agentmail 0.5.46 → 0.5.47

package/dist/cjs/BaseClient.js

@@ -43,8 +43,8 @@ function normalizeClientOptions(options) {
     const headers = (0, headers_js_1.mergeHeaders)({
         "X-Fern-Language": "JavaScript",
         "X-Fern-SDK-Name": "agentmail",
-        "X-Fern-SDK-Version": "0.5.46",
-        "User-Agent": "agentmail/0.5.46",
+        "X-Fern-SDK-Version": "0.5.47",
+        "User-Agent": "agentmail/0.5.47",
         "X-Fern-Runtime": core.RUNTIME.type,
         "X-Fern-Runtime-Version": core.RUNTIME.version,
     }, options === null || options === void 0 ? void 0 : options.headers);

package/dist/cjs/api/resources/agent/client/Client.d.ts

@@ -15,6 +15,8 @@ export declare class AgentClient {
      *
      * A 6-digit OTP is sent to the human's email for verification.
      *
+     * The new organization starts with 1 inbox, no custom domains, and 10 emails per day, which can be sent only to `human_email` until the organization is verified.
+     *
      * `human_email` is optional. Without it, the inbox can receive email but cannot send to anyone until a human is attached with the attach human endpoint or, for a US-region inbox, claims it in the AgentMail Console with the API key (see [How do I claim my agent's inbox?](https://docs.agentmail.to/knowledge-base/claiming-agent-inbox)). There is also no way to recover the API key, so store it durably. Calling sign-up again without `human_email` creates a new organization, which needs a different `username`: the original username stays with the lost organization's inbox.
      *
      * This endpoint is idempotent. Calling it again with the same `human_email` will rotate the API key and resend the OTP if expired.
@@ -70,7 +72,7 @@ export declare class AgentClient {
     /**
      * Verify an agent organization using the 6-digit OTP sent to the human's email during sign-up.
      *
-     * On success, the organization is upgraded from `agent_unverified` to `agent_verified`, the send allowlist is removed, and free plan entitlements are applied.
+     * On success, the organization is upgraded from `agent_unverified` to `agent_verified`, the send allowlist is removed, and the Free plan's entitlements are applied: 3 inboxes and 100 emails per day, at first to at most 3 distinct recipients in the first hour, 5 in the first day, and 10 in the first week.
      *
      * The OTP expires after 24 hours and allows a maximum of 10 attempts. If the OTP expired, call the attach human endpoint with the same `human_email` to get a new one without rotating the API key. Once all 10 attempts are used, even the correct OTP is rejected, and attach human keeps returning the same OTP until it expires, so wait for it to expire before asking for a new one. An organization that signed up without a `human_email` has no OTP until a human is attached. If you run into any difficulties receiving the OTP code, you can also create an account on [console.agentmail.to](https://console.agentmail.to) using the human email address you provided to verify your account.
      *

package/dist/cjs/api/resources/agent/client/Client.js

@@ -61,6 +61,8 @@ class AgentClient {
      *
      * A 6-digit OTP is sent to the human's email for verification.
      *
+     * The new organization starts with 1 inbox, no custom domains, and 10 emails per day, which can be sent only to `human_email` until the organization is verified.
+     *
      * `human_email` is optional. Without it, the inbox can receive email but cannot send to anyone until a human is attached with the attach human endpoint or, for a US-region inbox, claims it in the AgentMail Console with the API key (see [How do I claim my agent's inbox?](https://docs.agentmail.to/knowledge-base/claiming-agent-inbox)). There is also no way to recover the API key, so store it durably. Calling sign-up again without `human_email` creates a new organization, which needs a different `username`: the original username stays with the lost organization's inbox.
      *
      * This endpoint is idempotent. Calling it again with the same `human_email` will rotate the API key and resend the OTP if expired.
@@ -237,7 +239,7 @@ class AgentClient {
     /**
      * Verify an agent organization using the 6-digit OTP sent to the human's email during sign-up.
      *
-     * On success, the organization is upgraded from `agent_unverified` to `agent_verified`, the send allowlist is removed, and free plan entitlements are applied.
+     * On success, the organization is upgraded from `agent_unverified` to `agent_verified`, the send allowlist is removed, and the Free plan's entitlements are applied: 3 inboxes and 100 emails per day, at first to at most 3 distinct recipients in the first hour, 5 in the first day, and 10 in the first week.
      *
      * The OTP expires after 24 hours and allows a maximum of 10 attempts. If the OTP expired, call the attach human endpoint with the same `human_email` to get a new one without rotating the API key. Once all 10 attempts are used, even the correct OTP is rejected, and attach human keeps returning the same OTP until it expires, so wait for it to expire before asking for a new one. An organization that signed up without a `human_email` has no OTP until a human is attached. If you run into any difficulties receiving the OTP code, you can also create an account on [console.agentmail.to](https://console.agentmail.to) using the human email address you provided to verify your account.
      *

package/dist/cjs/api/resources/apiKeys/types/ApiKeyPermissions.d.ts

@@ -110,12 +110,12 @@ export interface ApiKeyPermissions {
     calendarEventUpdate?: boolean;
     /** Delete calendar events. */
     calendarEventDelete?: boolean;
-    /** List and get Agent Drive files, with their download URLs. */
+    /** Reserved; not released yet. */
     fileRead?: boolean;
-    /** Upload Agent Drive files (Create File and Complete File). */
+    /** Reserved; not released yet. */
     fileCreate?: boolean;
-    /** Update Agent Drive files. Reserved; no endpoint uses it yet. */
+    /** Reserved; not released yet. */
     fileUpdate?: boolean;
-    /** Delete Agent Drive files. */
+    /** Reserved; not released yet. */
     fileDelete?: boolean;
 }

package/dist/cjs/api/resources/calendar/types/IanaTimezone.d.ts

@@ -1,6 +1,8 @@
 /**
- * Canonical IANA time zone name, for example `America/New_York`, `Europe/London` or `UTC`.
- * Abbreviations such as `PST`, Windows names such as `Pacific Standard Time`, and spellings that
- * differ from the canonical name are rejected.
+ * IANA time zone name, for example `America/New_York`, `Europe/London` or `UTC`. Requests accept
+ * any capitalization and IANA aliases such as `US/Eastern`. The calendar stores and returns the
+ * canonical name, which for some zones is an older spelling: `Asia/Kolkata` is returned as
+ * `Asia/Calcutta`. Abbreviations such as `PST` and Windows names such as `Pacific Standard Time`
+ * are rejected.
  */
 export type IanaTimezone = string;

package/dist/cjs/api/resources/domains/types/Domain.d.ts

@@ -4,17 +4,24 @@ export interface Domain {
     domainId: AgentMail.DomainId;
     domain: AgentMail.DomainName;
     status: AgentMail.Status;
-    /** Why the domain is not (yet) VERIFIED, when known. `dns_records_missing` / `dns_records_invalid` point at the DNS records. The `ses_*` values mean the records look right and sending-infrastructure validation has not converged: `ses_dkim_pending` / `ses_mail_from_pending` (still checking), `ses_dkim_temporary_failure` / `ses_mail_from_temporary_failure` (a transient error the infrastructure keeps retrying on its own — usually resolves without changes), `ses_dkim_failed` / `ses_mail_from_failed` (a terminal verdict; re-verify after fixing), `ses_dkim_not_started` / `ses_mail_from_not_started` (the attribute was never configured on the identity — re-verify to push it), and `ses_not_verified_for_sending`. Absent when VERIFIED. */
+    /** Why the domain is not (yet) VERIFIED, when known. `dns_records_missing` / `dns_records_invalid` point at the DNS records. The `ses_*` values mean the records look right and sending-infrastructure validation has not converged: `ses_dkim_pending` / `ses_mail_from_pending` (still checking), `ses_dkim_temporary_failure` / `ses_mail_from_temporary_failure` (a transient error the infrastructure keeps retrying on its own — usually resolves without changes), `ses_dkim_failed` / `ses_mail_from_failed` (a terminal verdict; re-verify after fixing), `ses_dkim_not_started` / `ses_mail_from_not_started` (the attribute was never configured on the identity — re-verify to push it), `ses_not_verified_for_sending`, and `tracking_certificate_failed` (the certificate for the open tracking `link.` subdomain was refused; fix CAA or DNS, then turn tracking off and back on). Absent when VERIFIED. */
     reason?: string;
     feedbackEnabled: AgentMail.FeedbackEnabled;
     /** Absent on domains created before this field existed; those receive email. */
     inboundEnabled?: AgentMail.InboundEnabled;
     subdomainsEnabled: AgentMail.SubdomainsEnabled;
     trackingEnabled: AgentMail.TrackingEnabled;
+    /** Present when `tracking_enabled` is true. */
+    trackingStatus?: AgentMail.TrackingStatus;
+    /** Why open tracking is not (yet) VERIFIED, when known. `dns_records_missing` / `dns_records_invalid` point at the `link.<domain>` CNAME. `caa_blocked` means the domain's CAA records leave Amazon out: add the `CAA` record listed in `records`, and AgentMail retries the certificate on its own within a few minutes. `certificate_failed` means the certificate was refused; fix the DNS, then turn tracking off and back on. Absent when `tracking_status` is VERIFIED. */
+    trackingReason?: string;
     /**
-     * A list of DNS records required to verify the domain. Includes the apex
-     * MX record unless `inbound_enabled` is false, and a wildcard MX record
-     * (`*.<domain>`) when `subdomains_enabled` is true.
+     * A list of DNS records for the domain. Includes the apex MX record unless
+     * `inbound_enabled` is false, and a wildcard MX record (`*.<domain>`) when
+     * `subdomains_enabled` is true. When `tracking_enabled` is true it also lists
+     * the `link.<domain>` CNAME and, if the domain's CAA records restrict
+     * issuance, a `CAA` record. Those two are for open tracking only: they
+     * feed `tracking_status` and do not affect `status`.
      */
     records: AgentMail.VerificationRecord[];
     clientId?: AgentMail.ClientId;

package/dist/cjs/api/resources/domains/types/RecordType.d.ts

@@ -2,5 +2,6 @@ export declare const RecordType: {
     readonly Txt: "TXT";
     readonly Cname: "CNAME";
     readonly Mx: "MX";
+    readonly Caa: "CAA";
 };
 export type RecordType = (typeof RecordType)[keyof typeof RecordType];

package/dist/cjs/api/resources/domains/types/RecordType.js

@@ -6,4 +6,5 @@ exports.RecordType = {
     Txt: "TXT",
     Cname: "CNAME",
     Mx: "MX",
+    Caa: "CAA",
 };

package/dist/cjs/api/resources/domains/types/TrackingEnabled.d.ts

@@ -1,6 +1,7 @@
 /**
- * Serve open tracking pixels from this domain. Adds a required `link.<domain>`
- * CNAME record to `records`, which must be published and verified before
- * `track_opens` can be used on a send.
+ * Serve open tracking pixels from this domain. Adds a `link.<domain>` CNAME
+ * record to `records`. Open tracking reports its readiness in `tracking_status`
+ * and never changes the domain's `status`. Sends with `track_opens` are accepted
+ * once `tracking_status` is `VERIFIED`.
  */
 export type TrackingEnabled = boolean;

package/dist/cjs/api/resources/domains/types/TrackingStatus.d.ts

@@ -0,0 +1,10 @@
+import type * as AgentMail from "../../../index.js";
+/**
+ * Whether open tracking is ready on this domain, independent of the domain's
+ * `status`. `PENDING`: the `link.<domain>` CNAME is not published yet.
+ * `INVALID`: the CNAME is wrong, or the domain's CAA records do not allow
+ * Amazon to issue its certificate. `VERIFYING`: the certificate is being
+ * issued. `VERIFIED`: `track_opens` can be used. `FAILED`: the certificate was
+ * refused; turn tracking off and back on to request a new one.
+ */
+export type TrackingStatus = AgentMail.VerificationStatus;

package/dist/cjs/api/resources/domains/types/TrackingStatus.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/domains/types/UpdateDomainRequest.d.ts

@@ -5,7 +5,8 @@ import type * as AgentMail from "../../../index.js";
  * unchanged; an empty body is rejected. Enabling `inbound_enabled` or
  * `subdomains_enabled` on a verified domain returns it to `PENDING` until the
  * newly required MX record (the apex MX, or the wildcard `*.<domain>`) is
- * published and verified.
+ * published and verified. Enabling `tracking_enabled` leaves `status` as it is
+ * and starts `tracking_status` at `PENDING`.
  */
 export interface UpdateDomainRequest {
     feedbackEnabled?: AgentMail.FeedbackEnabled;

package/dist/cjs/api/resources/domains/types/VerificationRecord.d.ts

@@ -1,6 +1,6 @@
 import type * as AgentMail from "../../../index.js";
 export interface VerificationRecord {
-    /** The type of the DNS record. */
+    /** The type of the DNS record. A `CAA` record is listed only when open tracking is on and the domain's CAA records restrict which certificate authorities may issue for it: add it next to the existing CAA records, not in place of them. */
     type: AgentMail.RecordType;
     /** The name or host of the record. */
     name: string;

package/dist/cjs/api/resources/domains/types/index.d.ts

@@ -13,6 +13,7 @@ export * from "./RecordType.js";
 export * from "./Status.js";
 export * from "./SubdomainsEnabled.js";
 export * from "./TrackingEnabled.js";
+export * from "./TrackingStatus.js";
 export * from "./UpdateDomainRequest.js";
 export * from "./VerificationRecord.js";
 export * from "./VerificationStatus.js";

package/dist/cjs/api/resources/domains/types/index.js

@@ -29,6 +29,7 @@ __exportStar(require("./RecordType.js"), exports);
 __exportStar(require("./Status.js"), exports);
 __exportStar(require("./SubdomainsEnabled.js"), exports);
 __exportStar(require("./TrackingEnabled.js"), exports);
+__exportStar(require("./TrackingStatus.js"), exports);
 __exportStar(require("./UpdateDomainRequest.js"), exports);
 __exportStar(require("./VerificationRecord.js"), exports);
 __exportStar(require("./VerificationStatus.js"), exports);

package/dist/cjs/api/resources/events/types/EventId.d.ts

@@ -1,4 +1,6 @@
 /**
- * ID of event.
+ * ID of the event. It is the same on every retry and redelivery of the event and on every webhook
+ * or WebSocket subscription that receives it, so use it to deduplicate. The format varies by event
+ * type; treat it as an opaque string.
  */
 export type EventId = string;

package/dist/cjs/api/resources/events/types/InboxIds.d.ts

@@ -1,4 +1,4 @@
 /**
- * Inboxes for which to send events. Maximum 10 per webhook.
+ * Inboxes for which to send events.
  */
 export type InboxIds = string[];

package/dist/cjs/api/resources/events/types/MessageReceivedEvent.d.ts

@@ -6,6 +6,6 @@ export interface MessageReceivedEvent {
     type: "event";
     eventType: AgentMail.MessageReceivedEventType;
     eventId: AgentMail.EventId;
-    message: AgentMail.Message;
+    message: AgentMail.ReceivedMessage;
     thread: AgentMail.ThreadItem;
 }

package/dist/cjs/api/resources/events/types/PodIds.d.ts

@@ -1,4 +1,4 @@
 /**
- * Pods for which to send events. Maximum 10 per webhook.
+ * Pods for which to send events.
  */
 export type PodIds = string[];

package/dist/cjs/api/resources/events/types/ReceivedMessage.d.ts

@@ -0,0 +1,18 @@
+import type * as AgentMail from "../../../index.js";
+/**
+ * The received message. The body (`text`, `html`, `extracted_text`, and `extracted_html`) is included
+ * inline only when it is small enough. Webhooks omit it when the stored body is larger than 64 KiB;
+ * WebSocket events also omit it when the serialized event would be larger than 30 KiB. When the body
+ * is omitted, `body_url` and `body_expires_at` are set instead.
+ */
+export interface ReceivedMessage extends AgentMail.Message {
+    /**
+     * Pre-signed URL that downloads the stored body as a JSON object including `text`, `html`,
+     * `extracted_text`, and `extracted_html`. Present only when the body is omitted from the event.
+     * Valid until `body_expires_at`, one hour after the event was built. The body stays available
+     * through the get message endpoint after the URL expires.
+     */
+    bodyUrl?: string;
+    /** Time at which `body_url` expires. Present only with `body_url`. */
+    bodyExpiresAt?: Date;
+}

package/dist/cjs/api/resources/events/types/ReceivedMessage.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/events/types/index.d.ts

@@ -28,6 +28,7 @@ export * from "./MessageSecurityReviewEvent.js";
 export * from "./MessageSentEvent.js";
 export * from "./Open.js";
 export * from "./PodIds.js";
+export * from "./ReceivedMessage.js";
 export * from "./Recipient.js";
 export * from "./Reject.js";
 export * from "./Send.js";

package/dist/cjs/api/resources/events/types/index.js

@@ -44,6 +44,7 @@ __exportStar(require("./MessageSecurityReviewEvent.js"), exports);
 __exportStar(require("./MessageSentEvent.js"), exports);
 __exportStar(require("./Open.js"), exports);
 __exportStar(require("./PodIds.js"), exports);
+__exportStar(require("./ReceivedMessage.js"), exports);
 __exportStar(require("./Recipient.js"), exports);
 __exportStar(require("./Reject.js"), exports);
 __exportStar(require("./Send.js"), exports);

package/dist/cjs/api/resources/inboxes/resources/calendar/client/Client.d.ts

@@ -17,9 +17,8 @@ export declare class CalendarClient {
      * created. Its `etag` (also the `ETag` response header) is the value to send in `If-Match` to
      * make an update conditional.
      *
-     * Requires the `calendar_read` permission. Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`)
-     * but not yet in EU production (`api.agentmail.eu`). Organizations that have not joined
-     * Labs receive a `403`.
+     * Requires the `calendar_read` permission. Calendar is available in US production
+     * (`api.agentmail.to`) but not yet in EU production (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.inboxes.GetCalendarRequest} request
@@ -44,8 +43,8 @@ export declare class CalendarClient {
      * calendar's current `etag` in `If-Match`: a stale value returns `412`. Without `If-Match` the
      * update applies to the calendar as it is.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.inboxes.UpdateCalendarRequestWrapper} request
@@ -77,8 +76,8 @@ export declare class CalendarClient {
      * The list is always read in the region that serves the request, so it can trail a change made
      * moments earlier by a few seconds. Requires the `calendar_event_read` permission.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.inboxes.ListCalendarEventsRequest} request
@@ -115,8 +114,8 @@ export declare class CalendarClient {
      * moments earlier by a few seconds. Pass `consistency=primary` to read your own change right
      * away. Requires the `calendar_event_read` permission.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.inboxes.GetCalendarAgendaRequest} request
@@ -158,8 +157,8 @@ export declare class CalendarClient {
      * The event's `etag` is the value to send in `If-Match` to make a later update or delete
      * conditional. Requires the `calendar_event_create` permission.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.CreateCalendarEventRequest} request
@@ -220,8 +219,8 @@ export declare class CalendarClient {
      * reads back as it ran, even if a later change to the series no longer produces it. Requires
      * the `calendar_event_read` permission.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.CalendarEventId} event_id
@@ -269,8 +268,8 @@ export declare class CalendarClient {
      * send limits, charged before the change is saved; an over-limit request returns `429`
      * `rate_limit_exceeded` and changes nothing.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.CalendarEventId} event_id
@@ -327,8 +326,8 @@ export declare class CalendarClient {
      * send limits, charged before the delete; an over-limit request returns `429`
      * `rate_limit_exceeded` and deletes nothing.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.CalendarEventId} event_id
@@ -368,8 +367,8 @@ export declare class CalendarClient {
      * trail a change made moments earlier by a few seconds; pass `consistency=primary` to read
      * your own change right away. Requires the `calendar_event_read` permission.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {string} event_id - UUID of the recurring event.
@@ -407,8 +406,8 @@ export declare class CalendarClient {
      * charged before the response is saved; an over-limit request returns `429`
      * `rate_limit_exceeded` and changes nothing.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.CalendarEventId} event_id

package/dist/cjs/api/resources/inboxes/resources/calendar/client/Client.js

@@ -74,9 +74,8 @@ class CalendarClient {
      * created. Its `etag` (also the `ETag` response header) is the value to send in `If-Match` to
      * make an update conditional.
      *
-     * Requires the `calendar_read` permission. Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`)
-     * but not yet in EU production (`api.agentmail.eu`). Organizations that have not joined
-     * Labs receive a `403`.
+     * Requires the `calendar_read` permission. Calendar is available in US production
+     * (`api.agentmail.to`) but not yet in EU production (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.inboxes.GetCalendarRequest} request
@@ -177,8 +176,8 @@ class CalendarClient {
      * calendar's current `etag` in `If-Match`: a stale value returns `412`. Without `If-Match` the
      * update applies to the calendar as it is.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.inboxes.UpdateCalendarRequestWrapper} request
@@ -308,8 +307,8 @@ class CalendarClient {
      * The list is always read in the region that serves the request, so it can trail a change made
      * moments earlier by a few seconds. Requires the `calendar_event_read` permission.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.inboxes.ListCalendarEventsRequest} request
@@ -418,8 +417,8 @@ class CalendarClient {
      * moments earlier by a few seconds. Pass `consistency=primary` to read your own change right
      * away. Requires the `calendar_event_read` permission.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.inboxes.GetCalendarAgendaRequest} request
@@ -552,8 +551,8 @@ class CalendarClient {
      * The event's `etag` is the value to send in `If-Match` to make a later update or delete
      * conditional. Requires the `calendar_event_create` permission.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.CreateCalendarEventRequest} request
@@ -711,8 +710,8 @@ class CalendarClient {
      * reads back as it ran, even if a later change to the series no longer produces it. Requires
      * the `calendar_event_read` permission.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.CalendarEventId} event_id
@@ -844,8 +843,8 @@ class CalendarClient {
      * send limits, charged before the change is saved; an over-limit request returns `429`
      * `rate_limit_exceeded` and changes nothing.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.CalendarEventId} event_id
@@ -1024,8 +1023,8 @@ class CalendarClient {
      * send limits, charged before the delete; an over-limit request returns `429`
      * `rate_limit_exceeded` and deletes nothing.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.CalendarEventId} event_id
@@ -1174,8 +1173,8 @@ class CalendarClient {
      * trail a change made moments earlier by a few seconds; pass `consistency=primary` to read
      * your own change right away. Requires the `calendar_event_read` permission.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {string} event_id - UUID of the recurring event.
@@ -1312,8 +1311,8 @@ class CalendarClient {
      * charged before the response is saved; an over-limit request returns `429`
      * `rate_limit_exceeded` and changes nothing.
      *
-     * Calendar is in AgentMail Labs, available in US production (`api.agentmail.to`) but not yet
-     * in EU production (`api.agentmail.eu`). Organizations that have not joined Labs receive a `403`.
+     * Calendar is available in US production (`api.agentmail.to`) but not yet in EU production
+     * (`api.agentmail.eu`), which returns `403`.
      *
      * @param {AgentMail.inboxes.InboxId} inbox_id
      * @param {AgentMail.CalendarEventId} event_id

package/dist/cjs/api/resources/messages/types/Message.d.ts

@@ -24,6 +24,7 @@ export interface Message {
     calendarEventId?: AgentMail.MessageCalendarEventId;
     references?: AgentMail.MessageReferences;
     headers?: AgentMail.MessageHeaders;
+    authenticationResults?: AgentMail.MessageAuthenticationResults;
     agentArmor?: AgentMail.AgentArmorResult;
     size: AgentMail.MessageSize;
     updatedAt: AgentMail.MessageUpdatedAt;

package/dist/cjs/api/resources/messages/types/MessageAuthenticationDomain.d.ts

@@ -0,0 +1,5 @@
+/**
+ * The domain an authentication verdict is about, lowercase. Present only beside its verdict:
+ * when the verdict is withheld, so is the domain.
+ */
+export type MessageAuthenticationDomain = string;

package/dist/cjs/api/resources/messages/types/MessageAuthenticationDomain.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/messages/types/MessageAuthenticationResults.d.ts

@@ -0,0 +1,56 @@
+import type * as AgentMail from "../../../index.js";
+/**
+ * Per-mechanism SPF, DKIM, and DMARC verdicts for a received message, each with the domain it
+ * is about, kept only where they speak for the sender's From identity. A verdict that could
+ * not be computed is absent, so the field can be `{}`. The field is absent on sent messages
+ * and on messages received before 2026-09-09; the `*_domain` and `arc_sealer` keys appear on
+ * messages received after they were introduced.
+ *
+ * The verdicts are the ones Amazon SES computed when the message reached AgentMail, with one
+ * exception. Forwarded mail fails DMARC at the receiving hop by construction. When AgentMail
+ * delivers a forwarded message as authenticated because a trusted forwarder (such as Google or
+ * Microsoft) sealed a valid ARC chain vouching for the original, the field reports the
+ * verdicts that forwarder recorded for the original message, and `arc_sealer` names it.
+ *
+ * - `spf` is about the envelope MAIL FROM (Return-Path) domain, named in `spf_domain`. It is
+ *   present only when that domain is aligned with the sender's domain (the From mailbox, or
+ *   the Sender header when From spans domains), meaning the two share an organizational
+ *   domain: `mail.example.com` is aligned with `example.com`. An unaligned SPF result is
+ *   withheld whatever its value.
+ * - `dkim` is the DKIM verdict, and `dkim_domain` the signing domain (the `d=` tag). On
+ *   directly received mail the domain is named only when every DKIM signature on the message
+ *   is from the same domain; a message signed by more than one domain (a sender and its email
+ *   provider, for instance) keeps the verdict and omits the domain. `dkim_domain` is the
+ *   signing domain as written, so compare it with the From domain before relying on it.
+ * - `dmarc` is the DMARC verdict for the From domain, named in `dmarc_domain`.
+ * - `dkim` and `dmarc` are withheld when the From list spans more than one domain or could not
+ *   be fully parsed.
+ * - On forwarded mail each sealed verdict is reported only when the domain the forwarder
+ *   recorded it for matches the message's current From domain. If the forwarder rewrote From,
+ *   or vouched for nothing, the field is `{}`.
+ *
+ * The `unauthenticated` label, not this field, is AgentMail's acceptance decision, and it uses
+ * a looser rule, so the two can disagree: a single-From message whose only pass is an
+ * unaligned envelope SPF is delivered without the label while this field shows no pass. Use
+ * the label to tell whether AgentMail accepted the message as legitimate, and this field to
+ * see which domain each mechanism authenticated. Do not reject mail on `dmarc: fail` alone.
+ */
+export interface MessageAuthenticationResults {
+    spf?: AgentMail.MessageAuthenticationVerdict;
+    dkim?: AgentMail.MessageAuthenticationVerdict;
+    dmarc?: AgentMail.MessageAuthenticationVerdict;
+    /** Envelope MAIL FROM domain the `spf` verdict is about (`smtp.mailfrom`). */
+    spfDomain?: AgentMail.MessageAuthenticationDomain;
+    /**
+     * Signing domain the `dkim` verdict is about (`header.d`). Present only when `dkim` is
+     * `pass` or `fail`.
+     */
+    dkimDomain?: AgentMail.MessageAuthenticationDomain;
+    /** From domain the `dmarc` verdict is about (`header.from`). */
+    dmarcDomain?: AgentMail.MessageAuthenticationDomain;
+    /**
+     * Domain of the trusted forwarder whose ARC seal the verdicts were taken from, such as
+     * `google.com`. Present only on forwarded mail, and only beside at least one verdict.
+     */
+    arcSealer?: AgentMail.MessageAuthenticationDomain;
+}

package/dist/cjs/api/resources/messages/types/MessageAuthenticationResults.js

@@ -0,0 +1,3 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/api/resources/messages/types/MessageAuthenticationVerdict.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Result of one email authentication mechanism, in the vocabulary of the
+ * `Authentication-Results` header (RFC 8601). `none` means there was nothing to evaluate
+ * (Amazon SES calls this GRAY): no SPF record for the envelope MAIL FROM domain, no DKIM
+ * signature to check, or no DMARC record for the From domain.
+ */
+export declare const MessageAuthenticationVerdict: {
+    readonly Pass: "pass";
+    readonly Fail: "fail";
+    readonly None: "none";
+    readonly Neutral: "neutral";
+    readonly Softfail: "softfail";
+    readonly Temperror: "temperror";
+    readonly Permerror: "permerror";
+};
+export type MessageAuthenticationVerdict = (typeof MessageAuthenticationVerdict)[keyof typeof MessageAuthenticationVerdict];

package/dist/cjs/api/resources/messages/types/MessageAuthenticationVerdict.js

@@ -0,0 +1,19 @@
+"use strict";
+// This file was auto-generated by Fern from our API Definition.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MessageAuthenticationVerdict = void 0;
+/**
+ * Result of one email authentication mechanism, in the vocabulary of the
+ * `Authentication-Results` header (RFC 8601). `none` means there was nothing to evaluate
+ * (Amazon SES calls this GRAY): no SPF record for the envelope MAIL FROM domain, no DKIM
+ * signature to check, or no DMARC record for the From domain.
+ */
+exports.MessageAuthenticationVerdict = {
+    Pass: "pass",
+    Fail: "fail",
+    None: "none",
+    Neutral: "neutral",
+    Softfail: "softfail",
+    Temperror: "temperror",
+    Permerror: "permerror",
+};