agentmail 0.5.45 → 0.5.47

package/dist/cjs/BaseClient.js

@@ -43,8 +43,8 @@ function normalizeClientOptions(options) {
     const headers = (0, headers_js_1.mergeHeaders)({
         "X-Fern-Language": "JavaScript",
         "X-Fern-SDK-Name": "agentmail",
-        "X-Fern-SDK-Version": "0.5.45",
-        "User-Agent": "agentmail/0.5.45",
+        "X-Fern-SDK-Version": "0.5.47",
+        "User-Agent": "agentmail/0.5.47",
         "X-Fern-Runtime": core.RUNTIME.type,
         "X-Fern-Runtime-Version": core.RUNTIME.version,
     }, options === null || options === void 0 ? void 0 : options.headers);

package/dist/cjs/api/resources/agent/client/Client.d.ts

@@ -15,6 +15,8 @@ export declare class AgentClient {
      *
      * A 6-digit OTP is sent to the human's email for verification.
      *
+     * The new organization starts with 1 inbox, no custom domains, and 10 emails per day, which can be sent only to `human_email` until the organization is verified.
+     *
      * `human_email` is optional. Without it, the inbox can receive email but cannot send to anyone until a human is attached with the attach human endpoint or, for a US-region inbox, claims it in the AgentMail Console with the API key (see [How do I claim my agent's inbox?](https://docs.agentmail.to/knowledge-base/claiming-agent-inbox)). There is also no way to recover the API key, so store it durably. Calling sign-up again without `human_email` creates a new organization, which needs a different `username`: the original username stays with the lost organization's inbox.
      *
      * This endpoint is idempotent. Calling it again with the same `human_email` will rotate the API key and resend the OTP if expired.
@@ -70,7 +72,7 @@ export declare class AgentClient {
     /**
      * Verify an agent organization using the 6-digit OTP sent to the human's email during sign-up.
      *
-     * On success, the organization is upgraded from `agent_unverified` to `agent_verified`, the send allowlist is removed, and free plan entitlements are applied.
+     * On success, the organization is upgraded from `agent_unverified` to `agent_verified`, the send allowlist is removed, and the Free plan's entitlements are applied: 3 inboxes and 100 emails per day, at first to at most 3 distinct recipients in the first hour, 5 in the first day, and 10 in the first week.
      *
      * The OTP expires after 24 hours and allows a maximum of 10 attempts. If the OTP expired, call the attach human endpoint with the same `human_email` to get a new one without rotating the API key. Once all 10 attempts are used, even the correct OTP is rejected, and attach human keeps returning the same OTP until it expires, so wait for it to expire before asking for a new one. An organization that signed up without a `human_email` has no OTP until a human is attached. If you run into any difficulties receiving the OTP code, you can also create an account on [console.agentmail.to](https://console.agentmail.to) using the human email address you provided to verify your account.
      *

package/dist/cjs/api/resources/agent/client/Client.js

@@ -61,6 +61,8 @@ class AgentClient {
      *
      * A 6-digit OTP is sent to the human's email for verification.
      *
+     * The new organization starts with 1 inbox, no custom domains, and 10 emails per day, which can be sent only to `human_email` until the organization is verified.
+     *
      * `human_email` is optional. Without it, the inbox can receive email but cannot send to anyone until a human is attached with the attach human endpoint or, for a US-region inbox, claims it in the AgentMail Console with the API key (see [How do I claim my agent's inbox?](https://docs.agentmail.to/knowledge-base/claiming-agent-inbox)). There is also no way to recover the API key, so store it durably. Calling sign-up again without `human_email` creates a new organization, which needs a different `username`: the original username stays with the lost organization's inbox.
      *
      * This endpoint is idempotent. Calling it again with the same `human_email` will rotate the API key and resend the OTP if expired.
@@ -237,7 +239,7 @@ class AgentClient {
     /**
      * Verify an agent organization using the 6-digit OTP sent to the human's email during sign-up.
      *
-     * On success, the organization is upgraded from `agent_unverified` to `agent_verified`, the send allowlist is removed, and free plan entitlements are applied.
+     * On success, the organization is upgraded from `agent_unverified` to `agent_verified`, the send allowlist is removed, and the Free plan's entitlements are applied: 3 inboxes and 100 emails per day, at first to at most 3 distinct recipients in the first hour, 5 in the first day, and 10 in the first week.
      *
      * The OTP expires after 24 hours and allows a maximum of 10 attempts. If the OTP expired, call the attach human endpoint with the same `human_email` to get a new one without rotating the API key. Once all 10 attempts are used, even the correct OTP is rejected, and attach human keeps returning the same OTP until it expires, so wait for it to expire before asking for a new one. An organization that signed up without a `human_email` has no OTP until a human is attached. If you run into any difficulties receiving the OTP code, you can also create an account on [console.agentmail.to](https://console.agentmail.to) using the human email address you provided to verify your account.
      *

package/dist/cjs/api/resources/agentArmor/types/AgentArmorCompleteResult.d.ts

@@ -7,4 +7,6 @@ export interface AgentArmorCompleteResult {
     model: string;
     /** When the scan finished. */
     completedAt: Date;
+    /** Present on a `review` held in hold mode that someone released. */
+    manualOverride?: AgentMail.AgentArmorManualOverride;
 }

package/dist/cjs/api/resources/agentArmor/types/AgentArmorCompletedEventResult.d.ts

@@ -1,6 +1,6 @@
 import type * as AgentMail from "../../../index.js";
 /**
- * The result in a `message.security.completed` event, which is always `complete`.
+ * The result in a `message.security.completed` or `message.security.review` event, which is always `complete`.
  */
 export interface AgentArmorCompletedEventResult extends AgentMail.AgentArmorCompleteResult {
     status: "complete";

package/dist/cjs/api/resources/agentArmor/types/AgentArmorManualOverride.d.ts

@@ -0,0 +1,15 @@
+import type * as AgentMail from "../../../index.js";
+/**
+ * The record of a release of a message Agent Armor held for review.
+ */
+export interface AgentArmorManualOverride {
+    /** ID of the release, and the `event_id` of its `message.security.override` event. */
+    overrideId: string;
+    actor: AgentMail.AgentArmorReleaseActor;
+    /** Why it was released, as given by whoever released it. */
+    reason: string;
+    /** The verdict that held the message. */
+    originalVerdict: "review";
+    /** When it was released. */
+    releasedAt: Date;
+}

package/dist/cjs/api/resources/agentArmor/types/AgentArmorManualOverride.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/agentArmor/types/AgentArmorReleaseActor.d.ts

@@ -0,0 +1,13 @@
+import type * as AgentMail from "../../../index.js";
+/**
+ * Who released the message.
+ */
+export type AgentArmorReleaseActor = AgentMail.AgentArmorReleaseActor.ApiKey | AgentMail.AgentArmorReleaseActor.Console;
+export declare namespace AgentArmorReleaseActor {
+    interface ApiKey extends AgentMail.AgentArmorReleaseApiKeyActor {
+        kind: "api_key";
+    }
+    interface Console extends AgentMail.AgentArmorReleaseConsoleActor {
+        kind: "console";
+    }
+}

package/dist/cjs/api/resources/agentArmor/types/AgentArmorReleaseActor.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/agentArmor/types/AgentArmorReleaseApiKeyActor.d.ts

@@ -0,0 +1,4 @@
+export interface AgentArmorReleaseApiKeyActor {
+    /** The API key that released it. */
+    apiKeyId: string;
+}

package/dist/cjs/api/resources/agentArmor/types/AgentArmorReleaseApiKeyActor.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/agentArmor/types/AgentArmorReleaseConsoleActor.d.ts

@@ -0,0 +1 @@
+export type AgentArmorReleaseConsoleActor = {};

package/dist/cjs/api/resources/agentArmor/types/AgentArmorReleaseConsoleActor.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/agentArmor/types/ReleaseAgentArmorMessageRequest.d.ts

@@ -0,0 +1,4 @@
+export interface ReleaseAgentArmorMessageRequest {
+    /** Why the message is safe to release, up to 2,048 characters and not blank. Recorded on the message. */
+    reason: string;
+}

package/dist/cjs/api/resources/agentArmor/types/ReleaseAgentArmorMessageRequest.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/agentArmor/types/ReleaseAgentArmorMessageResponse.d.ts

@@ -0,0 +1,4 @@
+import type * as AgentMail from "../../../index.js";
+export interface ReleaseAgentArmorMessageResponse {
+    manualOverride: AgentMail.AgentArmorManualOverride;
+}

package/dist/cjs/api/resources/agentArmor/types/ReleaseAgentArmorMessageResponse.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/agentArmor/types/index.d.ts

@@ -5,9 +5,15 @@ export * from "./AgentArmorFeedbackActor.js";
 export * from "./AgentArmorFeedbackApiKeyActor.js";
 export * from "./AgentArmorFeedbackConsoleActor.js";
 export * from "./AgentArmorFeedbackValue.js";
+export * from "./AgentArmorManualOverride.js";
 export * from "./AgentArmorPendingResult.js";
+export * from "./AgentArmorReleaseActor.js";
+export * from "./AgentArmorReleaseApiKeyActor.js";
+export * from "./AgentArmorReleaseConsoleActor.js";
 export * from "./AgentArmorResult.js";
 export * from "./AgentArmorUnavailableReason.js";
 export * from "./AgentArmorUnavailableResult.js";
 export * from "./AgentArmorVerdict.js";
 export * from "./CreateAgentArmorFeedbackRequest.js";
+export * from "./ReleaseAgentArmorMessageRequest.js";
+export * from "./ReleaseAgentArmorMessageResponse.js";

package/dist/cjs/api/resources/agentArmor/types/index.js

@@ -21,9 +21,15 @@ __exportStar(require("./AgentArmorFeedbackActor.js"), exports);
 __exportStar(require("./AgentArmorFeedbackApiKeyActor.js"), exports);
 __exportStar(require("./AgentArmorFeedbackConsoleActor.js"), exports);
 __exportStar(require("./AgentArmorFeedbackValue.js"), exports);
+__exportStar(require("./AgentArmorManualOverride.js"), exports);
 __exportStar(require("./AgentArmorPendingResult.js"), exports);
+__exportStar(require("./AgentArmorReleaseActor.js"), exports);
+__exportStar(require("./AgentArmorReleaseApiKeyActor.js"), exports);
+__exportStar(require("./AgentArmorReleaseConsoleActor.js"), exports);
 __exportStar(require("./AgentArmorResult.js"), exports);
 __exportStar(require("./AgentArmorUnavailableReason.js"), exports);
 __exportStar(require("./AgentArmorUnavailableResult.js"), exports);
 __exportStar(require("./AgentArmorVerdict.js"), exports);
 __exportStar(require("./CreateAgentArmorFeedbackRequest.js"), exports);
+__exportStar(require("./ReleaseAgentArmorMessageRequest.js"), exports);
+__exportStar(require("./ReleaseAgentArmorMessageResponse.js"), exports);

package/dist/cjs/api/resources/apiKeys/types/ApiKeyPermissions.d.ts

@@ -20,6 +20,11 @@ export interface ApiKeyPermissions {
     messageUpdate?: boolean;
     /** Delete messages. Also required to delete threads. */
     messageDelete?: boolean;
+    /**
+     * Release mail Agent Armor holds for review. Opt-in: no key has it unless it was granted explicitly, even one
+     * without a `permissions` object. See [Permissions](/permissions#agent-armor).
+     */
+    agentArmorRelease?: boolean;
     /** Access messages labeled spam. */
     labelSpamRead?: boolean;
     /** Access messages labeled blocked. */
@@ -105,4 +110,12 @@ export interface ApiKeyPermissions {
     calendarEventUpdate?: boolean;
     /** Delete calendar events. */
     calendarEventDelete?: boolean;
+    /** Reserved; not released yet. */
+    fileRead?: boolean;
+    /** Reserved; not released yet. */
+    fileCreate?: boolean;
+    /** Reserved; not released yet. */
+    fileUpdate?: boolean;
+    /** Reserved; not released yet. */
+    fileDelete?: boolean;
 }

package/dist/cjs/api/resources/calendar/types/IanaTimezone.d.ts

@@ -1,6 +1,8 @@
 /**
- * Canonical IANA time zone name, for example `America/New_York`, `Europe/London` or `UTC`.
- * Abbreviations such as `PST`, Windows names such as `Pacific Standard Time`, and spellings that
- * differ from the canonical name are rejected.
+ * IANA time zone name, for example `America/New_York`, `Europe/London` or `UTC`. Requests accept
+ * any capitalization and IANA aliases such as `US/Eastern`. The calendar stores and returns the
+ * canonical name, which for some zones is an older spelling: `Asia/Kolkata` is returned as
+ * `Asia/Calcutta`. Abbreviations such as `PST` and Windows names such as `Pacific Standard Time`
+ * are rejected.
  */
 export type IanaTimezone = string;

package/dist/cjs/api/resources/domains/types/Domain.d.ts

@@ -4,17 +4,24 @@ export interface Domain {
     domainId: AgentMail.DomainId;
     domain: AgentMail.DomainName;
     status: AgentMail.Status;
-    /** Why the domain is not (yet) VERIFIED, when known. `dns_records_missing` / `dns_records_invalid` point at the DNS records. The `ses_*` values mean the records look right and sending-infrastructure validation has not converged: `ses_dkim_pending` / `ses_mail_from_pending` (still checking), `ses_dkim_temporary_failure` / `ses_mail_from_temporary_failure` (a transient error the infrastructure keeps retrying on its own — usually resolves without changes), `ses_dkim_failed` / `ses_mail_from_failed` (a terminal verdict; re-verify after fixing), `ses_dkim_not_started` / `ses_mail_from_not_started` (the attribute was never configured on the identity — re-verify to push it), and `ses_not_verified_for_sending`. Absent when VERIFIED. */
+    /** Why the domain is not (yet) VERIFIED, when known. `dns_records_missing` / `dns_records_invalid` point at the DNS records. The `ses_*` values mean the records look right and sending-infrastructure validation has not converged: `ses_dkim_pending` / `ses_mail_from_pending` (still checking), `ses_dkim_temporary_failure` / `ses_mail_from_temporary_failure` (a transient error the infrastructure keeps retrying on its own — usually resolves without changes), `ses_dkim_failed` / `ses_mail_from_failed` (a terminal verdict; re-verify after fixing), `ses_dkim_not_started` / `ses_mail_from_not_started` (the attribute was never configured on the identity — re-verify to push it), `ses_not_verified_for_sending`, and `tracking_certificate_failed` (the certificate for the open tracking `link.` subdomain was refused; fix CAA or DNS, then turn tracking off and back on). Absent when VERIFIED. */
     reason?: string;
     feedbackEnabled: AgentMail.FeedbackEnabled;
     /** Absent on domains created before this field existed; those receive email. */
     inboundEnabled?: AgentMail.InboundEnabled;
     subdomainsEnabled: AgentMail.SubdomainsEnabled;
     trackingEnabled: AgentMail.TrackingEnabled;
+    /** Present when `tracking_enabled` is true. */
+    trackingStatus?: AgentMail.TrackingStatus;
+    /** Why open tracking is not (yet) VERIFIED, when known. `dns_records_missing` / `dns_records_invalid` point at the `link.<domain>` CNAME. `caa_blocked` means the domain's CAA records leave Amazon out: add the `CAA` record listed in `records`, and AgentMail retries the certificate on its own within a few minutes. `certificate_failed` means the certificate was refused; fix the DNS, then turn tracking off and back on. Absent when `tracking_status` is VERIFIED. */
+    trackingReason?: string;
     /**
-     * A list of DNS records required to verify the domain. Includes the apex
-     * MX record unless `inbound_enabled` is false, and a wildcard MX record
-     * (`*.<domain>`) when `subdomains_enabled` is true.
+     * A list of DNS records for the domain. Includes the apex MX record unless
+     * `inbound_enabled` is false, and a wildcard MX record (`*.<domain>`) when
+     * `subdomains_enabled` is true. When `tracking_enabled` is true it also lists
+     * the `link.<domain>` CNAME and, if the domain's CAA records restrict
+     * issuance, a `CAA` record. Those two are for open tracking only: they
+     * feed `tracking_status` and do not affect `status`.
      */
     records: AgentMail.VerificationRecord[];
     clientId?: AgentMail.ClientId;

package/dist/cjs/api/resources/domains/types/RecordType.d.ts

@@ -2,5 +2,6 @@ export declare const RecordType: {
     readonly Txt: "TXT";
     readonly Cname: "CNAME";
     readonly Mx: "MX";
+    readonly Caa: "CAA";
 };
 export type RecordType = (typeof RecordType)[keyof typeof RecordType];

package/dist/cjs/api/resources/domains/types/RecordType.js

@@ -6,4 +6,5 @@ exports.RecordType = {
     Txt: "TXT",
     Cname: "CNAME",
     Mx: "MX",
+    Caa: "CAA",
 };

package/dist/cjs/api/resources/domains/types/TrackingEnabled.d.ts

@@ -1,6 +1,7 @@
 /**
- * Serve open tracking pixels from this domain. Adds a required `link.<domain>`
- * CNAME record to `records`, which must be published and verified before
- * `track_opens` can be used on a send.
+ * Serve open tracking pixels from this domain. Adds a `link.<domain>` CNAME
+ * record to `records`. Open tracking reports its readiness in `tracking_status`
+ * and never changes the domain's `status`. Sends with `track_opens` are accepted
+ * once `tracking_status` is `VERIFIED`.
  */
 export type TrackingEnabled = boolean;

package/dist/cjs/api/resources/domains/types/TrackingStatus.d.ts

@@ -0,0 +1,10 @@
+import type * as AgentMail from "../../../index.js";
+/**
+ * Whether open tracking is ready on this domain, independent of the domain's
+ * `status`. `PENDING`: the `link.<domain>` CNAME is not published yet.
+ * `INVALID`: the CNAME is wrong, or the domain's CAA records do not allow
+ * Amazon to issue its certificate. `VERIFYING`: the certificate is being
+ * issued. `VERIFIED`: `track_opens` can be used. `FAILED`: the certificate was
+ * refused; turn tracking off and back on to request a new one.
+ */
+export type TrackingStatus = AgentMail.VerificationStatus;

package/dist/cjs/api/resources/domains/types/TrackingStatus.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/domains/types/UpdateDomainRequest.d.ts

@@ -5,7 +5,8 @@ import type * as AgentMail from "../../../index.js";
  * unchanged; an empty body is rejected. Enabling `inbound_enabled` or
  * `subdomains_enabled` on a verified domain returns it to `PENDING` until the
  * newly required MX record (the apex MX, or the wildcard `*.<domain>`) is
- * published and verified.
+ * published and verified. Enabling `tracking_enabled` leaves `status` as it is
+ * and starts `tracking_status` at `PENDING`.
  */
 export interface UpdateDomainRequest {
     feedbackEnabled?: AgentMail.FeedbackEnabled;

package/dist/cjs/api/resources/domains/types/VerificationRecord.d.ts

@@ -1,6 +1,6 @@
 import type * as AgentMail from "../../../index.js";
 export interface VerificationRecord {
-    /** The type of the DNS record. */
+    /** The type of the DNS record. A `CAA` record is listed only when open tracking is on and the domain's CAA records restrict which certificate authorities may issue for it: add it next to the existing CAA records, not in place of them. */
     type: AgentMail.RecordType;
     /** The name or host of the record. */
     name: string;

package/dist/cjs/api/resources/domains/types/index.d.ts

@@ -13,6 +13,7 @@ export * from "./RecordType.js";
 export * from "./Status.js";
 export * from "./SubdomainsEnabled.js";
 export * from "./TrackingEnabled.js";
+export * from "./TrackingStatus.js";
 export * from "./UpdateDomainRequest.js";
 export * from "./VerificationRecord.js";
 export * from "./VerificationStatus.js";

package/dist/cjs/api/resources/domains/types/index.js

@@ -29,6 +29,7 @@ __exportStar(require("./RecordType.js"), exports);
 __exportStar(require("./Status.js"), exports);
 __exportStar(require("./SubdomainsEnabled.js"), exports);
 __exportStar(require("./TrackingEnabled.js"), exports);
+__exportStar(require("./TrackingStatus.js"), exports);
 __exportStar(require("./UpdateDomainRequest.js"), exports);
 __exportStar(require("./VerificationRecord.js"), exports);
 __exportStar(require("./VerificationStatus.js"), exports);

package/dist/cjs/api/resources/events/types/EventId.d.ts

@@ -1,4 +1,6 @@
 /**
- * ID of event.
+ * ID of the event. It is the same on every retry and redelivery of the event and on every webhook
+ * or WebSocket subscription that receives it, so use it to deduplicate. The format varies by event
+ * type; treat it as an opaque string.
  */
 export type EventId = string;

package/dist/cjs/api/resources/events/types/EventType.d.ts

@@ -4,6 +4,8 @@ export declare const EventType: {
     readonly MessageReceivedBlocked: "message.received.blocked";
     readonly MessageReceivedUnauthenticated: "message.received.unauthenticated";
     readonly MessageSecurityCompleted: "message.security.completed";
+    readonly MessageSecurityReview: "message.security.review";
+    readonly MessageSecurityOverride: "message.security.override";
     readonly MessageSent: "message.sent";
     readonly MessageDelivered: "message.delivered";
     readonly MessageBounced: "message.bounced";

package/dist/cjs/api/resources/events/types/EventType.js

@@ -8,6 +8,8 @@ exports.EventType = {
     MessageReceivedBlocked: "message.received.blocked",
     MessageReceivedUnauthenticated: "message.received.unauthenticated",
     MessageSecurityCompleted: "message.security.completed",
+    MessageSecurityReview: "message.security.review",
+    MessageSecurityOverride: "message.security.override",
     MessageSent: "message.sent",
     MessageDelivered: "message.delivered",
     MessageBounced: "message.bounced",

package/dist/cjs/api/resources/events/types/InboxIds.d.ts

@@ -1,4 +1,4 @@
 /**
- * Inboxes for which to send events. Maximum 10 per webhook.
+ * Inboxes for which to send events.
  */
 export type InboxIds = string[];

package/dist/cjs/api/resources/events/types/MessageReceivedEvent.d.ts

@@ -6,6 +6,6 @@ export interface MessageReceivedEvent {
     type: "event";
     eventType: AgentMail.MessageReceivedEventType;
     eventId: AgentMail.EventId;
-    message: AgentMail.Message;
+    message: AgentMail.ReceivedMessage;
     thread: AgentMail.ThreadItem;
 }

package/dist/cjs/api/resources/events/types/MessageSecurityCompletedEvent.d.ts

@@ -1,8 +1,9 @@
 import type * as AgentMail from "../../../index.js";
 /**
- * Agent Armor reached a verdict on a received message. Sent only for `complete` results: an `unavailable` result
- * sends no event. Sent once per message and inbox; `event_id` is stable, so use it to deduplicate. Not sent for
- * messages labeled `spam`, `blocked`, `unauthenticated`, or `trash`: read those through the API.
+ * Agent Armor reached a verdict on a received message. Sent only in monitor mode, and only for `complete` results:
+ * an `unavailable` result sends no event. Sent once per message and inbox; `event_id` is stable, so use it to
+ * deduplicate. Not sent for messages labeled `spam`, `blocked`, `unauthenticated`, or `trash`: read those through
+ * the API.
  */
 export interface MessageSecurityCompletedEvent {
     type: "event";

package/dist/cjs/api/resources/events/types/MessageSecurityOverride.d.ts

@@ -0,0 +1,10 @@
+import type * as AgentMail from "../../../index.js";
+/**
+ * The message someone released, and the record of the release. Fetch the message for its content.
+ */
+export interface MessageSecurityOverride {
+    organizationId: AgentMail.OrganizationId;
+    inboxId: AgentMail.inboxes.InboxId;
+    messageId: AgentMail.MessageId;
+    manualOverride: AgentMail.AgentArmorManualOverride;
+}

package/dist/cjs/api/resources/events/types/MessageSecurityOverride.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/events/types/MessageSecurityOverrideEvent.d.ts

@@ -0,0 +1,13 @@
+import type * as AgentMail from "../../../index.js";
+/**
+ * Someone released a message Agent Armor held for review. Its `message.received` is sent to your agents as well,
+ * and the two can arrive in either order.
+ * Sent once per message and inbox; `event_id` is stable. Not sent for messages labeled `spam`, `blocked`,
+ * `unauthenticated`, or `trash`.
+ */
+export interface MessageSecurityOverrideEvent {
+    type: "event";
+    eventType: "message.security.override";
+    eventId: AgentMail.EventId;
+    message: AgentMail.MessageSecurityOverride;
+}

package/dist/cjs/api/resources/events/types/MessageSecurityOverrideEvent.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/events/types/MessageSecurityReviewEvent.d.ts

@@ -0,0 +1,13 @@
+import type * as AgentMail from "../../../index.js";
+/**
+ * In hold mode, Agent Armor held a received message for review: your agents are not sent its `message.received`
+ * until someone releases it. The message carries the `agent-armor-held` label until then. Sent once per message and
+ * inbox; `event_id` is stable. Not sent for messages labeled `spam`, `blocked`, `unauthenticated`, or `trash`: list
+ * held mail by the `agent-armor-held` label instead.
+ */
+export interface MessageSecurityReviewEvent {
+    type: "event";
+    eventType: "message.security.review";
+    eventId: AgentMail.EventId;
+    message: AgentMail.MessageSecurity;
+}

package/dist/cjs/api/resources/events/types/MessageSecurityReviewEvent.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/events/types/PodIds.d.ts

@@ -1,4 +1,4 @@
 /**
- * Pods for which to send events. Maximum 10 per webhook.
+ * Pods for which to send events.
  */
 export type PodIds = string[];

package/dist/cjs/api/resources/events/types/ReceivedMessage.d.ts

@@ -0,0 +1,18 @@
+import type * as AgentMail from "../../../index.js";
+/**
+ * The received message. The body (`text`, `html`, `extracted_text`, and `extracted_html`) is included
+ * inline only when it is small enough. Webhooks omit it when the stored body is larger than 64 KiB;
+ * WebSocket events also omit it when the serialized event would be larger than 30 KiB. When the body
+ * is omitted, `body_url` and `body_expires_at` are set instead.
+ */
+export interface ReceivedMessage extends AgentMail.Message {
+    /**
+     * Pre-signed URL that downloads the stored body as a JSON object including `text`, `html`,
+     * `extracted_text`, and `extracted_html`. Present only when the body is omitted from the event.
+     * Valid until `body_expires_at`, one hour after the event was built. The body stays available
+     * through the get message endpoint after the URL expires.
+     */
+    bodyUrl?: string;
+    /** Time at which `body_url` expires. Present only with `body_url`. */
+    bodyExpiresAt?: Date;
+}

package/dist/cjs/api/resources/events/types/ReceivedMessage.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/events/types/index.d.ts

@@ -22,9 +22,13 @@ export * from "./MessageReceivedEventType.js";
 export * from "./MessageRejectedEvent.js";
 export * from "./MessageSecurity.js";
 export * from "./MessageSecurityCompletedEvent.js";
+export * from "./MessageSecurityOverride.js";
+export * from "./MessageSecurityOverrideEvent.js";
+export * from "./MessageSecurityReviewEvent.js";
 export * from "./MessageSentEvent.js";
 export * from "./Open.js";
 export * from "./PodIds.js";
+export * from "./ReceivedMessage.js";
 export * from "./Recipient.js";
 export * from "./Reject.js";
 export * from "./Send.js";

package/dist/cjs/api/resources/events/types/index.js

@@ -38,9 +38,13 @@ __exportStar(require("./MessageReceivedEventType.js"), exports);
 __exportStar(require("./MessageRejectedEvent.js"), exports);
 __exportStar(require("./MessageSecurity.js"), exports);
 __exportStar(require("./MessageSecurityCompletedEvent.js"), exports);
+__exportStar(require("./MessageSecurityOverride.js"), exports);
+__exportStar(require("./MessageSecurityOverrideEvent.js"), exports);
+__exportStar(require("./MessageSecurityReviewEvent.js"), exports);
 __exportStar(require("./MessageSentEvent.js"), exports);
 __exportStar(require("./Open.js"), exports);
 __exportStar(require("./PodIds.js"), exports);
+__exportStar(require("./ReceivedMessage.js"), exports);
 __exportStar(require("./Recipient.js"), exports);
 __exportStar(require("./Reject.js"), exports);
 __exportStar(require("./Send.js"), exports);

package/dist/cjs/api/resources/files/errors/FileForbiddenError.d.ts

@@ -0,0 +1,6 @@
+import type * as core from "../../../../core/index.js";
+import * as errors from "../../../../errors/index.js";
+import type * as AgentMail from "../../../index.js";
+export declare class FileForbiddenError extends errors.AgentMailError {
+    constructor(body: AgentMail.ErrorResponse, rawResponse?: core.RawResponse);
+}

package/dist/cjs/api/resources/files/errors/FileForbiddenError.js

@@ -0,0 +1,54 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileForbiddenError = void 0;
+const errors = __importStar(require("../../../../errors/index.js"));
+class FileForbiddenError extends errors.AgentMailError {
+    constructor(body, rawResponse) {
+        super({
+            message: "FileForbiddenError",
+            statusCode: 403,
+            body: body,
+            rawResponse: rawResponse,
+        });
+        Object.setPrototypeOf(this, new.target.prototype);
+        if (Error.captureStackTrace) {
+            Error.captureStackTrace(this, this.constructor);
+        }
+        this.name = this.constructor.name;
+    }
+}
+exports.FileForbiddenError = FileForbiddenError;

package/dist/cjs/api/resources/files/errors/index.d.ts

@@ -0,0 +1 @@
+export * from "./FileForbiddenError.js";

package/dist/cjs/api/resources/files/errors/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./FileForbiddenError.js"), exports);

package/dist/cjs/api/resources/files/exports.d.ts

@@ -0,0 +1 @@
+export * from "./index.js";