coss 0.2.0 → 0.4.0

package/dist/index.d.ts

@@ -70,7 +70,7 @@ interface HttpClientOptions {
 interface ApiRequest {
   /** Disable automatic retries for operations without server-side deduplication. */
   retry?: boolean;
-  method: "GET" | "POST" | "PATCH" | "DELETE";
+  method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
   /** Path including the version prefix, e.g. `/v1/emails`. */
   path: string;
   /** Query parameters; `undefined` values are left out. */
@@ -95,11 +95,59 @@ declare class HttpClient {
   request<T>(request: ApiRequest): Promise<CossResult<T>>;
 }
 //#endregion
+//#region src/types/environment.d.ts
+/** Environment wire types (hand-written mirrors of the API's `Environment` schema). */
+/** A project or organization, as named in the dashboard. */
+interface NamedResource {
+  id: string;
+  name: string;
+  /** As in dashboard URLs. */
+  slug: string;
+}
+/** `GET /v1/environment`: the environment the API key belongs to. */
+interface Environment {
+  object: "environment";
+  id: string;
+  name: string;
+  slug: string;
+  /** `live` delivers email; `sandbox` (`coss_test_` keys) never does. */
+  mode: "live" | "sandbox";
+  project: NamedResource;
+  organization: NamedResource & {
+    /** The organization's pinned API version (for requests without `Coss-Version`). */
+    api_version: string;
+  };
+  /** The API key making the request. */
+  api_key: {
+    id: string;
+    name: string | null;
+    /** The key's first characters, as shown in the dashboard. */
+    start: string | null;
+  };
+}
+/** `DELETE /v1/api_key`: the key revoked itself. */
+interface DeletedApiKey {
+  object: "api_key";
+  id: string;
+  deleted: true;
+}
+//#endregion
+//#region src/resources/api-key.d.ts
+type ReadOptions$18 = Pick<RequestOptions, "signal">;
+/** `coss.apiKey`: the API key the client was created with. */
+declare class ApiKeyResource {
+  #private;
+  /** @internal Use `new Coss().apiKey`. */
+  constructor(http: HttpClient);
+  /** Revokes the client's own API key, at once: every later request with it fails. */
+  revoke(options?: ReadOptions$18): Promise<CossResult<DeletedApiKey>>;
+}
+//#endregion
 //#region src/types/audit-event.d.ts
 /** Audit log wire types (hand-written mirrors of the API's schemas). */
 /**
- * `user`: a member, in the dashboard. `api_key`: a request made with an API key. `system`: COSS
- * itself, including COSS support.
+ * `user`: a member, in the dashboard. `api_key`: a request made with an API key. `system`: coss.com
+ * itself, including coss.com support.
  */
 type AuditActorType = "user" | "api_key" | "system";
 /** One change to the organization. */
@@ -111,7 +159,7 @@ interface AuditEvent {
   actor_type: AuditActorType;
   /** The user's or API key's id; `null` for the system. */
   actor_id: string | null;
-  /** The user's email, the API key's id, or `COSS support` (copied when recorded). */
+  /** The user's email, the API key's id, or `coss.com support` (copied when recorded). */
   actor_label: string;
   /** `<resource>.<verb>`, e.g. `api_key.created`, `domain.deleted`, `member.role_changed`. */
   action: string;
@@ -151,13 +199,165 @@ interface ListAuditEventsParams {
   after?: string;
 }
 //#endregion
+//#region src/types/email-template.d.ts
+/** Wire types of email templates (`coss.email.templates`). */
+/** A variable's type. `list` is an array of objects with the declared `fields`. */
+type TemplateVariableType = "string" | "number" | "boolean" | "list";
+type TemplateScalarType = "string" | "number" | "boolean";
+/** A declared variable, used in the template as `{{name}}`. */
+interface TemplateVariable {
+  name: string;
+  type: TemplateVariableType;
+  /** Sends must pass it unless it has a `default`. */
+  required: boolean;
+  /** Used when a send leaves it out. */
+  default?: string | number | boolean;
+  description?: string;
+  /** A list's item fields. */
+  fields?: {
+    name: string;
+    type: TemplateScalarType;
+    required: boolean;
+  }[];
+}
+/** A variable to declare. `required` defaults to true. */
+interface TemplateVariableParams {
+  /** 1-64 letters, digits and underscores, not starting with a digit. */
+  name: string;
+  type: TemplateVariableType;
+  required?: boolean;
+  /** Not for lists. */
+  default?: string | number | boolean;
+  description?: string;
+  /** Required for lists, only for lists. */
+  fields?: {
+    name: string;
+    type: TemplateScalarType;
+    required?: boolean;
+  }[];
+}
+/** One locale's subject, HTML and text templates. */
+interface TemplateContent {
+  /** A BCP 47 language tag, e.g. `"en"` or `"pt-BR"`. */
+  locale: string;
+  subject: string;
+  html: string | null;
+  text: string | null;
+}
+/** One locale's templates. Provide `html`, `text`, or both. */
+interface TemplateContentParams {
+  locale: string;
+  subject: string;
+  html?: string | null;
+  text?: string | null;
+}
+/** A problem that keeps a draft from being published, at a line and column of one field. */
+interface TemplateProblem {
+  locale: string;
+  field: "subject" | "html" | "text";
+  message: string;
+  line: number;
+  column: number;
+}
+interface EmailTemplate {
+  object: "email_template";
+  id: string;
+  /** Send it by this name in any environment that has a template with the same alias. */
+  alias: string | null;
+  name: string;
+  description: string | null;
+  /** The version sends use; `null` until the draft is first published. */
+  published_version: number | null;
+  /** ISO 8601 timestamp, or `null`. */
+  published_at: string | null;
+  /** Whether the draft was changed since it was last published. */
+  has_unpublished_changes: boolean;
+  created_at: string;
+  updated_at: string;
+}
+/** A template's draft (`version: null`) or a published version (which never changes). */
+interface EmailTemplateVersion {
+  object: "email_template_version";
+  template_id: string;
+  version: number | null;
+  /** Counts the draft's saves; pass it back to refuse overwriting someone else's changes. */
+  revision: number;
+  /** The locale sends fall back to. */
+  default_locale: string;
+  variables: TemplateVariable[];
+  /** Example values for previews and test sends. */
+  sample_variables: Record<string, unknown>;
+  contents: TemplateContent[];
+  /** Problems of a draft; always empty for published versions. */
+  problems: TemplateProblem[];
+  published_at: string | null;
+  created_at: string;
+  updated_at: string;
+}
+interface TemplateDraftParams {
+  /** Defaults to the first entry of `contents` (or `"en"`). */
+  default_locale?: string;
+  variables?: TemplateVariableParams[];
+  sample_variables?: Record<string, unknown>;
+  contents?: TemplateContentParams[];
+}
+/** Parameters of `coss.email.templates.create`. */
+interface CreateEmailTemplateParams extends TemplateDraftParams {
+  name: string;
+  /** 1-64 lower-case letters, digits, `-` and `_`, e.g. `"welcome"`. */
+  alias?: string;
+  description?: string;
+}
+/** Parameters of `coss.email.templates.update`. */
+interface UpdateEmailTemplateParams {
+  name?: string;
+  /** `null` removes the alias. */
+  alias?: string | null;
+  description?: string | null;
+}
+/** Parameters of `coss.email.templates.updateDraft`: replaces the whole draft. */
+interface UpdateEmailTemplateDraftParams extends TemplateDraftParams {
+  /** The `revision` you read: refused (`template_revision_mismatch`) if the draft changed since. */
+  revision?: number;
+}
+/** Parameters of `coss.email.templates.publish`. */
+interface PublishEmailTemplateParams {
+  /** The draft `revision` you reviewed: refused if the draft changed since. */
+  revision?: number;
+}
+interface ListEmailTemplatesParams {
+  /** 1-100, default 50. */
+  limit?: number;
+  /** Cursor: the `id` of the last template of the previous page. */
+  after?: string;
+}
+interface ListEmailTemplateVersionsParams {
+  /** 1-20, default 10. */
+  limit?: number;
+  /** Cursor: the `version` of the last version of the previous page. */
+  after?: number;
+}
+interface DeletedEmailTemplate {
+  object: "email_template";
+  id: string;
+  deleted: true;
+}
+/** The template an email was rendered from. */
+interface EmailTemplateReference {
+  id: string;
+  /** `null` for a dashboard test send of the draft. */
+  version: number | null;
+  locale: string;
+}
+//#endregion
 //#region src/types/suppression.d.ts
 /** Suppression list wire types (hand-written mirrors of the API's schemas). */
 /**
  * Why an address is suppressed. `bounce`: a permanent bounce. `complaint`: a spam complaint.
  * `manual`: added one by one through the API or the dashboard. `import`: added by a bulk import.
+ * `unsubscribe`: the recipient's one-click unsubscribe, scoped to the email's category.
  */
-type SuppressionReason = "bounce" | "complaint" | "manual" | "import";
+type SuppressionReason = "bounce" | "complaint" | "manual" | "import" | "unsubscribe";
 /** An entry of the API key's environment's suppression list. */
 interface Suppression {
   object: "suppression";
@@ -292,7 +492,7 @@ interface EmailRecipient {
   /** ISO 8601 timestamp of the latest event for this recipient, or `null`. */
   last_event_at: string | null;
 }
-type EmailEventType = "email.sent" | "email.delivered" | "email.delivery_delayed" | "email.bounced" | "email.complained" | "email.failed" | "email.suppressed" | "email.scheduled" | "email.canceled" | "email.opened" | "email.clicked" | "email.rescheduled";
+type EmailEventType = "email.sent" | "email.delivered" | "email.delivery_delayed" | "email.bounced" | "email.complained" | "email.failed" | "email.suppressed" | "email.scheduled" | "email.canceled" | "email.opened" | "email.clicked" | "email.rescheduled" | "email.unsubscribed";
 /** Details of an event; which member is present depends on the event type. */
 interface EmailEventData {
   bounce?: {
@@ -367,23 +567,35 @@ interface TrackingOptions {
   /** Add an invisible pixel to the HTML body and record `email.opened` events. */
   opens?: boolean;
   /**
-   * Send HTML links through a COSS redirect and record `email.clicked` events. Links with a
+   * Send HTML links through a coss.com redirect and record `email.clicked` events. Links with a
    * `data-coss-no-track` attribute are left alone.
    */
   clicks?: boolean;
+  /**
+   * Add one-click unsubscribe headers (`List-Unsubscribe` and `List-Unsubscribe-Post`, RFC 8058).
+   * An unsubscribe suppresses the recipient for this email's category and records
+   * `email.unsubscribed`. Needs a `category`, a single recipient, no `List-Unsubscribe` header of
+   * your own and at most 13 custom headers.
+   */
+  unsubscribe?: boolean;
 }
-/** Body of `POST /v1/emails`. */
-interface SendEmailParams {
+/**
+ * A React element, such as `<WelcomeEmail name="Ada" />`. Described by its shape so the SDK needs
+ * no React types: any JSX element fits.
+ */
+interface ReactEmailElement {
+  type: unknown;
+  props: unknown;
+  key: unknown;
+}
+/** What every send has, with or without a template. */
+interface SendEmailBaseParams {
   /** `"you@example.com"` or `"Your Name <you@example.com>"`. */
   from: string;
   to: string | string[];
   cc?: string | string[];
   bcc?: string | string[];
   reply_to?: string | string[];
-  subject: string;
-  /** At least one of `html` or `text` is required. */
-  html?: string;
-  text?: string;
   /** Custom headers. Names are case-insensitive; reserved names such as `subject` are rejected. */
   headers?: Record<string, string>;
   tags?: EmailTag[];
@@ -402,6 +614,44 @@ interface SendEmailParams {
   attachments?: EmailAttachmentParams[];
   tracking?: TrackingOptions;
 }
+/** A send with its own subject and body. */
+interface SendEmailContentParams extends SendEmailBaseParams {
+  subject: string;
+  /** At least one of `html`, `text` or `react` is required. */
+  html?: string;
+  /** Without it, an `html` email goes out with a text part generated from the HTML. */
+  text?: string;
+  /**
+   * A [React Email](https://react.email) component, rendered by the SDK into `html` and, unless you
+   * pass `text`, into `text` too. Needs the optional peer dependency `@react-email/render`
+   * (`npm install @react-email/render`). Can't be combined with `html`; never sent to the API as is.
+   */
+  react?: ReactEmailElement;
+  template_id?: never;
+  template_version?: never;
+  locale?: never;
+  variables?: never;
+}
+/** A send of a published email template (`coss.email.templates`). */
+interface SendEmailTemplateParams extends SendEmailBaseParams {
+  /** The template's id or alias. */
+  template_id: string;
+  /** A published version to send; defaults to the latest one. */
+  template_version?: number;
+  /**
+   * The locale to send, e.g. `"pt-BR"`. Falls back to the language (`"pt"`), then to the
+   * template's default locale.
+   */
+  locale?: string;
+  /** Values for the template's variables, keyed by name. */
+  variables?: Record<string, unknown>;
+  subject?: never;
+  html?: never;
+  text?: never;
+  react?: never;
+}
+/** A send: a subject and body (or `react`, which the SDK renders before sending), or a template. */
+type SendEmailParams = SendEmailContentParams | SendEmailTemplateParams;
 /** Parameters of `coss.email.reschedule`. */
 interface RescheduleEmailParams {
   /**
@@ -417,6 +667,8 @@ interface RescheduleEmailParams {
 interface EmailTracking {
   opens: boolean;
   clicks: boolean;
+  /** Whether the email carries one-click unsubscribe headers (RFC 8058). */
+  unsubscribe: boolean;
   open_count: number;
   /** ISO 8601 timestamps, or `null`. */
   first_opened_at: string | null;
@@ -425,7 +677,7 @@ interface EmailTracking {
   first_clicked_at: string | null;
   last_clicked_at: string | null;
 }
-/** A link COSS rewrote for click tracking. */
+/** A link coss.com rewrote for click tracking. */
 interface EmailLink {
   object: "email_link";
   id: string;
@@ -437,6 +689,15 @@ interface EmailLink {
   first_clicked_at: string | null;
   last_clicked_at: string | null;
 }
+/** Why an email failed as a whole. */
+interface EmailFailure {
+  /**
+   * E.g. `all_recipients_suppressed`, `domain_not_verified`, `content_rejected`,
+   * `attachments_unavailable`, `dispatch_failed` or `provider_error`.
+   */
+  code: string;
+  message: string;
+}
 /** An email as returned by the API. Recipient fields are always arrays. */
 interface Email {
   object: "email";
@@ -454,6 +715,8 @@ interface Email {
   tags: EmailTag[];
   category: string | null;
   status: EmailStatus;
+  /** Why the email failed; `null` unless `status` is `"failed"`. */
+  failure: EmailFailure | null;
   /** Every distinct recipient across `to`, `cc` and `bcc`, with its delivery status. */
   recipients: EmailRecipient[];
   /** Attachment metadata; the content is discarded once the email is sent. */
@@ -469,6 +732,33 @@ interface Email {
   scheduled_at: string | null;
   /** The batch that sent the email (`coss.email.sendBatch`), or `null` if it was sent alone. */
   batch_id: string | null;
+  /** The template the email was rendered from, or `null` if it was sent without one. */
+  template: EmailTemplateReference | null;
+}
+/** An email in a list (`coss.email.list`): everything but its content. */
+type EmailSummary = Omit<Email, "html" | "text" | "headers" | "attachments">;
+/** Filters of `coss.email.list`. Emails are returned newest first. */
+interface ListEmailsParams {
+  /** Only emails with this recipient (in `to`, `cc` or `bcc`; the bare address, any case). */
+  to?: string;
+  /** Only emails with a recipient in one of these statuses (with `to`, that recipient's). */
+  recipient_status?: EmailRecipientStatus[];
+  /** Only emails in these statuses. */
+  status?: EmailStatus[];
+  /** Free text, matched against the subject and the `to` addresses. */
+  q?: string;
+  /** Only emails of this category. */
+  category?: string;
+  /** Only the emails of this batch. */
+  batch_id?: string;
+  /** Only emails created at or after this time. */
+  created_after?: Date | string;
+  /** Only emails created before this time. */
+  created_before?: Date | string;
+  /** 1-100, default 20. */
+  limit?: number;
+  /** Cursor: the `id` of the last email of the previous page. */
+  after?: string;
 }
 /** Emails sent together by `coss.email.sendBatch`. */
 interface EmailBatch {
@@ -481,19 +771,19 @@ interface EmailBatch {
 }
 //#endregion
 //#region src/resources/audit-events.d.ts
-type ReadOptions$12 = Pick<RequestOptions, "signal">;
+type ReadOptions$17 = Pick<RequestOptions, "signal">;
 /**
  * `coss.auditEvents`: the organization's audit log, newest first: changes made by members, API
- * keys and COSS support. Organization-wide, whichever environment the key belongs to.
+ * keys and coss.com support. Organization-wide, whichever environment the key belongs to.
  */
 declare class AuditEventsResource {
   #private;
   /** @internal Use `new Coss().auditEvents`. */
   constructor(http: HttpClient);
   /** Lists audit events, newest first. Pass the last `id` as `after` while `has_more` is true. */
-  list(params?: ListAuditEventsParams, options?: ReadOptions$12): Promise<CossResult<List<AuditEvent>>>;
+  list(params?: ListAuditEventsParams, options?: ReadOptions$17): Promise<CossResult<List<AuditEvent>>>;
   /** Retrieves one audit event. */
-  get(id: string, options?: ReadOptions$12): Promise<CossResult<AuditEvent>>;
+  get(id: string, options?: ReadOptions$17): Promise<CossResult<AuditEvent>>;
 }
 //#endregion
 //#region src/types/billing.d.ts
@@ -502,7 +792,7 @@ declare class AuditEventsResource {
  * schemas). Amounts are integers in cents (USD); unit prices are dollar decimal strings.
  */
 type PlanKey = "free" | "pro" | "scale" | "enterprise";
-type Meter = "email.recipients" | "sms.segments" | "video.participant_minutes" | "scheduling.bookings";
+type Meter = "email.recipients" | "email.dedicated_ip" | "sms.segments" | "video.participant_minutes" | "scheduling.bookings";
 type BillingHoldReason = "delinquent" | "spend_limit" | "admin";
 /** `GET /v1/billing`: the organization's plan, the current month so far, and its standing. */
 interface Billing {
@@ -560,12 +850,23 @@ interface Billing {
     brand: string | null;
     last4: string | null;
   } | null;
+  /** Add-ons of the contract in effect, charged on top of the plan. */
+  add_ons: {
+    /** e.g. `dedicated_ips`. */
+    key: string;
+    name: string;
+    quantity: number;
+    /** The price per unit and interval (cents). */
+    unit_amount: number;
+    interval: "month" | "quarter" | "year";
+  }[];
   features: {
     tracking_domains: boolean;
     audit_log: boolean;
     log_drains: boolean;
     sso: boolean;
     scim: boolean;
+    dedicated_ips: boolean;
   };
   /** Resource limits (`null`: unlimited). */
   limits: {
@@ -689,16 +990,16 @@ interface ListCreditsParams {
 }
 //#endregion
 //#region src/resources/billing.d.ts
-type ReadOptions$11 = Pick<RequestOptions, "signal">;
+type ReadOptions$16 = Pick<RequestOptions, "signal">;
 /** `coss.billing.invoices`: the organization's invoices, newest first. */
 declare class BillingInvoicesResource {
   #private;
   /** @internal Use `new Coss().billing.invoices`. */
   constructor(http: HttpClient);
   /** Lists invoices (without lines). Pass the last `id` as `after` while `has_more` is true. */
-  list(params?: ListInvoicesParams, options?: ReadOptions$11): Promise<CossResult<List<InvoiceSummary>>>;
+  list(params?: ListInvoicesParams, options?: ReadOptions$16): Promise<CossResult<List<InvoiceSummary>>>;
   /** Retrieves one invoice with its lines. */
-  get(id: string, options?: ReadOptions$11): Promise<CossResult<Invoice>>;
+  get(id: string, options?: ReadOptions$16): Promise<CossResult<Invoice>>;
 }
 /** `coss.billing.credits`: the organization's credits and what's left of them. */
 declare class BillingCreditsResource {
@@ -706,7 +1007,7 @@ declare class BillingCreditsResource {
   /** @internal Use `new Coss().billing.credits`. */
   constructor(http: HttpClient);
   /** Lists credits, newest first (usable ones by default). */
-  list(params?: ListCreditsParams, options?: ReadOptions$11): Promise<CossResult<List<Credit>>>;
+  list(params?: ListCreditsParams, options?: ReadOptions$16): Promise<CossResult<List<Credit>>>;
 }
 /**
  * `coss.billing`: the organization's plan, usage, invoices and credits (read only; plan changes
@@ -719,9 +1020,9 @@ declare class BillingResource {
   /** @internal Use `new Coss().billing`. */
   constructor(http: HttpClient);
   /** The plan, the current month's usage and estimate, standing and what the plan includes. */
-  get(options?: ReadOptions$11): Promise<CossResult<Billing>>;
+  get(options?: ReadOptions$16): Promise<CossResult<Billing>>;
   /** Billable usage per meter and bucket (the current month, by day, by default), oldest first. */
-  usage(params?: ListUsageParams, options?: ReadOptions$11): Promise<CossResult<List<Usage>>>;
+  usage(params?: ListUsageParams, options?: ReadOptions$16): Promise<CossResult<List<Usage>>>;
 }
 //#endregion
 //#region src/types/domain.d.ts
@@ -760,7 +1061,7 @@ interface DomainRecord {
   found: string[];
 }
 /**
- * `pending` until the CNAME points at COSS and its certificate is issued, `active` once tracking
+ * `pending` until the CNAME points at coss.com and its certificate is issued, `active` once tracking
  * links of emails sent from the domain use it, `temporary_failure` when an active hostname stopped
  * working (emails fall back to the default tracking host meanwhile), and `failed` when setup gave
  * up (72 hours) — call `domains.verify` to start over. `deleting` is a removal in progress.
@@ -799,7 +1100,7 @@ interface ReceivingDomainRecord {
   /** The mail exchange the record must point at. */
   value: string;
   priority: number;
-  /** `verified` once the most preferred MX records point at COSS. */
+  /** `verified` once the most preferred MX records point at coss.com. */
   status: DomainRecordStatus;
   /** What DNS returned when it did not match. */
   found: string[];
@@ -814,6 +1115,39 @@ interface ReceivingDomain {
   created_at: string;
   last_checked_at: string | null;
 }
+/**
+ * `configured` when the BIMI record is valid and DMARC is enforced, `invalid` when a record exists
+ * but something is wrong (see `issues`), `missing` when there is no record, and `not_checked` until
+ * DNS has been consulted. coss.com checks DNS only: mailbox providers still validate the logo and the
+ * certificate.
+ */
+type BimiStatus = "not_checked" | "missing" | "invalid" | "configured";
+/** What keeps a domain's logo from showing, as far as DNS tells. */
+type BimiIssueCode = "dmarc_missing" | "dmarc_not_enforced" | "dmarc_partial" | "record_multiple" | "record_invalid" | "logo_missing" | "logo_not_https" | "certificate_missing" | "certificate_not_https";
+/** The last BIMI check of a domain (brand logos in inboxes; the certificate is your own). */
+interface DomainBimi {
+  status: BimiStatus;
+  /**
+   * Where the BIMI record was found, or looked up when there is none: `default._bimi.<domain>`,
+   * or the organizational domain's when only it has one.
+   */
+  name: string;
+  /** The `v=BIMI1` record found. */
+  record: string | null;
+  /** The record's logo URL (`l=`). */
+  logo_url: string | null;
+  /** The record's VMC or CMC certificate URL (`a=`). */
+  certificate_url: string | null;
+  /**
+   * The DMARC policy that applies to the domain (the organizational domain's `sp` when it has no
+   * record of its own), `null` without a DMARC record.
+   */
+  dmarc_policy: "none" | "quarantine" | "reject" | null;
+  issues: {
+    code: BimiIssueCode;
+    message: string;
+  }[];
+}
 /** A sending domain of the organization. */
 interface Domain {
   object: "domain";
@@ -838,6 +1172,8 @@ interface Domain {
   tracking: TrackingDomain | null;
   /** The receiving hostname, or `null` when the domain doesn't receive email. */
   receiving: ReceivingDomain | null;
+  /** The last BIMI check: whether mailbox providers can find the domain's brand logo. */
+  bimi: DomainBimi;
 }
 /** Body of `POST /v1/domains`. */
 interface CreateDomainParams {
@@ -864,6 +1200,201 @@ interface CreateReceivingDomainParams {
   hostname: string;
 }
 //#endregion
+//#region src/types/dmarc.d.ts
+/** DMARC wire types (hand-written mirrors of the API's `DomainDmarc` and `DmarcReport` schemas). */
+type DmarcPolicy = "none" | "quarantine" | "reject";
+/** Where a domain is on the path from `p=none` to `p=reject`. */
+type DmarcStage = "not_checked" | "no_record" | "monitoring" | "quarantine" | "reject";
+/**
+ * `publish` a first record, `add_reporting` (send reports to coss.com), `complete_rollout` (drop
+ * `pct`/`t=y`) or `tighten` to the next policy.
+ */
+type DmarcNextStepKind = "publish" | "add_reporting" | "complete_rollout" | "tighten";
+type DmarcCheckId = "coverage" | "recent" | "complete" | "time_at_policy" | "coss_pass_rate" | "pass_rate" | "sources";
+/** The DMARC record found at `_dmarc.<domain>` by the latest DNS check. */
+interface DmarcPublishedRecord {
+  /** The `v=DMARC1` TXT record as published. */
+  value: string;
+  p: DmarcPolicy | null;
+  sp: DmarcPolicy | null;
+  np: DmarcPolicy | null;
+  adkim: "r" | "s" | null;
+  aspf: "r" | "s" | null;
+  /** Removed by RFC 9989 but still honored by many receivers. */
+  pct: number | null;
+  t: "y" | "n" | null;
+  /** Aggregate report addresses. */
+  rua: string[];
+}
+/** Messages from one source IP with one From domain, over the report summary's period. */
+interface DmarcSource {
+  source_ip: string;
+  /** The domain in the messages' From header. */
+  header_from: string;
+  messages: number;
+  /** Messages that passed DMARC. */
+  passing: number;
+  /** Signed with the domain's coss.com DKIM keys or sent from its coss.com MAIL FROM domain. */
+  via_coss: boolean;
+}
+/** One readiness check gating `DomainDmarc.next`. */
+interface DmarcCheck {
+  id: DmarcCheckId;
+  ok: boolean;
+  message: string;
+}
+/** The next step on the path to `p=reject`. */
+interface DmarcNextStep {
+  kind: DmarcNextStepKind;
+  policy: DmarcPolicy;
+  /** The TXT record to publish at `_dmarc.<domain>`. */
+  record: string;
+}
+/** A domain's DMARC status: its record, the guided next step and recent reports. */
+interface DomainDmarc {
+  object: "domain_dmarc";
+  domain_id: string;
+  /** Where the domain's aggregate reports go; `null` when the deployment doesn't receive email. */
+  report_address: string | null;
+  /** The domain's own record. `null`: none found (or an invalid one), or DNS not checked yet. */
+  record: DmarcPublishedRecord | null;
+  /** The policy receivers apply: the domain's own, else its organizational domain's (`sp`, else `p`). */
+  policy: DmarcPolicy | null;
+  /** The organizational domain whose record applies, when the domain publishes none of its own. */
+  inherited_from: string | null;
+  /** ISO 8601 timestamp: when a DNS check first saw the current policy. */
+  policy_since: string | null;
+  stage: DmarcStage;
+  /** The policy applies only partly (`pct` below 100, or `t=y`). */
+  partial: boolean;
+  /** The published record sends aggregate reports to `report_address`. */
+  reporting: boolean;
+  /** Whether `next` is safe to publish now. */
+  ready: boolean;
+  /** `null` at `p=reject`. */
+  next: DmarcNextStep | null;
+  checks: DmarcCheck[];
+  warnings: string[];
+  report_summary: {
+    /** ISO 8601 timestamps of the summarized period (the last 14 days). */
+    period_start: string;
+    period_end: string;
+    reports: number;
+    messages: number;
+    passing: number;
+    coss_messages: number;
+    coss_passing: number;
+    first_report_at: string | null;
+    last_report_at: string | null;
+    /** The 50 sources with the most messages in the period. */
+    sources: DmarcSource[];
+  };
+}
+/** The policy a reporter found when it evaluated the mail. */
+interface DmarcPolicyPublished {
+  domain: string;
+  p: string | null;
+  sp: string | null;
+  np: string | null;
+  adkim: string | null;
+  aspf: string | null;
+  pct: number | null;
+  testing: string | null;
+}
+/** A DMARC aggregate report, without its rows (lists). */
+interface DmarcReportSummary {
+  object: "dmarc_report";
+  id: string;
+  domain_id: string;
+  reporter: {
+    org_name: string;
+    email: string | null;
+  };
+  /** The reporter's own id of the report. */
+  report_id: string;
+  /** ISO 8601 timestamps. */
+  period_start: string;
+  period_end: string;
+  policy_published: DmarcPolicyPublished;
+  messages: number;
+  passing: number;
+  /** The report listed more rows than are kept (10,000); totals cover the kept rows. */
+  truncated: boolean;
+  /** ISO 8601 timestamp. */
+  received_at: string;
+}
+/** One row of a report: messages from one source IP with one outcome. */
+interface DmarcReportRecord {
+  source_ip: string;
+  count: number;
+  /** What the receiver did with the messages. */
+  disposition: DmarcPolicy;
+  /** Aligned DKIM result. */
+  dkim: "pass" | "fail";
+  /** Aligned SPF result. */
+  spf: "pass" | "fail";
+  dmarc_pass: boolean;
+  header_from: string;
+  envelope_from: string | null;
+  via_coss: boolean;
+  auth_results: {
+    dkim: {
+      domain: string;
+      selector: string | null;
+      result: string;
+    }[];
+    spf: {
+      domain: string;
+      scope: string | null;
+      result: string;
+    }[];
+  };
+  reasons: {
+    type: string;
+    comment: string | null;
+  }[];
+}
+/** A DMARC aggregate report with its rows. */
+interface DmarcReport extends DmarcReportSummary {
+  records: DmarcReportRecord[];
+}
+/** Query of `coss.domains.dmarc.reports.list`. */
+interface ListDmarcReportsParams {
+  /** 1-100, default 20. */
+  limit?: number;
+  /** The `id` of the last report of the previous page. */
+  after?: string;
+}
+//#endregion
+//#region src/resources/dmarc.d.ts
+type ReadOptions$15 = Pick<RequestOptions, "signal">;
+/** `coss.domains.dmarc.reports`: the aggregate reports received about a domain. */
+declare class DmarcReportsResource {
+  #private;
+  /** @internal Use `new Coss().domains.dmarc.reports`. */
+  constructor(http: HttpClient);
+  /** Lists the domain's reports, newest first, without their rows. */
+  list(domainId: string, params?: ListDmarcReportsParams, options?: ReadOptions$15): Promise<CossResult<List<DmarcReportSummary>>>;
+  /** Retrieves one report with its rows. */
+  get(domainId: string, reportId: string, options?: ReadOptions$15): Promise<CossResult<DmarcReport>>;
+}
+/**
+ * `coss.domains.dmarc`: a domain's DMARC record, the guided path from `p=none` to `p=reject`, and
+ * the aggregate reports mailbox providers send to its `report_address`.
+ */
+declare class DmarcResource {
+  #private;
+  /** The domain's aggregate reports. */
+  readonly reports: DmarcReportsResource;
+  /** @internal Use `new Coss().domains.dmarc`. */
+  constructor(http: HttpClient);
+  /**
+   * The domain's DMARC status: its published record, the record to publish next and whether
+   * the last 14 days of reports say that is safe (`ready`), and a summary of those reports.
+   */
+  get(domainId: string, options?: ReadOptions$15): Promise<CossResult<DomainDmarc>>;
+}
+//#endregion
 //#region src/resources/receiving-domains.d.ts
 type DeleteOptions$1 = Pick<RequestOptions, "signal">;
 /**
@@ -906,7 +1437,7 @@ declare class TrackingDomainsResource {
 }
 //#endregion
 //#region src/resources/domains.d.ts
-type ReadOptions$10 = Pick<RequestOptions, "signal">;
+type ReadOptions$14 = Pick<RequestOptions, "signal">;
 /**
  * `coss.domains`: the domains live (`coss_live_…`) keys may send from. Domains belong to the
  * organization, so every API key of the organization sees the same ones.
@@ -917,6 +1448,8 @@ declare class DomainsResource {
   readonly tracking: TrackingDomainsResource;
   /** Each domain's receiving hostname: start and stop receiving email at it. */
   readonly receiving: ReceivingDomainsResource;
+  /** Each domain's DMARC status, guidance and aggregate reports. */
+  readonly dmarc: DmarcResource;
   /** @internal Use `new Coss().domains`. */
   constructor(http: HttpClient);
   /**
@@ -925,9 +1458,9 @@ declare class DomainsResource {
    */
   create(params: CreateDomainParams, options?: RequestOptions): Promise<CossResult<Domain>>;
   /** Lists the organization's domains, ordered by name. */
-  list(options?: ReadOptions$10): Promise<CossResult<List<Domain>>>;
+  list(options?: ReadOptions$14): Promise<CossResult<List<Domain>>>;
   /** Retrieves a domain with the result of the last DNS check. */
-  get(id: string, options?: ReadOptions$10): Promise<CossResult<Domain>>;
+  get(id: string, options?: ReadOptions$14): Promise<CossResult<Domain>>;
   /**
    * Checks the domain's records now instead of waiting for the next background check. A `failed`
    * domain starts verification over with fresh DKIM records, which have to be published again.
@@ -935,7 +1468,103 @@ declare class DomainsResource {
    */
   verify(id: string, options?: RequestOptions): Promise<CossResult<Domain>>;
   /** Removes the domain. Emails already sent are unaffected; live keys can no longer use it. */
-  delete(id: string, options?: ReadOptions$10): Promise<CossResult<DeletedDomain>>;
+  delete(id: string, options?: ReadOptions$14): Promise<CossResult<DeletedDomain>>;
+}
+//#endregion
+//#region src/types/dedicated-ip.d.ts
+/** Dedicated IP wire types (hand-written mirrors of the API's `DedicatedIpPool` schema). */
+type DedicatedIpPoolStatus = "not_enabled" | "waiting" | "provisioning" | "warming" | "ready" | "releasing";
+/** `GET /v1/dedicated_ips`: the organization's dedicated IPs (the Dedicated IPs add-on). */
+interface DedicatedIpPool {
+  object: "dedicated_ip_pool";
+  /**
+   * `warming`: live emails go through the pool while its IPs warm up (what they can't take yet
+   * leaves from shared IPs); `ready`: at least 95% of the last 7 days' deliveries left from them.
+   */
+  status: DedicatedIpPoolStatus;
+  /** The pool's IPs, with their deliveries in the last 7 days. */
+  ips: {
+    ip: string;
+    delivered_7d: number;
+  }[];
+  /** Share (0–1) of the last 7 days' deliveries from the pool's IPs; `null` below 1,000. */
+  dedicated_share: number | null;
+  /** What is holding the pool up, if anything. */
+  message: string | null;
+  created_at: string | null;
+  /** When it was first `ready`. */
+  ready_at: string | null;
+}
+//#endregion
+//#region src/resources/dedicated-ips.d.ts
+type ReadOptions$13 = Pick<RequestOptions, "signal">;
+/**
+ * `coss.email.dedicatedIps`: the organization's own sending IPs (the Dedicated IPs add-on),
+ * managed and warmed up automatically.
+ */
+declare class DedicatedIpsResource {
+  #private;
+  /** @internal Use `new Coss().email.dedicatedIps`. */
+  constructor(http: HttpClient);
+  /** The pool's status and IPs (`not_enabled` without the add-on). */
+  get(options?: ReadOptions$13): Promise<CossResult<DedicatedIpPool>>;
+}
+//#endregion
+//#region src/resources/email-templates.d.ts
+type ReadOptions$12 = Pick<RequestOptions, "signal">;
+/** `coss.email.templates.versions`: a template's published versions. */
+declare class EmailTemplateVersionsResource {
+  #private;
+  /** @internal Use `new Coss().email.templates.versions`. */
+  constructor(http: HttpClient);
+  /** Published versions, newest first. */
+  list(template: string, params?: ListEmailTemplateVersionsParams, options?: ReadOptions$12): Promise<CossResult<List<EmailTemplateVersion>>>;
+  get(template: string, version: number, options?: ReadOptions$12): Promise<CossResult<EmailTemplateVersion>>;
+  /**
+   * Replaces the draft with this version's content; publish the draft to send it again. Never
+   * automatically retried: every restore is a new draft revision, so a repeat could overwrite an
+   * edit saved in between.
+   */
+  restore(template: string, version: number, options?: ReadOptions$12): Promise<CossResult<EmailTemplateVersion>>;
+}
+/**
+ * `coss.email.templates`: the environment's email templates. Templates are addressed by id or
+ * alias. Edit the draft, publish it, then send with `coss.email.send({ template_id, variables })`.
+ */
+declare class EmailTemplatesResource {
+  #private;
+  /** Published versions. */
+  readonly versions: EmailTemplateVersionsResource;
+  /** @internal Use `new Coss().email.templates`. */
+  constructor(http: HttpClient);
+  /**
+   * Creates a template and its draft. Never automatically retried: the API doesn't deduplicate it
+   * (a template with an `alias` can't be created twice, though).
+   */
+  create(params: CreateEmailTemplateParams, options?: RequestOptions): Promise<CossResult<EmailTemplate>>;
+  /** The environment's templates, newest first. */
+  list(params?: ListEmailTemplatesParams, options?: ReadOptions$12): Promise<CossResult<List<EmailTemplate>>>;
+  get(template: string, options?: ReadOptions$12): Promise<CossResult<EmailTemplate>>;
+  /** Changes its name, alias or description. */
+  update(template: string, params: UpdateEmailTemplateParams, options?: ReadOptions$12): Promise<CossResult<EmailTemplate>>;
+  /** Deletes it with every version. Emails already sent keep their content. */
+  delete(template: string, options?: ReadOptions$12): Promise<CossResult<DeletedEmailTemplate>>;
+  /** The draft, with `problems` that keep it from being published. */
+  getDraft(template: string, options?: ReadOptions$12): Promise<CossResult<EmailTemplateVersion>>;
+  /**
+   * Replaces the whole draft. Sends keep using the published version until you publish. Never
+   * automatically retried: every save is a new revision, so a repeat whose first attempt was saved
+   * would fail with `template_revision_mismatch` (or, without `revision`, overwrite an edit saved
+   * in between). Read the draft again before retrying.
+   */
+  updateDraft(template: string, params: UpdateEmailTemplateDraftParams, options?: ReadOptions$12): Promise<CossResult<EmailTemplateVersion>>;
+  /**
+   * Publishes the draft as the next version, which sends use from then on. Automatically retried
+   * only with a `revision`: a draft without changes since the last publish returns that version,
+   * and one saved again since is refused. Without it, a retry could publish someone else's newer
+   * edits as yet another version.
+   */
+  publish(template: string, params?: PublishEmailTemplateParams, options?: ReadOptions$12): Promise<CossResult<EmailTemplateVersion>>;
 }
 //#endregion
 //#region src/types/received-email.d.ts
@@ -1027,7 +1656,7 @@ interface DeletedReceivedEmail {
   id: string;
   deleted: true;
 }
-/** The environment's own domain under COSS's inbound domain: any address at it is received. */
+/** The environment's own domain under coss.com's inbound domain: any address at it is received. */
 interface InboundAddress {
   object: "inbound_address";
   environment_id: string;
@@ -1035,7 +1664,7 @@ interface InboundAddress {
 }
 //#endregion
 //#region src/resources/received-emails.d.ts
-type ReadOptions$9 = Pick<RequestOptions, "signal">;
+type ReadOptions$11 = Pick<RequestOptions, "signal">;
 /**
  * `coss.email.received`: emails received by the API key's environment, at its inbound address
  * (`address()`) or at a receiving domain (`coss.domains.receiving`). An `email.received` webhook
@@ -1046,24 +1675,24 @@ declare class ReceivedEmailsResource {
   /** @internal Use `new Coss().email.received`. */
   constructor(http: HttpClient);
   /** Lists received emails, newest first, without bodies. Pass the last `id` as `after` while `has_more` is true. */
-  list(params?: ListReceivedEmailsParams, options?: ReadOptions$9): Promise<CossResult<List<ReceivedEmailSummary>>>;
+  list(params?: ListReceivedEmailsParams, options?: ReadOptions$11): Promise<CossResult<List<ReceivedEmailSummary>>>;
   /** Retrieves a received email with its headers and bodies. */
-  get(id: string, options?: ReadOptions$9): Promise<CossResult<ReceivedEmail>>;
+  get(id: string, options?: ReadOptions$11): Promise<CossResult<ReceivedEmail>>;
   /** The whole message as received (`message/rfc822` bytes). */
-  getRaw(id: string, options?: ReadOptions$9): Promise<CossResult<Uint8Array>>;
+  getRaw(id: string, options?: ReadOptions$11): Promise<CossResult<Uint8Array>>;
   /** An attachment's bytes (untrusted: its declared type is the attachment's `content_type`). */
-  getAttachment(id: string, attachmentId: string, options?: ReadOptions$9): Promise<CossResult<Uint8Array>>;
+  getAttachment(id: string, attachmentId: string, options?: ReadOptions$11): Promise<CossResult<Uint8Array>>;
   /**
    * The environment's inbound domain: email to any address at it (`support@<domain>`) is
    * received, with no DNS setup.
    */
-  address(options?: ReadOptions$9): Promise<CossResult<InboundAddress>>;
+  address(options?: ReadOptions$11): Promise<CossResult<InboundAddress>>;
   /** Deletes a received email with its raw message and attachments right away. */
-  delete(id: string, options?: ReadOptions$9): Promise<CossResult<DeletedReceivedEmail>>;
+  delete(id: string, options?: ReadOptions$11): Promise<CossResult<DeletedReceivedEmail>>;
 }
 //#endregion
 //#region src/resources/suppressions.d.ts
-type ReadOptions$8 = Pick<RequestOptions, "signal">;
+type ReadOptions$10 = Pick<RequestOptions, "signal">;
 /**
  * `coss.email.suppressions`: the suppression list of the API key's environment. Sends skip
  * suppressed recipients; permanent bounces and complaints are added automatically.
@@ -1082,20 +1711,20 @@ declare class SuppressionResource {
    * and reported in `invalid`; entries already on the list count as `existing`. If a request
    * fails, the earlier batches stay imported: importing everything again is safe.
    */
-  import(params: ImportSuppressionsParams, options?: ReadOptions$8): Promise<CossResult<SuppressionImport>>;
+  import(params: ImportSuppressionsParams, options?: ReadOptions$10): Promise<CossResult<SuppressionImport>>;
   /**
    * The whole list as CSV (`address,scope,reason,created_at,email_id,id`, oldest first), which
    * `import` (or the dashboard) accepts again.
    */
-  export(params?: ExportSuppressionsParams, options?: ReadOptions$8): Promise<CossResult<string>>;
+  export(params?: ExportSuppressionsParams, options?: ReadOptions$10): Promise<CossResult<string>>;
   /** Lists entries, newest first. Pass the last `id` as `after` while `has_more` is true. */
-  list(params?: ListSuppressionsParams, options?: ReadOptions$8): Promise<CossResult<List<Suppression>>>;
+  list(params?: ListSuppressionsParams, options?: ReadOptions$10): Promise<CossResult<List<Suppression>>>;
   /** Whether a send to `address` (with `category`, if given) would skip it. */
-  check(params: CheckSuppressionParams, options?: ReadOptions$8): Promise<CossResult<SuppressionCheck>>;
+  check(params: CheckSuppressionParams, options?: ReadOptions$10): Promise<CossResult<SuppressionCheck>>;
   /** Retrieves one entry. */
-  get(id: string, options?: ReadOptions$8): Promise<CossResult<Suppression>>;
+  get(id: string, options?: ReadOptions$10): Promise<CossResult<Suppression>>;
   /** Removes an entry, so later sends reach the address again (e.g. when a recipient resubscribes). */
-  remove(id: string, options?: ReadOptions$8): Promise<CossResult<DeletedSuppression>>;
+  remove(id: string, options?: ReadOptions$10): Promise<CossResult<DeletedSuppression>>;
 }
 //#endregion
 //#region src/types/tracking.d.ts
@@ -1110,14 +1739,20 @@ interface TrackingRule {
   opens: boolean;
   /** Whether clicks are tracked. */
   clicks: boolean;
+  /**
+   * Whether emails get one-click unsubscribe headers (only emails with a category and a single
+   * recipient).
+   */
+  unsubscribe: boolean;
   /** ISO 8601 timestamp. */
   created_at: string;
   /** ISO 8601 timestamp. */
   updated_at: string;
 }
 /**
- * Open and click tracking settings of the API key's environment. For each of `opens` and
- * `clicks`, a send's own `tracking` wins, then its category's rule, then `default`, then off.
+ * Open and click tracking and one-click unsubscribe settings of the API key's environment. For
+ * each of `opens`, `clicks` and `unsubscribe`, a send's own `tracking` wins, then its category's
+ * rule, then `default`, then off.
  */
 interface TrackingSettings {
   object: "tracking_settings";
@@ -1128,11 +1763,13 @@ interface TrackingSettings {
 }
 /**
  * Body of `PATCH /v1/tracking_settings/default` and `…/categories/{category}`: at least one
- * field. Fields left out keep their value; a new rule starts with both off.
+ * field. Fields left out keep their value; a new rule starts with all off.
  */
 interface UpdateTrackingRuleParams {
   opens?: boolean;
   clicks?: boolean;
+  /** Add one-click unsubscribe headers to emails with a category and a single recipient. */
+  unsubscribe?: boolean;
 }
 /** Returned when a rule is removed. */
 interface DeletedTrackingRule {
@@ -1143,32 +1780,32 @@ interface DeletedTrackingRule {
 }
 //#endregion
 //#region src/resources/tracking.d.ts
-type ReadOptions$7 = Pick<RequestOptions, "signal">;
+type ReadOptions$9 = Pick<RequestOptions, "signal">;
 /**
  * `coss.email.tracking`: which emails of the API key's environment have their opens and clicks
- * tracked. Emails keep the settings that applied when they were sent; a send's own `tracking`
- * option wins over them.
+ * tracked and get one-click unsubscribe headers. Emails keep the settings that applied when they
+ * were sent; a send's own `tracking` option wins over them.
  */
 declare class TrackingResource {
   #private;
   /** @internal Use `new Coss().email.tracking`. */
   constructor(http: HttpClient);
   /** The environment default and the category rules. */
-  get(options?: ReadOptions$7): Promise<CossResult<TrackingSettings>>;
+  get(options?: ReadOptions$9): Promise<CossResult<TrackingSettings>>;
   /**
    * Sets the environment default, which applies to emails without a rule for their category.
    * Fields left out keep their value; a new default starts with both off.
    */
-  updateDefault(params: UpdateTrackingRuleParams, options?: ReadOptions$7): Promise<CossResult<TrackingRule>>;
+  updateDefault(params: UpdateTrackingRuleParams, options?: ReadOptions$9): Promise<CossResult<TrackingRule>>;
   /** Removes the environment default: emails without a category rule are then not tracked. */
-  removeDefault(options?: ReadOptions$7): Promise<CossResult<DeletedTrackingRule>>;
+  removeDefault(options?: ReadOptions$9): Promise<CossResult<DeletedTrackingRule>>;
   /**
    * Sets the rule for emails sent with `category`, which wins over the default. Fields left out
    * keep their value; a new rule starts with both off.
    */
-  updateCategory(category: string, params: UpdateTrackingRuleParams, options?: ReadOptions$7): Promise<CossResult<TrackingRule>>;
+  updateCategory(category: string, params: UpdateTrackingRuleParams, options?: ReadOptions$9): Promise<CossResult<TrackingRule>>;
   /** Removes a category's rule: its emails follow the environment default again. */
-  removeCategory(category: string, options?: ReadOptions$7): Promise<CossResult<DeletedTrackingRule>>;
+  removeCategory(category: string, options?: ReadOptions$9): Promise<CossResult<DeletedTrackingRule>>;
 }
 //#endregion
 //#region src/resources/email.d.ts
@@ -1181,13 +1818,19 @@ declare class EmailResource {
   readonly tracking: TrackingResource;
   /** Emails the environment received. */
   readonly received: ReceivedEmailsResource;
+  /** The environment's email templates. */
+  readonly templates: EmailTemplatesResource;
+  /** The organization's dedicated IPs. */
+  readonly dedicatedIps: DedicatedIpsResource;
   /** @internal Use `new Coss().email`. */
   constructor(http: HttpClient);
   /**
-   * Sends an email. It is returned `queued` and handed to the delivery provider moments later:
+   * Sends an email, with its own subject and body or from a published template (`template_id`
+   * and `variables`). It is returned `queued` and handed to the delivery provider moments later:
    * `get` it or listen for the `email.sent` / `email.failed` webhooks for the outcome. Safe to
    * retry: the request always carries an `Idempotency-Key` (yours, or a generated one reused
-   * across automatic retries), so the API never sends it twice.
+   * across automatic retries), so the API never sends it twice. A `react` component is rendered
+   * once, before the first attempt.
    */
   send(params: SendEmailParams, options?: RequestOptions): Promise<CossResult<Email>>;
   /**
@@ -1197,8 +1840,16 @@ declare class EmailResource {
    * the whole batch. Larger lists need several calls, each with its own key.
    */
   sendBatch(emails: SendEmailParams[], options?: RequestOptions): Promise<CossResult<EmailBatch>>;
+  /** Retrieves a batch sent by `sendBatch`, with its emails' current statuses in request order. */
+  getBatch(id: string, options?: Pick<RequestOptions, "signal">): Promise<CossResult<EmailBatch>>;
   /** Retrieves an email sent from the same environment as the API key. */
   get(id: string, options?: Pick<RequestOptions, "signal">): Promise<CossResult<Email>>;
+  /**
+   * Lists emails sent from the same environment as the API key, newest first and without their
+   * content (`get` one for `html`, `text`, `headers` and `attachments`). Pass the last `id` as
+   * `after` while `has_more` is true.
+   */
+  list(params?: ListEmailsParams, options?: Pick<RequestOptions, "signal">): Promise<CossResult<List<EmailSummary>>>;
   /**
    * Cancels a scheduled email. Canceling an already canceled email returns it; any other email
    * fails with `email_not_cancelable`.
@@ -1216,10 +1867,21 @@ declare class EmailResource {
   listLinks(id: string, options?: Pick<RequestOptions, "signal">): Promise<CossResult<List<EmailLink>>>;
 }
 //#endregion
+//#region src/resources/environment.d.ts
+type ReadOptions$8 = Pick<RequestOptions, "signal">;
+/** `coss.environment`: which environment, project and organization the API key belongs to. */
+declare class EnvironmentResource {
+  #private;
+  /** @internal Use `new Coss().environment`. */
+  constructor(http: HttpClient);
+  /** The API key's environment, its project and organization, and the key itself. */
+  get(options?: ReadOptions$8): Promise<CossResult<Environment>>;
+}
+//#endregion
 //#region src/types/hooks.d.ts
 /**
  * Hooks wire types (webhooks as a service): you send a message to one of your applications once,
- * COSS delivers it to every endpoint its users registered, signed, with retries.
+ * coss.com delivers it to every endpoint its users registered, signed, with retries.
  */
 /** One of your customers (or users), with their own endpoints and portal. */
 interface HookApplication {
@@ -1376,7 +2038,7 @@ interface RecoverHookEndpointParams {
   /** Requeue failed deliveries of messages sent since then (ISO 8601 string or `Date`). */
   since: string | Date;
 }
-/** A recovery: COSS requeues the matching failed deliveries in the background. */
+/** A recovery: coss.com requeues the matching failed deliveries in the background. */
 interface HookEndpointRecovery {
   object: "hook_endpoint_recovery";
   id: string;
@@ -1488,7 +2150,7 @@ interface HookPortalSession {
 }
 //#endregion
 //#region src/resources/hooks.d.ts
-type ReadOptions$6 = Pick<RequestOptions, "signal">;
+type ReadOptions$7 = Pick<RequestOptions, "signal">;
 /** `coss.hooks.applications`: your customers, each with their own endpoints and portal. */
 declare class HookApplicationsResource {
   #private;
@@ -1497,12 +2159,12 @@ declare class HookApplicationsResource {
   /** Creates an application. Never automatically retried (the API does not deduplicate it). */
   create(params: CreateHookApplicationParams, options?: RequestOptions): Promise<CossResult<HookApplication>>;
   /** Lists the environment's applications, newest first. */
-  list(params?: ListHookApplicationsParams, options?: ReadOptions$6): Promise<CossResult<List<HookApplication>>>;
+  list(params?: ListHookApplicationsParams, options?: ReadOptions$7): Promise<CossResult<List<HookApplication>>>;
   /** Retrieves an application by its id or uid. */
-  get(application: string, options?: ReadOptions$6): Promise<CossResult<HookApplication>>;
-  update(application: string, params: UpdateHookApplicationParams, options?: ReadOptions$6): Promise<CossResult<HookApplication>>;
+  get(application: string, options?: ReadOptions$7): Promise<CossResult<HookApplication>>;
+  update(application: string, params: UpdateHookApplicationParams, options?: ReadOptions$7): Promise<CossResult<HookApplication>>;
   /** Deletes the application with its endpoints and portal sessions. */
-  delete(application: string, options?: ReadOptions$6): Promise<CossResult<DeletedHookApplication>>;
+  delete(application: string, options?: ReadOptions$7): Promise<CossResult<DeletedHookApplication>>;
 }
 /** `coss.hooks.eventTypes`: the catalog of messages you send, which your users subscribe from. */
 declare class HookEventTypesResource {
@@ -1512,12 +2174,12 @@ declare class HookEventTypesResource {
   /** Creates an event type. Never automatically retried (a retry would find it existing). */
   create(params: CreateHookEventTypeParams, options?: RequestOptions): Promise<CossResult<HookEventType>>;
   /** Lists event types by name (archived ones only with `include_archived`). */
-  list(params?: ListHookEventTypesParams, options?: ReadOptions$6): Promise<CossResult<List<HookEventType>>>;
-  get(name: string, options?: ReadOptions$6): Promise<CossResult<HookEventType>>;
+  list(params?: ListHookEventTypesParams, options?: ReadOptions$7): Promise<CossResult<List<HookEventType>>>;
+  get(name: string, options?: ReadOptions$7): Promise<CossResult<HookEventType>>;
   /** Changes its description, schema or examples, or archives or restores it. */
-  update(name: string, params: UpdateHookEventTypeParams, options?: ReadOptions$6): Promise<CossResult<HookEventType>>;
+  update(name: string, params: UpdateHookEventTypeParams, options?: ReadOptions$7): Promise<CossResult<HookEventType>>;
   /** Archives it: hidden from the portal and new subscriptions. */
-  archive(name: string, options?: ReadOptions$6): Promise<CossResult<HookEventType>>;
+  archive(name: string, options?: ReadOptions$7): Promise<CossResult<HookEventType>>;
 }
 /** `coss.hooks.endpoints`: an application's endpoints (usually added by its users in the portal). */
 declare class HookEndpointsResource {
@@ -1526,23 +2188,23 @@ declare class HookEndpointsResource {
   constructor(http: HttpClient);
   /** Creates an endpoint; the result carries its secret. Never automatically retried. */
   create(application: string, params: CreateHookEndpointParams, options?: RequestOptions): Promise<CossResult<HookEndpointWithSecret>>;
-  list(application: string, options?: ReadOptions$6): Promise<CossResult<List<HookEndpoint>>>;
-  get(application: string, id: string, options?: ReadOptions$6): Promise<CossResult<HookEndpoint>>;
-  update(application: string, id: string, params: UpdateHookEndpointParams, options?: ReadOptions$6): Promise<CossResult<HookEndpoint>>;
-  delete(application: string, id: string, options?: ReadOptions$6): Promise<CossResult<DeletedHookEndpoint>>;
+  list(application: string, options?: ReadOptions$7): Promise<CossResult<List<HookEndpoint>>>;
+  get(application: string, id: string, options?: ReadOptions$7): Promise<CossResult<HookEndpoint>>;
+  update(application: string, id: string, params: UpdateHookEndpointParams, options?: ReadOptions$7): Promise<CossResult<HookEndpoint>>;
+  delete(application: string, id: string, options?: ReadOptions$7): Promise<CossResult<DeletedHookEndpoint>>;
   /** The endpoint's current signing secret. */
-  getSecret(application: string, id: string, options?: ReadOptions$6): Promise<CossResult<HookEndpointSecret>>;
+  getSecret(application: string, id: string, options?: ReadOptions$7): Promise<CossResult<HookEndpointSecret>>;
   /** Replaces the signing secret. Never automatically retried (a second roll would stop the first). */
   rollSecret(application: string, id: string, params?: RollHookEndpointSecretParams, options?: RequestOptions): Promise<CossResult<HookEndpointWithSecret>>;
   /** Requeues the endpoint's failed deliveries of messages sent since `since` (in the background). */
   recover(application: string, id: string, params: RecoverHookEndpointParams, options?: RequestOptions): Promise<CossResult<HookEndpointRecovery>>;
-  getRecovery(application: string, id: string, recoveryId: string, options?: ReadOptions$6): Promise<CossResult<HookEndpointRecovery>>;
+  getRecovery(application: string, id: string, recoveryId: string, options?: ReadOptions$7): Promise<CossResult<HookEndpointRecovery>>;
   /** Sends a message to this endpoint only. Never automatically retried. */
   sendTest(application: string, id: string, params: SendHookTestParams, options?: RequestOptions): Promise<CossResult<HookMessage>>;
   /** The endpoint's deliveries, newest first. */
-  listDeliveries(application: string, id: string, params?: ListHookDeliveriesParams, options?: ReadOptions$6): Promise<CossResult<List<HookDelivery>>>;
+  listDeliveries(application: string, id: string, params?: ListHookDeliveriesParams, options?: ReadOptions$7): Promise<CossResult<List<HookDelivery>>>;
 }
-/** `coss.hooks.messages`: send a message once; COSS delivers it to every subscribed endpoint. */
+/** `coss.hooks.messages`: send a message once; coss.com delivers it to every subscribed endpoint. */
 declare class HookMessagesResource {
   #private;
   /** @internal Use `new Coss().hooks.messages`. */
@@ -1553,19 +2215,19 @@ declare class HookMessagesResource {
    */
   send(params: SendHookMessageParams, options?: RequestOptions): Promise<CossResult<HookMessage>>;
   /** The application's messages, newest first. */
-  list(application: string, params?: ListHookMessagesParams, options?: ReadOptions$6): Promise<CossResult<List<HookMessage>>>;
-  get(application: string, id: string, options?: ReadOptions$6): Promise<CossResult<HookMessage>>;
+  list(application: string, params?: ListHookMessagesParams, options?: ReadOptions$7): Promise<CossResult<List<HookMessage>>>;
+  get(application: string, id: string, options?: ReadOptions$7): Promise<CossResult<HookMessage>>;
   /** One delivery per endpoint the message went to. */
-  listDeliveries(application: string, id: string, options?: ReadOptions$6): Promise<CossResult<List<HookDelivery>>>;
+  listDeliveries(application: string, id: string, options?: ReadOptions$7): Promise<CossResult<List<HookDelivery>>>;
 }
 /** `coss.hooks.deliveries`: one message's delivery to one endpoint. */
 declare class HookDeliveriesResource {
   #private;
   /** @internal Use `new Coss().hooks.deliveries`. */
   constructor(http: HttpClient);
-  get(application: string, id: string, options?: ReadOptions$6): Promise<CossResult<HookDelivery>>;
+  get(application: string, id: string, options?: ReadOptions$7): Promise<CossResult<HookDelivery>>;
   /** Every HTTP request of the delivery, oldest first. */
-  listAttempts(application: string, id: string, options?: ReadOptions$6): Promise<CossResult<List<HookAttempt>>>;
+  listAttempts(application: string, id: string, options?: ReadOptions$7): Promise<CossResult<List<HookAttempt>>>;
   /** Queues a finished delivery for one more attempt. Never automatically retried. */
   retry(application: string, id: string, options?: RequestOptions): Promise<CossResult<HookDelivery>>;
 }
@@ -1582,7 +2244,7 @@ declare class HookPortalResource {
 }
 /**
  * `coss.hooks`: webhooks as a service. Send a message to one of your applications once
- * (`coss.hooks.messages.send`); COSS delivers it to every endpoint its users registered, signed
+ * (`coss.hooks.messages.send`); coss.com delivers it to every endpoint its users registered, signed
  * (Standard Webhooks), with retries, and gives them a portal to manage it all.
  */
 declare class HooksResource {
@@ -1602,7 +2264,7 @@ declare class HooksResource {
  * `api`: a request to the API. `email`: an email event. `webhook`: a webhook delivery attempt.
  * `risk`: a risk assessment or its feedback.
  */
-type LogSource = "api" | "email" | "webhook" | "risk";
+type LogSource = "api" | "email" | "webhook" | "risk" | "smtp";
 /**
  * `error`: 5xx responses, bounces, complaints, failures. `warning`: 4xx responses, delays,
  * suppressions, failed webhook attempts that will be retried. `info`: everything else.
@@ -1616,7 +2278,7 @@ interface Log {
   occurred_at: string;
   source: LogSource;
   level: LogLevel;
-  /** `api.request`, `webhook.attempt`, or an email event type such as `email.delivered`. */
+  /** `api.request`, `webhook.attempt`, `webhook.forward` (`coss listen`), or an email event type such as `email.delivered`. */
   type: string;
   /** A one-line summary. */
   message: string;
@@ -1688,7 +2350,7 @@ interface LogDrain {
   sources: LogDrainSource[];
   /** A disabled drain receives nothing, and lines logged meanwhile are not kept for it. */
   enabled: boolean;
-  /** `manual`, or `failing`: a batch failed every attempt, so COSS disabled it. */
+  /** `manual`, or `failing`: a batch failed every attempt, so coss.com disabled it. */
   disabled_reason: "manual" | "failing" | null;
   /** ISO 8601 timestamp; `null` while enabled. */
   disabled_at: string | null;
@@ -1705,7 +2367,7 @@ interface DeletedLogDrain {
   deleted: true;
 }
 interface CreateLogDrainParams {
-  /** An `https://` URL COSS posts batches to. */
+  /** An `https://` URL coss.com posts batches to. */
   url: string;
   description?: string | null;
   /** Defaults to every source. */
@@ -1763,16 +2425,16 @@ interface ListLogDrainBatchesParams {
 type LogDrainLine = Log | AuditEvent;
 //#endregion
 //#region src/resources/log-drains.d.ts
-type ReadOptions$5 = Pick<RequestOptions, "signal">;
+type ReadOptions$6 = Pick<RequestOptions, "signal">;
 /** `coss.logDrains.batches`: a drain's delivery log, each batch with every HTTP attempt. */
 declare class LogDrainBatchesResource {
   #private;
   /** @internal Use `new Coss().logDrains.batches`. */
   constructor(http: HttpClient);
   /** Lists the drain's batches, newest first. Pass the last `id` as `after` while `has_more` is true. */
-  list(drainId: string, params?: ListLogDrainBatchesParams, options?: ReadOptions$5): Promise<CossResult<List<LogDrainBatch>>>;
+  list(drainId: string, params?: ListLogDrainBatchesParams, options?: ReadOptions$6): Promise<CossResult<List<LogDrainBatch>>>;
   /** Retrieves one batch of the drain. */
-  get(drainId: string, id: string, options?: ReadOptions$5): Promise<CossResult<LogDrainBatch>>;
+  get(drainId: string, id: string, options?: ReadOptions$6): Promise<CossResult<LogDrainBatch>>;
 }
 /**
  * `coss.logDrains`: HTTPS endpoints the environment's log is streamed to (API requests, email
@@ -1793,21 +2455,21 @@ declare class LogDrainsResource {
    */
   create(params: CreateLogDrainParams, options?: RequestOptions): Promise<CossResult<LogDrainWithSecret>>;
   /** Lists the environment's drains, oldest first. Secrets are never included. */
-  list(options?: ReadOptions$5): Promise<CossResult<List<LogDrain>>>;
+  list(options?: ReadOptions$6): Promise<CossResult<List<LogDrain>>>;
   /** Retrieves a drain of the API key's environment. */
-  get(id: string, options?: ReadOptions$5): Promise<CossResult<LogDrain>>;
+  get(id: string, options?: ReadOptions$6): Promise<CossResult<LogDrain>>;
   /**
    * Changes the URL, description, sources or `enabled` flag. The signing secret stays the same.
-   * Disabling drops the lines still waiting for the drain; enabling it again (also after COSS
+   * Disabling drops the lines still waiting for the drain; enabling it again (also after coss.com
    * disabled it for failing) sends lines logged from then on.
    */
-  update(id: string, params: UpdateLogDrainParams, options?: ReadOptions$5): Promise<CossResult<LogDrain>>;
+  update(id: string, params: UpdateLogDrainParams, options?: ReadOptions$6): Promise<CossResult<LogDrain>>;
   /** Deletes the drain and its batch log. To pause it instead, update `enabled` to false. */
-  delete(id: string, options?: ReadOptions$5): Promise<CossResult<DeletedLogDrain>>;
+  delete(id: string, options?: ReadOptions$6): Promise<CossResult<DeletedLogDrain>>;
 }
 //#endregion
 //#region src/resources/logs.d.ts
-type ReadOptions$4 = Pick<RequestOptions, "signal">;
+type ReadOptions$5 = Pick<RequestOptions, "signal">;
 /**
  * `coss.logs`: the API key's environment log, newest first: API requests made with its keys,
  * email events and webhook delivery attempts.
@@ -1820,9 +2482,9 @@ declare class LogsResource {
    * Lists log lines, newest first (the last hour unless `from`/`to` say otherwise). Pass the last
    * `id` as `after` while `has_more` is true.
    */
-  list(params?: ListLogsParams, options?: ReadOptions$4): Promise<CossResult<List<Log>>>;
+  list(params?: ListLogsParams, options?: ReadOptions$5): Promise<CossResult<List<Log>>>;
   /** Retrieves one log line. */
-  get(id: string, options?: ReadOptions$4): Promise<CossResult<Log>>;
+  get(id: string, options?: ReadOptions$5): Promise<CossResult<Log>>;
 }
 //#endregion
 //#region src/types/reputation.d.ts
@@ -1849,7 +2511,7 @@ interface ReputationCheck {
 interface Reputation {
   object: "reputation";
   /**
-   * `suspended` means live sending is refused (`account_suspended`) until COSS support
+   * `suspended` means live sending is refused (`account_suspended`) until coss.com support
    * reinstates the organization; sandbox keys keep working.
    */
   status: ReputationStatus;
@@ -1868,9 +2530,9 @@ interface Reputation {
 }
 //#endregion
 //#region src/resources/reputation.d.ts
-type ReadOptions$3 = Pick<RequestOptions, "signal">;
+type ReadOptions$4 = Pick<RequestOptions, "signal">;
 /**
- * `coss.reputation`: the organization's standing with the COSS reputation guard, which suspends
+ * `coss.reputation`: the organization's standing with the coss.com reputation guard, which suspends
  * live sending automatically when bounce or complaint rates cross its thresholds.
  */
 declare class ReputationResource {
@@ -1878,7 +2540,7 @@ declare class ReputationResource {
   /** @internal Use `new Coss().reputation`. */
   constructor(http: HttpClient);
   /** The current status and the latest rates measured over live environments. */
-  get(options?: ReadOptions$3): Promise<CossResult<Reputation>>;
+  get(options?: ReadOptions$4): Promise<CossResult<Reputation>>;
 }
 //#endregion
 //#region src/types/risk.d.ts
@@ -1896,9 +2558,16 @@ type RiskList = "allow" | "block";
  */
 type RiskListEntryType = "email" | "domain" | "ip" | "asn" | "country" | "user";
 /** Signal groups an assessment was made without (a lookup failed or timed out). */
-type RiskDegradedSignal = "email_dns" | "domain_age" | "ip_data" | "velocity" | "captcha";
+type RiskDegradedSignal = "email_dns" | "domain_age" | "ip_data" | "velocity" | "captcha" | "content" | "ip_privacy";
+/** What content classification scores. */
+type RiskContentCategory = "spam" | "phishing" | "malware" | "fraud";
+/**
+ * Per category, the model's probability (0-1) that the content belongs to it. Not calibrated:
+ * pick thresholds by looking at your own traffic.
+ */
+type RiskContentScores = Record<RiskContentCategory, number>;
 /** Every reason an assessment can give (see the reason catalog in the docs). */
-type RiskReasonCode = "email.invalid" | "email.disposable" | "email.undeliverable" | "email.role_account" | "email.typo" | "email.domain_new" | "ip.tor" | "ip.vpn_network" | "ip.hosting_provider" | "ip.private" | "velocity.signups_per_ip_1h" | "velocity.signups_per_ip_24h" | "velocity.signups_per_subnet_1h" | "velocity.signups_per_email_domain_1h" | "velocity.signups_per_mailbox_24h" | "velocity.logins_per_ip_1h" | "velocity.logins_per_user_1h" | "velocity.events_per_ip_1h" | "velocity.events_per_user_1h" | "duplicate.canonical_mailbox" | "history.fraud_mailbox" | "history.fraud_user" | "history.fraud_ip" | "history.fraud_subnet" | "login.new_country" | "login.new_network" | "captcha.failed" | "captcha.missing" | "rule.matched" | "list.blocked" | "list.allowed";
+type RiskReasonCode = "email.invalid" | "email.disposable" | "email.undeliverable" | "email.role_account" | "email.typo" | "email.domain_new" | "ip.tor" | "ip.vpn_network" | "ip.hosting_provider" | "ip.vpn" | "ip.proxy" | "ip.relay" | "ip.private" | "velocity.signups_per_ip_1h" | "velocity.signups_per_ip_24h" | "velocity.signups_per_subnet_1h" | "velocity.signups_per_email_domain_1h" | "velocity.signups_per_mailbox_24h" | "velocity.signups_per_device_24h" | "velocity.checkouts_per_ip_1h" | "velocity.checkouts_per_user_1h" | "velocity.checkouts_per_card_24h" | "velocity.logins_per_ip_1h" | "velocity.logins_per_user_1h" | "velocity.events_per_ip_1h" | "velocity.events_per_user_1h" | "duplicate.canonical_mailbox" | "duplicate.device" | "history.fraud_mailbox" | "history.fraud_user" | "history.fraud_ip" | "history.fraud_subnet" | "history.fraud_card" | "history.fraud_device" | "checkout.card_country_mismatch" | "checkout.billing_country_mismatch" | "checkout.prepaid_card" | "device.automation" | "device.invalid" | "login.new_country" | "login.new_network" | "captcha.failed" | "captcha.missing" | "content.spam" | "content.phishing" | "content.malware" | "content.fraud" | "rule.matched" | "list.blocked" | "list.allowed";
 /** Why an assessment decided what it did. Never show reasons to the person being assessed. */
 interface RiskReason {
   code: RiskReasonCode;
@@ -1911,11 +2580,11 @@ interface RiskReason {
   window?: "1h" | "24h";
   /** `email.typo`: the likely domain, which you may show the user ("Did you mean …?"). */
   suggestion?: string;
-  /** `ip.hosting_provider`, `ip.vpn_network`: the network's operator. */
+  /** `ip.hosting_provider`, `ip.vpn_network`: the network's operator; `ip.vpn`: the VPN service. */
   provider?: string;
-  /** `duplicate.canonical_mailbox`: your id of the user who has the mailbox, if known. */
+  /** `duplicate.*`: your id of the user who has the mailbox or device, if known. */
   previous_user?: string | null;
-  /** `duplicate.canonical_mailbox`: the assessment that first saw the mailbox. */
+  /** `duplicate.*`: the assessment that first saw the mailbox or device. */
   previous_assessment?: string;
   /** `list.*`: the matching list entry. */
   entry?: string;
@@ -1963,6 +2632,45 @@ interface RiskIpSignals {
   as_name: string | null;
   /** ISO 3166-1 alpha-2. */
   country: string | null;
+  /**
+   * From coss.com's IP privacy data provider; `null` when it isn't available or was not asked
+   * (private addresses).
+   */
+  privacy: RiskIpPrivacy | null;
+}
+/** Whether an address is a VPN exit, a proxy or a privacy relay (iCloud Private Relay…). */
+interface RiskIpPrivacy {
+  vpn: boolean;
+  proxy: boolean;
+  relay: boolean;
+  /** The VPN or proxy service. */
+  service: string | null;
+}
+/** How a card is funded, as your payment processor reports it. */
+type RiskCardFunding = "credit" | "debit" | "prepaid" | "unknown";
+/** What you sent in `checkout` (never the card). */
+interface RiskCheckoutSignals {
+  amount: number;
+  currency: string;
+  card_country: string | null;
+  card_funding: RiskCardFunding | null;
+  billing_country: string | null;
+  shipping_country: string | null;
+}
+/** What the browser reported through `coss/device` (its device id is only kept as a keyed hash). */
+interface RiskDeviceSignals {
+  /** `false`: the token was malformed or too old. */
+  valid: boolean;
+  /** WebDriver control or a headless browser. */
+  automation: boolean;
+  /** IANA time zone (`Europe/London`). */
+  timezone: string | null;
+  /** The browser's first language. */
+  language: string | null;
+  platform: string | null;
+  /** `<width>x<height>` in CSS pixels. */
+  screen: string | null;
+  touch: boolean | null;
 }
 /** An assessment of one event. */
 interface RiskAssessment {
@@ -1985,6 +2693,10 @@ interface RiskAssessment {
     velocity: Record<string, number> | null;
     captcha: RiskCaptchaSignals | null;
     login: RiskLoginSignals | null;
+    /** `null` when no content was given or it couldn't be classified. */
+    content: RiskContentScores | null;
+    checkout: RiskCheckoutSignals | null;
+    device: RiskDeviceSignals | null;
   };
   user: {
     id: string | null;
@@ -2022,6 +2734,38 @@ interface AssessRiskParams {
   captcha?: {
     token: string;
   };
+  /**
+   * Text the user wrote (a bio, a message, a listing), classified with the event and never
+   * stored: its scores go in `signals.content`, and `content.*` reasons fire only at thresholds
+   * you set.
+   */
+  content?: {
+    text: string;
+  };
+  /** Only with `checkout` events: what is being paid for, and with which card. */
+  checkout?: {
+    /** In the currency's minor unit (cents for USD: 1999 is $19.99). */
+    amount: number;
+    /** ISO 4217, upper-case (`USD`). */
+    currency: string;
+    /** What your payment processor tells you about the card. */
+    card?: {
+      /**
+       * Your processor's fingerprint of the card number (Stripe: `card.fingerprint`), kept as a
+       * keyed hash only. Never send the card number.
+       */
+      fingerprint?: string;
+      /** Where the card was issued (ISO 3166-1 alpha-2, upper-case). */
+      country?: string;
+      funding?: RiskCardFunding;
+    };
+    billing_country?: string;
+    shipping_country?: string;
+  };
+  /** What `collectDevice()` from `coss/device` returned in the user's browser. */
+  device?: {
+    token: string;
+  };
 }
 /** Query of `GET /v1/risk/assessments`. */
 interface ListRiskAssessmentsParams {
@@ -2114,6 +2858,10 @@ interface RiskSettings {
     provider: RiskCaptchaProvider;
     required: boolean;
   } | null;
+  /** Per content category, the score at which `content.<category>` fires; `null`: never. */
+  content_thresholds: Record<RiskContentCategory, number | null>;
+  /** Reasons whose weight this environment changed; the rest weigh what the catalog says. */
+  reason_weights: Partial<Record<RiskReasonCode, number>>;
   /** ISO 8601 timestamp; `null` while on the defaults. */
   updated_at: string | null;
 }
@@ -2130,9 +2878,48 @@ interface UpdateRiskSettingsParams {
     /** Assessments without a token get `captcha.missing`. */
     required?: boolean;
   } | null;
+  /** Changes the categories given: a score in (0, 1] sets the threshold, `null` removes it. */
+  content_thresholds?: Partial<Record<RiskContentCategory, number | null>>;
+  /**
+   * Changes the reasons given: a weight in [0, 0.99] replaces the default (for example
+   * calibration's `suggested_weight`), `null` restores it. Not `list.*` or `rule.matched`.
+   */
+  reason_weights?: Partial<Record<RiskReasonCode, number | null>>;
+}
+/** Feedback counted against one reason or rule (`fraud` includes `abuse`). */
+interface RiskCalibrationCounts {
+  fraud: number;
+  legitimate: number;
+  /** `fraud / (fraud + legitimate)`; `null` without feedback. */
+  precision: number | null;
+}
+/** How often each reason and rule was right over the last 90 days, by your feedback. */
+interface RiskCalibration {
+  object: "risk_calibration";
+  window_days: number;
+  /** Assessments in the window. */
+  assessments: number;
+  /** Of those, with feedback. */
+  labeled: number;
+  reasons: (RiskCalibrationCounts & {
+    code: RiskReasonCode;
+    /** Assessments it fired in. */
+    fired: number;
+    default_weight: number;
+    /** Its weight in this environment now. */
+    weight: number;
+    /** What feedback supports; `null` with fewer than 20 assessments with feedback. */
+    suggested_weight: number | null;
+  })[];
+  rules: (RiskCalibrationCounts & {
+    rule: string;
+    name: string;
+    /** Assessments it decided. */
+    matched: number;
+  })[];
 }
 /** A field a rule condition can test (see the rules guide). */
-type RiskRuleField = "email.valid" | "email.disposable" | "email.undeliverable" | "email.role_account" | "email.free_provider" | "email.typo" | "email.domain_new" | "email.domain" | "email.domain_age_days" | "ip.tor" | "ip.hosting" | "ip.vpn" | "ip.private" | "ip.country" | "ip.asn" | "ip.hosting_provider" | "captcha.passed" | "duplicate.canonical_mailbox" | "history.fraud" | "login.new_country" | "login.new_network" | "score" | "velocity.ip_1h" | "velocity.ip_24h" | "velocity.subnet_1h" | "velocity.subnet_24h" | "velocity.email_domain_1h" | "velocity.email_domain_24h" | "velocity.mailbox_1h" | "velocity.mailbox_24h" | "velocity.user_1h" | "velocity.user_24h";
+type RiskRuleField = "email.valid" | "email.disposable" | "email.undeliverable" | "email.role_account" | "email.free_provider" | "email.typo" | "email.domain_new" | "email.domain" | "email.domain_age_days" | "ip.tor" | "ip.hosting" | "ip.vpn" | "ip.proxy" | "ip.relay" | "ip.private" | "ip.country" | "ip.asn" | "ip.hosting_provider" | "captcha.passed" | "duplicate.canonical_mailbox" | "duplicate.device" | "history.fraud" | "login.new_country" | "login.new_network" | "content.spam" | "content.phishing" | "content.malware" | "content.fraud" | "checkout.amount" | "checkout.currency" | "checkout.card_country" | "checkout.card_funding" | "checkout.billing_country" | "checkout.shipping_country" | "device.automation" | "device.timezone" | "device.language" | "score" | "velocity.ip_1h" | "velocity.ip_24h" | "velocity.subnet_1h" | "velocity.subnet_24h" | "velocity.email_domain_1h" | "velocity.email_domain_24h" | "velocity.mailbox_1h" | "velocity.mailbox_24h" | "velocity.user_1h" | "velocity.user_24h" | "velocity.card_1h" | "velocity.card_24h" | "velocity.device_1h" | "velocity.device_24h";
 /** A test of one field. A field without a value (no IP, no email…) never matches. */
 interface RiskRuleCondition {
   field: RiskRuleField;
@@ -2179,21 +2966,122 @@ interface DeletedRiskRule {
   id: string;
   deleted: true;
 }
+/** Result of `coss.risk.checkEmail()`: what coss.com knows about an address. Nothing is stored. */
+interface RiskEmailCheck {
+  object: "risk_email_check";
+  email: string;
+  valid: boolean;
+  domain: string | null;
+  /** The mailbox with the provider's aliasing folded (dots and `+tags` at Gmail…). */
+  canonical: string | null;
+  disposable: boolean;
+  /** From DNS (MX, A, AAAA). `unknown` when the lookup failed or timed out. */
+  deliverability: "deliverable" | "undeliverable" | "unknown";
+  role_account: boolean;
+  free_provider: boolean;
+  /** The likely intended domain when this one looks like a typo of a popular one. */
+  suggestion: string | null;
+  /** Days since the domain was registered (RDAP); `null` when unknown or not looked up. */
+  domain_age_days: number | null;
+  /** Lookups that failed or timed out. */
+  degraded: ("email_dns" | "domain_age")[];
+}
+/** Result of `coss.risk.checkIp()`. Nothing is stored. */
+interface RiskIpCheck extends RiskIpSignals {
+  object: "risk_ip_check";
+  ip: string;
+  /**
+   * `ip_data` when some IP data is unavailable at the moment; `ip_privacy` when the privacy data
+   * provider failed or timed out.
+   */
+  degraded: ("ip_data" | "ip_privacy")[];
+}
+/** Result of `coss.risk.classify()`: scores only, neither stored nor logged. */
+interface RiskContentClassification {
+  object: "risk_content_classification";
+  scores: RiskContentScores;
+  /** The text was longer than the model reads (8,000 characters): only its beginning counted. */
+  truncated: boolean;
+}
+/** What `on_failure` answers while coss.com can't count. */
+type RiskLimitFailureMode = "allow" | "deny";
+/** One of your rate limit buckets: each key gets `burst` tokens, refilling `limit` per period. */
+interface RiskLimitBucket {
+  object: "risk_limit_bucket";
+  id: string;
+  /** What `coss.risk.limit({ bucket })` names it by. */
+  name: string;
+  /** Tokens added per `period_seconds`. */
+  limit: number;
+  period_seconds: number;
+  /** How many requests a key can make at once. */
+  burst: number;
+  on_failure: RiskLimitFailureMode;
+  /** ISO 8601 timestamp. */
+  created_at: string;
+  /** ISO 8601 timestamp. */
+  updated_at: string;
+}
+/** Body of `POST /v1/risk/limit_buckets`. */
+interface CreateRiskLimitBucketParams {
+  /** 1-64 lower-case letters, digits, `.`, `_` or `-`; unique in the environment. */
+  name: string;
+  limit: number;
+  /** 1 second to 1 day. */
+  period_seconds: number;
+  /** Defaults to `limit`. */
+  burst?: number;
+  /** Defaults to `allow`. */
+  on_failure?: RiskLimitFailureMode;
+}
+/** Body of `PATCH /v1/risk/limit_buckets/{id}` (the name can't change). */
+type UpdateRiskLimitBucketParams = Partial<Omit<CreateRiskLimitBucketParams, "name">>;
+interface DeletedRiskLimitBucket {
+  object: "risk_limit_bucket";
+  id: string;
+  deleted: true;
+}
+/** Body of `POST /v1/risk/limits`. */
+interface CheckRiskLimitParams {
+  /** The bucket's name. */
+  bucket: string;
+  /** Who or what is limited (a user id, an email or IP address…); coss.com keeps only a hash. */
+  key: string;
+  /** Tokens this request takes. Default 1. */
+  cost?: number;
+}
+/** Result of `coss.risk.limit()`. */
+interface RiskLimit {
+  object: "risk_limit";
+  bucket: string;
+  /** Whether to let the request through. Denied requests take no tokens. */
+  allowed: boolean;
+  /** The bucket's size (`burst`). */
+  limit: number;
+  /** Tokens left for this key. */
+  remaining: number;
+  /** Milliseconds until the key's bucket is full again. */
+  reset_ms: number;
+  /** When denied: milliseconds until the same request would fit; `null` if it never would. */
+  retry_after_ms: number | null;
+  /** coss.com couldn't count: `allowed` is the bucket's `on_failure`. */
+  degraded: boolean;
+}
 //#endregion
 //#region src/resources/risk.d.ts
-type ReadOptions$2 = Pick<RequestOptions, "signal">;
+type ReadOptions$3 = Pick<RequestOptions, "signal">;
 /** `coss.risk.assessments`: reading past assessments (`assess` lives on `coss.risk`). */
 declare class RiskAssessmentsResource {
   #private;
   /** @internal Use `new Coss().risk.assessments`. */
   constructor(http: HttpClient);
   /** Retrieves one assessment. */
-  get(id: string, options?: ReadOptions$2): Promise<CossResult<RiskAssessment>>;
+  get(id: string, options?: ReadOptions$3): Promise<CossResult<RiskAssessment>>;
   /**
    * Lists assessments, newest first (`review_status: "open"` is the review queue). Pass the last
    * `id` as `after` while `has_more` is true.
    */
-  list(params?: ListRiskAssessmentsParams, options?: ReadOptions$2): Promise<CossResult<List<RiskAssessment>>>;
+  list(params?: ListRiskAssessmentsParams, options?: ReadOptions$3): Promise<CossResult<List<RiskAssessment>>>;
 }
 /** `coss.risk.lists`: the environment's allow and block lists. */
 declare class RiskListsResource {
@@ -2209,20 +3097,20 @@ declare class RiskListsResource {
     expires_at?: string | Date;
   }, options?: RequestOptions): Promise<CossResult<RiskListEntry>>;
   /** Lists entries, newest first. Pass the last `id` as `after` while `has_more` is true. */
-  list(params?: ListRiskListEntriesParams, options?: ReadOptions$2): Promise<CossResult<List<RiskListEntry>>>;
+  list(params?: ListRiskListEntriesParams, options?: ReadOptions$3): Promise<CossResult<List<RiskListEntry>>>;
   /** Retrieves one entry. */
-  get(id: string, options?: ReadOptions$2): Promise<CossResult<RiskListEntry>>;
+  get(id: string, options?: ReadOptions$3): Promise<CossResult<RiskListEntry>>;
   /** Removes an entry. */
-  remove(id: string, options?: ReadOptions$2): Promise<CossResult<DeletedRiskListEntry>>;
+  remove(id: string, options?: ReadOptions$3): Promise<CossResult<DeletedRiskListEntry>>;
 }
 /** `coss.risk.settings`: the environment's thresholds, disabled reasons and captcha provider. */
 declare class RiskSettingsResource {
   #private;
   /** @internal Use `new Coss().risk.settings`. */
   constructor(http: HttpClient);
-  get(options?: ReadOptions$2): Promise<CossResult<RiskSettings>>;
+  get(options?: ReadOptions$3): Promise<CossResult<RiskSettings>>;
   /** Changes the fields given. The captcha secret is write-only. */
-  update(params: UpdateRiskSettingsParams, options?: ReadOptions$2): Promise<CossResult<RiskSettings>>;
+  update(params: UpdateRiskSettingsParams, options?: ReadOptions$3): Promise<CossResult<RiskSettings>>;
 }
 /**
  * `coss.risk.rules`: the environment's rules. After the lists, the first enabled rule whose
@@ -2233,24 +3121,40 @@ declare class RiskRulesResource {
   /** @internal Use `new Coss().risk.rules`. */
   constructor(http: HttpClient);
   /** Creates a rule. Not retried automatically: a retry could create it twice. */
-  create(params: CreateRiskRuleParams, options?: ReadOptions$2): Promise<CossResult<RiskRule>>;
+  create(params: CreateRiskRuleParams, options?: ReadOptions$3): Promise<CossResult<RiskRule>>;
   /** Every rule, in evaluation order. */
-  list(options?: ReadOptions$2): Promise<CossResult<List<RiskRule>>>;
-  get(id: string, options?: ReadOptions$2): Promise<CossResult<RiskRule>>;
+  list(options?: ReadOptions$3): Promise<CossResult<List<RiskRule>>>;
+  get(id: string, options?: ReadOptions$3): Promise<CossResult<RiskRule>>;
   /** Changes the fields given; `conditions` replaces the whole list. */
-  update(id: string, params: UpdateRiskRuleParams, options?: ReadOptions$2): Promise<CossResult<RiskRule>>;
-  delete(id: string, options?: ReadOptions$2): Promise<CossResult<DeletedRiskRule>>;
+  update(id: string, params: UpdateRiskRuleParams, options?: ReadOptions$3): Promise<CossResult<RiskRule>>;
+  delete(id: string, options?: ReadOptions$3): Promise<CossResult<DeletedRiskRule>>;
 }
-/** `coss.risk.users`: what COSS remembers about your users. */
+/**
+ * `coss.risk.limitBuckets`: your rate limit buckets, which `coss.risk.limit()` charges per key.
+ */
+declare class RiskLimitBucketsResource {
+  #private;
+  /** @internal Use `new Coss().risk.limitBuckets`. */
+  constructor(http: HttpClient);
+  /** Creates a bucket. Not retried automatically: a retry would find its name taken. */
+  create(params: CreateRiskLimitBucketParams, options?: ReadOptions$3): Promise<CossResult<RiskLimitBucket>>;
+  /** Every bucket, by name. */
+  list(options?: ReadOptions$3): Promise<CossResult<List<RiskLimitBucket>>>;
+  get(id: string, options?: ReadOptions$3): Promise<CossResult<RiskLimitBucket>>;
+  /** Changes the fields given; the next check uses them. */
+  update(id: string, params: UpdateRiskLimitBucketParams, options?: ReadOptions$3): Promise<CossResult<RiskLimitBucket>>;
+  delete(id: string, options?: ReadOptions$3): Promise<CossResult<DeletedRiskLimitBucket>>;
+}
+/** `coss.risk.users`: what coss.com remembers about your users. */
 declare class RiskUsersResource {
   #private;
   /** @internal Use `new Coss().risk.users`. */
   constructor(http: HttpClient);
   /**
-   * Call when you delete a user: COSS deletes what identifies them (their mailbox, fraud reports,
+   * Call when you delete a user: coss.com deletes what identifies them (their mailbox, fraud reports,
    * and the user id, email, IP and user agent on their assessments). Safe to repeat.
    */
-  forget(userId: string, options?: ReadOptions$2): Promise<CossResult<ForgottenRiskUser>>;
+  forget(userId: string, options?: ReadOptions$3): Promise<CossResult<ForgottenRiskUser>>;
 }
 /**
  * `coss.risk`: assess sign-ups, logins and other events. Call it from your server and treat an
@@ -2273,6 +3177,8 @@ declare class RiskResource {
   readonly settings: RiskSettingsResource;
   /** Rules (`create`, `list`, `get`, `update`, `delete`). */
   readonly rules: RiskRulesResource;
+  /** Your rate limit buckets (`create`, `list`, `get`, `update`, `delete`). */
+  readonly limitBuckets: RiskLimitBucketsResource;
   /** @internal Use `new Coss().risk`. */
   constructor(http: HttpClient);
   /**
@@ -2282,9 +3188,42 @@ declare class RiskResource {
   assess(params: AssessRiskParams, options?: RequestOptions): Promise<CossResult<RiskAssessment>>;
   /**
    * Reports what an assessed user turned out to be: `fraud` and `abuse` teach later assessments to
-   * flag the same mailbox, user, IP and subnet; `legitimate` takes that back. Resolves a review.
+   * flag the same mailbox, user, card, device, IP and subnet; `legitimate` takes that back.
+   * Resolves a review, and counts in `calibration()`.
    */
   feedback(id: string, params: RiskFeedbackParams, options?: RequestOptions): Promise<CossResult<RiskAssessment>>;
+  /**
+   * How often each reason and rule was right over the last 90 days, by your feedback, and the
+   * reason weights that supports. Apply them with `settings.update({ reason_weights })`.
+   */
+  calibration(options?: ReadOptions$3): Promise<CossResult<RiskCalibration>>;
+  /**
+   * Checks an email address on its own: syntax, disposable domains, deliverability, role
+   * accounts, free providers, the canonical mailbox, typos and domain age. Nothing is stored.
+   */
+  checkEmail(email: string, options?: ReadOptions$3): Promise<CossResult<RiskEmailCheck>>;
+  /**
+   * Checks an IP address on its own: Tor, cloud, hosting and VPN networks, ASN and country, and
+   * VPN, proxy and relay exits when coss.com's privacy data is available.
+   */
+  checkIp(ip: string, options?: ReadOptions$3): Promise<CossResult<RiskIpCheck>>;
+  /**
+   * Scores text for spam, phishing, malware and fraud. Scores only, never a verdict: you choose
+   * the thresholds. The text is neither stored nor logged.
+   */
+  classify(params: {
+    text: string;
+  }, options?: ReadOptions$3): Promise<CossResult<RiskContentClassification>>;
+  /**
+   * Takes `cost` tokens (default 1) from `key`'s share of one of your buckets
+   * (`coss.risk.limitBuckets`). Retries reuse one `Idempotency-Key`, so they are charged once.
+   *
+   * ```ts
+   * const { data } = await coss.risk.limit({ bucket: "password_reset", key: email });
+   * if (data && !data.allowed) return tooManyRequests(data.retry_after_ms);
+   * ```
+   */
+  limit(params: CheckRiskLimitParams, options?: RequestOptions): Promise<CossResult<RiskLimit>>;
 }
 //#endregion
 //#region src/types/webhook.d.ts
@@ -2348,6 +3287,36 @@ interface ReceivedEmailWebhookEvent {
   created_at: string;
   data: ReceivedEmailWebhookEventData;
 }
+/** Events about the organization's domains (sent to live environments only). */
+type DomainEventType = "domain.dmarc_report_received";
+/** What a webhook says about a DMARC report; never its rows or source addresses. */
+interface DomainWebhookEventData {
+  organization_id: string;
+  domain_id: string;
+  domain: string;
+  /** Retrieve the report (its rows) with `coss.domains.dmarc.reports.get`. */
+  dmarc_report_id: string;
+  /** The reporting organization (`org_name`). */
+  reporter: string;
+  /** ISO 8601 timestamps of the period the report covers. */
+  period_start: string;
+  period_end: string;
+  messages: number;
+  passing: number;
+  /** ISO 8601 timestamp. */
+  occurred_at: string;
+}
+/** A DMARC aggregate report about a domain arrived. `id` equals the `webhook-id` header. */
+interface DomainWebhookEvent {
+  id: string;
+  object: "event";
+  type: DomainEventType;
+  /** The API version this event is rendered in: the receiving endpoint's `api_version`. */
+  api_version: string;
+  /** ISO 8601 timestamp. */
+  created_at: string;
+  data: DomainWebhookEventData;
+}
 /** Changes of the organization's reputation standing (sent to live environments only). */
 type AccountEventType = "account.reputation_warning" | "account.reputation_recovered" | "account.suspended" | "account.reinstated";
 interface AccountWebhookEventData {
@@ -2492,11 +3461,11 @@ interface HookEndpointWebhookEvent {
   data: HookEndpointWebhookEventData;
 }
 /** The JSON body of a webhook request; narrow on `type`. */
-type WebhookEvent = EmailWebhookEvent | ReceivedEmailWebhookEvent | AccountWebhookEvent | BillingWebhookEvent | RiskWebhookEvent | HookEndpointWebhookEvent;
+type WebhookEvent = EmailWebhookEvent | ReceivedEmailWebhookEvent | DomainWebhookEvent | AccountWebhookEvent | BillingWebhookEvent | RiskWebhookEvent | HookEndpointWebhookEvent;
 //#endregion
 //#region src/types/webhook-endpoint.d.ts
 /** Every event type an endpoint can subscribe to. */
-type WebhookEventType = EmailEventType | ReceivedEmailEventType | AccountEventType | BillingEventType | RiskEventType | HookOperationalEventType;
+type WebhookEventType = EmailEventType | ReceivedEmailEventType | DomainEventType | AccountEventType | BillingEventType | RiskEventType | HookOperationalEventType;
 /** Why an endpoint is disabled. */
 type WebhookEndpointDisabledReason = "manual" | "failing";
 /** A URL of the API key's environment that receives signed event notifications. */
@@ -2516,7 +3485,7 @@ interface WebhookEndpoint {
   enabled: boolean;
   /**
    * `manual`: someone disabled it. `failing`: its deliveries failed every attempt for five days,
-   * so COSS disabled it. `null` while enabled.
+   * so coss.com disabled it. `null` while enabled.
    */
   disabled_reason: WebhookEndpointDisabledReason | null;
   /** When it was disabled (ISO 8601); `null` while enabled. */
@@ -2545,7 +3514,7 @@ interface WebhookEndpointWithSecret extends WebhookEndpoint {
 }
 /** Body of `POST /v1/webhook_endpoints`. */
 interface CreateWebhookEndpointParams {
-  /** An `https://` URL COSS posts events to. */
+  /** An `https://` URL coss.com posts events to. */
   url: string;
   /** A note for your own reference. */
   description?: string | null;
@@ -2651,7 +3620,7 @@ interface ListWebhookDeliveriesParams {
 }
 //#endregion
 //#region src/resources/webhook-deliveries.d.ts
-type ReadOptions$1 = Pick<RequestOptions, "signal">;
+type ReadOptions$2 = Pick<RequestOptions, "signal">;
 /**
  * `coss.webhookEndpoints.deliveries`: an endpoint's delivery log. Each delivery carries every
  * HTTP attempt and the payload as sent.
@@ -2661,9 +3630,9 @@ declare class WebhookDeliveriesResource {
   /** @internal Use `new Coss().webhookEndpoints.deliveries`. */
   constructor(http: HttpClient);
   /** Lists the endpoint's deliveries, newest first. Pass the last `id` as `after` while `has_more` is true. */
-  list(endpointId: string, params?: ListWebhookDeliveriesParams, options?: ReadOptions$1): Promise<CossResult<List<WebhookDelivery>>>;
+  list(endpointId: string, params?: ListWebhookDeliveriesParams, options?: ReadOptions$2): Promise<CossResult<List<WebhookDelivery>>>;
   /** Retrieves one delivery of the endpoint. */
-  get(endpointId: string, id: string, options?: ReadOptions$1): Promise<CossResult<WebhookDelivery>>;
+  get(endpointId: string, id: string, options?: ReadOptions$2): Promise<CossResult<WebhookDelivery>>;
   /**
    * Queues a finished delivery for one more attempt, made within seconds. A delivery that is
    * still `pending` is returned unchanged (it is already scheduled for `next_attempt_at`).
@@ -2674,7 +3643,7 @@ declare class WebhookDeliveriesResource {
 }
 //#endregion
 //#region src/resources/webhook-endpoints.d.ts
-type ReadOptions = Pick<RequestOptions, "signal">;
+type ReadOptions$1 = Pick<RequestOptions, "signal">;
 /**
  * `coss.webhookEndpoints`: the URLs that receive signed event notifications. Endpoints belong to
  * the API key's own environment, so a `coss_test_…` key only ever manages sandbox endpoints.
@@ -2693,14 +3662,14 @@ declare class WebhookEndpointsResource {
    */
   create(params: CreateWebhookEndpointParams, options?: RequestOptions): Promise<CossResult<WebhookEndpointWithSecret>>;
   /** Lists the environment's endpoints, oldest first. Secrets are never included. */
-  list(options?: ReadOptions): Promise<CossResult<List<WebhookEndpoint>>>;
+  list(options?: ReadOptions$1): Promise<CossResult<List<WebhookEndpoint>>>;
   /** Retrieves an endpoint of the API key's environment. */
-  get(id: string, options?: ReadOptions): Promise<CossResult<WebhookEndpoint>>;
+  get(id: string, options?: ReadOptions$1): Promise<CossResult<WebhookEndpoint>>;
   /**
    * Changes the URL, description, subscribed event types or `enabled` flag. The signing secret
    * stays the same (see `rollSecret`), so receivers keep verifying deliveries.
    */
-  update(id: string, params: UpdateWebhookEndpointParams, options?: ReadOptions): Promise<CossResult<WebhookEndpoint>>;
+  update(id: string, params: UpdateWebhookEndpointParams, options?: ReadOptions$1): Promise<CossResult<WebhookEndpoint>>;
   /**
    * Replaces the endpoint's signing secret; the result carries the new `secret`. Until
    * `previous_secret_expires_at` (a day by default), deliveries are signed with both secrets, so
@@ -2716,7 +3685,100 @@ declare class WebhookEndpointsResource {
    */
   recover(id: string, params: RecoverWebhookEndpointParams, options?: RequestOptions): Promise<CossResult<WebhookEndpointRecovery>>;
   /** Deletes the endpoint and its delivery log. To pause it instead, update `enabled` to false. */
-  delete(id: string, options?: ReadOptions): Promise<CossResult<DeletedWebhookEndpoint>>;
+  delete(id: string, options?: ReadOptions$1): Promise<CossResult<DeletedWebhookEndpoint>>;
+}
+//#endregion
+//#region src/types/webhook-listener.d.ts
+/** A temporary subscriber of the API key's environment, open while it is polled. */
+interface WebhookListener {
+  object: "webhook_listener";
+  id: string;
+  /** The API version events are rendered in. */
+  api_version: string;
+  /** Empty: every event type. */
+  event_types: string[];
+  description: string | null;
+  /** When it closes unless polled again (every poll moves it 10 minutes ahead). */
+  expires_at: string;
+  created_at: string;
+}
+/** One event handed out by a poll, to forward and acknowledge. */
+interface WebhookListenerDelivery {
+  object: "webhook_listener_delivery";
+  id: string;
+  /** Send it back in the acknowledgement. */
+  ack_token: string;
+  /** The event's id: the body's `id`, and the `webhook-id` header endpoints receive. */
+  event_id: string;
+  event_type: string;
+  /** How many polls have handed it out (more than 1 after an unacknowledged answer). */
+  attempt: number;
+  /** The event body, exactly as an endpoint would receive it: forward these bytes. */
+  body: string;
+  created_at: string;
+}
+/** Answer of `POST /v1/webhook_listeners/{id}/poll`. */
+interface WebhookListenerPoll {
+  object: "webhook_listener_poll";
+  listener: WebhookListener;
+  /** Oldest first; empty when nothing arrived while the poll waited. */
+  deliveries: WebhookListenerDelivery[];
+  /** How many of the request's acknowledgements were recorded. */
+  acknowledged: number;
+}
+interface DeletedWebhookListener {
+  object: "webhook_listener";
+  id: string;
+  deleted: true;
+}
+/** Body of `POST /v1/webhook_listeners`. */
+interface CreateWebhookListenerParams {
+  /** Defaults to every event type. */
+  event_types?: WebhookEventType[];
+  /** Defaults to the client's `apiVersion`. */
+  api_version?: ApiVersion;
+  /** Where the events go, for your own reference (shown in the log). */
+  description?: string | null;
+}
+/** What happened to one delivery handed out earlier. */
+interface WebhookListenerAck {
+  delivery_id: string;
+  ack_token: string;
+  /** The local server's status; `null` when nothing answered, or the event was only printed. */
+  status_code: number | null;
+  duration_ms: number;
+  /** Why forwarding failed; `null` if it didn't. */
+  error: string | null;
+}
+/** Body of `POST /v1/webhook_listeners/{id}/poll`. */
+interface PollWebhookListenerParams {
+  acks?: WebhookListenerAck[];
+  /** How long to wait for events, in milliseconds (default 20000, at most 25000). */
+  wait_ms?: number;
+  /** The most deliveries to hand out (default 10, at most 50). */
+  limit?: number;
+}
+//#endregion
+//#region src/resources/webhook-listeners.d.ts
+type ReadOptions = Pick<RequestOptions, "signal">;
+/**
+ * `coss.webhookListeners`: what `coss listen` uses to forward an environment's events to a local
+ * server. A listener receives events created after it opens, while it is polled; it is closed by
+ * `delete` or after 10 minutes without a poll.
+ */
+declare class WebhookListenersResource {
+  #private;
+  /** @internal Use `new Coss().webhookListeners`. */
+  constructor(http: HttpClient);
+  /** Opens a listener. Never retried automatically: a lost answer leaves one to expire. */
+  create(params?: CreateWebhookListenerParams, options?: ReadOptions): Promise<CossResult<WebhookListener>>;
+  /**
+   * Acknowledges earlier deliveries and waits (up to `wait_ms`) for more. Never retried
+   * automatically: call it in a loop, and keep unacknowledged acks for the next call after an error.
+   */
+  poll(id: string, params?: PollWebhookListenerParams, options?: ReadOptions): Promise<CossResult<WebhookListenerPoll>>;
+  /** Closes a listener: it receives nothing more. */
+  delete(id: string, options?: ReadOptions): Promise<CossResult<DeletedWebhookListener>>;
 }
 //#endregion
 //#region src/client.d.ts
@@ -2743,7 +3805,7 @@ interface CossOptions {
   dangerouslyAllowBrowser?: boolean;
 }
 /**
- * The COSS client. One API key covers every product.
+ * The coss.com client. One API key covers every product.
  *
  * ```ts
  * const coss = new Coss({ apiKey: "coss_test_…" });
@@ -2752,17 +3814,23 @@ interface CossOptions {
  */
 export declare class Coss {
   readonly email: EmailResource;
+  /** The API key's environment, project and organization (`coss.environment.get()`). */
+  readonly environment: EnvironmentResource;
+  /** The client's own API key (`coss.apiKey.revoke()`). */
+  readonly apiKey: ApiKeyResource;
   /** Sending domains of the organization (`coss.domains.create`, `.verify`, …). */
   readonly domains: DomainsResource;
   /** Webhook endpoints of the API key's environment. */
   readonly webhookEndpoints: WebhookEndpointsResource;
+  /** Temporary listeners `coss listen` pulls the environment's events from. */
+  readonly webhookListeners: WebhookListenersResource;
   /** The organization's sending reputation (`coss.reputation.get()`). */
   readonly reputation: ReputationResource;
   /** The environment's log: API requests, email events, webhook attempts (`coss.logs.list()`). */
   readonly logs: LogsResource;
   /** HTTPS endpoints the environment's log is streamed to (`coss.logDrains.create()`). */
   readonly logDrains: LogDrainsResource;
-  /** The organization's audit log: changes by members, API keys and COSS support (`coss.auditEvents.list()`). */
+  /** The organization's audit log: changes by members, API keys and coss.com support (`coss.auditEvents.list()`). */
   readonly auditEvents: AuditEventsResource;
   /** Hooks, webhooks as a service: `coss.hooks.messages.send()` delivers to your users' endpoints. */
   readonly hooks: HooksResource;
@@ -2779,7 +3847,7 @@ export declare class Coss {
 //#endregion
 //#region src/version.d.ts
 /** SDK version, sent in the User-Agent. A test keeps it equal to package.json's `version`. */
-export declare const VERSION = "0.2.0";
+export declare const VERSION = "0.4.0";
 //#endregion
 //#region src/webhooks.d.ts
 /** A webhook request failed verification: reject it (e.g. respond 400). */
@@ -2803,7 +3871,7 @@ interface VerifyWebhookOptions {
  * const event = await verifyWebhook(await request.text(), request.headers, process.env.COSS_WEBHOOK_SECRET);
  * ```
  *
- * The same check verifies messages your own users receive from COSS Hooks (`coss.hooks`): pass
+ * The same check verifies messages your own users receive from coss.com Hooks (`coss.hooks`): pass
  * the endpoint's secret and name your payload type, e.g. `verifyWebhook<InvoicePaid>(…)`.
  */
 export declare function verifyWebhook<T = WebhookEvent>(payload: string, headers: WebhookHeaders, secret: string, options?: VerifyWebhookOptions): Promise<T>;
@@ -2820,4 +3888,4 @@ export declare function verifyWebhook<T = WebhookEvent>(payload: string, headers
  */
 export declare function verifyLogDrainBatch(payload: string, headers: WebhookHeaders, secret: string, options?: VerifyWebhookOptions): Promise<LogDrainLine[]>;
 //#endregion
-export type { AccountEventType, AccountWebhookEvent, AccountWebhookEventData, ApiVersion, AssessRiskParams, AuditActorType, AuditEvent, AuditEventsResource, Billing, BillingCreditsResource, BillingEventType, BillingHoldReason, BillingInvoicesResource, BillingResource, BillingWebhookEvent, CheckSuppressionParams, CossError, CossErrorIssue, CossErrorType, CossOptions, CossResult, CreateDomainParams, CreateHookApplicationParams, CreateHookEndpointParams, CreateHookEventTypeParams, CreateHookPortalSessionParams, CreateLogDrainParams, CreateReceivingDomainParams, CreateRiskListEntryParams, CreateRiskRuleParams, CreateSuppressionParams, CreateTrackingDomainParams, CreateWebhookEndpointParams, Credit, DeletedDomain, DeletedHookApplication, DeletedHookEndpoint, DeletedLogDrain, DeletedReceivedEmail, DeletedRiskListEntry, DeletedRiskRule, DeletedSuppression, DeletedTrackingRule, DeletedWebhookEndpoint, Domain, DomainRecord, DomainRecordPurpose, DomainRecordStatus, DomainStatus, DomainsResource, Email, EmailAttachment, EmailAttachmentParams, EmailBatch, EmailEvent, EmailEventData, EmailEventType, EmailLink, EmailRecipient, EmailRecipientStatus, EmailResource, EmailStatus, EmailTag, EmailTracking, EmailWebhookEvent, EmailWebhookEventData, ExportSuppressionsParams, FetchLike, ForgottenRiskUser, HookApplication, HookApplicationsResource, HookAttempt, HookDeliveriesResource, HookDelivery, HookDeliveryStatus, HookEndpoint, HookEndpointDisabledReason, HookEndpointRecovery, HookEndpointSecret, HookEndpointWebhookEvent, HookEndpointWebhookEventData, HookEndpointWithSecret, HookEndpointsResource, HookEventType, HookEventTypesResource, HookMessage, HookMessagesResource, HookOperationalEventType, HookPortalResource, HookPortalSession, HooksResource, ImportSuppressionEntry, ImportSuppressionsParams, InboundAddress, Invoice, InvoiceLine, InvoiceLineKind, InvoiceStatus, InvoiceSummary, List, ListAuditEventsParams, ListCreditsParams, ListHookApplicationsParams, ListHookDeliveriesParams, ListHookEventTypesParams, ListHookMessagesParams, ListInvoicesParams, ListLogDrainBatchesParams, ListLogsParams, ListReceivedEmailsParams, ListRiskAssessmentsParams, ListRiskListEntriesParams, ListSuppressionsParams, ListUsageParams, ListWebhookDeliveriesParams, Log, LogDrain, LogDrainAttempt, LogDrainBatch, LogDrainBatchStatus, LogDrainBatchesResource, LogDrainLine, LogDrainSource, LogDrainWithSecret, LogDrainsResource, LogLevel, LogSource, LogsResource, MailFromStatus, Meter, PlanKey, ReceivedEmail, ReceivedEmailAttachment, ReceivedEmailEventType, ReceivedEmailStatus, ReceivedEmailSummary, ReceivedEmailVerdicts, ReceivedEmailWebhookEvent, ReceivedEmailWebhookEventData, ReceivedEmailsResource, ReceivingDomain, ReceivingDomainRecord, ReceivingDomainsResource, RecoverHookEndpointParams, RecoverWebhookEndpointParams, Reputation, ReputationCheck, ReputationCheckSeverity, ReputationResource, ReputationStatus, RequestOptions, RescheduleEmailParams, RiskAssessment, RiskAssessmentsResource, RiskCaptchaProvider, RiskCaptchaSignals, RiskDecision, RiskDegradedSignal, RiskEmailSignals, RiskEvent, RiskEventType, RiskFeedbackParams, RiskIpSignals, RiskList, RiskListEntry, RiskListEntryType, RiskListEntryValue, RiskListsResource, RiskLoginSignals, RiskOutcome, RiskReason, RiskReasonCode, RiskResource, RiskRule, RiskRuleCondition, RiskRuleField, RiskRulesResource, RiskSettings, RiskSettingsResource, RiskUsersResource, RiskWebhookEvent, RiskWebhookEventData, RollHookEndpointSecretParams, RollWebhookEndpointSecretParams, SendEmailParams, SendHookMessageParams, SendHookTestParams, Suppression, SuppressionCheck, SuppressionImport, SuppressionReason, SuppressionResource, TrackingDomain, TrackingDomainRecord, TrackingDomainStatus, TrackingDomainsResource, TrackingOptions, TrackingResource, TrackingRule, TrackingSettings, UpdateHookApplicationParams, UpdateHookEndpointParams, UpdateHookEventTypeParams, UpdateLogDrainParams, UpdateRiskRuleParams, UpdateRiskSettingsParams, UpdateTrackingRuleParams, UpdateWebhookEndpointParams, Usage, VerdictStatus, VerifyWebhookOptions, WebhookAttempt, WebhookDeliveriesResource, WebhookDelivery, WebhookDeliveryStatus, WebhookEndpoint, WebhookEndpointDisabledReason, WebhookEndpointRecovery, WebhookEndpointWithSecret, WebhookEndpointsResource, WebhookEvent, WebhookEventType, WebhookHeaders };
+export type { AccountEventType, AccountWebhookEvent, AccountWebhookEventData, ApiKeyResource, ApiVersion, AssessRiskParams, AuditActorType, AuditEvent, AuditEventsResource, Billing, BillingCreditsResource, BillingEventType, BillingHoldReason, BillingInvoicesResource, BillingResource, BillingWebhookEvent, BimiIssueCode, BimiStatus, CheckRiskLimitParams, CheckSuppressionParams, CossError, CossErrorIssue, CossErrorType, CossOptions, CossResult, CreateDomainParams, CreateEmailTemplateParams, CreateHookApplicationParams, CreateHookEndpointParams, CreateHookEventTypeParams, CreateHookPortalSessionParams, CreateLogDrainParams, CreateReceivingDomainParams, CreateRiskLimitBucketParams, CreateRiskListEntryParams, CreateRiskRuleParams, CreateSuppressionParams, CreateTrackingDomainParams, CreateWebhookEndpointParams, CreateWebhookListenerParams, Credit, DedicatedIpPool, DedicatedIpPoolStatus, DedicatedIpsResource, DeletedApiKey, DeletedDomain, DeletedEmailTemplate, DeletedHookApplication, DeletedHookEndpoint, DeletedLogDrain, DeletedReceivedEmail, DeletedRiskLimitBucket, DeletedRiskListEntry, DeletedRiskRule, DeletedSuppression, DeletedTrackingRule, DeletedWebhookEndpoint, DeletedWebhookListener, DmarcCheck, DmarcCheckId, DmarcNextStep, DmarcNextStepKind, DmarcPolicy, DmarcPolicyPublished, DmarcPublishedRecord, DmarcReport, DmarcReportRecord, DmarcReportSummary, DmarcReportsResource, DmarcResource, DmarcSource, DmarcStage, Domain, DomainBimi, DomainDmarc, DomainEventType, DomainRecord, DomainRecordPurpose, DomainRecordStatus, DomainStatus, DomainWebhookEvent, DomainWebhookEventData, DomainsResource, Email, EmailAttachment, EmailAttachmentParams, EmailBatch, EmailEvent, EmailEventData, EmailEventType, EmailFailure, EmailLink, EmailRecipient, EmailRecipientStatus, EmailResource, EmailStatus, EmailSummary, EmailTag, EmailTemplate, EmailTemplateReference, EmailTemplateVersion, EmailTemplateVersionsResource, EmailTemplatesResource, EmailTracking, EmailWebhookEvent, EmailWebhookEventData, Environment, EnvironmentResource, ExportSuppressionsParams, FetchLike, ForgottenRiskUser, HookApplication, HookApplicationsResource, HookAttempt, HookDeliveriesResource, HookDelivery, HookDeliveryStatus, HookEndpoint, HookEndpointDisabledReason, HookEndpointRecovery, HookEndpointSecret, HookEndpointWebhookEvent, HookEndpointWebhookEventData, HookEndpointWithSecret, HookEndpointsResource, HookEventType, HookEventTypesResource, HookMessage, HookMessagesResource, HookOperationalEventType, HookPortalResource, HookPortalSession, HooksResource, ImportSuppressionEntry, ImportSuppressionsParams, InboundAddress, Invoice, InvoiceLine, InvoiceLineKind, InvoiceStatus, InvoiceSummary, List, ListAuditEventsParams, ListCreditsParams, ListDmarcReportsParams, ListEmailTemplateVersionsParams, ListEmailTemplatesParams, ListEmailsParams, ListHookApplicationsParams, ListHookDeliveriesParams, ListHookEventTypesParams, ListHookMessagesParams, ListInvoicesParams, ListLogDrainBatchesParams, ListLogsParams, ListReceivedEmailsParams, ListRiskAssessmentsParams, ListRiskListEntriesParams, ListSuppressionsParams, ListUsageParams, ListWebhookDeliveriesParams, Log, LogDrain, LogDrainAttempt, LogDrainBatch, LogDrainBatchStatus, LogDrainBatchesResource, LogDrainLine, LogDrainSource, LogDrainWithSecret, LogDrainsResource, LogLevel, LogSource, LogsResource, MailFromStatus, Meter, NamedResource, PlanKey, PollWebhookListenerParams, PublishEmailTemplateParams, ReactEmailElement, ReceivedEmail, ReceivedEmailAttachment, ReceivedEmailEventType, ReceivedEmailStatus, ReceivedEmailSummary, ReceivedEmailVerdicts, ReceivedEmailWebhookEvent, ReceivedEmailWebhookEventData, ReceivedEmailsResource, ReceivingDomain, ReceivingDomainRecord, ReceivingDomainsResource, RecoverHookEndpointParams, RecoverWebhookEndpointParams, Reputation, ReputationCheck, ReputationCheckSeverity, ReputationResource, ReputationStatus, RequestOptions, RescheduleEmailParams, RiskAssessment, RiskAssessmentsResource, RiskCalibration, RiskCaptchaProvider, RiskCaptchaSignals, RiskCardFunding, RiskCheckoutSignals, RiskContentCategory, RiskContentClassification, RiskContentScores, RiskDecision, RiskDegradedSignal, RiskDeviceSignals, RiskEmailCheck, RiskEmailSignals, RiskEvent, RiskEventType, RiskFeedbackParams, RiskIpCheck, RiskIpPrivacy, RiskIpSignals, RiskLimit, RiskLimitBucket, RiskLimitBucketsResource, RiskLimitFailureMode, RiskList, RiskListEntry, RiskListEntryType, RiskListEntryValue, RiskListsResource, RiskLoginSignals, RiskOutcome, RiskReason, RiskReasonCode, RiskResource, RiskRule, RiskRuleCondition, RiskRuleField, RiskRulesResource, RiskSettings, RiskSettingsResource, RiskUsersResource, RiskWebhookEvent, RiskWebhookEventData, RollHookEndpointSecretParams, RollWebhookEndpointSecretParams, SendEmailBaseParams, SendEmailContentParams, SendEmailParams, SendEmailTemplateParams, SendHookMessageParams, SendHookTestParams, Suppression, SuppressionCheck, SuppressionImport, SuppressionReason, SuppressionResource, TemplateContent, TemplateContentParams, TemplateProblem, TemplateScalarType, TemplateVariable, TemplateVariableParams, TemplateVariableType, TrackingDomain, TrackingDomainRecord, TrackingDomainStatus, TrackingDomainsResource, TrackingOptions, TrackingResource, TrackingRule, TrackingSettings, UpdateEmailTemplateDraftParams, UpdateEmailTemplateParams, UpdateHookApplicationParams, UpdateHookEndpointParams, UpdateHookEventTypeParams, UpdateLogDrainParams, UpdateRiskLimitBucketParams, UpdateRiskRuleParams, UpdateRiskSettingsParams, UpdateTrackingRuleParams, UpdateWebhookEndpointParams, Usage, VerdictStatus, VerifyWebhookOptions, WebhookAttempt, WebhookDeliveriesResource, WebhookDelivery, WebhookDeliveryStatus, WebhookEndpoint, WebhookEndpointDisabledReason, WebhookEndpointRecovery, WebhookEndpointWithSecret, WebhookEndpointsResource, WebhookEvent, WebhookEventType, WebhookHeaders, WebhookListener, WebhookListenerAck, WebhookListenerDelivery, WebhookListenerPoll, WebhookListenersResource };