 (message/rfc822)",
+    description: "Served from stored content when the account stores bodies.",
+    spec: fileResponse({
+      mediaType: "message/rfc822",
+      description: "The message as message/rfc822",
+      disposition: "attachment"
+    })
+  }).errors(MESSAGE_READ).input(MessageIdInput).output(StreamedFile),
+  attachment: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/messages/{messageId}/attachments/{attachmentId}",
+    tags: ["Mail"],
+    summary: "Download an attachment",
+    description: "Served from stored content when the account stores bodies; an id the stored message does not have is asked of the provider, which answers provider_not_found when it has no such attachment either.",
+    spec: fileResponse({
+      mediaType: "*/*",
+      description: "The attachment, with the Content-Type it was sent with",
+      disposition: "attachment"
+    })
+  }).errors(MESSAGE_READ).input(AttachmentIdInput).output(StreamedFile),
+  update: base.route({
+    method: "PATCH",
+    path: "/v1/accounts/{accountId}/messages/{messageId}",
+    tags: ["Mail"],
+    summary: "Change flags, move, or change labels",
+    description: "mailboxId moves the message (Microsoft folders, or Gmail: replaces the message's folder-like labels). addMailboxIds/removeMailboxIds apply Gmail labels."
+  }).errors({
+    ...ACCOUNT_NOT_FOUND,
+    ...errors({
+      message_not_found: "The message does not exist.",
+      mailbox_not_label: "addMailboxIds or removeMailboxIds names a mailbox that is not a label."
+    }),
+    ...UNKNOWN_MAILBOX,
+    ...accountState(),
+    ...PROVIDER_CHANGE
+  }).input(MessageIdInput.extend(UpdateMessage.shape)).output(MessageSummary),
+  delete: base.route({
+    method: "DELETE",
+    path: "/v1/accounts/{accountId}/messages/{messageId}",
+    tags: ["Mail"],
+    summary: "Delete a message",
+    description: "Moves it to Trash; ?permanent=true deletes it outright.",
+    successStatus: 204,
+    inputStructure: "detailed"
+  }).errors({
+    ...ACCOUNT_NOT_FOUND,
+    ...errors({ message_not_found: "The message does not exist." }),
+    ...accountState(),
+    ...PROVIDER_CHANGE
+  }).input(DeleteMessageInput).output(z25.void())
+};
+var search = {
+  messages: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/search/messages",
+    tags: ["Mail"],
+    summary: "Search messages",
+    description: [
+      'source=index searches the index with full-text search (q in web search syntax: words, "phrases", OR, -word) over subject, sender and recipient names and addresses, the snippet, and the body text of stored messages (bodyStorage cache or full), best matches first.',
+      "source=provider passes q to the provider unchanged (Gmail search syntax, Microsoft KQL, IMAP SEARCH TEXT), newest first; results the index holds carry their id, others id null.",
+      "source=auto (default) asks the provider when the index cannot cover the request: `after` lies before the sync window, or the index found nothing while it does not hold everything (the account has a sync window, or bodyStorage is not full). Otherwise, and whenever the provider cannot be asked (inactive account, rate limit, provider error), the index answers.",
+      "The response names the source that answered; nextCursor stays with it.",
+      "A provider search of a Gmail account counts against the account's Gmail searches per minute; past them it answers rate_limited with Retry-After."
+    ].join(" ")
+  }).errors({
+    ...ACCOUNT_NOT_FOUND,
+    ...errors({ invalid_range: "before is not after after." }),
+    ...errors({
+      invalid_cursor: "The cursor is invalid, was issued for another account, or is a provider cursor older than an hour."
+    }),
+    ...UNKNOWN_MAILBOX,
+    ...accountState("With source=provider, the account"),
+    ...PROVIDER_FAILURES,
+    ...errors({
+      provider_forbidden: "With source=provider, the provider refused the search.",
+      provider_rejected: "With source=provider, the provider rejected q.",
+      provider_unsupported: "With source=provider, the provider cannot run the search."
+    })
+  }).input(withDateRange(AccountIdInput.extend(SearchMessagesQuery.shape), {
+    from: "after",
+    to: "before"
+  })).output(SearchPage)
+};
+
+// ../contract/src/meetings/routes.ts
+import * as z26 from "zod";
+var APP_TAGS = ["Meeting apps"];
+var CONNECTION_TAGS = ["Meeting connections"];
+var MEETINGS = planModule("Zoom and Webex meetings");
+var APP_NOT_FOUND = errors({ meeting_app_not_found: "The app does not exist." });
+var meetingApps = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/meeting-apps",
+    tags: APP_TAGS,
+    summary: "List meeting apps"
+  }).errors(MEETINGS).output(MeetingAppList),
+  create: base.route({
+    method: "POST",
+    path: "/v1/meeting-apps",
+    tags: APP_TAGS,
+    summary: "Register a meeting app",
+    description: `A sign-in app (zoom_oauth, webex_oauth) is named by meeting connect sessions in place of the platform's; register \`redirectUri\` at the service. A server app (zoom_s2s, webex_service_app) starts unverified; test it.`,
+    successStatus: 201
+  }).errors({
+    ...MEETINGS,
+    ...errors({ meeting_app_exists: "The tenant already has a server app for the service." })
+  }).input(CreateMeetingApp).output(MeetingApp),
+  test: base.route({
+    method: "POST",
+    path: "/v1/meeting-apps/{appId}/test",
+    tags: APP_TAGS,
+    summary: "Test a meeting server app",
+    description: `Requests a token the way meetings will and, with \`user\`, looks that address up as a host; the app becomes active or failing.`
+  }).errors({
+    ...MEETINGS,
+    ...APP_NOT_FOUND,
+    ...errors({ not_testable: "The app is a sign-in app, which only account connects use." })
+  }).input(MeetingAppIdInput.extend(TestMeetingAppRequest.shape)).output(MeetingAppTestResult),
+  delete: base.route({
+    method: "DELETE",
+    path: "/v1/meeting-apps/{appId}",
+    tags: APP_TAGS,
+    summary: "Delete a meeting app",
+    description: "Meetings already created stay at the service. Allowed without the meetings module, so a tenant can remove an app it no longer uses.",
+    successStatus: 204
+  }).errors({
+    ...APP_NOT_FOUND,
+    ...errors({
+      meeting_app_in_use: "Account connections were issued through the sign-in app."
+    })
+  }).input(MeetingAppIdInput).output(z26.void())
+};
+var meetingConnections = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/meeting-connections",
+    tags: CONNECTION_TAGS,
+    summary: "List an account's meeting connections"
+  }).errors({ ...MEETINGS, ...ACCOUNT_NOT_FOUND }).input(AccountIdInput).output(MeetingConnectionList),
+  delete: base.route({
+    method: "DELETE",
+    path: "/v1/accounts/{accountId}/meeting-connections/{service}",
+    tags: CONNECTION_TAGS,
+    summary: "Remove a meeting connection",
+    description: "Deletes the grant (and revokes it at Zoom); meetings created with it stay. Later events use the tenant's server app, if any. Allowed without the meetings module, so a tenant can remove a grant it no longer uses.",
+    successStatus: 204
+  }).errors({
+    ...ACCOUNT_NOT_FOUND,
+    ...errors({ meeting_connection_not_found: "The account has no connection to the service." })
+  }).input(MeetingConnectionInput).output(z26.void())
+};
+var meetingConnectSessions = {
+  create: base.route({
+    method: "POST",
+    path: "/v1/accounts/{accountId}/meeting-connect-sessions",
+    tags: CONNECTION_TAGS,
+    summary: "Create a hosted meeting connect session",
+    description: "Returns a link to the hosted page where the account's user signs in to the service; the browser then returns to redirectUri with status=success|error, service, error and state, or without redirectUri to workwae's own confirmation page, which needs no allowlist entry. The sign-in passes a Continue page on the API origin naming the tenant, the service and the account, and must finish in the browser that pressed Continue (an HttpOnly cookie on the API origin); a callback in any other browser renders an error page and connects nothing. A session yields at most one grant: once one sign-in completed it, the others end with error=session_used, and one completing after expiresAt ends with error=session_expired. Connecting again replaces the account's grant for the service."
+  }).errors({
+    ...MEETINGS,
+    ...ACCOUNT_NOT_FOUND,
+    ...errors({
+      redirect_uri_not_allowed: "redirectUri is not on the tenant's allowlist.",
+      unknown_meeting_app: "meetingAppId names no meeting app of the tenant.",
+      meeting_app_mismatch: "meetingAppId is not a sign-in app of the service.",
+      meeting_app_secret_unreadable: "The meetingAppId app's secret cannot be decrypted; register the app again.",
+      provider_not_configured: "No meetingAppId is given and the platform has no app for the service."
+    })
+  }).input(AccountIdInput.extend(CreateMeetingConnectSession.shape)).output(SessionLink)
+};
+var hostedMeetingConnectSessions = {
+  get: base.route({
+    method: "GET",
+    path: "/v1/hosted/meeting-connect-sessions/{token}",
+    tags: ["Hosted pages"],
+    summary: "Read a hosted meeting connect session",
+    spec: publicOperation
+  }).errors(errors({
+    meeting_connect_session_not_found: "No session has this token, or its account no longer exists."
+  })).input(SessionTokenInput).output(MeetingConnectSessionPublic)
+};
+
+// ../contract/src/oauth-apps/routes.ts
+import * as z27 from "zod";
+var NOT_FOUND = errors({ oauth_app_not_found: "The OAuth app does not exist." });
+var oauthApps = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/oauth-apps",
+    tags: ["OAuth apps"],
+    summary: "List tenant OAuth apps"
+  }).output(OAuthAppList),
+  create: base.route({
+    method: "POST",
+    path: "/v1/oauth-apps",
+    tags: ["OAuth apps"],
+    summary: "Register a tenant OAuth app",
+    successStatus: 201
+  }).errors(errors({
+    cloud_required: "provider is microsoft and no cloud is given.",
+    not_microsoft: "cloud or authority is given for a Google app."
+  })).input(CreateOAuthApp).output(OAuthApp),
+  update: base.route({
+    method: "PATCH",
+    path: "/v1/oauth-apps/{appId}",
+    tags: ["OAuth apps"],
+    summary: "Change a tenant OAuth app: name, client secret, authority or Gmail push",
+    description: "Accounts on the app use the new secret from their next token refresh. gmailPush (Google apps) makes the app's accounts watch the topic with users.watch instead of being polled; null stops their watches and returns them to polling. Changing it wakes the app's accounts so it applies at once, and saving it again retries a watch Gmail refused."
+  }).errors({
+    ...NOT_FOUND,
+    ...errors({
+      not_microsoft: "authority is given for a Google app.",
+      gmail_push_unsupported: "gmailPush is given for a Microsoft app.",
+      push_unavailable: "gmailPush is set and the instance has no PUSH_BASE_URL."
+    })
+  }).input(OAuthAppIdInput.extend(UpdateOAuthApp.shape)).output(OAuthApp),
+  delete: base.route({
+    method: "DELETE",
+    path: "/v1/oauth-apps/{appId}",
+    tags: ["OAuth apps"],
+    summary: "Delete a tenant OAuth app",
+    successStatus: 204
+  }).errors({
+    ...NOT_FOUND,
+    ...errors({ oauth_app_in_use: "Live accounts still use the app." })
+  }).input(OAuthAppIdInput).output(z27.void())
+};
+
+// ../contract/src/org-connections/routes.ts
+import * as z28 from "zod";
+var NOT_FOUND2 = errors({
+  org_connection_not_found: "The organization connection does not exist."
+});
+var CONSENT_REQUIRED = errors({
+  consent_required: "No Microsoft directory has consented to the app yet."
+});
+var CREDENTIALS = errors({
+  invalid_service_account_key: "serviceAccountKey is not a usable Google service account key.",
+  invalid_certificate: "The certificate or private key is not a usable PEM certificate and unencrypted PKCS#8 RSA key.",
+  directory_id_not_allowed: "A directoryId is given for a platform connection."
+});
+var TAGS = ["Organization connections"];
+var orgConnections = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/org-connections",
+    tags: TAGS,
+    summary: "List organization connections"
+  }).output(OrgConnectionList),
+  create: base.route({
+    method: "POST",
+    path: "/v1/org-connections",
+    tags: TAGS,
+    summary: "Register an organization connection",
+    description: "Google: the service account key is checked and sealed; authorize the returned clientId for the returned scopes in the Admin console, then test. Microsoft: a platform connection starts in pending_consent (POST .../consent); a tenant app with a directoryId starts unverified.",
+    successStatus: 201
+  }).errors({
+    ...CREDENTIALS,
+    ...errors({
+      provider_not_configured: "A platform connection names a cloud the platform has no app for."
+    })
+  }).input(CreateOrgConnection).output(OrgConnection),
+  get: base.route({
+    method: "GET",
+    path: "/v1/org-connections/{connectionId}",
+    tags: TAGS,
+    summary: "Get an organization connection"
+  }).errors(NOT_FOUND2).input(OrgConnectionIdInput).output(OrgConnection),
+  update: base.route({
+    method: "PATCH",
+    path: "/v1/org-connections/{connectionId}",
+    tags: TAGS,
+    summary: "Update an organization connection",
+    description: "Replacing a credential or the authorized scopes makes the connection unverified until the next test."
+  }).errors({
+    ...NOT_FOUND2,
+    ...CREDENTIALS,
+    ...errors({
+      credential_mismatch: "A field does not apply to this connection's kind or credential type, or a certificate is replaced without its private key."
+    })
+  }).input(OrgConnectionIdInput.extend(UpdateOrgConnection.shape)).output(OrgConnection),
+  delete: base.route({
+    method: "DELETE",
+    path: "/v1/org-connections/{connectionId}",
+    tags: TAGS,
+    summary: "Delete an organization connection",
+    successStatus: 204
+  }).errors({
+    ...NOT_FOUND2,
+    ...errors({ connection_in_use: "Live accounts still authenticate through the connection." })
+  }).input(OrgConnectionIdInput).output(z28.void()),
+  consent: base.route({
+    method: "POST",
+    path: "/v1/org-connections/{connectionId}/consent",
+    tags: TAGS,
+    summary: "Start Microsoft admin consent",
+    description: "Returns the URL an administrator of the directory grants consent at. Afterwards the browser returns to redirectUri with status=success|error, connection_id, error and state; the connection records the consenting directory and is tested. A tenant app uses /adminconsent. The platform app is consented through a sign-in (authorize with prompt=admin_consent) and records the directory named by the sign-in's ID token; it can only be started from the board, and the board user who started it has to be signed in, in the browser that returns, for the directory to be recorded. Errors on return include access_denied, consent_failed, consent_unverified, directory_mismatch and directory_already_connected (another platform connection holds the directory)."
+  }).errors({
+    ...NOT_FOUND2,
+    ...errors({
+      not_microsoft: "The connection is a Google connection.",
+      redirect_uri_not_allowed: "redirectUri is neither on the tenant allowlist (settings.redirectUris) nor the board.",
+      session_required: "A platform connection's consent is started by a caller that is not a board session.",
+      provider_not_configured: "A platform connection's cloud has no platform app (the platform's configuration changed)."
+    })
+  }).input(OrgConnectionIdInput.extend(StartConsentRequest.shape)).output(ConsentLink),
+  test: base.route({
+    method: "POST",
+    path: "/v1/org-connections/{connectionId}/test",
+    tags: TAGS,
+    summary: "Test an organization connection",
+    description: "Requests a token the way accounts will and reports each check; the connection becomes active or failing. A passing test returns accounts that were moved to reauth_required to active. Google impersonates `user` (default: the directory admin)."
+  }).errors({
+    ...NOT_FOUND2,
+    ...CONSENT_REQUIRED,
+    ...errors({
+      user_required: "A Google connection has neither a user nor a directory admin to test as."
+    })
+  }).input(OrgConnectionIdInput.extend(TestOrgConnectionRequest.shape)).output(OrgConnectionTestResult),
+  directoryEntries: base.route({
+    method: "GET",
+    path: "/v1/org-connections/{connectionId}/directory-entries",
+    tags: TAGS,
+    summary: "List the directory's mailboxes",
+    description: "Microsoft: Graph /users (needs User.Read.All). Google: the Admin SDK users.list as the directory admin (needs admin.directory.user.readonly). `query` matches the start of names and addresses. A nextCursor is good for an hour, on this connection only."
+  }).errors({
+    ...NOT_FOUND2,
+    ...CONSENT_REQUIRED,
+    ...INVALID_CURSOR,
+    ...PROVIDER_FAILURES,
+    ...errors({
+      directory_unavailable: "The connection may not list the directory: there is no directory admin, the permission or scope is not granted, or the connection cannot get a token (test it).",
+      provider_rejected: "The provider rejected the listing (e.g. the query).",
+      provider_not_found: "The provider no longer has the directory."
+    })
+  }).input(OrgConnectionIdInput.extend(ListDirectoryEntriesQuery.shape)).output(DirectoryEntryPage),
+  addAccounts: base.route({
+    method: "POST",
+    path: "/v1/org-connections/{connectionId}/accounts",
+    tags: TAGS,
+    summary: "Add mailboxes as accounts",
+    description: "Each mailbox is checked through the connection before its account is created (Google: a delegated token for it; Microsoft: its inbox). items holds one result per mailbox, in request order. Per-mailbox failures are reported there with the reason the API would answer with, e.g. invalid_grant (no such user), consent_revoked (the scopes or permissions are not granted), provider_forbidden or provider_not_found (no mailbox access), plan_limit_accounts (the plan's account limit was reached part way through; the mailboxes before it are created)."
+  }).errors({
+    ...NOT_FOUND2,
+    ...CONSENT_REQUIRED,
+    ...bodyStorage("settings.bodyStorage"),
+    ...BILLING_PAST_DUE
+  }).input(OrgConnectionIdInput.extend(AddMailboxesRequest.shape)).output(AddedMailboxList)
+};
+var sharedMailboxes = {
+  create: base.route({
+    method: "POST",
+    path: "/v1/accounts/{accountId}/shared-mailboxes",
+    tags: ["Shared mailboxes"],
+    summary: "Open a shared mailbox with an account's grant",
+    description: "Creates (or re-points) an account for a shared mailbox the delegating account's user can access, authenticated with that account's grant: Graph addresses it as /users/{email}; an Exchange IMAP account logs in as user\\shared with XOAUTH2. Gmail has no delegated shared mailboxes: add them through a Google domain-wide delegation connection.",
+    successStatus: 201
+  }).errors({
+    ...planModule("shared mailboxes"),
+    ...bodyStorage("settings.bodyStorage"),
+    ...PLAN_LIMIT_ACCOUNTS,
+    ...BILLING_PAST_DUE,
+    ...accountState("The delegating account"),
+    ...PROVIDER_FAILURES,
+    ...errors({
+      account_not_found: "The delegating account does not exist.",
+      shared_mailbox_unsupported: "The delegating account is Gmail, password IMAP, or itself shared or organization-authenticated, or the mailbox is its own.",
+      scope_missing: "The delegating account's grant lacks the shared mailbox scope (reconnect it with options.sharedMailboxesEnabled).",
+      shared_mailbox_inaccessible: "The delegating account's user cannot open the mailbox (no access, no such mailbox, or the login is refused).",
+      account_exists: "The mailbox is already an account authenticated another way."
+    })
+  }).input(AccountIdInput.extend(OpenSharedMailboxRequest.shape)).output(Account)
+};
+
+// ../contract/src/send/routes.ts
+import * as z29 from "zod";
+var LIST = "With listId, content is always rendered, `{{rcpt.unsubscribeUrl}}`, `{{rcpt.address}}` and `{{rcpt.name}}` are the recipient's, and the message carries List-Unsubscribe with that same URL and List-Unsubscribe-Post: List-Unsubscribe=One-Click (RFC 8058). Click tracking never rewrites a List-Unsubscribe URL, so the body's link stays as written. A recipient on that list or on the global list is not sent to, at queue time and again at delivery (send.failed with code suppressed). Without listId no list is consulted. Whether the provider's DKIM signature covers the List-Unsubscribe headers is up to its signing.";
+var UNDO = "A message without a sendAt later than the account's undo window (undoSendSeconds) from now waits out the window; undoUntil says until when cancelling the entry (DELETE .../outbox/{outboxId}) undoes the send.";
+var DELIVERY = "Delivery is at-least-once, except outcome_unknown (below), and without order across retries: an account's entries are first tried in queue order, but one backing off after a failed attempt does not hold up the later ones. A retry first looks for a copy that already went out. When no SMTP reply comes after the final dot was handed to the operating system (the connection dropped or timed out, or the attempt ran out of time), the server may have accepted the message, so it is not sent again: send.failed carries code outcome_unknown and the client app decides whether to resend.";
+var TRACKING = "With tracking, the HTML part gets a 1x1 pixel (opens) and its http(s) links point at workwae's redirect (clicks), reported as message.opened and message.clicked and counted on the outbox entry; text parts are left as they are. With clicks, tracking.honeypot (else the account's trackingHoneypot) also adds one hidden link only machines follow; it does nothing without clicks, so asking for it with clicks off is refused rather than ignored. Tracking is per message, not per recipient: every recipient gets the same MIME.";
+var MAIL_MERGE = `Each of at most ${MAX_MAIL_MERGE_ENTRIES} entries becomes its own outbox entry and message, addressed to its to alone, with its own Message-ID, events, bounce matching and tracking; the answer has one result per entry, in order. Content is rendered per entry with its params (a template always; inline content only for entries that carry params, or with listId). An entry that cannot be queued fails alone, its result naming the reason (invalid_recipient, invalid_message_id, duplicate_message_id, template_render_failed, plan_limit_sends once the day's sends run out, suppressed when listId is given and the address is on that list or the global list, internal_error), while the others go ahead; the call itself succeeds. The body is the send body without to, cc, bcc and render: an unknown field is refused.`;
+var COMPOSE_ERRORS = {
+  ...ACCOUNT_NOT_FOUND,
+  ...errors({
+    from_not_allowed: "from is not one of the account's identities.",
+    attachments_too_large: "The attachments exceed the provider's limit.",
+    unknown_reply_target: "inReplyToMessageId names no message of the account."
+  }),
+  ...accountState(),
+  ...PROVIDER_FAILURES
+};
+var TEMPLATE_ERRORS = errors({
+  unknown_template: "template names no template of the tenant.",
+  template_account_mismatch: "The template is bound to another account.",
+  template_and_inline_fields: "template comes with an inline subject, html, text, previewText or format.",
+  invalid_template: "Inline content to render is not valid Handlebars or uses partials or decorators; data.field names the field.",
+  params_too_large: `params exceed ${MAX_RENDER_PARAMS_BYTES} bytes as JSON.`,
+  template_render_failed: `Rendering fails (a missing helper, more than ${MAX_RENDER_ITERATIONS} block iterations, a field rendered past its limit, Markdown longer than ${MAX_MARKDOWN_LENGTH} characters, rendered or not); data.field names the field.`
+});
+var RENDERED_ONCE = "Content is rendered when the request is taken, so later template edits never change it.";
+var TRACKING_ERRORS = errors({
+  honeypot_needs_click_tracking: "tracking.honeypot is true and click tracking is off.",
+  plan_module_unavailable: "Tracking is asked for and the tenant's plan does not include it (nor do the account's tracking defaults apply then)."
+});
+var LIST_UNSUBSCRIBE_UNAVAILABLE = errors({
+  list_unsubscribe_unavailable: "listId is given and TRACKING_BASE_URL is not https."
+});
+var PLAN_LIMIT_SENDS = errors({
+  plan_limit_sends: "The tenant already queued as many sends today (UTC) as its plan allows."
+});
+var DRAFT_NOT_FOUND = errors({ draft_not_found: "The message does not exist or is no draft." });
+var drafts = {
+  create: base.route({
+    method: "POST",
+    path: "/v1/accounts/{accountId}/drafts",
+    tags: ["Mail"],
+    summary: "Create a draft",
+    description: RENDERED_ONCE,
+    successStatus: 201
+  }).errors({
+    ...COMPOSE_ERRORS,
+    ...TEMPLATE_ERRORS,
+    ...PROVIDER_CHANGE,
+    ...errors({ draft_lost: "The provider took the draft but did not answer it back." })
+  }).input(AccountIdInput.extend(ComposeWithTemplate.shape)).output(MessageSummary),
+  update: base.route({
+    method: "PUT",
+    path: "/v1/accounts/{accountId}/drafts/{messageId}",
+    tags: ["Mail"],
+    summary: "Replace a draft's content",
+    description: RENDERED_ONCE
+  }).errors({ ...COMPOSE_ERRORS, ...TEMPLATE_ERRORS, ...PROVIDER_CHANGE, ...DRAFT_NOT_FOUND }).input(MessageIdInput.extend(ComposeWithTemplate.shape)).output(MessageSummary),
+  delete: base.route({
+    method: "DELETE",
+    path: "/v1/accounts/{accountId}/drafts/{messageId}",
+    tags: ["Mail"],
+    summary: "Delete a draft",
+    successStatus: 204
+  }).errors({ ...ACCOUNT_NOT_FOUND, ...DRAFT_NOT_FOUND, ...accountState(), ...PROVIDER_CHANGE }).input(MessageIdInput).output(z29.void()),
+  send: base.route({
+    method: "POST",
+    path: "/v1/accounts/{accountId}/drafts/{messageId}/send",
+    tags: ["Mail"],
+    summary: "Send a draft",
+    description: `${UNDO} ${TRACKING} A Gmail or Microsoft 365 draft is sent by the provider as it is stored, so it is never tracked (the account's defaults do not apply); an IMAP draft is. A cancelled draft-send leaves the draft in place.`,
+    successStatus: 201
+  }).errors({
+    ...ACCOUNT_NOT_FOUND,
+    ...DRAFT_NOT_FOUND,
+    ...accountState(),
+    ...errors({
+      not_a_draft: "The message stopped being a draft while the send was queued.",
+      no_recipients: "The draft has no to, cc or bcc recipients (as last indexed).",
+      tracking_unsupported: "Tracking (opens, clicks or honeypot) is asked for a Gmail or Microsoft 365 draft."
+    }),
+    ...TRACKING_ERRORS,
+    ...PLAN_LIMIT_SENDS,
+    ...BILLING_PAST_DUE
+  }).input(MessageIdInput.extend(SendOptions.shape)).output(QueuedSend)
+};
+var SEND_INPUT = AccountIdInput.extend(SendMessageRequest.shape).strict().superRefine((send, ctx) => {
+  if (send.to.length + send.cc.length + send.bcc.length === 0)
+    ctx.addIssue({
+      code: "custom",
+      path: ["to"],
+      message: "The message has no recipients (to, cc or bcc)",
+      params: { reason: "no_recipients" }
+    });
+});
+var SEND_NOT_FOUND = errors({ send_not_found: "The account has no such outbox entry." });
+var outbox = {
+  create: base.route({
+    method: "POST",
+    path: "/v1/accounts/{accountId}/outbox",
+    tags: ["Mail"],
+    summary: "Send a message",
+    description: `Queues the message as an outbox entry; delivery is reported with send.sent, send.retrying and send.failed events carrying its id as outboxId, and a later bounce with message.bounced. ${DELIVERY} ${UNDO} ${TRACKING} ${LIST} For one message per recipient, see POST .../mail-merges. ${RENDERED_ONCE} An unknown field is refused.`,
+    successStatus: 201
+  }).errors({
+    ...COMPOSE_ERRORS,
+    ...TEMPLATE_ERRORS,
+    ...errors({
+      no_recipients: "to, cc and bcc are all empty.",
+      list_send_recipients: "listId is given and the message has not exactly one to and no cc or bcc.",
+      suppressed: "listId is given and the recipient is on that list or the global list."
+    }),
+    ...TRACKING_ERRORS,
+    ...LIST_UNSUBSCRIBE_UNAVAILABLE,
+    ...PLAN_LIMIT_SENDS,
+    ...BILLING_PAST_DUE
+  }).input(SEND_INPUT).output(QueuedSend),
+  list: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/outbox",
+    tags: ["Mail"],
+    summary: "List queued and recent sends, newest first",
+    description: "status keeps the entries in that status."
+  }).errors({ ...ACCOUNT_NOT_FOUND, ...INVALID_CURSOR }).input(AccountIdInput.extend(ListOutboxQuery.shape)).output(OutboxEntryPage),
+  get: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/outbox/{outboxId}",
+    tags: ["Mail"],
+    summary: "Get a send",
+    description: "One entry with its tracking counts, for as long as the outbox keeps it: a sent message's outboxId names it."
+  }).errors({ ...ACCOUNT_NOT_FOUND, ...SEND_NOT_FOUND }).input(OutboxIdInput).output(OutboxEntry),
+  cancel: base.route({
+    method: "DELETE",
+    path: "/v1/accounts/{accountId}/outbox/{outboxId}",
+    tags: ["Mail"],
+    summary: "Cancel a queued send",
+    description: "Undoes a send while it waits for its sendAt.",
+    successStatus: 204
+  }).errors({
+    ...ACCOUNT_NOT_FOUND,
+    ...SEND_NOT_FOUND,
+    ...errors({
+      send_not_cancellable: "The entry is no longer queued: it is being sent, was sent, failed for good or was cancelled (the message names which)."
+    })
+  }).input(OutboxIdInput).output(z29.void()),
+  reschedule: base.route({
+    method: "PATCH",
+    path: "/v1/accounts/{accountId}/outbox/{outboxId}",
+    tags: ["Mail"],
+    summary: "Reschedule a queued send",
+    description: "Moves sendAt, earlier or later; a past sendAt sends as soon as possible. Announced as send.rescheduled."
+  }).errors({
+    ...ACCOUNT_NOT_FOUND,
+    ...SEND_NOT_FOUND,
+    ...errors({
+      send_not_reschedulable: "The entry is no longer queued (it is being sent, was sent, failed for good or was cancelled), or it is queued again after a failed attempt; the message names which."
+    })
+  }).input(OutboxIdInput.extend(RescheduleSendRequest.shape)).output(OutboxEntry),
+  tracking: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/outbox/{outboxId}/tracking",
+    tags: ["Mail"],
+    summary: "List a send's opens and clicks",
+    description: "Newest first. At most 1000 are kept per send (the counts on the entry keep going), each for the tracking retention period. Each event carries what its request showed: the method (GET or HEAD), the Referer and Origin hosts, the mail client (Gmail's image proxy, web or app; Outlook on the web, desktop or mobile; Apple Mail and its Mail Privacy Protection; Yahoo, AOL, Thunderbird, Proton, Fastmail, Zoho, iCloud, a self-hosted webmail; else unknown), the device, OS and browser families, Cloudflare's visitor location (country, region, city, timezone, latitude and longitude, behind a trusted proxy only), the seconds after the send and since the send's previous hit, its sequence number, whether it was conditional, a Range request or a prefetch, the sec-fetch tuple, and the request headers (lower-cased, values cut at 1024 characters, at most 64, never Cookie, Authorization or Proxy-Authorization, forwarding and cf-* headers only from the trusted proxy; the full Referer is only here). Full addresses and headers stay with the tenant for the retention period."
+  }).errors({ ...ACCOUNT_NOT_FOUND, ...INVALID_CURSOR, ...SEND_NOT_FOUND }).input(OutboxIdInput.extend(ListTrackingEventsQuery.shape)).output(TrackingEventPage)
+};
+var mailMerges = {
+  create: base.route({
+    method: "POST",
+    path: "/v1/accounts/{accountId}/mail-merges",
+    tags: ["Mail"],
+    summary: "Send one message per recipient (mail merge)",
+    description: `${MAIL_MERGE} ${DELIVERY} ${UNDO} ${TRACKING} ${LIST} What holds for the whole call is checked once and refuses it. ${RENDERED_ONCE} Answers 200: the merge itself is not kept, its entries are in the outbox.`
+  }).errors({
+    ...COMPOSE_ERRORS,
+    ...TEMPLATE_ERRORS,
+    ...errors({
+      attachments_too_large: `The attachments exceed the provider's limit, or the attachments times the entries exceed ${MAX_MAIL_MERGE_ATTACHMENT_BYTES} bytes.`
+    }),
+    ...TRACKING_ERRORS,
+    ...LIST_UNSUBSCRIBE_UNAVAILABLE,
+    ...BILLING_PAST_DUE
+  }).input(AccountIdInput.extend(MailMergeRequest.shape).strict()).output(MailMergeResultList)
+};
+
+// ../contract/src/settings/routes.ts
+var settings = {
+  get: base.route({
+    method: "GET",
+    path: "/v1/settings",
+    tags: ["Settings"],
+    summary: "Get tenant settings"
+  }).output(TenantSettings),
+  update: base.route({
+    method: "PATCH",
+    path: "/v1/settings",
+    tags: ["Settings"],
+    summary: "Update tenant settings",
+    description: "bodyStorage applies to every account without its own override; changing it restarts their syncs (full stores and backfills every indexed message, none deletes stored content)."
+  }).errors({
+    ...bodyStorage("bodyStorage"),
+    ...errors({
+      redirect_uri_not_allowed: "A redirect URI is not absolute https (http only for localhost)."
+    })
+  }).input(UpdateTenantSettings).output(TenantSettings)
+};
+
+// ../contract/src/suppressions/routes.ts
+import * as z30 from "zod";
+var LIST_NOT_FOUND = errors({
+  suppression_list_not_found: "The list does not exist (the global list has none to change)."
+});
+var REVIEW_NOT_FOUND = errors({
+  suppression_review_not_found: "The review does not exist."
+});
+var suppressions = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/suppressions",
+    tags: ["Suppressions"],
+    summary: "List suppression lists",
+    description: "The global list first, then every named list by listId, with its counts by source."
+  }).output(SuppressionListList),
+  create: base.route({
+    method: "POST",
+    path: "/v1/suppressions",
+    tags: ["Suppressions"],
+    summary: "Create a suppression list",
+    description: "id is what sends name as listId; it cannot change later, the name and description can. A send or add naming a list that does not exist creates it too, named after its id.",
+    successStatus: 201
+  }).errors(errors({ suppression_list_exists: "A list with that id exists." })).input(CreateSuppressionList).output(SuppressionList),
+  update: base.route({
+    method: "PATCH",
+    path: "/v1/suppressions/{listId}",
+    tags: ["Suppressions"],
+    summary: "Update a suppression list",
+    description: "Only the fields given change; description null clears it. The global list cannot be changed."
+  }).errors(LIST_NOT_FOUND).input(ListIdInput.extend(UpdateSuppressionList.shape)).output(SuppressionList),
+  delete: base.route({
+    method: "DELETE",
+    path: "/v1/suppressions/{listId}",
+    tags: ["Suppressions"],
+    summary: "Delete a suppression list",
+    description: "Deletes the list and its pending reviews and, with ?withEntries=true, every address on it: later sends naming it reach those addresses again (unless the global list holds them), and the next one naming it creates it anew. The global list cannot be deleted.",
+    successStatus: 204,
+    inputStructure: "detailed"
+  }).errors({
+    ...LIST_NOT_FOUND,
+    ...errors({
+      suppression_list_not_empty: "The list holds addresses and withEntries is not true."
+    })
+  }).input(DeleteSuppressionListInput).output(z30.void()),
+  entries: {
+    list: base.route({
+      method: "GET",
+      path: "/v1/suppressions/{listId}/entries",
+      tags: ["Suppressions"],
+      summary: "List suppressed addresses",
+      description: "Addresses on one list, by address; a list without addresses is empty, not missing. address keeps those containing it, source those that came from it."
+    }).errors(INVALID_CURSOR).input(SuppressionListIdInput.extend(ListSuppressionEntriesQuery.shape)).output(SuppressionEntryPage),
+    add: base.route({
+      method: "POST",
+      path: "/v1/suppressions/{listId}/entries",
+      tags: ["Suppressions"],
+      summary: "Suppress addresses",
+      description: `Puts up to ${MAX_SUPPRESSION_BATCH} addresses on the list in one call; a repeated address counts once. added counts the addresses put on the list, alreadyListed those that were on it already, which are left as they were. A list that does not exist is created, named after its listId. Answers 200: entries are listed, not fetched one by one. Emits no suppression.created: that event reports what recipients and bounces did.`
+    }).input(SuppressionListIdInput.extend(AddSuppressionEntriesRequest.shape)).output(SuppressionEntriesAdded),
+    remove: base.route({
+      method: "DELETE",
+      path: "/v1/suppressions/{listId}/entries/{address}",
+      tags: ["Suppressions"],
+      summary: "Release an address",
+      description: "Later sends naming the list reach the address again (unless another list they consult holds it).",
+      successStatus: 204
+    }).errors(errors({ suppression_entry_not_found: "The address is not on the list." })).input(SuppressionEntryInput).output(z30.void())
+  }
+};
+var suppressionReviews = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/suppression-reviews",
+    tags: ["Suppressions"],
+    summary: "List opt-outs to review",
+    description: "Detected opt-outs waiting for a person, newest first; listId keeps one list's. Holds AI-classified opt-out replies while optOutHandling is review, and auto-replies saying the person is no longer at the address (source inactive, on the global list) while it is review or suppress. A detection of an address already on its list, or already waiting, is not queued again."
+  }).errors(INVALID_CURSOR).input(ListSuppressionReviewsQuery).output(SuppressionReviewPage),
+  approve: base.route({
+    method: "POST",
+    path: "/v1/suppression-reviews/{reviewId}/approve",
+    tags: ["Suppressions"],
+    summary: "Approve an opt-out",
+    description: "Puts the address on the review's list with the review's source and removes the review. added is false when the address was on the list already. Emits suppression.created when it was not."
+  }).errors(REVIEW_NOT_FOUND).input(ReviewIdInput).output(SuppressionAdded),
+  dismiss: base.route({
+    method: "POST",
+    path: "/v1/suppression-reviews/{reviewId}/dismiss",
+    tags: ["Suppressions"],
+    summary: "Dismiss an opt-out",
+    description: "Removes the review without suppressing anything; a later detection of the same address queues it again.",
+    successStatus: 204
+  }).errors(REVIEW_NOT_FOUND).input(ReviewIdInput).output(z30.void())
+};
+
+// ../contract/src/templates/routes.ts
+import * as z31 from "zod";
+var NOT_FOUND3 = errors({ template_not_found: "The template does not exist." });
+var SYNTAX = errors({
+  invalid_template: "A field is not valid Handlebars or uses partials or decorators (data names the field, the message is the parser's)."
+});
+var NAME_TAKEN = errors({
+  template_name_taken: "The scope (the tenant, or the bound account) already has a template of that name."
+});
+var UNKNOWN_ACCOUNT = errors({
+  unknown_account: "The accountId names an account the tenant does not have (data lists it)."
+});
+var templates = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/templates",
+    tags: ["Templates"],
+    summary: "List templates",
+    description: "Newest first, without their content (GET /v1/templates/{templateId} has it). accountId lists those bound to that account; usableBy those the account may send with (the tenant's shared ones and its own); name the ones of that exact name, one per scope; query those whose name contains it, ignoring case."
+  }).errors(INVALID_CURSOR).input(ListTemplatesQuery).output(TemplateSummaryPage),
+  get: base.route({
+    method: "GET",
+    path: "/v1/templates/{templateId}",
+    tags: ["Templates"],
+    summary: "Get a template"
+  }).errors(NOT_FOUND3).input(TemplateIdInput).output(Template),
+  create: base.route({
+    method: "POST",
+    path: "/v1/templates",
+    tags: ["Templates"],
+    summary: "Create a template",
+    description: "Every field is checked to compile as Handlebars.",
+    successStatus: 201
+  }).errors({ ...SYNTAX, ...UNKNOWN_ACCOUNT, ...NAME_TAKEN }).input(CreateTemplate).output(Template),
+  update: base.route({
+    method: "PATCH",
+    path: "/v1/templates/{templateId}",
+    tags: ["Templates"],
+    summary: "Update a template",
+    description: "Only the fields given change; queued sends keep what they were rendered with."
+  }).errors({ ...NOT_FOUND3, ...SYNTAX, ...NAME_TAKEN }).input(TemplateIdInput.extend(UpdateTemplate.shape)).output(Template),
+  delete: base.route({
+    method: "DELETE",
+    path: "/v1/templates/{templateId}",
+    tags: ["Templates"],
+    summary: "Delete a template",
+    description: "Queued sends keep their rendered content.",
+    successStatus: 204
+  }).errors(NOT_FOUND3).input(TemplateIdInput).output(z31.void())
+};
+var templateRenders = {
+  create: base.route({
+    method: "POST",
+    path: "/v1/template-renders",
+    tags: ["Templates"],
+    summary: "Render a template without sending",
+    description: "Renders a stored template (templateId) or inline fields with params, as a send would. account.email and account.name come from accountId, else from the template's own account, else render empty."
+  }).errors({
+    ...SYNTAX,
+    ...UNKNOWN_ACCOUNT,
+    ...errors({
+      template_and_inline_fields: "The templateId comes with inline fields or format.",
+      unknown_template: "The templateId names no template of the tenant.",
+      template_account_mismatch: "The template is bound to another account than accountId.",
+      params_too_large: `The params exceed ${MAX_RENDER_PARAMS_BYTES} bytes as JSON.`,
+      template_render_failed: `Rendering fails: a missing helper, more than ${MAX_RENDER_ITERATIONS} block iterations, a field rendered past its limit, or Markdown longer than ${MAX_MARKDOWN_LENGTH} characters (data names the field).`
+    })
+  }).input(RenderTemplateRequest).output(RenderedTemplate)
+};
+
+// ../contract/src/threads/routes.ts
+import * as z33 from "zod";
+
+// ../contract/src/threads/models.ts
+import * as z32 from "zod";
+var ThreadSummary = named("ThreadSummary", z32.object({
+  id: ProviderId,
+  subject: z32.string().nullable(),
+  snippet: z32.string().nullable(),
+  participants: z32.array(Address),
+  messageCount: z32.number().int(),
+  unreadCount: z32.number().int(),
+  isFlagged: z32.boolean(),
+  hasAttachments: z32.boolean(),
+  hasDrafts: z32.boolean(),
+  mailboxIds: z32.array(Id),
+  latestMessageId: Id,
+  lastMessageAt: Timestamp.nullable()
+}));
+var Thread = named("Thread", ThreadSummary.extend({
+  messages: z32.array(MessageSummary)
+}));
+var ThreadSummaryPage = Page(ThreadSummary);
+var ThreadIdInput = named("ThreadIdInput", AccountIdInput.extend({ threadId: ProviderId }));
+var ListThreadsQuery = named("ListThreadsQuery", z32.object({
+  mailboxId: Id.optional(),
+  limit: pageLimit(MAX_THREAD_PAGE_SIZE, DEFAULT_THREAD_PAGE_SIZE),
+  cursor: Cursor.optional()
+}));
+var UpdateThread = named("UpdateThread", z32.object({ isRead: z32.boolean().optional(), mailboxId: Id.optional() }));
+
+// ../contract/src/threads/routes.ts
+var THREAD_NOT_FOUND = errors({
+  thread_not_found: "The account has no message in the thread."
+});
+var ACTION_ERRORS = {
+  ...ACCOUNT_NOT_FOUND,
+  ...THREAD_NOT_FOUND,
+  ...accountState(),
+  ...PROVIDER_CHANGE
+};
+var PART_WAY = "A failure part way leaves the messages done so far changed; repeating the call finishes the rest.";
+var threads = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/threads",
+    tags: ["Mail"],
+    summary: "List threads, latest activity first",
+    description: "Covers the account's sync window. With mailboxId, lists threads with a message in that mailbox, ordered by their latest message there; each summary still describes the whole thread."
+  }).errors({ ...ACCOUNT_NOT_FOUND, ...INVALID_CURSOR, ...UNKNOWN_MAILBOX }).input(AccountIdInput.extend(ListThreadsQuery.shape)).output(ThreadSummaryPage),
+  get: base.route({
+    method: "GET",
+    path: "/v1/accounts/{accountId}/threads/{threadId}",
+    tags: ["Mail"],
+    summary: "Get a thread with its messages, oldest first"
+  }).errors({ ...ACCOUNT_NOT_FOUND, ...THREAD_NOT_FOUND }).input(ThreadIdInput).output(Thread),
+  update: base.route({
+    method: "PATCH",
+    path: "/v1/accounts/{accountId}/threads/{threadId}",
+    tags: ["Mail"],
+    summary: "Mark a thread read or unread, or move it",
+    description: `Applies the change to every message of the thread through the message operations; messages already in that state are skipped. mailboxId moves each message there (Gmail: replaces its folder-like labels). ${PART_WAY}`
+  }).errors({ ...ACTION_ERRORS, ...UNKNOWN_MAILBOX }).input(ThreadIdInput.extend(UpdateThread.shape)).output(Thread),
+  delete: base.route({
+    method: "DELETE",
+    path: "/v1/accounts/{accountId}/threads/{threadId}",
+    tags: ["Mail"],
+    summary: "Move a thread to Trash",
+    description: `Moves every message of the thread that is not already there to Trash. ${PART_WAY}`,
+    successStatus: 204
+  }).errors(ACTION_ERRORS).input(ThreadIdInput).output(z33.void())
+};
+
+// ../contract/src/usage/models.ts
+import * as z34 from "zod";
+var PlanModules = named("PlanModules", z34.object({
+  calendar: z34.boolean(),
+  contacts: z34.boolean(),
+  tracking: z34.boolean(),
+  ai: z34.boolean(),
+  meetings: z34.boolean(),
+  sharedMailboxes: z34.boolean()
+}));
+var PlanIncluded = named("PlanIncluded", z34.object({
+  accounts: z34.number().int().min(0).nullable(),
+  sendsPerMonth: z34.number().int().min(0).nullable(),
+  aiCallsPerMonth: z34.number().int().min(0).nullable(),
+  storageBytes: z34.number().int().min(0).nullable()
+}));
+var Amount = z34.number().int().min(0);
+var StripePrice = z34.string().regex(/^price_[A-Za-z0-9]+$/).max(MAX_STRIPE_ID_LENGTH).nullable();
+var PlanStripePrices = named("PlanStripePrices", z34.object({
+  basePrice: StripePrice,
+  accountPrice: StripePrice,
+  sendsPrice: StripePrice,
+  aiCallsPrice: StripePrice,
+  storagePrice: StripePrice
+}));
+var PlanPricing = named("PlanPricing", z34.object({
+  currency: z34.string().regex(/^[a-z]{3}$/),
+  baseMonthly: Amount,
+  perAccountMonthly: Amount,
+  sendsPer1k: Amount,
+  aiCallsPer1k: Amount,
+  storagePerGbMonth: Amount,
+  stripe: PlanStripePrices
+}));
+var PlanLimits = named("PlanLimits", z34.object({
+  maxAccounts: z34.number().int().min(0).nullable(),
+  sendsPerDay: z34.number().int().min(0).nullable(),
+  apiCallsPerMinute: z34.number().int().min(1).nullable(),
+  apiCallsPerMinutePerKey: z34.number().int().min(1).nullable(),
+  webhookEndpoints: z34.number().int().min(0).nullable(),
+  bodyStorageAllowed: z34.boolean(),
+  storageBytes: z34.number().int().min(0).nullable(),
+  modules: PlanModules,
+  included: PlanIncluded,
+  pricing: PlanPricing.nullable()
+}));
+var EffectivePlan = named("EffectivePlan", z34.object({ id: Id.nullable(), name: z34.string(), limits: PlanLimits }));
+var UsageDay = named("UsageDay", z34.object({
+  day: DateOnly,
+  liveAccounts: z34.number().int(),
+  apiCalls: z34.record(z34.string(), z34.number().int()),
+  sends: z34.number().int(),
+  webhookDeliveries: z34.number().int(),
+  aiCalls: z34.number().int(),
+  storedBytes: z34.number().int().nullable()
+}));
+var CurrentUsage = named("CurrentUsage", z34.object({
+  accounts: z34.number().int(),
+  webhookEndpoints: z34.number().int(),
+  sendsToday: z34.number().int(),
+  storedBytes: z34.number().int()
+}));
+var Usage = named("Usage", z34.object({
+  plan: EffectivePlan,
+  current: CurrentUsage,
+  days: z34.array(UsageDay)
+}));
+var DAY_MS2 = 86400000;
+var UsageQuery = named("UsageQuery", withDateRange(z34.object({ from: DateOnly.optional(), to: DateOnly.optional() }), {
+  from: "from",
+  to: "to",
+  inclusive: true,
+  maxSpanMs: (MAX_USAGE_RANGE_DAYS - 1) * DAY_MS2
+}).superRefine((q, ctx) => {
+  if (q.from === undefined || q.to !== undefined)
+    return;
+  const span = Date.parse(new Date().toISOString().slice(0, 10)) - Date.parse(q.from);
+  if (span < 0 || span > (MAX_USAGE_RANGE_DAYS - 1) * DAY_MS2)
+    ctx.addIssue({
+      code: "custom",
+      path: ["from"],
+      message: span < 0 ? "from must be on or before today when to is left out" : `The range may span at most ${MAX_USAGE_RANGE_DAYS} days`,
+      params: { reason: "invalid_range" }
+    });
+}));
+
+// ../contract/src/usage/routes.ts
+var usage = {
+  get: base.route({
+    method: "GET",
+    path: "/v1/usage",
+    tags: ["Usage"],
+    summary: "Read usage and plan limits",
+    description: "Per UTC day: live accounts (sampled), API calls by scope, sends, webhook deliveries, AI calls and stored bytes (listed once a day). from and to default to the last 30 days; today's counters are live."
+  }).errors(errors({
+    invalid_range: `from is after to (or after today, with to left out), or the range spans more than ${MAX_USAGE_RANGE_DAYS} days.`
+  })).input(UsageQuery).output(Usage)
+};
+
+// ../contract/src/webhooks/routes.ts
+import * as z36 from "zod";
+
+// ../contract/src/webhooks/models.ts
+import * as z35 from "zod";
+var ADDRESS_PATTERN = /^(?:[^\s@]+)?@[^\s@.]+(?:\.[^\s@.]+)+$/;
+var WEBHOOK_HEADERS = {
+  id: "webhook-id",
+  timestamp: "webhook-timestamp",
+  signature: "webhook-signature"
+};
+var WEBHOOK_SECRET_PREFIX = "whsec_";
+var AddressPattern = z35.string().trim().toLowerCase().max(MAX_EMAIL_LENGTH).regex(ADDRESS_PATTERN, "Expected an address or @domain");
+var WebhookMessageFilters = named("WebhookMessageFilters", z35.object({
+  mailboxIds: z35.array(Id),
+  mailboxRoles: z35.array(MailboxRole),
+  from: z35.array(z35.string()),
+  to: z35.array(z35.string()),
+  subjectContains: z35.array(z35.string()),
+  hasAttachments: z35.boolean().nullable(),
+  direction: MessageDirection.nullable()
+}));
+var WebhookFilters = named("WebhookFilters", z35.object({
+  eventTypes: z35.array(EventType),
+  accountIds: z35.array(Id),
+  message: WebhookMessageFilters
+}));
+var WebhookMessageFiltersInput = named("WebhookMessageFiltersInput", z35.object({
+  mailboxIds: z35.array(Id).max(MAX_WEBHOOK_FILTER_VALUES).optional(),
+  mailboxRoles: z35.array(MailboxRole).max(MailboxRole.options.length).optional(),
+  from: z35.array(AddressPattern).max(MAX_WEBHOOK_FILTER_VALUES).optional(),
+  to: z35.array(AddressPattern).max(MAX_WEBHOOK_FILTER_VALUES).optional(),
+  subjectContains: z35.array(z35.string().trim().min(1).max(MAX_SUBJECT_FILTER_LENGTH)).max(MAX_WEBHOOK_FILTER_VALUES).optional(),
+  hasAttachments: z35.boolean().nullable().optional(),
+  direction: MessageDirection.nullable().optional()
+}));
+var WebhookFiltersInput = named("WebhookFiltersInput", z35.object({
+  eventTypes: z35.array(EventType).max(MAX_WEBHOOK_FILTER_VALUES).optional(),
+  accountIds: z35.array(Id).max(MAX_WEBHOOK_FILTER_VALUES).optional(),
+  message: WebhookMessageFiltersInput.optional()
+}));
+var WebhookEndpoint = named("WebhookEndpoint", z35.object({
+  id: Id,
+  url: z35.url(),
+  description: z35.string().nullable(),
+  filters: WebhookFilters,
+  isEnabled: z35.boolean(),
+  disabledReason: z35.string().nullable(),
+  lastSuccessAt: Timestamp.nullable(),
+  failingSince: Timestamp.nullable(),
+  previousSecretExpiresAt: Timestamp.nullable(),
+  createdAt: Timestamp
+}));
+var WebhookEndpointList = List(WebhookEndpoint);
+var WebhookEndpointWithSecret = named("WebhookEndpointWithSecret", z35.object({ endpoint: WebhookEndpoint, secret: z35.string() }));
+var WebhookSecret = named("WebhookSecret", z35.object({
+  secret: z35.string(),
+  previousSecretExpiresAt: Timestamp.nullable()
+}));
+var RotateWebhookSecretRequest = named("RotateWebhookSecretRequest", z35.object({
+  graceSeconds: z35.number().int().min(0).max(MAX_WEBHOOK_SECRET_GRACE_SECONDS).default(DEFAULT_WEBHOOK_SECRET_GRACE_SECONDS)
+}));
+var WebhookEndpointIdInput = named("WebhookEndpointIdInput", z35.object({ endpointId: Id }));
+var CreateWebhookEndpoint = named("CreateWebhookEndpoint", z35.object({
+  url: z35.url(),
+  description: z35.string().max(MAX_NOTE_LENGTH).optional(),
+  filters: WebhookFiltersInput.optional()
+}));
+var UpdateWebhookEndpoint = named("UpdateWebhookEndpoint", z35.object({
+  url: z35.url().optional(),
+  description: z35.string().max(MAX_NOTE_LENGTH).nullable().optional(),
+  filters: WebhookFiltersInput.optional(),
+  isEnabled: z35.boolean().optional()
+}));
+var SendTestEventRequest = named("SendTestEventRequest", z35.object({
+  eventType: EventType.default(TEST_EVENT_TYPE),
+  accountId: Id.optional(),
+  data: z35.looseObject({}).optional()
+}).superRefine((input, ctx) => {
+  if (input.data === undefined)
+    return;
+  const parsed = EVENTS[input.eventType].data.safeParse(input.data);
+  if (parsed.success)
+    return;
+  for (const issue of parsed.error.issues)
+    ctx.addIssue({ code: "custom", message: issue.message, path: ["data", ...issue.path] });
+}));
+var TestEventSent = named("TestEventSent", z35.object({ eventId: EventId }));
+var WebhookAttemptResult = named("WebhookAttemptResult", z35.enum(["succeeded", "failed"]));
+var WebhookAttempt = named("WebhookAttempt", z35.object({
+  id: Id,
+  eventId: EventId,
+  eventType: EventType,
+  accountId: Id.nullable(),
+  attempt: z35.number().int(),
+  statusCode: z35.number().int().nullable(),
+  error: z35.string().nullable(),
+  responseExcerpt: z35.string().nullable(),
+  durationMs: z35.number().int(),
+  isReplay: z35.boolean(),
+  isTest: z35.boolean(),
+  occurredAt: Timestamp
+}));
+var WebhookAttemptPage = Page(WebhookAttempt);
+var ListWebhookAttemptsQuery = named("ListWebhookAttemptsQuery", z35.object({
+  limit: pageLimit(MAX_WEBHOOK_ATTEMPT_PAGE_SIZE, DEFAULT_WEBHOOK_ATTEMPT_PAGE_SIZE),
+  cursor: Cursor.optional(),
+  eventType: EventType.optional(),
+  eventId: EventId.optional(),
+  accountId: Id.optional(),
+  result: WebhookAttemptResult.optional(),
+  since: QueryTimestamp.optional(),
+  until: QueryTimestamp.optional()
+}));
+var ListWebhookAttemptsInput = withDateRange(WebhookEndpointIdInput.extend(ListWebhookAttemptsQuery.shape), { from: "since", to: "until" });
+var ReplayEventInput = named("ReplayEventInput", WebhookEndpointIdInput.extend({ eventId: EventId }));
+var ReplayRangeRequest = named("ReplayRangeRequest", withDateRange(z35.object({ since: QueryTimestamp, until: QueryTimestamp }), {
+  from: "since",
+  to: "until"
+}));
+var ReplayResult = named("ReplayResult", z35.object({
+  queued: z35.number().int(),
+  alreadyQueued: z35.number().int()
+}));
+var FailedDeliveriesQuery = named("FailedDeliveriesQuery", withDateRange(z35.object({ since: QueryTimestamp.optional(), until: QueryTimestamp.optional() }), {
+  from: "since",
+  to: "until"
+}));
+var FailedDeliveryCount = named("FailedDeliveryCount", z35.object({
+  count: z35.number().int()
+}));
+
+// ../contract/src/webhooks/routes.ts
+var ENDPOINT_NOT_FOUND = errors({
+  webhook_endpoint_not_found: "The endpoint does not exist."
+});
+var ENDPOINT_DISABLED = errors({ endpoint_disabled: "The endpoint is disabled." });
+var HTTPS_REQUIRED = errors({ https_required: "url is not https." });
+var WEBHOOK_FILTER_ERRORS = errors({
+  unknown_account: "filters.accountIds names an account the tenant does not have; data.ids lists them.",
+  unknown_mailbox: "filters.message.mailboxIds names a mailbox the tenant does not have; data.ids lists them.",
+  mailbox_outside_accounts: "filters.message.mailboxIds names a mailbox of an account that filters.accountIds leaves out."
+});
+var webhooks = {
+  list: base.route({
+    method: "GET",
+    path: "/v1/webhooks",
+    tags: ["Webhooks"],
+    summary: "List webhook endpoints"
+  }).output(WebhookEndpointList),
+  create: base.route({
+    method: "POST",
+    path: "/v1/webhooks",
+    tags: ["Webhooks"],
+    summary: "Create a webhook endpoint",
+    description: "The signing secret is returned once.",
+    successStatus: 201
+  }).errors({
+    ...HTTPS_REQUIRED,
+    ...WEBHOOK_FILTER_ERRORS,
+    ...errors({
+      plan_limit_webhooks: "The tenant already has as many endpoints as its plan allows."
+    })
+  }).input(CreateWebhookEndpoint).output(WebhookEndpointWithSecret),
+  update: base.route({
+    method: "PATCH",
+    path: "/v1/webhooks/{endpointId}",
+    tags: ["Webhooks"],
+    summary: "Update a webhook endpoint",
+    description: "The mailbox check runs whenever filters.message.mailboxIds or filters.accountIds changes."
+  }).errors({ ...ENDPOINT_NOT_FOUND, ...HTTPS_REQUIRED, ...WEBHOOK_FILTER_ERRORS }).input(WebhookEndpointIdInput.extend(UpdateWebhookEndpoint.shape)).output(WebhookEndpoint),
+  delete: base.route({
+    method: "DELETE",
+    path: "/v1/webhooks/{endpointId}",
+    tags: ["Webhooks"],
+    summary: "Delete a webhook endpoint",
+    successStatus: 204
+  }).errors(ENDPOINT_NOT_FOUND).input(WebhookEndpointIdInput).output(z36.void()),
+  rotateSecret: base.route({
+    method: "POST",
+    path: "/v1/webhooks/{endpointId}/rotate-secret",
+    tags: ["Webhooks"],
+    summary: "Rotate the signing secret",
+    description: `Deliveries are signed with the new secret at once. For graceSeconds (default ${DEFAULT_WEBHOOK_SECRET_GRACE_SECONDS}, at most ${MAX_WEBHOOK_SECRET_GRACE_SECONDS}) they also carry a signature by the old one, in the same webhook-signature header, so receivers can switch secrets without refusing a delivery; 0 stops the old secret at once. A rotation during another's grace ends that grace: only the secret it replaces is kept.`
+  }).errors(ENDPOINT_NOT_FOUND).input(RotateWebhookSecretRequest.safeExtend(WebhookEndpointIdInput.shape)).output(WebhookSecret),
+  test: base.route({
+    method: "POST",
+    path: "/v1/webhooks/{endpointId}/test",
+    tags: ["Webhooks"],
+    summary: "Send a test event",
+    description: `Queues one event of eventType for delivery to this endpoint only, whatever its filters, signed like any other, with "isTest": true in its body; its attempts show in the delivery log. It carries the sample data for its type unless data is given, which must match the type's data. Test events are never in the change feed.`,
+    successStatus: 202
+  }).errors({
+    ...ENDPOINT_NOT_FOUND,
+    ...ENDPOINT_DISABLED,
+    ...errors({
+      unknown_account: "accountId names an account the tenant does not have; data.ids lists it."
+    })
+  }).input(SendTestEventRequest.safeExtend(WebhookEndpointIdInput.shape)).output(TestEventSent),
+  attempts: base.route({
+    method: "GET",
+    path: "/v1/webhooks/{endpointId}/attempts",
+    tags: ["Webhooks"],
+    summary: "Read the delivery log",
+    description: "Delivery attempts to this endpoint, newest first: of the last 500 within 7 days, those matching the filters. A cursor stays valid while its attempt is in the log."
+  }).errors({
+    ...ENDPOINT_NOT_FOUND,
+    ...INVALID_CURSOR,
+    ...errors({ invalid_range: "until is not after since." })
+  }).input(ListWebhookAttemptsInput).output(WebhookAttemptPage),
+  replay: base.route({
+    method: "POST",
+    path: "/v1/webhooks/{endpointId}/replay",
+    tags: ["Webhooks"],
+    summary: "Replay a time range",
+    description: `Queues every event in [since, until) that the endpoint would receive with its current filters again, with the same id and body as the first delivery and a fresh signature. Events the endpoint already has queued are not queued twice. Events past the tenant's eventRetentionDays cannot be replayed.`,
+    successStatus: 202
+  }).errors({
+    ...ENDPOINT_NOT_FOUND,
+    ...ENDPOINT_DISABLED,
+    ...errors({
+      invalid_range: "until is not after since.",
+      replay_range_too_large: `The range holds more than ${MAX_REPLAY_EVENTS} events.`
+    })
+  }).input(ReplayRangeRequest.safeExtend(WebhookEndpointIdInput.shape)).output(ReplayResult),
+  replayEvent: base.route({
+    method: "POST",
+    path: "/v1/webhooks/{endpointId}/events/{eventId}/replay",
+    tags: ["Webhooks"],
+    summary: "Replay one event",
+    description: `Queues the event again for this endpoint, whatever its filters, with the same id and body as the first delivery and a fresh signature; not twice if the endpoint already has it queued. Events past the tenant's eventRetentionDays cannot be replayed.`,
+    successStatus: 202
+  }).errors({
+    ...ENDPOINT_NOT_FOUND,
+    ...ENDPOINT_DISABLED,
+    ...errors({ event_not_found: "The event is unknown or no longer retained." })
+  }).input(ReplayEventInput).output(ReplayResult),
+  countFailed: base.route({
+    method: "GET",
+    path: "/v1/webhooks/{endpointId}/failed-deliveries/count",
+    tags: ["Webhooks"],
+    summary: "Count failed deliveries",
+    description: "How many events replay-failed would queue now: those the endpoint gave up on (retries exhausted, or given up when it was disabled) that are still retained and not queued again, optionally only those created in [since, until)."
+  }).errors({
+    ...ENDPOINT_NOT_FOUND,
+    ...errors({ invalid_range: "until is not after since." })
+  }).input(FailedDeliveriesQuery.safeExtend(WebhookEndpointIdInput.shape)).output(FailedDeliveryCount),
+  replayFailed: base.route({
+    method: "POST",
+    path: "/v1/webhooks/{endpointId}/replay-failed",
+    tags: ["Webhooks"],
+    summary: "Replay failed deliveries",
+    description: `Queues every event the endpoint gave up on again, once each, optionally only those created in [since, until), with the same id and body as the first delivery and a fresh signature. The failed deliveries are replaced by the replays (their attempts stay in the delivery log), so calling again does not send them twice. Events past the tenant's eventRetentionDays cannot be replayed.`,
+    successStatus: 202
+  }).errors({
+    ...ENDPOINT_NOT_FOUND,
+    ...ENDPOINT_DISABLED,
+    ...errors({
+      invalid_range: "until is not after since.",
+      replay_range_too_large: `More than ${MAX_REPLAY_EVENTS} events failed; replay a narrower range.`
+    })
+  }).input(FailedDeliveriesQuery.safeExtend(WebhookEndpointIdInput.shape)).output(ReplayResult)
+};
+
+// ../contract/src/router.ts
+var v1Contract = {
+  accounts,
+  mailboxes,
+  messages,
+  search,
+  threads,
+  drafts,
+  outbox,
+  mailMerges,
+  templates,
+  templateRenders,
+  suppressions,
+  suppressionReviews,
+  identities,
+  mailSettings,
+  calendars,
+  calendarEvents,
+  availability,
+  meetingConnections,
+  meetingConnectSessions,
+  meetingApps,
+  contacts,
+  contactFolders,
+  webhooks,
+  changes,
+  settings,
+  oauthApps,
+  connectSessions,
+  oauthAuthorizations,
+  orgConnections,
+  sharedMailboxes,
+  imapAccounts,
+  imapSettings,
+  autoconfig,
+  hostedConnectSessions,
+  hostedMeetingConnectSessions,
+  exports,
+  usage,
+  ai,
+  auditLog
+};
+
+// ../contract/src/webhooks/signing.ts
+var WEBHOOK_TOLERANCE_SECONDS = 300;
+var WEBHOOK_VERIFICATION_MESSAGES = {
+  missing_headers: "The webhook headers are missing",
+  timestamp: "The webhook timestamp is outside the tolerance",
+  signature: "No webhook signature matches the secret",
+  payload: "The webhook body is not a workwae event"
+};
+
+class WebhookVerificationError extends Error {
+  failure;
+  constructor(failure, message = WEBHOOK_VERIFICATION_MESSAGES[failure]) {
+    super(message);
+    this.failure = failure;
+    this.name = "WebhookVerificationError";
+  }
+}
+var encoder = new TextEncoder;
+function header(headers, name) {
+  if (headers instanceof Headers)
+    return headers.get(name);
+  for (const [key, value] of Object.entries(headers))
+    if (key.toLowerCase() === name)
+      return Array.isArray(value) ? value.join(" ") : value ?? null;
+  return null;
+}
+function fromBase64(text) {
+  try {
+    return Uint8Array.from(atob(text), (c) => c.charCodeAt(0));
+  } catch {
+    return null;
+  }
+}
+async function mac(secret, id, timestamp, body) {
+  const keyBytes = fromBase64(secret.startsWith(WEBHOOK_SECRET_PREFIX) ? secret.slice(WEBHOOK_SECRET_PREFIX.length) : secret);
+  if (!keyBytes || keyBytes.length === 0)
+    throw new TypeError("The webhook secret is not base64");
+  const key = await crypto.subtle.importKey("raw", keyBytes, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const prefix = encoder.encode(`${id}.${timestamp}.`);
+  const payload = typeof body === "string" ? encoder.encode(body) : new Uint8Array(body);
+  const signed = new Uint8Array(prefix.length + payload.length);
+  signed.set(prefix);
+  signed.set(payload, prefix.length);
+  return new Uint8Array(await crypto.subtle.sign("HMAC", key, signed));
+}
+function equalInConstantTime(a, b) {
+  let difference = 0;
+  for (let i = 0;i < a.length; i++)
+    difference |= (a[i] ?? 0) ^ (b[i] ?? 0);
+  return difference === 0;
+}
+async function checkWebhookSignature(secret, headers, body, options = {}) {
+  const id = header(headers, WEBHOOK_HEADERS.id);
+  const timestamp = header(headers, WEBHOOK_HEADERS.timestamp);
+  const signatures = header(headers, WEBHOOK_HEADERS.signature);
+  if (!id || !timestamp || !signatures)
+    return "missing_headers";
+  if (!/^[0-9]{1,15}$/.test(timestamp))
+    return "timestamp";
+  const nowSeconds = (options.now ?? new Date).getTime() / 1000;
+  const tolerance = options.toleranceSeconds ?? WEBHOOK_TOLERANCE_SECONDS;
+  if (Math.abs(nowSeconds - Number(timestamp)) > tolerance)
+    return "timestamp";
+  const expected = await mac(secret, id, timestamp, body);
+  for (const candidate of signatures.split(" ", MAX_SIGNATURE_CANDIDATES)) {
+    const [version, value] = candidate.split(",", 2);
+    if (version !== "v1" || !value)
+      continue;
+    const given = fromBase64(value);
+    if (given?.length === expected.length && equalInConstantTime(given, expected))
+      return null;
+  }
+  return "signature";
+}
+async function verifyWebhook(secret, headers, body, options = {}) {
+  return await checkWebhookSignature(secret, headers, body, options) === null;
+}
+// src/client.ts
+import { createORPCClient, ORPCError } from "@orpc/client";
+import { ResponseValidationPlugin } from "@orpc/contract/plugins";
+import { OpenAPILink } from "@orpc/openapi-client/fetch";
+var DEFAULT_BASE_URL = "https://api.workwae.com";
+function parseRetryAfter(value) {
+  if (value === null)
+    return null;
+  const trimmed = value.trim();
+  if (/^\d+(\.\d+)?$/.test(trimmed))
+    return Math.round(Number(trimmed) * 1000);
+  const at = Date.parse(trimmed);
+  return Number.isNaN(at) ? null : Math.max(0, at - Date.now());
+}
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(signal.reason);
+      return;
+    }
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signal?.reason);
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+var BACKOFF_START_MS = 500;
+var SEEN = Symbol("workwae.seen");
+function retrying(send, options = {}) {
+  const maxRetries = options.maxRetries ?? 2;
+  const maxDelayMs = options.maxDelayMs ?? 60000;
+  const wait = options.wait ?? sleep;
+  return async (request, init, { signal, context }) => {
+    if (request.method === "POST" && !request.headers.has("idempotency-key"))
+      request.headers.set("idempotency-key", crypto.randomUUID());
+    for (let attempt = 0;; attempt++) {
+      const last = attempt >= maxRetries;
+      const response = await send(last ? request : request.clone(), init);
+      const seen = context[SEEN];
+      if (seen)
+        seen.requestId = response.headers.get("x-request-id") ?? undefined;
+      if (last || response.status !== 429 && response.status !== 503)
+        return response;
+      const retryAfterMs = parseRetryAfter(response.headers.get("retry-after"));
+      if (retryAfterMs !== null && retryAfterMs > maxDelayMs)
+        return response;
+      await response.body?.cancel();
+      const backoff = BACKOFF_START_MS * 2 ** attempt * (0.5 + Math.random() / 2);
+      await wait(retryAfterMs ?? Math.min(backoff, maxDelayMs), signal);
+      signal?.throwIfAborted();
+    }
+  };
+}
+function createClient(options) {
+  const { apiKey } = options;
+  const link = new OpenAPILink(v1Contract, {
+    url: options.baseUrl ?? DEFAULT_BASE_URL,
+    headers: async ({ context }) => {
+      const key = typeof apiKey === "function" ? await apiKey() : apiKey;
+      return {
+        ...options.headers,
+        ...key && { authorization: `Bearer ${key}` },
+        ...context.idempotencyKey && { "idempotency-key": context.idempotencyKey }
+      };
+    },
+    fetch: retrying(options.fetch ?? ((request, init) => fetch(request, init)), options.retry),
+    interceptors: [
+      async ({ next, ...call }) => {
+        const seen = { requestId: undefined };
+        try {
+          return await next({ ...call, context: { ...call.context, [SEEN]: seen } });
+        } catch (error) {
+          if (error instanceof ORPCError)
+            error.requestId = seen.requestId;
+          throw error;
+        }
+      }
+    ],
+    clientInterceptors: [
+      async ({ next }) => {
+        const response = await next();
+        if (response.status >= 400) {
+          const read = response.body;
+          response.body = () => read().catch(() => {
+            return;
+          });
+        }
+        return response;
+      }
+    ],
+    plugins: [new ResponseValidationPlugin(v1Contract)]
+  });
+  return createORPCClient(link);
+}
+// src/errors.ts
+import { ORPCError as ORPCError2 } from "@orpc/client";
+import { isDefinedError, ORPCError as ORPCError3, safe } from "@orpc/client";
+function isApiError(error, reason) {
+  return error instanceof ORPCError2 && isErrorReason(error.code) && (reason === undefined || error.code === reason);
+}
+// src/pagination.ts
+function pages(list, input, options) {
+  return followCursor((cursor) => list({ ...input, cursor }, options), input.cursor, (page) => page.nextCursor ?? undefined);
+}
+async function* paginate(list, input, options) {
+  for await (const page of pages(list, input, options))
+    yield* page.items;
+}
+
+class ChangeFeed {
+  list;
+  input;
+  options;
+  #cursor;
+  constructor(list, input, options) {
+    this.list = list;
+    this.input = input;
+    this.options = options;
+    this.#cursor = input.cursor;
+  }
+  get cursor() {
+    return this.#cursor;
+  }
+  async* [Symbol.asyncIterator]() {
+    const feed = followCursor((cursor) => this.list({ ...this.input, cursor }, this.options), this.#cursor, (page) => page.items.length === 0 ? undefined : page.nextCursor);
+    for await (const page of feed) {
+      yield* page.items;
+      this.#cursor = page.nextCursor;
+    }
+  }
+}
+function changes2(list, input, options) {
+  return new ChangeFeed(list, input, options);
+}
+// src/webhooks.ts
+import * as z37 from "zod";
+var LaterEvent = z37.looseObject({
+  id: EventId,
+  type: z37.string(),
+  accountId: Id.nullable(),
+  createdAt: Timestamp,
+  data: z37.looseObject({}),
+  isTest: z37.literal(true).exactOptional()
+});
+async function parseWebhook(secret, headers, body, options = {}) {
+  const failure = await checkWebhookSignature(secret, headers, body, options);
+  if (failure)
+    throw new WebhookVerificationError(failure);
+  let json;
+  try {
+    json = JSON.parse(typeof body === "string" ? body : new TextDecoder().decode(body));
+  } catch {
+    throw new WebhookVerificationError("payload", "The webhook body is not JSON");
+  }
+  const type = typeof json === "object" && json !== null && "type" in json ? json.type : undefined;
+  if (EventType.safeParse(type).success) {
+    const parsed = Event.safeParse(json);
+    if (parsed.success)
+      return { ...json, ...parsed.data, known: true };
+  } else {
+    const later = LaterEvent.safeParse(json);
+    if (later.success)
+      return { ...later.data, known: false };
+  }
+  throw new WebhookVerificationError("payload");
+}
+export {
+  ChangeFeed,
+  EVENT_TYPES,
+  MAX_SIGNATURE_CANDIDATES,
+  MAX_TEMPLATE_BODY_LENGTH,
+  MAX_TEMPLATE_DESCRIPTION_LENGTH,
+  MAX_TEMPLATE_NAME_LENGTH,
+  MAX_TEMPLATE_PREVIEW_TEXT_LENGTH,
+  MAX_TEMPLATE_SUBJECT_LENGTH,
+  ORPCError3 as ORPCError,
+  WEBHOOK_TOLERANCE_SECONDS,
+  WebhookVerificationError,
+  changes2 as changes,
+  checkWebhookSignature,
+  createClient,
+  isApiError,
+  isDefinedError,
+  pages,
+  paginate,
+  parseWebhook,
+  safe,
+  verifyWebhook
+};
+
+//# debugId=2876276784BC8B1464756E2164756E21
+//# sourceMappingURL=index.js.map