coss 0.0.5 → 0.2.0

package/dist/index.js

@@ -0,0 +1,1917 @@
+//#region src/api-version.ts
+/**
+* API versions this SDK knows, oldest first: a hand-written mirror of `API_VERSIONS` in the API
+* (`apps/api/test/sdk-contract.test.ts` keeps them equal).
+*/
+const API_VERSIONS = ["2026-10-10"];
+/** The version this SDK's types describe, sent with every request unless `apiVersion` overrides it. */
+const API_VERSION = "2026-10-10";
+//#endregion
+//#region src/version.ts
+/** SDK version, sent in the User-Agent. A test keeps it equal to package.json's `version`. */
+const VERSION = "0.2.0";
+//#endregion
+//#region src/core/errors.ts
+const API_ERROR_TYPES = /* @__PURE__ */ new Set([
+	"invalid_request_error",
+	"authentication_error",
+	"permission_error",
+	"not_found_error",
+	"idempotency_error",
+	"rate_limit_error",
+	"billing_error",
+	"api_error"
+]);
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseIssues(value) {
+	if (!Array.isArray(value)) return void 0;
+	const issues = [];
+	for (const item of value) if (isRecord(item) && typeof item.path === "string" && typeof item.message === "string") issues.push({
+		path: item.path,
+		message: item.message
+	});
+	return issues;
+}
+/**
+* Maps a non-2xx response to a `CossError`. Bodies that are not the API's error envelope (a proxy's
+* HTML 502, an empty 503) become `api_error` / `unexpected_response`.
+*/
+function errorFromResponse(status, statusText, body, headerRequestId) {
+	let parsed;
+	try {
+		parsed = JSON.parse(body);
+	} catch {
+		parsed = void 0;
+	}
+	const envelope = isRecord(parsed) ? parsed.error : void 0;
+	if (!isRecord(envelope) || typeof envelope.message !== "string") return {
+		type: "api_error",
+		code: "unexpected_response",
+		message: `The COSS API returned an unexpected HTTP ${status}${statusText ? ` (${statusText})` : ""} response.`,
+		status,
+		request_id: headerRequestId
+	};
+	const error = {
+		type: typeof envelope.type === "string" && API_ERROR_TYPES.has(envelope.type) ? envelope.type : "api_error",
+		code: typeof envelope.code === "string" ? envelope.code : "unknown_error",
+		message: envelope.message,
+		status,
+		request_id: typeof envelope.request_id === "string" ? envelope.request_id : headerRequestId
+	};
+	if (typeof envelope.param === "string") error.param = envelope.param;
+	const issues = parseIssues(envelope.issues);
+	if (issues) error.issues = issues;
+	return error;
+}
+/** Builds an error for a failure that happened on the client (no HTTP response to read). */
+function clientError(type, code, message) {
+	return {
+		type,
+		code,
+		message,
+		status: null,
+		request_id: null
+	};
+}
+//#endregion
+//#region src/core/http.ts
+const INITIAL_RETRY_DELAY_MS = 500;
+const MAX_RETRY_DELAY_MS = 8e3;
+const MAX_RETRY_AFTER_MS = 6e4;
+/** Exponential backoff (500ms, 1s, 2s … capped at 8s) minus up to 25% random jitter. */
+function backoffDelay(retry, random = Math.random) {
+	return Math.min(INITIAL_RETRY_DELAY_MS * 2 ** retry, MAX_RETRY_DELAY_MS) * (1 - random() * .25);
+}
+/** `Retry-After` as milliseconds. Accepts delay-seconds or an HTTP date; `null` if absent/invalid. */
+function parseRetryAfter(value, now = Date.now()) {
+	const trimmed = value?.trim();
+	if (!trimmed) return null;
+	const seconds = Number(trimmed);
+	if (Number.isFinite(seconds)) return seconds >= 0 ? seconds * 1e3 : null;
+	const date = Date.parse(trimmed);
+	return Number.isNaN(date) ? null : Math.max(0, date - now);
+}
+/** 409 (idempotent request still in progress), 429 and 5xx are transient. */
+function isRetryableStatus(status) {
+	return status === 409 || status === 429 || status >= 500;
+}
+function sleep(ms, signal) {
+	return new Promise((resolve) => {
+		if (signal?.aborted) {
+			resolve();
+			return;
+		}
+		const done = () => {
+			clearTimeout(timer);
+			signal?.removeEventListener("abort", done);
+			resolve();
+		};
+		const timer = setTimeout(done, ms);
+		signal?.addEventListener("abort", done, { once: true });
+	});
+}
+/** Error message plus the underlying cause (undici's "fetch failed" hides ECONNREFUSED there). */
+function describe(error) {
+	if (!(error instanceof Error)) return String(error);
+	const cause = error.cause instanceof Error ? error.cause.message : void 0;
+	return cause && cause !== error.message ? `${error.message} (${cause})` : error.message;
+}
+function abortedError() {
+	return clientError("connection_error", "aborted", "The request was aborted.");
+}
+/**
+* The request pipeline shared by all resources: auth + JSON, a per-attempt timeout, retries with
+* backoff, and mapping every failure to a `CossError`. It never throws for API or network errors.
+*/
+var HttpClient = class {
+	#apiKey;
+	#baseUrl;
+	#fetch;
+	#timeout;
+	#maxRetries;
+	#apiVersion;
+	#sleep;
+	constructor(options) {
+		this.#apiKey = options.apiKey;
+		this.#baseUrl = options.baseUrl.replace(/\/+$/, "");
+		this.#fetch = options.fetch;
+		this.#timeout = options.timeout;
+		this.#maxRetries = options.maxRetries;
+		this.#apiVersion = options.apiVersion;
+		this.#sleep = options.sleep ?? sleep;
+	}
+	async request(request) {
+		let url = `${this.#baseUrl}${request.path}`;
+		const query = new URLSearchParams();
+		for (const [name, value] of Object.entries(request.query ?? {})) if (value !== void 0) query.set(name, String(value));
+		const search = query.toString();
+		if (search) url += `?${search}`;
+		const headers = {
+			Accept: request.responseType === "text" || request.responseType === "bytes" ? "*/*" : "application/json",
+			Authorization: `Bearer ${this.#apiKey}`,
+			"User-Agent": `coss-typescript/${VERSION}`,
+			"Coss-Version": this.#apiVersion
+		};
+		let body;
+		if (request.body !== void 0) {
+			headers["Content-Type"] = "application/json";
+			body = JSON.stringify(request.body);
+		}
+		if (request.method === "POST") headers["Idempotency-Key"] = request.idempotencyKey ?? crypto.randomUUID();
+		try {
+			new Headers(headers);
+		} catch (cause) {
+			return {
+				data: null,
+				error: clientError("invalid_request_error", "invalid_header", `Invalid request header: ${describe(cause)}`)
+			};
+		}
+		const init = {
+			method: request.method,
+			headers,
+			body
+		};
+		for (let retry = 0;; retry++) {
+			if (request.signal?.aborted) return {
+				data: null,
+				error: abortedError()
+			};
+			const attempt = await this.#attempt(url, init, request.signal, request.responseType);
+			if (request.retry === false || !attempt.retry || retry >= this.#maxRetries) return attempt.result;
+			const delay = attempt.retryAfterMs ?? backoffDelay(retry);
+			if (delay > MAX_RETRY_AFTER_MS) return attempt.result;
+			await this.#sleep(delay, request.signal);
+		}
+	}
+	async #attempt(url, init, callerSignal, responseType) {
+		const timeoutSignal = AbortSignal.timeout(this.#timeout);
+		const signal = callerSignal ? AbortSignal.any([callerSignal, timeoutSignal]) : timeoutSignal;
+		let response;
+		let text;
+		let bytes = null;
+		try {
+			response = await this.#fetch(url, {
+				...init,
+				signal
+			});
+			if (responseType === "bytes") {
+				bytes = new Uint8Array(await response.arrayBuffer());
+				text = response.ok ? "" : new TextDecoder().decode(bytes);
+			} else text = await response.text();
+		} catch (cause) {
+			if (callerSignal?.aborted) return {
+				result: failed(abortedError()),
+				retry: false,
+				retryAfterMs: null
+			};
+			const timeoutMessage = `Request timed out after ${this.#timeout}ms.`;
+			return {
+				result: failed(timeoutSignal.aborted ? clientError("timeout_error", "request_timeout", timeoutMessage) : clientError("connection_error", "network_error", `Could not reach the COSS API at ${this.#baseUrl}: ${describe(cause)}`)),
+				retry: true,
+				retryAfterMs: null
+			};
+		}
+		const requestId = response.headers.get("x-request-id");
+		if (!response.ok) return {
+			result: failed(errorFromResponse(response.status, response.statusText, text, requestId)),
+			retry: isRetryableStatus(response.status),
+			retryAfterMs: parseRetryAfter(response.headers.get("retry-after"))
+		};
+		if (responseType === "text") return {
+			result: {
+				data: text,
+				error: null
+			},
+			retry: false,
+			retryAfterMs: null
+		};
+		if (responseType === "bytes") return {
+			result: {
+				data: bytes,
+				error: null
+			},
+			retry: false,
+			retryAfterMs: null
+		};
+		try {
+			return {
+				result: {
+					data: JSON.parse(text),
+					error: null
+				},
+				retry: false,
+				retryAfterMs: null
+			};
+		} catch {
+			return {
+				result: failed({
+					type: "api_error",
+					code: "invalid_response",
+					message: `The COSS API returned an HTTP ${response.status} response that is not valid JSON.`,
+					status: response.status,
+					request_id: requestId
+				}),
+				retry: false,
+				retryAfterMs: null
+			};
+		}
+	}
+};
+function failed(error) {
+	return {
+		data: null,
+		error
+	};
+}
+//#endregion
+//#region src/resources/list-query.ts
+/** One query parameter: lists are comma-joined (an empty one is left out), dates ISO 8601. */
+function joined(value) {
+	if (value === void 0) return void 0;
+	if (value instanceof Date) return value.toISOString();
+	if (Array.isArray(value)) return value.length === 0 ? void 0 : value.join(",");
+	return String(value);
+}
+/** The query string of a list method whose filters accept arrays and dates. */
+function listQuery(params) {
+	const query = {};
+	for (const [name, value] of Object.entries(params)) query[name] = joined(value);
+	return query;
+}
+//#endregion
+//#region src/resources/audit-events.ts
+/**
+* `coss.auditEvents`: the organization's audit log, newest first: changes made by members, API
+* keys and COSS support. Organization-wide, whichever environment the key belongs to.
+*/
+var AuditEventsResource = class {
+	#http;
+	/** @internal Use `new Coss().auditEvents`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Lists audit events, newest first. Pass the last `id` as `after` while `has_more` is true. */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/audit_events",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	/** Retrieves one audit event. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/audit_events/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/billing.ts
+/** `coss.billing.invoices`: the organization's invoices, newest first. */
+var BillingInvoicesResource = class {
+	#http;
+	/** @internal Use `new Coss().billing.invoices`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Lists invoices (without lines). Pass the last `id` as `after` while `has_more` is true. */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/billing/invoices",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	/** Retrieves one invoice with its lines. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/billing/invoices/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.billing.credits`: the organization's credits and what's left of them. */
+var BillingCreditsResource = class {
+	#http;
+	/** @internal Use `new Coss().billing.credits`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Lists credits, newest first (usable ones by default). */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/billing/credits",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+};
+/**
+* `coss.billing`: the organization's plan, usage, invoices and credits (read only; plan changes
+* are made in the dashboard). Organization-wide, whichever environment the key belongs to.
+*/
+var BillingResource = class {
+	#http;
+	invoices;
+	credits;
+	/** @internal Use `new Coss().billing`. */
+	constructor(http) {
+		this.#http = http;
+		this.invoices = new BillingInvoicesResource(http);
+		this.credits = new BillingCreditsResource(http);
+	}
+	/** The plan, the current month's usage and estimate, standing and what the plan includes. */
+	get(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/billing",
+			signal: options?.signal
+		});
+	}
+	/** Billable usage per meter and bucket (the current month, by day, by default), oldest first. */
+	usage(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/billing/usage",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/receiving-domains.ts
+const receivingPath = (domainId) => `/v1/domains/${encodeURIComponent(domainId)}/receiving`;
+/**
+* `coss.domains.receiving`: a domain's receiving hostname (the domain itself or a subdomain, e.g.
+* `inbound.acme.com`). Email sent to any address at it is received by the API key's environment.
+*/
+var ReceivingDomainsResource = class {
+	#http;
+	/** @internal Use `new Coss().domains.receiving`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/**
+	* Starts receiving at a hostname of the domain, for the API key's environment, and returns the
+	* domain with the MX record to publish in `data.receiving.record`.
+	*/
+	create(domainId, params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: receivingPath(domainId),
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Stops receiving at the domain's hostname. Emails already received are kept. */
+	delete(domainId, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: receivingPath(domainId),
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/tracking-domains.ts
+const trackingPath = (domainId) => `/v1/domains/${encodeURIComponent(domainId)}/tracking`;
+/**
+* `coss.domains.tracking`: a domain's custom tracking domain (e.g. `links.acme.com`). Open pixels
+* and click redirects of emails sent from the domain use it while it is `active`.
+*/
+var TrackingDomainsResource = class {
+	#http;
+	/** @internal Use `new Coss().domains.tracking`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/**
+	* Sets up a subdomain of the domain as its tracking domain and returns the domain, with the
+	* CNAME to publish in `data.tracking.record`. Setup gives up after 72 hours.
+	*/
+	create(domainId, params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: trackingPath(domainId),
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Removes the domain's tracking domain. Later emails use the default tracking host; links in
+	* emails already sent through it stop working.
+	*/
+	delete(domainId, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: trackingPath(domainId),
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/domains.ts
+/**
+* `coss.domains`: the domains live (`coss_live_…`) keys may send from. Domains belong to the
+* organization, so every API key of the organization sees the same ones.
+*/
+var DomainsResource = class {
+	#http;
+	/** Each domain's custom tracking domain: add and remove it. */
+	tracking;
+	/** Each domain's receiving hostname: start and stop receiving email at it. */
+	receiving;
+	/** @internal Use `new Coss().domains`. */
+	constructor(http) {
+		this.#http = http;
+		this.tracking = new TrackingDomainsResource(http);
+		this.receiving = new ReceivingDomainsResource(http);
+	}
+	/**
+	* Adds a domain and returns the DNS records to publish (`data.records`). The records are
+	* checked in the background; verification gives up after 72 hours.
+	*/
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/domains",
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Lists the organization's domains, ordered by name. */
+	list(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/domains",
+			signal: options?.signal
+		});
+	}
+	/** Retrieves a domain with the result of the last DNS check. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/domains/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Checks the domain's records now instead of waiting for the next background check. A `failed`
+	* domain starts verification over with fresh DKIM records, which have to be published again.
+	* Its tracking domain, if any, is checked too.
+	*/
+	verify(id, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/domains/${encodeURIComponent(id)}/verify`,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Removes the domain. Emails already sent are unaffected; live keys can no longer use it. */
+	delete(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/domains/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/received-emails.ts
+const emailPath = (id) => `/v1/received_emails/${encodeURIComponent(id)}`;
+/**
+* `coss.email.received`: emails received by the API key's environment, at its inbound address
+* (`address()`) or at a receiving domain (`coss.domains.receiving`). An `email.received` webhook
+* announces each one.
+*/
+var ReceivedEmailsResource = class {
+	#http;
+	/** @internal Use `new Coss().email.received`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Lists received emails, newest first, without bodies. Pass the last `id` as `after` while `has_more` is true. */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/received_emails",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	/** Retrieves a received email with its headers and bodies. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: emailPath(id),
+			signal: options?.signal
+		});
+	}
+	/** The whole message as received (`message/rfc822` bytes). */
+	getRaw(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${emailPath(id)}/raw`,
+			responseType: "bytes",
+			signal: options?.signal
+		});
+	}
+	/** An attachment's bytes (untrusted: its declared type is the attachment's `content_type`). */
+	getAttachment(id, attachmentId, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${emailPath(id)}/attachments/${encodeURIComponent(attachmentId)}`,
+			responseType: "bytes",
+			signal: options?.signal
+		});
+	}
+	/**
+	* The environment's inbound domain: email to any address at it (`support@<domain>`) is
+	* received, with no DNS setup.
+	*/
+	address(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/received_emails/address",
+			signal: options?.signal
+		});
+	}
+	/** Deletes a received email with its raw message and attachments right away. */
+	delete(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: emailPath(id),
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/suppressions.ts
+/** The API's per-request maximum for imports. */
+const IMPORT_BATCH_SIZE = 1e3;
+/**
+* `coss.email.suppressions`: the suppression list of the API key's environment. Sends skip
+* suppressed recipients; permanent bounces and complaints are added automatically.
+*/
+var SuppressionResource = class {
+	#http;
+	/** @internal Use `new Coss().email.suppressions`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/**
+	* Suppresses an address for every email (`scope: "*"`, the default) or for one category, e.g.
+	* when a recipient unsubscribes. Returns the existing entry if there already is one.
+	*/
+	add(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/suppressions",
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Adds many entries at once (reason `import`), 1,000 per request. Invalid entries are skipped
+	* and reported in `invalid`; entries already on the list count as `existing`. If a request
+	* fails, the earlier batches stay imported: importing everything again is safe.
+	*/
+	async import(params, options) {
+		const total = {
+			object: "suppression_import",
+			created: 0,
+			existing: 0,
+			invalid: []
+		};
+		for (let start = 0; start === 0 || start < params.suppressions.length;) {
+			const batch = params.suppressions.slice(start, start + IMPORT_BATCH_SIZE);
+			const result = await this.#http.request({
+				method: "POST",
+				path: "/v1/suppressions/import",
+				body: { suppressions: batch },
+				signal: options?.signal
+			});
+			if (result.error) return result;
+			total.created += result.data.created;
+			total.existing += result.data.existing;
+			for (const entry of result.data.invalid) total.invalid.push({
+				...entry,
+				index: entry.index + start
+			});
+			start += IMPORT_BATCH_SIZE;
+		}
+		return {
+			data: total,
+			error: null
+		};
+	}
+	/**
+	* The whole list as CSV (`address,scope,reason,created_at,email_id,id`, oldest first), which
+	* `import` (or the dashboard) accepts again.
+	*/
+	export(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/suppressions/export",
+			query: { ...params },
+			responseType: "text",
+			signal: options?.signal
+		});
+	}
+	/** Lists entries, newest first. Pass the last `id` as `after` while `has_more` is true. */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/suppressions",
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+	/** Whether a send to `address` (with `category`, if given) would skip it. */
+	check(params, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/suppressions/check",
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+	/** Retrieves one entry. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/suppressions/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** Removes an entry, so later sends reach the address again (e.g. when a recipient resubscribes). */
+	remove(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/suppressions/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/tracking.ts
+const categoryPath = (category) => `/v1/tracking_settings/categories/${encodeURIComponent(category)}`;
+/**
+* `coss.email.tracking`: which emails of the API key's environment have their opens and clicks
+* tracked. Emails keep the settings that applied when they were sent; a send's own `tracking`
+* option wins over them.
+*/
+var TrackingResource = class {
+	#http;
+	/** @internal Use `new Coss().email.tracking`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** The environment default and the category rules. */
+	get(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/tracking_settings",
+			signal: options?.signal
+		});
+	}
+	/**
+	* Sets the environment default, which applies to emails without a rule for their category.
+	* Fields left out keep their value; a new default starts with both off.
+	*/
+	updateDefault(params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: "/v1/tracking_settings/default",
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Removes the environment default: emails without a category rule are then not tracked. */
+	removeDefault(options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: "/v1/tracking_settings/default",
+			signal: options?.signal
+		});
+	}
+	/**
+	* Sets the rule for emails sent with `category`, which wins over the default. Fields left out
+	* keep their value; a new rule starts with both off.
+	*/
+	updateCategory(category, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: categoryPath(category),
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Removes a category's rule: its emails follow the environment default again. */
+	removeCategory(category, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: categoryPath(category),
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/email.ts
+/** `coss.email`: transactional email. */
+var EmailResource = class {
+	#http;
+	/** The environment's suppression list. */
+	suppressions;
+	/** The environment's open and click tracking settings. */
+	tracking;
+	/** Emails the environment received. */
+	received;
+	/** @internal Use `new Coss().email`. */
+	constructor(http) {
+		this.#http = http;
+		this.suppressions = new SuppressionResource(http);
+		this.tracking = new TrackingResource(http);
+		this.received = new ReceivedEmailsResource(http);
+	}
+	/**
+	* Sends an email. It is returned `queued` and handed to the delivery provider moments later:
+	* `get` it or listen for the `email.sent` / `email.failed` webhooks for the outcome. Safe to
+	* retry: the request always carries an `Idempotency-Key` (yours, or a generated one reused
+	* across automatic retries), so the API never sends it twice.
+	*/
+	send(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/emails",
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Sends up to 100 emails in one request, each as `send` would. The batch is all or nothing: if
+	* any email is invalid (the error's `issues` name it, e.g. `emails.3.to`), none is sent. Its
+	* recipients count against the send quota together. Safe to retry: one `Idempotency-Key` covers
+	* the whole batch. Larger lists need several calls, each with its own key.
+	*/
+	sendBatch(emails, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/emails/batch",
+			body: { emails },
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Retrieves an email sent from the same environment as the API key. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/emails/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Cancels a scheduled email. Canceling an already canceled email returns it; any other email
+	* fails with `email_not_cancelable`.
+	*/
+	cancel(id, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/emails/${encodeURIComponent(id)}/cancel`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Moves a scheduled email to a new time and records an `email.rescheduled` event. The time it
+	* already has returns it unchanged; an email that is no longer scheduled fails with
+	* `email_not_reschedulable`.
+	*/
+	reschedule(id, params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/emails/${encodeURIComponent(id)}/reschedule`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Lists an email's delivery events, oldest first. */
+	listEvents(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/emails/${encodeURIComponent(id)}/events`,
+			signal: options?.signal
+		});
+	}
+	/** Lists the links tracked for clicks in an email, in document order, with click counts. */
+	listLinks(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/emails/${encodeURIComponent(id)}/links`,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/hooks.ts
+const segment = encodeURIComponent;
+const applicationPath = (application) => `/v1/hooks/applications/${segment(application)}`;
+const endpointPath = (application, id) => `${applicationPath(application)}/endpoints/${segment(id)}`;
+/** `coss.hooks.applications`: your customers, each with their own endpoints and portal. */
+var HookApplicationsResource = class {
+	#http;
+	/** @internal Use `new Coss().hooks.applications`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Creates an application. Never automatically retried (the API does not deduplicate it). */
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/hooks/applications",
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Lists the environment's applications, newest first. */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/hooks/applications",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	/** Retrieves an application by its id or uid. */
+	get(application, options) {
+		return this.#http.request({
+			method: "GET",
+			path: applicationPath(application),
+			signal: options?.signal
+		});
+	}
+	update(application, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: applicationPath(application),
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Deletes the application with its endpoints and portal sessions. */
+	delete(application, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: applicationPath(application),
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.hooks.eventTypes`: the catalog of messages you send, which your users subscribe from. */
+var HookEventTypesResource = class {
+	#http;
+	/** @internal Use `new Coss().hooks.eventTypes`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Creates an event type. Never automatically retried (a retry would find it existing). */
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/hooks/event_types",
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Lists event types by name (archived ones only with `include_archived`). */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/hooks/event_types",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	get(name, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/hooks/event_types/${segment(name)}`,
+			signal: options?.signal
+		});
+	}
+	/** Changes its description, schema or examples, or archives or restores it. */
+	update(name, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: `/v1/hooks/event_types/${segment(name)}`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Archives it: hidden from the portal and new subscriptions. */
+	archive(name, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/hooks/event_types/${segment(name)}`,
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.hooks.endpoints`: an application's endpoints (usually added by its users in the portal). */
+var HookEndpointsResource = class {
+	#http;
+	/** @internal Use `new Coss().hooks.endpoints`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Creates an endpoint; the result carries its secret. Never automatically retried. */
+	create(application, params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `${applicationPath(application)}/endpoints`,
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	list(application, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${applicationPath(application)}/endpoints`,
+			signal: options?.signal
+		});
+	}
+	get(application, id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: endpointPath(application, id),
+			signal: options?.signal
+		});
+	}
+	update(application, id, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: endpointPath(application, id),
+			body: params,
+			signal: options?.signal
+		});
+	}
+	delete(application, id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: endpointPath(application, id),
+			signal: options?.signal
+		});
+	}
+	/** The endpoint's current signing secret. */
+	getSecret(application, id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${endpointPath(application, id)}/secret`,
+			signal: options?.signal
+		});
+	}
+	/** Replaces the signing secret. Never automatically retried (a second roll would stop the first). */
+	rollSecret(application, id, params = {}, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `${endpointPath(application, id)}/roll_secret`,
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Requeues the endpoint's failed deliveries of messages sent since `since` (in the background). */
+	recover(application, id, params, options) {
+		const since = params.since instanceof Date ? params.since.toISOString() : params.since;
+		return this.#http.request({
+			method: "POST",
+			path: `${endpointPath(application, id)}/recover`,
+			body: { since },
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	getRecovery(application, id, recoveryId, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${endpointPath(application, id)}/recoveries/${segment(recoveryId)}`,
+			signal: options?.signal
+		});
+	}
+	/** Sends a message to this endpoint only. Never automatically retried. */
+	sendTest(application, id, params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `${endpointPath(application, id)}/test`,
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** The endpoint's deliveries, newest first. */
+	listDeliveries(application, id, params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${endpointPath(application, id)}/deliveries`,
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.hooks.messages`: send a message once; COSS delivers it to every subscribed endpoint. */
+var HookMessagesResource = class {
+	#http;
+	/** @internal Use `new Coss().hooks.messages`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/**
+	* Sends a message to an application. Safe to retry: every attempt carries the same
+	* `Idempotency-Key`, so a retried send is delivered once.
+	*/
+	send(params, options) {
+		const { application, ...body } = params;
+		return this.#http.request({
+			method: "POST",
+			path: `${applicationPath(application)}/messages`,
+			body,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** The application's messages, newest first. */
+	list(application, params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${applicationPath(application)}/messages`,
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	get(application, id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${applicationPath(application)}/messages/${segment(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** One delivery per endpoint the message went to. */
+	listDeliveries(application, id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${applicationPath(application)}/messages/${segment(id)}/deliveries`,
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.hooks.deliveries`: one message's delivery to one endpoint. */
+var HookDeliveriesResource = class {
+	#http;
+	/** @internal Use `new Coss().hooks.deliveries`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	get(application, id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${applicationPath(application)}/deliveries/${segment(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** Every HTTP request of the delivery, oldest first. */
+	listAttempts(application, id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${applicationPath(application)}/deliveries/${segment(id)}/attempts`,
+			signal: options?.signal
+		});
+	}
+	/** Queues a finished delivery for one more attempt. Never automatically retried. */
+	retry(application, id, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `${applicationPath(application)}/deliveries/${segment(id)}/retry`,
+			retry: false,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.hooks.portal`: a ready-made page for an application's user to manage their endpoints. */
+var HookPortalResource = class {
+	#http;
+	/** @internal Use `new Coss().hooks.portal`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/**
+	* Signs the application's user in to the portal: open or embed the returned `url`. Call it from
+	* your backend each time the user opens the portal.
+	*/
+	createSession(params, options) {
+		const { application, ...body } = params;
+		return this.#http.request({
+			method: "POST",
+			path: `${applicationPath(application)}/portal_sessions`,
+			body,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+};
+/**
+* `coss.hooks`: webhooks as a service. Send a message to one of your applications once
+* (`coss.hooks.messages.send`); COSS delivers it to every endpoint its users registered, signed
+* (Standard Webhooks), with retries, and gives them a portal to manage it all.
+*/
+var HooksResource = class {
+	applications;
+	eventTypes;
+	endpoints;
+	messages;
+	deliveries;
+	portal;
+	/** @internal Use `new Coss().hooks`. */
+	constructor(http) {
+		this.applications = new HookApplicationsResource(http);
+		this.eventTypes = new HookEventTypesResource(http);
+		this.endpoints = new HookEndpointsResource(http);
+		this.messages = new HookMessagesResource(http);
+		this.deliveries = new HookDeliveriesResource(http);
+		this.portal = new HookPortalResource(http);
+	}
+};
+//#endregion
+//#region src/resources/log-drains.ts
+const drainPath = (id) => `/v1/log_drains/${encodeURIComponent(id)}`;
+/** `coss.logDrains.batches`: a drain's delivery log, each batch with every HTTP attempt. */
+var LogDrainBatchesResource = class {
+	#http;
+	/** @internal Use `new Coss().logDrains.batches`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Lists the drain's batches, newest first. Pass the last `id` as `after` while `has_more` is true. */
+	list(drainId, params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${drainPath(drainId)}/batches`,
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+	/** Retrieves one batch of the drain. */
+	get(drainId, id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${drainPath(drainId)}/batches/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+/**
+* `coss.logDrains`: HTTPS endpoints the environment's log is streamed to (API requests, email
+* events, webhook attempts and audit events), in signed NDJSON batches. Drains belong to the API
+* key's own environment, so a `coss_test_…` key only ever manages sandbox drains.
+*/
+var LogDrainsResource = class {
+	#http;
+	/** Each drain's delivery log. */
+	batches;
+	/** @internal Use `new Coss().logDrains`. */
+	constructor(http) {
+		this.#http = http;
+		this.batches = new LogDrainBatchesResource(http);
+	}
+	/**
+	* Creates a drain. The result carries its `secret` (returned only here) — store it and pass it
+	* to `verifyLogDrainBatch` for every request. Creation is never automatically retried: the API
+	* does not deduplicate it. After a lost response, list drains and remove the one with the
+	* unknown secret before creating a replacement.
+	*/
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/log_drains",
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Lists the environment's drains, oldest first. Secrets are never included. */
+	list(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/log_drains",
+			signal: options?.signal
+		});
+	}
+	/** Retrieves a drain of the API key's environment. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: drainPath(id),
+			signal: options?.signal
+		});
+	}
+	/**
+	* Changes the URL, description, sources or `enabled` flag. The signing secret stays the same.
+	* Disabling drops the lines still waiting for the drain; enabling it again (also after COSS
+	* disabled it for failing) sends lines logged from then on.
+	*/
+	update(id, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: drainPath(id),
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Deletes the drain and its batch log. To pause it instead, update `enabled` to false. */
+	delete(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: drainPath(id),
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/logs.ts
+/**
+* `coss.logs`: the API key's environment log, newest first: API requests made with its keys,
+* email events and webhook delivery attempts.
+*/
+var LogsResource = class {
+	#http;
+	/** @internal Use `new Coss().logs`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/**
+	* Lists log lines, newest first (the last hour unless `from`/`to` say otherwise). Pass the last
+	* `id` as `after` while `has_more` is true.
+	*/
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/logs",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	/** Retrieves one log line. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/logs/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/reputation.ts
+/**
+* `coss.reputation`: the organization's standing with the COSS reputation guard, which suspends
+* live sending automatically when bounce or complaint rates cross its thresholds.
+*/
+var ReputationResource = class {
+	#http;
+	/** @internal Use `new Coss().reputation`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** The current status and the latest rates measured over live environments. */
+	get(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/reputation",
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/risk.ts
+const LIST_ENTRY_TYPES = [
+	"email",
+	"domain",
+	"ip",
+	"asn",
+	"country",
+	"user"
+];
+/** `coss.risk.assessments`: reading past assessments (`assess` lives on `coss.risk`). */
+var RiskAssessmentsResource = class {
+	#http;
+	/** @internal Use `new Coss().risk.assessments`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Retrieves one assessment. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/risk/assessments/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Lists assessments, newest first (`review_status: "open"` is the review queue). Pass the last
+	* `id` as `after` while `has_more` is true.
+	*/
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/risk/assessments",
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.risk.lists`: the environment's allow and block lists. */
+var RiskListsResource = class {
+	#http;
+	/** @internal Use `new Coss().risk.lists`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/**
+	* Adds an entry: `coss.risk.lists.add("block", { domain: "evil.example" })`. An allow-list match
+	* makes decisions `allow`, a block-list match `block`. Returns the existing entry if there is one.
+	*/
+	add(list, entry, options) {
+		const type = LIST_ENTRY_TYPES.find((name) => name in entry);
+		const body = {
+			list,
+			type,
+			value: String(entry[type] ?? ""),
+			...entry.note === void 0 ? {} : { note: entry.note },
+			...entry.expires_at === void 0 ? {} : { expires_at: entry.expires_at instanceof Date ? entry.expires_at.toISOString() : entry.expires_at }
+		};
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/risk/list_entries",
+			body,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Lists entries, newest first. Pass the last `id` as `after` while `has_more` is true. */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/risk/list_entries",
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+	/** Retrieves one entry. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/risk/list_entries/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** Removes an entry. */
+	remove(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/risk/list_entries/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.risk.settings`: the environment's thresholds, disabled reasons and captcha provider. */
+var RiskSettingsResource = class {
+	#http;
+	/** @internal Use `new Coss().risk.settings`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	get(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/risk/settings",
+			signal: options?.signal
+		});
+	}
+	/** Changes the fields given. The captcha secret is write-only. */
+	update(params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: "/v1/risk/settings",
+			body: params,
+			signal: options?.signal
+		});
+	}
+};
+/**
+* `coss.risk.rules`: the environment's rules. After the lists, the first enabled rule whose
+* conditions match an event decides it.
+*/
+var RiskRulesResource = class {
+	#http;
+	/** @internal Use `new Coss().risk.rules`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Creates a rule. Not retried automatically: a retry could create it twice. */
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/risk/rules",
+			body: params,
+			retry: false,
+			signal: options?.signal
+		});
+	}
+	/** Every rule, in evaluation order. */
+	list(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/risk/rules",
+			signal: options?.signal
+		});
+	}
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/risk/rules/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** Changes the fields given; `conditions` replaces the whole list. */
+	update(id, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: `/v1/risk/rules/${encodeURIComponent(id)}`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	delete(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/risk/rules/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.risk.users`: what COSS remembers about your users. */
+var RiskUsersResource = class {
+	#http;
+	/** @internal Use `new Coss().risk.users`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/**
+	* Call when you delete a user: COSS deletes what identifies them (their mailbox, fraud reports,
+	* and the user id, email, IP and user agent on their assessments). Safe to repeat.
+	*/
+	forget(userId, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/risk/users/${encodeURIComponent(userId)}`,
+			signal: options?.signal
+		});
+	}
+};
+/**
+* `coss.risk`: assess sign-ups, logins and other events. Call it from your server and treat an
+* error as `allow` (fail open), so an outage never locks your users out.
+*
+* ```ts
+* const { data } = await coss.risk.assess({ event: "signup", user: { email }, ip, user_agent });
+* if (data?.decision === "block") return refuse();
+* ```
+*/
+var RiskResource = class {
+	/** Past assessments (`get`, `list`). */
+	assessments;
+	/** Allow and block lists (`add`, `list`, `get`, `remove`). */
+	lists;
+	/** Forgetting deleted users. */
+	users;
+	/** Thresholds, disabled reasons and the captcha provider (`get`, `update`). */
+	settings;
+	/** Rules (`create`, `list`, `get`, `update`, `delete`). */
+	rules;
+	#http;
+	/** @internal Use `new Coss().risk`. */
+	constructor(http) {
+		this.#http = http;
+		this.assessments = new RiskAssessmentsResource(http);
+		this.lists = new RiskListsResource(http);
+		this.users = new RiskUsersResource(http);
+		this.settings = new RiskSettingsResource(http);
+		this.rules = new RiskRulesResource(http);
+	}
+	/**
+	* Assesses an event and returns the decision with its score and reasons. Retries reuse one
+	* `Idempotency-Key`, so an event is never counted twice.
+	*/
+	assess(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/risk/assessments",
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Reports what an assessed user turned out to be: `fraud` and `abuse` teach later assessments to
+	* flag the same mailbox, user, IP and subnet; `legitimate` takes that back. Resolves a review.
+	*/
+	feedback(id, params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/risk/assessments/${encodeURIComponent(id)}/feedback`,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/webhook-deliveries.ts
+const deliveriesPath = (endpointId) => `/v1/webhook_endpoints/${encodeURIComponent(endpointId)}/deliveries`;
+/**
+* `coss.webhookEndpoints.deliveries`: an endpoint's delivery log. Each delivery carries every
+* HTTP attempt and the payload as sent.
+*/
+var WebhookDeliveriesResource = class {
+	#http;
+	/** @internal Use `new Coss().webhookEndpoints.deliveries`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Lists the endpoint's deliveries, newest first. Pass the last `id` as `after` while `has_more` is true. */
+	list(endpointId, params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: deliveriesPath(endpointId),
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+	/** Retrieves one delivery of the endpoint. */
+	get(endpointId, id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${deliveriesPath(endpointId)}/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Queues a finished delivery for one more attempt, made within seconds. A delivery that is
+	* still `pending` is returned unchanged (it is already scheduled for `next_attempt_at`).
+	* Never automatically retried: the API does not deduplicate replay requests, even with an
+	* idempotency key.
+	*/
+	retry(endpointId, id, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `${deliveriesPath(endpointId)}/${encodeURIComponent(id)}/retry`,
+			retry: false,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/webhook-endpoints.ts
+/**
+* `coss.webhookEndpoints`: the URLs that receive signed event notifications. Endpoints belong to
+* the API key's own environment, so a `coss_test_…` key only ever manages sandbox endpoints.
+*/
+var WebhookEndpointsResource = class {
+	#http;
+	/** Each endpoint's delivery log: list, retrieve and retry deliveries. */
+	deliveries;
+	/** @internal Use `new Coss().webhookEndpoints`. */
+	constructor(http) {
+		this.#http = http;
+		this.deliveries = new WebhookDeliveriesResource(http);
+	}
+	/**
+	* Creates an endpoint. The result carries its `secret` (returned again only by `rollSecret`) —
+	* store it and pass it to `verifyWebhook` for every delivery. Creation is never automatically retried:
+	* the API does not deduplicate it, even with an idempotency key. After a lost response,
+	* list endpoints and remove the endpoint with the unknown secret before creating a replacement.
+	*/
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/webhook_endpoints",
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Lists the environment's endpoints, oldest first. Secrets are never included. */
+	list(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/webhook_endpoints",
+			signal: options?.signal
+		});
+	}
+	/** Retrieves an endpoint of the API key's environment. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/webhook_endpoints/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Changes the URL, description, subscribed event types or `enabled` flag. The signing secret
+	* stays the same (see `rollSecret`), so receivers keep verifying deliveries.
+	*/
+	update(id, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: `/v1/webhook_endpoints/${encodeURIComponent(id)}`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Replaces the endpoint's signing secret; the result carries the new `secret`. Until
+	* `previous_secret_expires_at` (a day by default), deliveries are signed with both secrets, so
+	* `verifyWebhook` accepts them with either: deploy the new one, then let the old one expire.
+	* Never automatically retried (a second roll would stop the original secret at once): after a
+	* lost response, roll again and deploy that secret.
+	*/
+	rollSecret(id, params = {}, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/webhook_endpoints/${encodeURIComponent(id)}/roll_secret`,
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Queues the endpoint's deliveries that failed since `since` for one more attempt each (at most
+	* 1,000 per call; while `has_more` is true, call again with the same `since`), e.g. after fixing a
+	* receiver that was down. The endpoint must be enabled.
+	*/
+	recover(id, params, options) {
+		const since = params.since instanceof Date ? params.since.toISOString() : params.since;
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/webhook_endpoints/${encodeURIComponent(id)}/recover`,
+			body: { since },
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Deletes the endpoint and its delivery log. To pause it instead, update `enabled` to false. */
+	delete(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/webhook_endpoints/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/client.ts
+const DEFAULT_BASE_URL = "https://api.coss.com";
+const DEFAULT_TIMEOUT_MS = 3e4;
+const DEFAULT_MAX_RETRIES = 2;
+const MAX_TIMEOUT_MS = 2147483647;
+/** Reads an env variable where one exists (Node, Bun, Deno's `process`), never throwing. */
+function readEnv(name) {
+	try {
+		return (globalThis.process?.env)?.[name]?.trim() || void 0;
+	} catch {
+		return;
+	}
+}
+function retries(value) {
+	return value !== void 0 && Number.isFinite(value) && value >= 0 ? Math.floor(value) : DEFAULT_MAX_RETRIES;
+}
+function timeoutMs(value) {
+	return value !== void 0 && Number.isFinite(value) && value > 0 ? Math.min(Math.ceil(value), MAX_TIMEOUT_MS) : DEFAULT_TIMEOUT_MS;
+}
+/**
+* The COSS client. One API key covers every product.
+*
+* ```ts
+* const coss = new Coss({ apiKey: "coss_test_…" });
+* const { data, error } = await coss.email.send({ from, to, subject, html });
+* ```
+*/
+var Coss = class {
+	email;
+	/** Sending domains of the organization (`coss.domains.create`, `.verify`, …). */
+	domains;
+	/** Webhook endpoints of the API key's environment. */
+	webhookEndpoints;
+	/** The organization's sending reputation (`coss.reputation.get()`). */
+	reputation;
+	/** The environment's log: API requests, email events, webhook attempts (`coss.logs.list()`). */
+	logs;
+	/** HTTPS endpoints the environment's log is streamed to (`coss.logDrains.create()`). */
+	logDrains;
+	/** The organization's audit log: changes by members, API keys and COSS support (`coss.auditEvents.list()`). */
+	auditEvents;
+	/** Hooks, webhooks as a service: `coss.hooks.messages.send()` delivers to your users' endpoints. */
+	hooks;
+	/** Risk assessments of sign-ups, logins and other events (`coss.risk.assess()`). */
+	risk;
+	/** The organization's plan, usage, invoices and credits (`coss.billing.get()`). */
+	billing;
+	/**
+	* Throws only for programmer errors: no API key, or running in a browser without
+	* `dangerouslyAllowBrowser`. Request failures are returned as `{ data: null, error }`.
+	*/
+	constructor(options = {}) {
+		if (typeof globalThis.document !== "undefined" && !options.dangerouslyAllowBrowser) throw new Error("Refusing to create a COSS client in a browser-like environment: COSS API keys are secret, and any key sent to the browser can be read by anyone using the page. Call COSS from your server instead, or pass `dangerouslyAllowBrowser: true` if you understand the risk.");
+		const apiKey = options.apiKey?.trim() || readEnv("COSS_API_KEY");
+		if (!apiKey) throw new Error("Missing COSS API key. Pass `apiKey` to `new Coss({ apiKey })` or set the COSS_API_KEY environment variable.");
+		const http = new HttpClient({
+			apiKey,
+			baseUrl: options.baseUrl?.trim() || readEnv("COSS_BASE_URL") || DEFAULT_BASE_URL,
+			fetch: options.fetch ?? ((input, init) => globalThis.fetch(input, init)),
+			timeout: timeoutMs(options.timeout),
+			maxRetries: retries(options.maxRetries),
+			apiVersion: options.apiVersion?.trim() || "2026-10-10"
+		});
+		this.email = new EmailResource(http);
+		this.domains = new DomainsResource(http);
+		this.webhookEndpoints = new WebhookEndpointsResource(http);
+		this.reputation = new ReputationResource(http);
+		this.logs = new LogsResource(http);
+		this.logDrains = new LogDrainsResource(http);
+		this.auditEvents = new AuditEventsResource(http);
+		this.hooks = new HooksResource(http);
+		this.risk = new RiskResource(http);
+		this.billing = new BillingResource(http);
+	}
+};
+//#endregion
+//#region src/webhooks.ts
+/** A webhook request failed verification: reject it (e.g. respond 400). */
+var WebhookVerificationError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "WebhookVerificationError";
+	}
+};
+const SECRET_PREFIX = "whsec_";
+const DEFAULT_TOLERANCE_SECONDS = 300;
+function header(headers, name) {
+	if (typeof headers.get === "function") return headers.get(name);
+	for (const [key, value] of Object.entries(headers)) {
+		if (key.toLowerCase() !== name) continue;
+		const first = Array.isArray(value) ? value[0] : value;
+		return typeof first === "string" ? first : null;
+	}
+	return null;
+}
+function decodeBase64(value) {
+	try {
+		const binary = atob(value);
+		const bytes = new Uint8Array(binary.length);
+		for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+		return bytes;
+	} catch {
+		return null;
+	}
+}
+/** Throws unless one of the request's signatures matches and its timestamp is recent. */
+async function verifySignature(payload, headers, secret, options) {
+	const id = header(headers, "webhook-id");
+	const timestamp = header(headers, "webhook-timestamp");
+	const signatures = header(headers, "webhook-signature");
+	if (!id || !timestamp || !signatures) throw new WebhookVerificationError("Missing webhook-id, webhook-timestamp or webhook-signature.");
+	const sentAt = Number(timestamp);
+	const now = Math.floor((options.now ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
+	const tolerance = options.toleranceSeconds ?? DEFAULT_TOLERANCE_SECONDS;
+	if (!/^\d+$/.test(timestamp) || Math.abs(now - sentAt) > tolerance) throw new WebhookVerificationError("The webhook timestamp is too old or in the future.");
+	const keyBytes = decodeBase64(secret.startsWith(SECRET_PREFIX) ? secret.slice(6) : secret);
+	if (!keyBytes || keyBytes.length === 0) throw new WebhookVerificationError("The signing secret is not a valid whsec_… secret.");
+	const key = await crypto.subtle.importKey("raw", keyBytes, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["verify"]);
+	const signed = new TextEncoder().encode(`${id}.${timestamp}.${payload}`);
+	for (const candidate of signatures.split(" ")) {
+		const [version, value] = candidate.split(",", 2);
+		if (version !== "v1" || !value) continue;
+		const signature = decodeBase64(value);
+		if (signature && await crypto.subtle.verify("HMAC", key, signature, signed)) return;
+	}
+	throw new WebhookVerificationError("No webhook signature matches.");
+}
+/**
+* Checks the request's signature and age, then returns the parsed event. Pass the raw request
+* body exactly as received (not re-serialized JSON) and the endpoint's `whsec_…` signing secret.
+* Throws `WebhookVerificationError` when the request must be rejected.
+*
+* ```ts
+* const event = await verifyWebhook(await request.text(), request.headers, process.env.COSS_WEBHOOK_SECRET);
+* ```
+*
+* The same check verifies messages your own users receive from COSS Hooks (`coss.hooks`): pass
+* the endpoint's secret and name your payload type, e.g. `verifyWebhook<InvoicePaid>(…)`.
+*/
+async function verifyWebhook(payload, headers, secret, options = {}) {
+	await verifySignature(payload, headers, secret, options);
+	try {
+		return JSON.parse(payload);
+	} catch {
+		throw new WebhookVerificationError("The webhook body is not valid JSON.");
+	}
+}
+/**
+* Checks a log drain request's signature and age, then returns its lines (NDJSON: one log line or
+* audit event per line). Pass the raw request body exactly as received and the drain's `whsec_…`
+* signing secret. The `webhook-id` header is the batch id, the same on every retry of a batch:
+* use it (or each line's `id`) to skip a batch you already stored. Throws
+* `WebhookVerificationError` when the request must be rejected.
+*
+* ```ts
+* const lines = await verifyLogDrainBatch(await request.text(), request.headers, process.env.COSS_LOG_DRAIN_SECRET);
+* ```
+*/
+async function verifyLogDrainBatch(payload, headers, secret, options = {}) {
+	await verifySignature(payload, headers, secret, options);
+	try {
+		return payload.split("\n").filter((line) => line.length > 0).map((line) => JSON.parse(line));
+	} catch {
+		throw new WebhookVerificationError("The log drain body is not valid NDJSON.");
+	}
+}
+//#endregion
+export { API_VERSION, API_VERSIONS, Coss, VERSION, WebhookVerificationError, verifyLogDrainBatch, verifyWebhook };