coss 0.2.0 → 0.4.0

package/dist/index.js

@@ -9,7 +9,7 @@ const API_VERSION = "2026-10-10";
 //#endregion
 //#region src/version.ts
 /** SDK version, sent in the User-Agent. A test keeps it equal to package.json's `version`. */
-const VERSION = "0.2.0";
+const VERSION = "0.4.0";
 //#endregion
 //#region src/core/errors.ts
 const API_ERROR_TYPES = /* @__PURE__ */ new Set([
@@ -49,7 +49,7 @@ function errorFromResponse(status, statusText, body, headerRequestId) {
 	if (!isRecord(envelope) || typeof envelope.message !== "string") return {
 		type: "api_error",
 		code: "unexpected_response",
-		message: `The COSS API returned an unexpected HTTP ${status}${statusText ? ` (${statusText})` : ""} response.`,
+		message: `The coss.com API returned an unexpected HTTP ${status}${statusText ? ` (${statusText})` : ""} response.`,
 		status,
 		request_id: headerRequestId
 	};
@@ -208,7 +208,7 @@ var HttpClient = class {
 			};
 			const timeoutMessage = `Request timed out after ${this.#timeout}ms.`;
 			return {
-				result: failed(timeoutSignal.aborted ? clientError("timeout_error", "request_timeout", timeoutMessage) : clientError("connection_error", "network_error", `Could not reach the COSS API at ${this.#baseUrl}: ${describe(cause)}`)),
+				result: failed(timeoutSignal.aborted ? clientError("timeout_error", "request_timeout", timeoutMessage) : clientError("connection_error", "network_error", `Could not reach the coss.com API at ${this.#baseUrl}: ${describe(cause)}`)),
 				retry: true,
 				retryAfterMs: null
 			};
@@ -249,7 +249,7 @@ var HttpClient = class {
 				result: failed({
 					type: "api_error",
 					code: "invalid_response",
-					message: `The COSS API returned an HTTP ${response.status} response that is not valid JSON.`,
+					message: `The coss.com API returned an HTTP ${response.status} response that is not valid JSON.`,
 					status: response.status,
 					request_id: requestId
 				}),
@@ -266,6 +266,24 @@ function failed(error) {
 	};
 }
 //#endregion
+//#region src/resources/api-key.ts
+/** `coss.apiKey`: the API key the client was created with. */
+var ApiKeyResource = class {
+	#http;
+	/** @internal Use `new Coss().apiKey`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Revokes the client's own API key, at once: every later request with it fails. */
+	revoke(options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: "/v1/api_key",
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
 //#region src/resources/list-query.ts
 /** One query parameter: lists are comma-joined (an empty one is left out), dates ISO 8601. */
 function joined(value) {
@@ -284,7 +302,7 @@ function listQuery(params) {
 //#region src/resources/audit-events.ts
 /**
 * `coss.auditEvents`: the organization's audit log, newest first: changes made by members, API
-* keys and COSS support. Organization-wide, whichever environment the key belongs to.
+* keys and coss.com support. Organization-wide, whichever environment the key belongs to.
 */
 var AuditEventsResource = class {
 	#http;
@@ -387,6 +405,59 @@ var BillingResource = class {
 	}
 };
 //#endregion
+//#region src/resources/dmarc.ts
+const dmarcPath = (domainId) => `/v1/domains/${encodeURIComponent(domainId)}/dmarc`;
+/** `coss.domains.dmarc.reports`: the aggregate reports received about a domain. */
+var DmarcReportsResource = class {
+	#http;
+	/** @internal Use `new Coss().domains.dmarc.reports`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Lists the domain's reports, newest first, without their rows. */
+	list(domainId, params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${dmarcPath(domainId)}/reports`,
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	/** Retrieves one report with its rows. */
+	get(domainId, reportId, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${dmarcPath(domainId)}/reports/${encodeURIComponent(reportId)}`,
+			signal: options?.signal
+		});
+	}
+};
+/**
+* `coss.domains.dmarc`: a domain's DMARC record, the guided path from `p=none` to `p=reject`, and
+* the aggregate reports mailbox providers send to its `report_address`.
+*/
+var DmarcResource = class {
+	#http;
+	/** The domain's aggregate reports. */
+	reports;
+	/** @internal Use `new Coss().domains.dmarc`. */
+	constructor(http) {
+		this.#http = http;
+		this.reports = new DmarcReportsResource(http);
+	}
+	/**
+	* The domain's DMARC status: its published record, the record to publish next and whether
+	* the last 14 days of reports say that is safe (`ready`), and a summary of those reports.
+	*/
+	get(domainId, options) {
+		return this.#http.request({
+			method: "GET",
+			path: dmarcPath(domainId),
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
 //#region src/resources/receiving-domains.ts
 const receivingPath = (domainId) => `/v1/domains/${encodeURIComponent(domainId)}/receiving`;
 /**
@@ -471,11 +542,14 @@ var DomainsResource = class {
 	tracking;
 	/** Each domain's receiving hostname: start and stop receiving email at it. */
 	receiving;
+	/** Each domain's DMARC status, guidance and aggregate reports. */
+	dmarc;
 	/** @internal Use `new Coss().domains`. */
 	constructor(http) {
 		this.#http = http;
 		this.tracking = new TrackingDomainsResource(http);
 		this.receiving = new ReceivingDomainsResource(http);
+		this.dmarc = new DmarcResource(http);
 	}
 	/**
 	* Adds a domain and returns the DNS records to publish (`data.records`). The records are
@@ -529,6 +603,230 @@ var DomainsResource = class {
 	}
 };
 //#endregion
+//#region src/react.ts
+/**
+* React Email: a send's `react` is rendered into `html` (and `text`, unless given) by
+* `@react-email/render`, an optional peer dependency imported only when a send has `react`, so the
+* SDK itself keeps zero dependencies.
+*/
+let renderer;
+/** Imports `@react-email/render` once; `null` when it isn't installed. */
+function loadReactEmailRenderer() {
+	renderer ??= (async () => {
+		try {
+			return await import("@react-email/render");
+		} catch {
+			return null;
+		}
+	})();
+	return renderer;
+}
+/**
+* Turns `react` into `html` and `text`; params without it pass through. Rendering mistakes come back
+* as `invalid_request_error`s naming `param`, like the API's validation errors, never thrown.
+*/
+async function renderReactEmail(params, param, load = loadReactEmailRenderer) {
+	const { react, ...body } = params;
+	if (react === void 0) return {
+		body,
+		error: null
+	};
+	if (body.template_id !== void 0) return failure("validation_error", "Pass either `react` or `template_id`, not both.", param);
+	if (body.html !== void 0) return failure("validation_error", "Pass either `react` or `html`, not both.", param);
+	const renderer = await load();
+	if (!renderer) return failure("react_renderer_missing", "Sending `react` needs the `@react-email/render` package: install it next to `coss`.", param);
+	try {
+		const html = await renderer.render(react);
+		if (body.text !== void 0) return {
+			body: {
+				...body,
+				html
+			},
+			error: null
+		};
+		const text = renderer.toPlainText ? renderer.toPlainText(html) : await renderer.render(react, { plainText: true });
+		return {
+			body: {
+				...body,
+				html,
+				text
+			},
+			error: null
+		};
+	} catch (cause) {
+		return failure("react_render_failed", `Rendering \`react\` failed: ${cause instanceof Error ? cause.message : String(cause)}`, param);
+	}
+}
+function failure(code, message, param) {
+	return {
+		body: null,
+		error: {
+			...clientError("invalid_request_error", code, message),
+			param
+		}
+	};
+}
+//#endregion
+//#region src/resources/dedicated-ips.ts
+/**
+* `coss.email.dedicatedIps`: the organization's own sending IPs (the Dedicated IPs add-on),
+* managed and warmed up automatically.
+*/
+var DedicatedIpsResource = class {
+	#http;
+	/** @internal Use `new Coss().email.dedicatedIps`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** The pool's status and IPs (`not_enabled` without the add-on). */
+	get(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/dedicated_ips",
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/email-templates.ts
+const templatePath = (template) => `/v1/email_templates/${encodeURIComponent(template)}`;
+/** `coss.email.templates.versions`: a template's published versions. */
+var EmailTemplateVersionsResource = class {
+	#http;
+	/** @internal Use `new Coss().email.templates.versions`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Published versions, newest first. */
+	list(template, params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${templatePath(template)}/versions`,
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	get(template, version, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${templatePath(template)}/versions/${version}`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Replaces the draft with this version's content; publish the draft to send it again. Never
+	* automatically retried: every restore is a new draft revision, so a repeat could overwrite an
+	* edit saved in between.
+	*/
+	restore(template, version, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `${templatePath(template)}/versions/${version}/restore`,
+			retry: false,
+			signal: options?.signal
+		});
+	}
+};
+/**
+* `coss.email.templates`: the environment's email templates. Templates are addressed by id or
+* alias. Edit the draft, publish it, then send with `coss.email.send({ template_id, variables })`.
+*/
+var EmailTemplatesResource = class {
+	#http;
+	/** Published versions. */
+	versions;
+	/** @internal Use `new Coss().email.templates`. */
+	constructor(http) {
+		this.#http = http;
+		this.versions = new EmailTemplateVersionsResource(http);
+	}
+	/**
+	* Creates a template and its draft. Never automatically retried: the API doesn't deduplicate it
+	* (a template with an `alias` can't be created twice, though).
+	*/
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/email_templates",
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** The environment's templates, newest first. */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/email_templates",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	get(template, options) {
+		return this.#http.request({
+			method: "GET",
+			path: templatePath(template),
+			signal: options?.signal
+		});
+	}
+	/** Changes its name, alias or description. */
+	update(template, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: templatePath(template),
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Deletes it with every version. Emails already sent keep their content. */
+	delete(template, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: templatePath(template),
+			signal: options?.signal
+		});
+	}
+	/** The draft, with `problems` that keep it from being published. */
+	getDraft(template, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${templatePath(template)}/draft`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Replaces the whole draft. Sends keep using the published version until you publish. Never
+	* automatically retried: every save is a new revision, so a repeat whose first attempt was saved
+	* would fail with `template_revision_mismatch` (or, without `revision`, overwrite an edit saved
+	* in between). Read the draft again before retrying.
+	*/
+	updateDraft(template, params, options) {
+		return this.#http.request({
+			method: "PUT",
+			path: `${templatePath(template)}/draft`,
+			retry: false,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Publishes the draft as the next version, which sends use from then on. Automatically retried
+	* only with a `revision`: a draft without changes since the last publish returns that version,
+	* and one saved again since is refused. Without it, a retry could publish someone else's newer
+	* edits as yet another version.
+	*/
+	publish(template, params = {}, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `${templatePath(template)}/publish`,
+			retry: params.revision !== void 0,
+			body: params,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
 //#region src/resources/received-emails.ts
 const emailPath = (id) => `/v1/received_emails/${encodeURIComponent(id)}`;
 /**
@@ -711,8 +1009,8 @@ var SuppressionResource = class {
 const categoryPath = (category) => `/v1/tracking_settings/categories/${encodeURIComponent(category)}`;
 /**
 * `coss.email.tracking`: which emails of the API key's environment have their opens and clicks
-* tracked. Emails keep the settings that applied when they were sent; a send's own `tracking`
-* option wins over them.
+* tracked and get one-click unsubscribe headers. Emails keep the settings that applied when they
+* were sent; a send's own `tracking` option wins over them.
 */
 var TrackingResource = class {
 	#http;
@@ -780,24 +1078,37 @@ var EmailResource = class {
 	tracking;
 	/** Emails the environment received. */
 	received;
+	/** The environment's email templates. */
+	templates;
+	/** The organization's dedicated IPs. */
+	dedicatedIps;
 	/** @internal Use `new Coss().email`. */
 	constructor(http) {
 		this.#http = http;
 		this.suppressions = new SuppressionResource(http);
 		this.tracking = new TrackingResource(http);
 		this.received = new ReceivedEmailsResource(http);
+		this.templates = new EmailTemplatesResource(http);
+		this.dedicatedIps = new DedicatedIpsResource(http);
 	}
 	/**
-	* Sends an email. It is returned `queued` and handed to the delivery provider moments later:
+	* Sends an email, with its own subject and body or from a published template (`template_id`
+	* and `variables`). It is returned `queued` and handed to the delivery provider moments later:
 	* `get` it or listen for the `email.sent` / `email.failed` webhooks for the outcome. Safe to
 	* retry: the request always carries an `Idempotency-Key` (yours, or a generated one reused
-	* across automatic retries), so the API never sends it twice.
+	* across automatic retries), so the API never sends it twice. A `react` component is rendered
+	* once, before the first attempt.
 	*/
-	send(params, options) {
+	async send(params, options) {
+		const { body, error } = await renderReactEmail(params, "react");
+		if (error) return {
+			data: null,
+			error
+		};
 		return this.#http.request({
 			method: "POST",
 			path: "/v1/emails",
-			body: params,
+			body,
 			idempotencyKey: options?.idempotencyKey,
 			signal: options?.signal
 		});
@@ -808,15 +1119,32 @@ var EmailResource = class {
 	* recipients count against the send quota together. Safe to retry: one `Idempotency-Key` covers
 	* the whole batch. Larger lists need several calls, each with its own key.
 	*/
-	sendBatch(emails, options) {
+	async sendBatch(emails, options) {
+		const rendered = await Promise.all(emails.map((email, index) => renderReactEmail(email, `emails.${index}.react`)));
+		const bodies = [];
+		for (const { body, error } of rendered) {
+			if (error) return {
+				data: null,
+				error
+			};
+			bodies.push(body);
+		}
 		return this.#http.request({
 			method: "POST",
 			path: "/v1/emails/batch",
-			body: { emails },
+			body: { emails: bodies },
 			idempotencyKey: options?.idempotencyKey,
 			signal: options?.signal
 		});
 	}
+	/** Retrieves a batch sent by `sendBatch`, with its emails' current statuses in request order. */
+	getBatch(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/emails/batch/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
 	/** Retrieves an email sent from the same environment as the API key. */
 	get(id, options) {
 		return this.#http.request({
@@ -826,6 +1154,19 @@ var EmailResource = class {
 		});
 	}
 	/**
+	* Lists emails sent from the same environment as the API key, newest first and without their
+	* content (`get` one for `html`, `text`, `headers` and `attachments`). Pass the last `id` as
+	* `after` while `has_more` is true.
+	*/
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/emails",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	/**
 	* Cancels a scheduled email. Canceling an already canceled email returns it; any other email
 	* fails with `email_not_cancelable`.
 	*/
@@ -867,6 +1208,24 @@ var EmailResource = class {
 	}
 };
 //#endregion
+//#region src/resources/environment.ts
+/** `coss.environment`: which environment, project and organization the API key belongs to. */
+var EnvironmentResource = class {
+	#http;
+	/** @internal Use `new Coss().environment`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** The API key's environment, its project and organization, and the key itself. */
+	get(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/environment",
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
 //#region src/resources/hooks.ts
 const segment = encodeURIComponent;
 const applicationPath = (application) => `/v1/hooks/applications/${segment(application)}`;
@@ -1080,7 +1439,7 @@ var HookEndpointsResource = class {
 		});
 	}
 };
-/** `coss.hooks.messages`: send a message once; COSS delivers it to every subscribed endpoint. */
+/** `coss.hooks.messages`: send a message once; coss.com delivers it to every subscribed endpoint. */
 var HookMessagesResource = class {
 	#http;
 	/** @internal Use `new Coss().hooks.messages`. */
@@ -1183,7 +1542,7 @@ var HookPortalResource = class {
 };
 /**
 * `coss.hooks`: webhooks as a service. Send a message to one of your applications once
-* (`coss.hooks.messages.send`); COSS delivers it to every endpoint its users registered, signed
+* (`coss.hooks.messages.send`); coss.com delivers it to every endpoint its users registered, signed
 * (Standard Webhooks), with retries, and gives them a portal to manage it all.
 */
 var HooksResource = class {
@@ -1279,7 +1638,7 @@ var LogDrainsResource = class {
 	}
 	/**
 	* Changes the URL, description, sources or `enabled` flag. The signing secret stays the same.
-	* Disabling drops the lines still waiting for the drain; enabling it again (also after COSS
+	* Disabling drops the lines still waiting for the drain; enabling it again (also after coss.com
 	* disabled it for failing) sends lines logged from then on.
 	*/
 	update(id, params, options) {
@@ -1335,7 +1694,7 @@ var LogsResource = class {
 //#endregion
 //#region src/resources/reputation.ts
 /**
-* `coss.reputation`: the organization's standing with the COSS reputation guard, which suspends
+* `coss.reputation`: the organization's standing with the coss.com reputation guard, which suspends
 * live sending automatically when bounce or complaint rates cross its thresholds.
 */
 var ReputationResource = class {
@@ -1521,7 +1880,58 @@ var RiskRulesResource = class {
 		});
 	}
 };
-/** `coss.risk.users`: what COSS remembers about your users. */
+/**
+* `coss.risk.limitBuckets`: your rate limit buckets, which `coss.risk.limit()` charges per key.
+*/
+var RiskLimitBucketsResource = class {
+	#http;
+	/** @internal Use `new Coss().risk.limitBuckets`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Creates a bucket. Not retried automatically: a retry would find its name taken. */
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/risk/limit_buckets",
+			body: params,
+			retry: false,
+			signal: options?.signal
+		});
+	}
+	/** Every bucket, by name. */
+	list(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/risk/limit_buckets",
+			signal: options?.signal
+		});
+	}
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/risk/limit_buckets/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** Changes the fields given; the next check uses them. */
+	update(id, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: `/v1/risk/limit_buckets/${encodeURIComponent(id)}`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	delete(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/risk/limit_buckets/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.risk.users`: what coss.com remembers about your users. */
 var RiskUsersResource = class {
 	#http;
 	/** @internal Use `new Coss().risk.users`. */
@@ -1529,7 +1939,7 @@ var RiskUsersResource = class {
 		this.#http = http;
 	}
 	/**
-	* Call when you delete a user: COSS deletes what identifies them (their mailbox, fraud reports,
+	* Call when you delete a user: coss.com deletes what identifies them (their mailbox, fraud reports,
 	* and the user id, email, IP and user agent on their assessments). Safe to repeat.
 	*/
 	forget(userId, options) {
@@ -1560,6 +1970,8 @@ var RiskResource = class {
 	settings;
 	/** Rules (`create`, `list`, `get`, `update`, `delete`). */
 	rules;
+	/** Your rate limit buckets (`create`, `list`, `get`, `update`, `delete`). */
+	limitBuckets;
 	#http;
 	/** @internal Use `new Coss().risk`. */
 	constructor(http) {
@@ -1569,6 +1981,7 @@ var RiskResource = class {
 		this.users = new RiskUsersResource(http);
 		this.settings = new RiskSettingsResource(http);
 		this.rules = new RiskRulesResource(http);
+		this.limitBuckets = new RiskLimitBucketsResource(http);
 	}
 	/**
 	* Assesses an event and returns the decision with its score and reasons. Retries reuse one
@@ -1585,7 +1998,8 @@ var RiskResource = class {
 	}
 	/**
 	* Reports what an assessed user turned out to be: `fraud` and `abuse` teach later assessments to
-	* flag the same mailbox, user, IP and subnet; `legitimate` takes that back. Resolves a review.
+	* flag the same mailbox, user, card, device, IP and subnet; `legitimate` takes that back.
+	* Resolves a review, and counts in `calibration()`.
 	*/
 	feedback(id, params, options) {
 		return this.#http.request({
@@ -1596,6 +2010,71 @@ var RiskResource = class {
 			signal: options?.signal
 		});
 	}
+	/**
+	* How often each reason and rule was right over the last 90 days, by your feedback, and the
+	* reason weights that supports. Apply them with `settings.update({ reason_weights })`.
+	*/
+	calibration(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/risk/calibration",
+			signal: options?.signal
+		});
+	}
+	/**
+	* Checks an email address on its own: syntax, disposable domains, deliverability, role
+	* accounts, free providers, the canonical mailbox, typos and domain age. Nothing is stored.
+	*/
+	checkEmail(email, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/risk/email/check",
+			body: { email },
+			signal: options?.signal
+		});
+	}
+	/**
+	* Checks an IP address on its own: Tor, cloud, hosting and VPN networks, ASN and country, and
+	* VPN, proxy and relay exits when coss.com's privacy data is available.
+	*/
+	checkIp(ip, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/risk/ip/check",
+			body: { ip },
+			signal: options?.signal
+		});
+	}
+	/**
+	* Scores text for spam, phishing, malware and fraud. Scores only, never a verdict: you choose
+	* the thresholds. The text is neither stored nor logged.
+	*/
+	classify(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/risk/content/classify",
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Takes `cost` tokens (default 1) from `key`'s share of one of your buckets
+	* (`coss.risk.limitBuckets`). Retries reuse one `Idempotency-Key`, so they are charged once.
+	*
+	* ```ts
+	* const { data } = await coss.risk.limit({ bucket: "password_reset", key: email });
+	* if (data && !data.allowed) return tooManyRequests(data.retry_after_ms);
+	* ```
+	*/
+	limit(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/risk/limits",
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
 };
 //#endregion
 //#region src/resources/webhook-deliveries.ts
@@ -1744,6 +2223,51 @@ var WebhookEndpointsResource = class {
 	}
 };
 //#endregion
+//#region src/resources/webhook-listeners.ts
+/**
+* `coss.webhookListeners`: what `coss listen` uses to forward an environment's events to a local
+* server. A listener receives events created after it opens, while it is polled; it is closed by
+* `delete` or after 10 minutes without a poll.
+*/
+var WebhookListenersResource = class {
+	#http;
+	/** @internal Use `new Coss().webhookListeners`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Opens a listener. Never retried automatically: a lost answer leaves one to expire. */
+	create(params = {}, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/webhook_listeners",
+			retry: false,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Acknowledges earlier deliveries and waits (up to `wait_ms`) for more. Never retried
+	* automatically: call it in a loop, and keep unacknowledged acks for the next call after an error.
+	*/
+	poll(id, params = {}, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/webhook_listeners/${encodeURIComponent(id)}/poll`,
+			retry: false,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Closes a listener: it receives nothing more. */
+	delete(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/webhook_listeners/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
 //#region src/client.ts
 const DEFAULT_BASE_URL = "https://api.coss.com";
 const DEFAULT_TIMEOUT_MS = 3e4;
@@ -1764,7 +2288,7 @@ function timeoutMs(value) {
 	return value !== void 0 && Number.isFinite(value) && value > 0 ? Math.min(Math.ceil(value), MAX_TIMEOUT_MS) : DEFAULT_TIMEOUT_MS;
 }
 /**
-* The COSS client. One API key covers every product.
+* The coss.com client. One API key covers every product.
 *
 * ```ts
 * const coss = new Coss({ apiKey: "coss_test_…" });
@@ -1773,17 +2297,23 @@ function timeoutMs(value) {
 */
 var Coss = class {
 	email;
+	/** The API key's environment, project and organization (`coss.environment.get()`). */
+	environment;
+	/** The client's own API key (`coss.apiKey.revoke()`). */
+	apiKey;
 	/** Sending domains of the organization (`coss.domains.create`, `.verify`, …). */
 	domains;
 	/** Webhook endpoints of the API key's environment. */
 	webhookEndpoints;
+	/** Temporary listeners `coss listen` pulls the environment's events from. */
+	webhookListeners;
 	/** The organization's sending reputation (`coss.reputation.get()`). */
 	reputation;
 	/** The environment's log: API requests, email events, webhook attempts (`coss.logs.list()`). */
 	logs;
 	/** HTTPS endpoints the environment's log is streamed to (`coss.logDrains.create()`). */
 	logDrains;
-	/** The organization's audit log: changes by members, API keys and COSS support (`coss.auditEvents.list()`). */
+	/** The organization's audit log: changes by members, API keys and coss.com support (`coss.auditEvents.list()`). */
 	auditEvents;
 	/** Hooks, webhooks as a service: `coss.hooks.messages.send()` delivers to your users' endpoints. */
 	hooks;
@@ -1796,9 +2326,9 @@ var Coss = class {
 	* `dangerouslyAllowBrowser`. Request failures are returned as `{ data: null, error }`.
 	*/
 	constructor(options = {}) {
-		if (typeof globalThis.document !== "undefined" && !options.dangerouslyAllowBrowser) throw new Error("Refusing to create a COSS client in a browser-like environment: COSS API keys are secret, and any key sent to the browser can be read by anyone using the page. Call COSS from your server instead, or pass `dangerouslyAllowBrowser: true` if you understand the risk.");
+		if (typeof globalThis.document !== "undefined" && !options.dangerouslyAllowBrowser) throw new Error("Refusing to create a coss.com client in a browser-like environment: coss.com API keys are secret, and any key sent to the browser can be read by anyone using the page. Call coss.com from your server instead, or pass `dangerouslyAllowBrowser: true` if you understand the risk.");
 		const apiKey = options.apiKey?.trim() || readEnv("COSS_API_KEY");
-		if (!apiKey) throw new Error("Missing COSS API key. Pass `apiKey` to `new Coss({ apiKey })` or set the COSS_API_KEY environment variable.");
+		if (!apiKey) throw new Error("Missing coss.com API key. Pass `apiKey` to `new Coss({ apiKey })` or set the COSS_API_KEY environment variable.");
 		const http = new HttpClient({
 			apiKey,
 			baseUrl: options.baseUrl?.trim() || readEnv("COSS_BASE_URL") || DEFAULT_BASE_URL,
@@ -1808,8 +2338,11 @@ var Coss = class {
 			apiVersion: options.apiVersion?.trim() || "2026-10-10"
 		});
 		this.email = new EmailResource(http);
+		this.environment = new EnvironmentResource(http);
+		this.apiKey = new ApiKeyResource(http);
 		this.domains = new DomainsResource(http);
 		this.webhookEndpoints = new WebhookEndpointsResource(http);
+		this.webhookListeners = new WebhookListenersResource(http);
 		this.reputation = new ReputationResource(http);
 		this.logs = new LogsResource(http);
 		this.logDrains = new LogDrainsResource(http);
@@ -1883,7 +2416,7 @@ async function verifySignature(payload, headers, secret, options) {
 * const event = await verifyWebhook(await request.text(), request.headers, process.env.COSS_WEBHOOK_SECRET);
 * ```
 *
-* The same check verifies messages your own users receive from COSS Hooks (`coss.hooks`): pass
+* The same check verifies messages your own users receive from coss.com Hooks (`coss.hooks`): pass
 * the endpoint's secret and name your payload type, e.g. `verifyWebhook<InvoicePaid>(…)`.
 */
 async function verifyWebhook(payload, headers, secret, options = {}) {