coss 0.3.0 → 0.5.0

package/dist/index.d.ts

@@ -1,3104 +1,7 @@
-//#region src/api-version.d.ts
-/**
- * API versions this SDK knows, oldest first: a hand-written mirror of `API_VERSIONS` in the API
- * (`apps/api/test/sdk-contract.test.ts` keeps them equal).
- */
-export declare const API_VERSIONS: readonly ["2026-10-10"];
-/** A dated API version, sent as the `Coss-Version` header. */
-type ApiVersion = (typeof API_VERSIONS)[number];
-/** The version this SDK's types describe, sent with every request unless `apiVersion` overrides it. */
-export declare const API_VERSION: ApiVersion;
-//#endregion
-//#region src/core/errors.d.ts
-/** Error types returned by the API, plus the client-side `connection_error` and `timeout_error`. */
-type CossErrorType = "invalid_request_error" | "authentication_error" | "permission_error" | "not_found_error" | "idempotency_error" | "rate_limit_error" | "billing_error" | "api_error" | "connection_error" | "timeout_error";
-/** One field-level validation problem (`invalid_request_error` / `validation_error`). */
-interface CossErrorIssue {
-  path: string;
-  message: string;
-}
-/**
- * A failed request. API errors mirror the API's `{ "error": { … } }` envelope; failures that never
- * produced a response (network, timeout, abort) have `status: null`.
- */
-interface CossError {
-  type: CossErrorType;
-  /** Machine-readable reason, e.g. `invalid_api_key`, `validation_error`, `aborted`. */
-  code: string;
-  message: string;
-  /** HTTP status, or `null` when no response was received. */
-  status: number | null;
-  /** The API's `X-Request-Id`. Include it when contacting support. */
-  request_id: string | null;
-  /** The request parameter the error relates to, when there is one. */
-  param?: string;
-  issues?: CossErrorIssue[];
-}
-type CossResult<T> = {
-  data: T;
-  error: null;
-} | {
-  data: null;
-  error: CossError;
-};
-//#endregion
-//#region src/core/http.d.ts
-/** Any WHATWG-compatible `fetch` (global fetch, undici, a test double, `app.fetch` adapters …). */
-type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-/** Per-request options accepted by every resource method. */
-interface RequestOptions {
-  /**
-   * Sent as `Idempotency-Key` on POST requests. When omitted a random UUID is generated; either way
-   * the same key is reused for every retry of the call, so a retried send is never duplicated.
-   */
-  idempotencyKey?: string;
-  /** Aborting cancels the in-flight attempt and any pending retry. */
-  signal?: AbortSignal;
-}
-interface HttpClientOptions {
-  apiKey: string;
-  baseUrl: string;
-  fetch: FetchLike;
-  /** Per-attempt timeout in milliseconds. */
-  timeout: number;
-  maxRetries: number;
-  /** Sent as `Coss-Version` with every request. */
-  apiVersion: string;
-  /** Waits between retries; must resolve early when `signal` aborts. Overridable for tests. */
-  sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
-}
-interface ApiRequest {
-  /** Disable automatic retries for operations without server-side deduplication. */
-  retry?: boolean;
-  method: "GET" | "POST" | "PATCH" | "DELETE";
-  /** Path including the version prefix, e.g. `/v1/emails`. */
-  path: string;
-  /** Query parameters; `undefined` values are left out. */
-  query?: Record<string, string | number | undefined>;
-  /** Serialized as JSON. */
-  body?: unknown;
-  /**
-   * `text` returns the raw body of a successful response (e.g. CSV) instead of parsing JSON;
-   * `bytes` returns it as a `Uint8Array` (a received email's raw message, an attachment).
-   */
-  responseType?: "json" | "text" | "bytes";
-  idempotencyKey?: string;
-  signal?: AbortSignal;
-}
-/**
- * The request pipeline shared by all resources: auth + JSON, a per-attempt timeout, retries with
- * backoff, and mapping every failure to a `CossError`. It never throws for API or network errors.
- */
-declare class HttpClient {
-  #private;
-  constructor(options: HttpClientOptions);
-  request<T>(request: ApiRequest): Promise<CossResult<T>>;
-}
-//#endregion
-//#region src/types/audit-event.d.ts
-/** Audit log wire types (hand-written mirrors of the API's schemas). */
-/**
- * `user`: a member, in the dashboard. `api_key`: a request made with an API key. `system`: COSS
- * itself, including COSS support.
- */
-type AuditActorType = "user" | "api_key" | "system";
-/** One change to the organization. */
-interface AuditEvent {
-  object: "audit_event";
-  id: string;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-  actor_type: AuditActorType;
-  /** The user's or API key's id; `null` for the system. */
-  actor_id: string | null;
-  /** The user's email, the API key's id, or `COSS support` (copied when recorded). */
-  actor_label: string;
-  /** `<resource>.<verb>`, e.g. `api_key.created`, `domain.deleted`, `member.role_changed`. */
-  action: string;
-  /** What was changed: `domain`, `api_key`, `member`… */
-  target_type: string | null;
-  target_id: string | null;
-  /** A readable name for the target when it was changed. */
-  target_label: string | null;
-  /** `null` for organization-wide changes (domains, members…). */
-  project_id: string | null;
-  /** `null` for organization-wide changes (domains, members…). */
-  environment_id: string | null;
-  /** Details of the change; API changes include their `request_id`. */
-  metadata: Record<string, unknown>;
-  client_ip: string | null;
-  user_agent: string | null;
-}
-type OneOrMany$1<T> = T | readonly T[];
-/** Query of `GET /v1/audit_events`. Lists may be given as arrays or comma-separated strings. */
-interface ListAuditEventsParams {
-  /** Actions, e.g. `"api_key.created"`; an entry ending in `.` (`"domain."`) matches a whole resource. */
-  action?: OneOrMany$1<string>;
-  actor_type?: OneOrMany$1<AuditActorType>;
-  /** Only changes made by this user or API key. */
-  actor_id?: string;
-  /** Only changes to this resource, e.g. a `dom_…` id. */
-  target_id?: string;
-  /** Only changes in this environment. */
-  environment_id?: string;
-  /** Only events at or after this time. */
-  from?: string | Date;
-  /** Only events before this time. */
-  to?: string | Date;
-  /** 1-100, default 50. */
-  limit?: number;
-  /** The `id` of the last event of the previous page. */
-  after?: string;
-}
-//#endregion
-//#region src/types/suppression.d.ts
-/** Suppression list wire types (hand-written mirrors of the API's schemas). */
-/**
- * Why an address is suppressed. `bounce`: a permanent bounce. `complaint`: a spam complaint.
- * `manual`: added one by one through the API or the dashboard. `import`: added by a bulk import.
- */
-type SuppressionReason = "bounce" | "complaint" | "manual" | "import";
-/** An entry of the API key's environment's suppression list. */
-interface Suppression {
-  object: "suppression";
-  id: string;
-  /** The bare, lower-cased address. */
-  address: string;
-  /** `"*"` (every email) or a category: only emails sent with that `category` skip the address. */
-  scope: string;
-  reason: SuppressionReason;
-  /** The email whose bounce or complaint added this entry. */
-  email_id: string | null;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-}
-/** Body of `POST /v1/suppressions`. */
-interface CreateSuppressionParams {
-  /** Display names are ignored; matching is case-insensitive. */
-  address: string;
-  /** `"*"` (the default) suppresses every email; a category only suppresses those emails. */
-  scope?: string;
-}
-/** Query of `GET /v1/suppressions`. */
-interface ListSuppressionsParams {
-  address?: string;
-  scope?: string;
-  /** 1-100, default 50. */
-  limit?: number;
-  /** The `id` of the last entry of the previous page. */
-  after?: string;
-}
-/** Query of `GET /v1/suppressions/check`. */
-interface CheckSuppressionParams {
-  address: string;
-  /** The category of the email you plan to send. Without it, only `"*"` entries count. */
-  category?: string;
-}
-/** Whether a send would skip an address. */
-interface SuppressionCheck {
-  object: "suppression_check";
-  address: string;
-  suppressed: boolean;
-  /** The entries that match. */
-  suppressions: Suppression[];
-}
-/** Response of `DELETE /v1/suppressions/{id}`. */
-interface DeletedSuppression {
-  object: "suppression";
-  id: string;
-  deleted: true;
-}
-/** One entry of `POST /v1/suppressions/import`. */
-interface ImportSuppressionEntry {
-  address: string;
-  /** `"*"` (the default) or a category. */
-  scope?: string;
-}
-/** Input of `coss.email.suppressions.import()`; the SDK sends 1,000 entries per request. */
-interface ImportSuppressionsParams {
-  suppressions: ImportSuppressionEntry[];
-}
-/** What an import did. */
-interface SuppressionImport {
-  object: "suppression_import";
-  /** Entries added. */
-  created: number;
-  /** Valid entries that were already on the list (or repeated in the import); unchanged. */
-  existing: number;
-  /** Skipped entries; `index` is the entry's position in `suppressions`. */
-  invalid: Array<{
-    index: number;
-    address: string;
-    message: string;
-  }>;
-}
-/** Query of `GET /v1/suppressions/export`. */
-interface ExportSuppressionsParams {
-  scope?: string;
-  reason?: SuppressionReason;
-}
-//#endregion
-//#region src/types/email.d.ts
-/** A `name`/`value` pair attached to an email for your own filtering and analytics. */
-interface EmailTag {
-  name: string;
-  value: string;
-}
-/**
- * A file to attach (at most 20 per email, 25 MB combined). Executables and other file types the
- * delivery provider refuses (such as `.exe` or `.js`) are rejected.
- */
-interface EmailAttachmentParams {
-  /** The name recipients see. Must include an extension, e.g. `"invoice.pdf"`. */
-  filename: string;
-  /** The file's bytes, base64-encoded (no line breaks or `data:` prefix). */
-  content: string;
-  /** Media type such as `"application/pdf"`. Defaults from the filename's extension. */
-  content_type?: string;
-  /**
-   * Makes the attachment inline: reference it from `html` as `<img src="cid:logo@acme">`
-   * (without angle brackets here).
-   */
-  content_id?: string;
-}
-/** Metadata of a sent attachment. The content itself is never returned. */
-interface EmailAttachment {
-  id: string;
-  filename: string;
-  content_type: string;
-  /** Set for inline attachments. */
-  content_id: string | null;
-  /** Size in bytes. */
-  size: number;
-}
-/**
- * Whether the email was handed to the delivery provider. `scheduled` emails wait for their
- * `scheduled_at`; `canceled` ones were canceled before that. Delivery is tracked per recipient.
- */
-type EmailStatus = "queued" | "sent" | "failed" | "scheduled" | "canceled";
-/**
- * Delivery status of one recipient. It only moves forward: `queued` → `sent` →
- * `delivery_delayed` → `delivered`, then `bounced` / `suppressed` / `failed`, then `complained`.
- * `suppressed` means the address is on the environment's suppression list (for every email or for
- * the email's `category`), so it was skipped. `canceled` means the scheduled email was canceled.
- */
-type EmailRecipientStatus = "queued" | "sent" | "delivery_delayed" | "delivered" | "bounced" | "suppressed" | "complained" | "failed" | "canceled";
-/** One distinct recipient address of an email. */
-interface EmailRecipient {
-  /** The bare, lower-cased address. */
-  address: string;
-  type: "to" | "cc" | "bcc";
-  status: EmailRecipientStatus;
-  /** ISO 8601 timestamp of the latest event for this recipient, or `null`. */
-  last_event_at: string | null;
-}
-type EmailEventType = "email.sent" | "email.delivered" | "email.delivery_delayed" | "email.bounced" | "email.complained" | "email.failed" | "email.suppressed" | "email.scheduled" | "email.canceled" | "email.opened" | "email.clicked" | "email.rescheduled";
-/** Details of an event; which member is present depends on the event type. */
-interface EmailEventData {
-  bounce?: {
-    type: "permanent" | "transient" | "undetermined";
-    sub_type: string;
-    diagnostic_code: string | null;
-  };
-  complaint?: {
-    feedback_type: string | null;
-    sub_type: string | null;
-  };
-  delay?: {
-    type: string;
-    expires_at: string | null;
-    diagnostic_code: string | null;
-  };
-  delivery?: {
-    smtp_response: string | null;
-  };
-  failure?: {
-    code: string;
-    message: string;
-  };
-  /** Only for `email.suppressed`: the entry that matched the recipient. */
-  suppression?: {
-    id: string;
-    scope: string;
-    reason: SuppressionReason;
-  };
-  /** Only for `email.opened`. */
-  open?: {
-    user_agent: string | null;
-  };
-  /** Only for `email.clicked`: the original link and its index among the tracked links. */
-  click?: {
-    url: string;
-    link_position: number;
-    user_agent: string | null;
-  };
-  /** Only for `email.rescheduled`: the new time and the one it replaced. */
-  reschedule?: {
-    scheduled_at: string;
-    previous_scheduled_at: string;
-  };
-}
-/** A delivery event of an email. */
-interface EmailEvent {
-  object: "email_event";
-  id: string;
-  email_id: string;
-  type: EmailEventType;
-  /**
-   * The recipient this event is about; `null` for the whole email (`email.sent`, `email.failed`),
-   * and for opens and clicks of an email with several recipients.
-   */
-  recipient: string | null;
-  /** ISO 8601 timestamp. */
-  occurred_at: string;
-  data: EmailEventData;
-}
-/** A list response. */
-interface List<T> {
-  object: "list";
-  data: T[];
-  has_more: boolean;
-}
-/**
- * Overrides the environment's tracking settings for one email. Omitted fields keep the configured
- * setting (the email's category rule, else the environment default, else off).
- */
-interface TrackingOptions {
-  /** Add an invisible pixel to the HTML body and record `email.opened` events. */
-  opens?: boolean;
-  /**
-   * Send HTML links through a COSS redirect and record `email.clicked` events. Links with a
-   * `data-coss-no-track` attribute are left alone.
-   */
-  clicks?: boolean;
-}
-/** Body of `POST /v1/emails`. */
-interface SendEmailParams {
-  /** `"you@example.com"` or `"Your Name <you@example.com>"`. */
-  from: string;
-  to: string | string[];
-  cc?: string | string[];
-  bcc?: string | string[];
-  reply_to?: string | string[];
-  subject: string;
-  /** At least one of `html` or `text` is required. */
-  html?: string;
-  text?: string;
-  /** Custom headers. Names are case-insensitive; reserved names such as `subject` are rejected. */
-  headers?: Record<string, string>;
-  tags?: EmailTag[];
-  /**
-   * What kind of email this is, e.g. `"marketing"`. Recipients suppressed for this category (or
-   * for every email) are skipped.
-   */
-  category?: string;
-  /**
-   * Send at this time instead of now: an ISO 8601 date-time with an offset, e.g.
-   * `"2026-10-11T09:00:00Z"`, at most 30 days ahead. A time that is not in the future sends
-   * immediately. Until it is sent, move it with `coss.email.reschedule(id, …)` or cancel it with
-   * `coss.email.cancel(id)`.
-   */
-  scheduled_at?: string;
-  attachments?: EmailAttachmentParams[];
-  tracking?: TrackingOptions;
-}
-/** Parameters of `coss.email.reschedule`. */
-interface RescheduleEmailParams {
-  /**
-   * The new time: an ISO 8601 date-time with an offset, at most 30 days ahead. A time that is not
-   * in the future sends the email right away.
-   */
-  scheduled_at: string;
-}
-/**
- * Open and click tracking as resolved when the email was sent, with engagement so far. Opens can
- * be inflated by mail clients that prefetch images, clicks by link scanners.
- */
-interface EmailTracking {
-  opens: boolean;
-  clicks: boolean;
-  open_count: number;
-  /** ISO 8601 timestamps, or `null`. */
-  first_opened_at: string | null;
-  last_opened_at: string | null;
-  click_count: number;
-  first_clicked_at: string | null;
-  last_clicked_at: string | null;
-}
-/** A link COSS rewrote for click tracking. */
-interface EmailLink {
-  object: "email_link";
-  id: string;
-  email_id: string;
-  /** Index of the link among the email's tracked links, in document order. */
-  position: number;
-  url: string;
-  click_count: number;
-  first_clicked_at: string | null;
-  last_clicked_at: string | null;
-}
-/** Why an email failed as a whole. */
-interface EmailFailure {
-  /**
-   * E.g. `all_recipients_suppressed`, `domain_not_verified`, `content_rejected`,
-   * `attachments_unavailable`, `dispatch_failed` or `provider_error`.
-   */
-  code: string;
-  message: string;
-}
-/** An email as returned by the API. Recipient fields are always arrays. */
-interface Email {
-  object: "email";
-  id: string;
-  from: string;
-  to: string[];
-  cc: string[];
-  bcc: string[];
-  reply_to: string[];
-  subject: string;
-  html: string | null;
-  text: string | null;
-  /** Header names are lower-cased. */
-  headers: Record<string, string>;
-  tags: EmailTag[];
-  category: string | null;
-  status: EmailStatus;
-  /** Why the email failed; `null` unless `status` is `"failed"`. */
-  failure: EmailFailure | null;
-  /** Every distinct recipient across `to`, `cc` and `bcc`, with its delivery status. */
-  recipients: EmailRecipient[];
-  /** Attachment metadata; the content is discarded once the email is sent. */
-  attachments: EmailAttachment[];
-  /** `true` when sent with a sandbox (`coss_test_…`) key: nothing is actually delivered. */
-  sandbox: boolean;
-  tracking: EmailTracking;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-  /** ISO 8601 timestamp, or `null` until the provider accepts the message. */
-  sent_at: string | null;
-  /** ISO 8601 timestamp the email was scheduled for, or `null` if no schedule was provided. */
-  scheduled_at: string | null;
-  /** The batch that sent the email (`coss.email.sendBatch`), or `null` if it was sent alone. */
-  batch_id: string | null;
-}
-/** An email in a list (`coss.email.list`): everything but its content. */
-type EmailSummary = Omit<Email, "html" | "text" | "headers" | "attachments">;
-/** Filters of `coss.email.list`. Emails are returned newest first. */
-interface ListEmailsParams {
-  /** Only emails with this recipient (in `to`, `cc` or `bcc`; the bare address, any case). */
-  to?: string;
-  /** Only emails with a recipient in one of these statuses (with `to`, that recipient's). */
-  recipient_status?: EmailRecipientStatus[];
-  /** Only emails in these statuses. */
-  status?: EmailStatus[];
-  /** Free text, matched against the subject and the `to` addresses. */
-  q?: string;
-  /** Only emails of this category. */
-  category?: string;
-  /** Only the emails of this batch. */
-  batch_id?: string;
-  /** Only emails created at or after this time. */
-  created_after?: Date | string;
-  /** Only emails created before this time. */
-  created_before?: Date | string;
-  /** 1-100, default 20. */
-  limit?: number;
-  /** Cursor: the `id` of the last email of the previous page. */
-  after?: string;
-}
-/** Emails sent together by `coss.email.sendBatch`. */
-interface EmailBatch {
-  object: "email_batch";
-  id: string;
-  /** The batch's emails, in the order they were passed. */
-  data: Email[];
-  /** ISO 8601 timestamp. */
-  created_at: string;
-}
-//#endregion
-//#region src/resources/audit-events.d.ts
-type ReadOptions$12 = Pick<RequestOptions, "signal">;
-/**
- * `coss.auditEvents`: the organization's audit log, newest first: changes made by members, API
- * keys and COSS support. Organization-wide, whichever environment the key belongs to.
- */
-declare class AuditEventsResource {
-  #private;
-  /** @internal Use `new Coss().auditEvents`. */
-  constructor(http: HttpClient);
-  /** Lists audit events, newest first. Pass the last `id` as `after` while `has_more` is true. */
-  list(params?: ListAuditEventsParams, options?: ReadOptions$12): Promise<CossResult<List<AuditEvent>>>;
-  /** Retrieves one audit event. */
-  get(id: string, options?: ReadOptions$12): Promise<CossResult<AuditEvent>>;
-}
-//#endregion
-//#region src/types/billing.d.ts
-/**
- * Billing wire types (hand-written mirrors of the API's `Billing`, `Usage`, `Invoice` and `Credit`
- * schemas). Amounts are integers in cents (USD); unit prices are dollar decimal strings.
- */
-type PlanKey = "free" | "pro" | "scale" | "enterprise";
-type Meter = "email.recipients" | "sms.segments" | "video.participant_minutes" | "scheduling.bookings";
-type BillingHoldReason = "delinquent" | "spend_limit" | "admin";
-/** `GET /v1/billing`: the organization's plan, the current month so far, and its standing. */
-interface Billing {
-  object: "billing";
-  organization_id: string;
-  /** The plan in effect now (`free` without a contract). */
-  plan: PlanKey;
-  /** The contract in effect; `null` on the Free plan. */
-  contract: {
-    id: string;
-    kind: "self_serve" | "sales" | "internal";
-    effective_from: string;
-    effective_until: string | null;
-    /** End of a committed term. */
-    term_end: string | null;
-    auto_renew: boolean;
-  } | null;
-  /** A plan change that takes effect later (a downgrade, a cancellation). */
-  scheduled_change: {
-    effective_at: string;
-    plan: PlanKey;
-  } | null;
-  /** `past_due`: an invoice is overdue; `delinquent`: past its grace period (live sending is held). */
-  status: "active" | "past_due" | "delinquent";
-  /** Billing holds on live sending (sandbox keys keep working). */
-  holds: {
-    reason: BillingHoldReason;
-    since: string;
-  }[];
-  currency: "usd";
-  /** The current billing month (UTC). */
-  period: {
-    start: string;
-    end: string;
-  };
-  usage: {
-    meter: Meter;
-    quantity: number;
-    /** The plan's monthly allowance where usage stops (Free), else `null`. */
-    included: number | null;
-  }[];
-  /** This month so far, as it would be invoiced if it ended now (cents). */
-  estimate: {
-    usage: number;
-    discount: number;
-    credit: number;
-    total: number;
-  };
-  /** Unused credit usable this month (cents). */
-  credit_remaining: number;
-  /** Usage beyond the credit past which live sending is held (cents); `null`: none. */
-  spend_limit: number | null;
-  payment_method: {
-    type: string;
-    brand: string | null;
-    last4: string | null;
-  } | null;
-  features: {
-    tracking_domains: boolean;
-    audit_log: boolean;
-    log_drains: boolean;
-    sso: boolean;
-    scim: boolean;
-  };
-  /** Resource limits (`null`: unlimited). */
-  limits: {
-    domains: number | null;
-    members: number | null;
-    webhook_endpoints_per_environment: number | null;
-  };
-}
-/** Billable usage of one meter in one bucket. */
-interface Usage {
-  object: "usage";
-  meter: Meter;
-  /** e.g. `country=US` for SMS; `null` for none. */
-  dimension: string | null;
-  /** Set with `group_by: "environment"`. */
-  environment_id: string | null;
-  start: string;
-  end: string;
-  quantity: number;
-}
-interface ListUsageParams {
-  /** Start (inclusive, ISO 8601). Defaults to the start of the current billing month. */
-  from?: string;
-  /** End (exclusive). Defaults to now. At most 400 days after `from` (7 by hour). */
-  to?: string;
-  /** Bucket size (UTC). Defaults to `day`. */
-  granularity?: "hour" | "day" | "month";
-  /** Split each bucket per environment. */
-  group_by?: "environment";
-  /** Only this meter. */
-  meter?: Meter;
-}
-type InvoiceStatus = "open" | "paid" | "void" | "uncollectible";
-type InvoiceLineKind = "plan_fee" | "proration" | "usage" | "credit" | "discount" | "commitment_fee" | "commitment_shortfall" | "add_on" | "adjustment" | "write_off";
-interface InvoiceLine {
-  object: "invoice_line";
-  id: string;
-  kind: InvoiceLineKind;
-  description: string;
-  meter: Meter | null;
-  dimension: string | null;
-  quantity: number | null;
-  /** Units covered by an allowance or committed volume (not charged). */
-  included_quantity: number | null;
-  /** Dollars per unit, e.g. `"0.0004"`; `null` when the price varies by volume. */
-  unit_price: string | null;
-  /** Cents. */
-  amount: number;
-  period: {
-    start: string;
-    end: string;
-  };
-}
-/** An invoice without its lines (lists and webhook events). Amounts in cents. */
-interface InvoiceSummary {
-  object: "invoice";
-  id: string;
-  number: string | null;
-  kind: "period" | "plan_change" | "one_off" | "final";
-  status: InvoiceStatus;
-  currency: "usd";
-  period: {
-    start: string;
-    end: string;
-  };
-  subtotal: number;
-  discount: number;
-  credit: number;
-  tax: number;
-  total: number;
-  amount_paid: number;
-  amount_due: number;
-  collection_method: "charge_automatically" | "send_invoice";
-  due_at: string | null;
-  finalized_at: string | null;
-  paid_at: string | null;
-  voided_at: string | null;
-  /** A page to view (and pay) the invoice. */
-  hosted_url: string | null;
-  pdf_url: string | null;
-}
-interface Invoice extends InvoiceSummary {
-  lines: InvoiceLine[];
-}
-interface ListInvoicesParams {
-  /** Only invoices in this status. */
-  status?: InvoiceStatus;
-  /** Continue after this id (the last of the previous page). */
-  after?: string;
-  /** At most this many (1-100, default 20). */
-  limit?: number;
-}
-/** Credit the organization can spend: dollars (cents) or free units of a meter. */
-interface Credit {
-  object: "credit";
-  id: string;
-  /** `amount`: dollars (`amount` and `remaining` in cents); `units`: free units of `meter`. */
-  kind: "amount" | "units";
-  amount: number;
-  remaining: number;
-  /** What a `units` credit covers. */
-  meter: Meter | null;
-  /** What an `amount` credit pays for (`null`: any usage). */
-  meters: Meter[] | null;
-  /** `any`: also fees and other charges. */
-  applies_to: "usage" | "any";
-  source: "fee" | "commitment" | "support" | "promotion" | "refund" | "sla";
-  description: string;
-  effective_at: string;
-  expires_at: string | null;
-  voided_at: string | null;
-  created_at: string;
-}
-interface ListCreditsParams {
-  /** `active` (default): usable now or later, with something left; `all`: every credit. */
-  status?: "active" | "all";
-  /** Continue after this id (the last of the previous page). */
-  after?: string;
-  /** At most this many (1-100, default 20). */
-  limit?: number;
-}
-//#endregion
-//#region src/resources/billing.d.ts
-type ReadOptions$11 = Pick<RequestOptions, "signal">;
-/** `coss.billing.invoices`: the organization's invoices, newest first. */
-declare class BillingInvoicesResource {
-  #private;
-  /** @internal Use `new Coss().billing.invoices`. */
-  constructor(http: HttpClient);
-  /** Lists invoices (without lines). Pass the last `id` as `after` while `has_more` is true. */
-  list(params?: ListInvoicesParams, options?: ReadOptions$11): Promise<CossResult<List<InvoiceSummary>>>;
-  /** Retrieves one invoice with its lines. */
-  get(id: string, options?: ReadOptions$11): Promise<CossResult<Invoice>>;
-}
-/** `coss.billing.credits`: the organization's credits and what's left of them. */
-declare class BillingCreditsResource {
-  #private;
-  /** @internal Use `new Coss().billing.credits`. */
-  constructor(http: HttpClient);
-  /** Lists credits, newest first (usable ones by default). */
-  list(params?: ListCreditsParams, options?: ReadOptions$11): Promise<CossResult<List<Credit>>>;
-}
-/**
- * `coss.billing`: the organization's plan, usage, invoices and credits (read only; plan changes
- * are made in the dashboard). Organization-wide, whichever environment the key belongs to.
- */
-declare class BillingResource {
-  #private;
-  readonly invoices: BillingInvoicesResource;
-  readonly credits: BillingCreditsResource;
-  /** @internal Use `new Coss().billing`. */
-  constructor(http: HttpClient);
-  /** The plan, the current month's usage and estimate, standing and what the plan includes. */
-  get(options?: ReadOptions$11): Promise<CossResult<Billing>>;
-  /** Billable usage per meter and bucket (the current month, by day, by default), oldest first. */
-  usage(params?: ListUsageParams, options?: ReadOptions$11): Promise<CossResult<List<Usage>>>;
-}
-//#endregion
-//#region src/types/domain.d.ts
-/**
- * Sending domain wire types. Hand-written to mirror the API's snake_case JSON 1:1 (the API's
- * contract test asserts they stay assignable to and from its zod schemas).
- */
-/**
- * `pending` while the DNS records are being checked, `verified` once they are,
- * `temporary_failure` after a transient DNS problem, and `failed` when verification gave up
- * (72 hours) — call `verify` to start over. `deleting` is a removal in progress.
- */
-type DomainStatus = "pending" | "verified" | "temporary_failure" | "failed" | "deleting";
-/** Verification state of the `send.` bounce subdomain. */
-type MailFromStatus = "pending" | "success" | "temporary_failure" | "failed";
-/**
- * What a record is for: `dkim` signs messages, `mail_from_mx` and `mail_from_spf` set up the
- * bounce subdomain, and `dmarc` is recommended but not required.
- */
-type DomainRecordPurpose = "dkim" | "mail_from_mx" | "mail_from_spf" | "dmarc";
-/** What the last DNS check saw. `not_checked` means DNS has not been consulted yet. */
-type DomainRecordStatus = "verified" | "missing" | "mismatch" | "not_checked";
-/** One DNS record a domain needs (or, when `required` is `false`, should have). */
-interface DomainRecord {
-  purpose: DomainRecordPurpose;
-  type: "CNAME" | "MX" | "TXT";
-  /** The fully qualified record name to create. */
-  name: string;
-  value: string;
-  /** `MX` records only. */
-  priority: number | null;
-  /** `false` for records that are only recommended. */
-  required: boolean;
-  status: DomainRecordStatus;
-  /** What DNS returned when it did not match. */
-  found: string[];
-}
-/**
- * `pending` until the CNAME points at COSS and its certificate is issued, `active` once tracking
- * links of emails sent from the domain use it, `temporary_failure` when an active hostname stopped
- * working (emails fall back to the default tracking host meanwhile), and `failed` when setup gave
- * up (72 hours) — call `domains.verify` to start over. `deleting` is a removal in progress.
- */
-type TrackingDomainStatus = "pending" | "active" | "temporary_failure" | "failed" | "deleting";
-/** The CNAME a tracking domain needs, with the result of the last check. */
-interface TrackingDomainRecord {
-  type: "CNAME";
-  /** The fully qualified record name to create. */
-  name: string;
-  /** The host the record must point at. */
-  value: string;
-  status: DomainRecordStatus;
-  /** What DNS returned when it did not match. */
-  found: string[];
-}
-/** A domain's custom tracking domain: open pixels and click redirects use it while `active`. */
-interface TrackingDomain {
-  /** The tracking hostname, a subdomain of the domain (e.g. `links.acme.com`). */
-  hostname: string;
-  status: TrackingDomainStatus;
-  record: TrackingDomainRecord;
-  /** What is holding the hostname up, when the certificate provider said. */
-  message: string | null;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-  last_checked_at: string | null;
-  activated_at: string | null;
-  failed_at: string | null;
-}
-/** The MX record a receiving domain needs, with the result of the last check. */
-interface ReceivingDomainRecord {
-  type: "MX";
-  /** The fully qualified record name to create. */
-  name: string;
-  /** The mail exchange the record must point at. */
-  value: string;
-  priority: number;
-  /** `verified` once the most preferred MX records point at COSS. */
-  status: DomainRecordStatus;
-  /** What DNS returned when it did not match. */
-  found: string[];
-}
-/** A domain's receiving hostname: email to any address at it is received by `environment_id`. */
-interface ReceivingDomain {
-  /** The domain itself or a subdomain of it (e.g. `inbound.acme.com`). */
-  hostname: string;
-  environment_id: string;
-  record: ReceivingDomainRecord;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-  last_checked_at: string | null;
-}
-/** A sending domain of the organization. */
-interface Domain {
-  object: "domain";
-  id: string;
-  /** The domain, lower-cased. */
-  name: string;
-  status: DomainStatus;
-  /** Whether live keys may send from this domain right now. */
-  can_send: boolean;
-  region: string | null;
-  /** The envelope sender subdomain bounces come back to. */
-  mail_from_domain: string;
-  mail_from_status: MailFromStatus;
-  /** The DNS records to publish, with the result of the last check. */
-  records: DomainRecord[];
-  /** ISO 8601 timestamp. */
-  created_at: string;
-  last_checked_at: string | null;
-  verified_at: string | null;
-  failed_at: string | null;
-  /** The custom tracking domain, or `null` when none is set up. */
-  tracking: TrackingDomain | null;
-  /** The receiving hostname, or `null` when the domain doesn't receive email. */
-  receiving: ReceivingDomain | null;
-}
-/** Body of `POST /v1/domains`. */
-interface CreateDomainParams {
-  /**
-   * The domain to send from, without a scheme or path (`"acme.com"`, `"mail.acme.com"`).
-   * Internationalized domains must be punycode-encoded.
-   */
-  name: string;
-}
-/** Returned by `domains.delete`. */
-interface DeletedDomain {
-  object: "domain";
-  id: string;
-  deleted: true;
-}
-/** Body of `POST /v1/domains/{id}/tracking`. */
-interface CreateTrackingDomainParams {
-  /** A subdomain of the domain to serve tracking links from (`"links.acme.com"`). */
-  hostname: string;
-}
-/** Body of `POST /v1/domains/{id}/receiving`. */
-interface CreateReceivingDomainParams {
-  /** The domain itself or a subdomain of it (`"inbound.acme.com"`). */
-  hostname: string;
-}
-//#endregion
-//#region src/resources/receiving-domains.d.ts
-type DeleteOptions$1 = Pick<RequestOptions, "signal">;
-/**
- * `coss.domains.receiving`: a domain's receiving hostname (the domain itself or a subdomain, e.g.
- * `inbound.acme.com`). Email sent to any address at it is received by the API key's environment.
- */
-declare class ReceivingDomainsResource {
-  #private;
-  /** @internal Use `new Coss().domains.receiving`. */
-  constructor(http: HttpClient);
-  /**
-   * Starts receiving at a hostname of the domain, for the API key's environment, and returns the
-   * domain with the MX record to publish in `data.receiving.record`.
-   */
-  create(domainId: string, params: CreateReceivingDomainParams, options?: RequestOptions): Promise<CossResult<Domain>>;
-  /** Stops receiving at the domain's hostname. Emails already received are kept. */
-  delete(domainId: string, options?: DeleteOptions$1): Promise<CossResult<Domain>>;
-}
-//#endregion
-//#region src/resources/tracking-domains.d.ts
-type DeleteOptions = Pick<RequestOptions, "signal">;
-/**
- * `coss.domains.tracking`: a domain's custom tracking domain (e.g. `links.acme.com`). Open pixels
- * and click redirects of emails sent from the domain use it while it is `active`.
- */
-declare class TrackingDomainsResource {
-  #private;
-  /** @internal Use `new Coss().domains.tracking`. */
-  constructor(http: HttpClient);
-  /**
-   * Sets up a subdomain of the domain as its tracking domain and returns the domain, with the
-   * CNAME to publish in `data.tracking.record`. Setup gives up after 72 hours.
-   */
-  create(domainId: string, params: CreateTrackingDomainParams, options?: RequestOptions): Promise<CossResult<Domain>>;
-  /**
-   * Removes the domain's tracking domain. Later emails use the default tracking host; links in
-   * emails already sent through it stop working.
-   */
-  delete(domainId: string, options?: DeleteOptions): Promise<CossResult<Domain>>;
-}
-//#endregion
-//#region src/resources/domains.d.ts
-type ReadOptions$10 = Pick<RequestOptions, "signal">;
-/**
- * `coss.domains`: the domains live (`coss_live_…`) keys may send from. Domains belong to the
- * organization, so every API key of the organization sees the same ones.
- */
-declare class DomainsResource {
-  #private;
-  /** Each domain's custom tracking domain: add and remove it. */
-  readonly tracking: TrackingDomainsResource;
-  /** Each domain's receiving hostname: start and stop receiving email at it. */
-  readonly receiving: ReceivingDomainsResource;
-  /** @internal Use `new Coss().domains`. */
-  constructor(http: HttpClient);
-  /**
-   * Adds a domain and returns the DNS records to publish (`data.records`). The records are
-   * checked in the background; verification gives up after 72 hours.
-   */
-  create(params: CreateDomainParams, options?: RequestOptions): Promise<CossResult<Domain>>;
-  /** Lists the organization's domains, ordered by name. */
-  list(options?: ReadOptions$10): Promise<CossResult<List<Domain>>>;
-  /** Retrieves a domain with the result of the last DNS check. */
-  get(id: string, options?: ReadOptions$10): Promise<CossResult<Domain>>;
-  /**
-   * Checks the domain's records now instead of waiting for the next background check. A `failed`
-   * domain starts verification over with fresh DKIM records, which have to be published again.
-   * Its tracking domain, if any, is checked too.
-   */
-  verify(id: string, options?: RequestOptions): Promise<CossResult<Domain>>;
-  /** Removes the domain. Emails already sent are unaffected; live keys can no longer use it. */
-  delete(id: string, options?: ReadOptions$10): Promise<CossResult<DeletedDomain>>;
-}
-//#endregion
-//#region src/types/received-email.d.ts
-/**
- * Received (inbound) email wire types. Hand-written to mirror the API's snake_case JSON 1:1 (the
- * API's contract test asserts they stay assignable to and from its zod schemas).
- */
-/** `received`, or `blocked` when the message carried a virus (only its envelope is kept). */
-type ReceivedEmailStatus = "received" | "blocked";
-/** What the receiving server concluded; `null` when the check did not run. */
-type VerdictStatus = "pass" | "fail" | "gray" | "processing_failed";
-interface ReceivedEmailVerdicts {
-  spam: VerdictStatus | null;
-  virus: VerdictStatus | null;
-  spf: VerdictStatus | null;
-  dkim: VerdictStatus | null;
-  dmarc: VerdictStatus | null;
-  /** The sender domain's DMARC policy (`none`, `quarantine`, `reject`) when DMARC failed. */
-  dmarc_policy: string | null;
-}
-/** Metadata of an attachment; download it with `email.received.getAttachment`. */
-interface ReceivedEmailAttachment {
-  id: string;
-  /** `null` when the part named none. */
-  filename: string | null;
-  content_type: string;
-  /** Set for parts the HTML references (`cid:` URLs). */
-  content_id: string | null;
-  disposition: "attachment" | "inline";
-  /** Size in bytes. */
-  size: number;
-}
-/** A received email as lists return it: without bodies and headers. */
-interface ReceivedEmailSummary {
-  object: "received_email";
-  id: string;
-  status: ReceivedEmailStatus;
-  blocked_reason: "virus" | null;
-  /** The envelope sender (`MAIL FROM`); empty for bounces. */
-  mail_from: string;
-  /** The envelope recipients this environment received it for (Bcc'd addresses included). */
-  recipients: string[];
-  /** The `From` header. */
-  from: string | null;
-  to: string[];
-  cc: string[];
-  subject: string | null;
-  /** The `Message-ID` header. */
-  message_id: string | null;
-  attachments: ReceivedEmailAttachment[];
-  /** Size of the raw message in bytes. */
-  size: number;
-  /** Whether the spam verdict is `fail`. */
-  spam: boolean;
-  verdicts: ReceivedEmailVerdicts;
-  /** Whether a sandbox environment received it. */
-  sandbox: boolean;
-  /** ISO 8601 timestamp. */
-  received_at: string;
-}
-/** A received email with its headers and bodies. HTML is the sender's: sanitize it to show it. */
-interface ReceivedEmail extends ReceivedEmailSummary {
-  reply_to: string[];
-  in_reply_to: string | null;
-  /** Message ids of the `References` header. */
-  references: string[];
-  /** The `Date` header, when valid (ISO 8601). */
-  sent_at: string | null;
-  /** Every header in message order, duplicates included. */
-  headers: {
-    name: string;
-    value: string;
-  }[];
-  text: string | null;
-  html: string | null;
-  /** Whether `text`, `html` or `headers` were shortened; `getRaw` always has everything. */
-  truncated: boolean;
-}
-/** Query of `email.received.list`. */
-interface ListReceivedEmailsParams {
-  /** 1-100, default 20. */
-  limit?: number;
-  /** The `id` of the last email of the previous page. */
-  after?: string;
-}
-/** Returned by `email.received.delete`. */
-interface DeletedReceivedEmail {
-  object: "received_email";
-  id: string;
-  deleted: true;
-}
-/** The environment's own domain under COSS's inbound domain: any address at it is received. */
-interface InboundAddress {
-  object: "inbound_address";
-  environment_id: string;
-  domain: string;
-}
-//#endregion
-//#region src/resources/received-emails.d.ts
-type ReadOptions$9 = Pick<RequestOptions, "signal">;
-/**
- * `coss.email.received`: emails received by the API key's environment, at its inbound address
- * (`address()`) or at a receiving domain (`coss.domains.receiving`). An `email.received` webhook
- * announces each one.
- */
-declare class ReceivedEmailsResource {
-  #private;
-  /** @internal Use `new Coss().email.received`. */
-  constructor(http: HttpClient);
-  /** Lists received emails, newest first, without bodies. Pass the last `id` as `after` while `has_more` is true. */
-  list(params?: ListReceivedEmailsParams, options?: ReadOptions$9): Promise<CossResult<List<ReceivedEmailSummary>>>;
-  /** Retrieves a received email with its headers and bodies. */
-  get(id: string, options?: ReadOptions$9): Promise<CossResult<ReceivedEmail>>;
-  /** The whole message as received (`message/rfc822` bytes). */
-  getRaw(id: string, options?: ReadOptions$9): Promise<CossResult<Uint8Array>>;
-  /** An attachment's bytes (untrusted: its declared type is the attachment's `content_type`). */
-  getAttachment(id: string, attachmentId: string, options?: ReadOptions$9): Promise<CossResult<Uint8Array>>;
-  /**
-   * The environment's inbound domain: email to any address at it (`support@<domain>`) is
-   * received, with no DNS setup.
-   */
-  address(options?: ReadOptions$9): Promise<CossResult<InboundAddress>>;
-  /** Deletes a received email with its raw message and attachments right away. */
-  delete(id: string, options?: ReadOptions$9): Promise<CossResult<DeletedReceivedEmail>>;
-}
-//#endregion
-//#region src/resources/suppressions.d.ts
-type ReadOptions$8 = Pick<RequestOptions, "signal">;
-/**
- * `coss.email.suppressions`: the suppression list of the API key's environment. Sends skip
- * suppressed recipients; permanent bounces and complaints are added automatically.
- */
-declare class SuppressionResource {
-  #private;
-  /** @internal Use `new Coss().email.suppressions`. */
-  constructor(http: HttpClient);
-  /**
-   * Suppresses an address for every email (`scope: "*"`, the default) or for one category, e.g.
-   * when a recipient unsubscribes. Returns the existing entry if there already is one.
-   */
-  add(params: CreateSuppressionParams, options?: RequestOptions): Promise<CossResult<Suppression>>;
-  /**
-   * Adds many entries at once (reason `import`), 1,000 per request. Invalid entries are skipped
-   * and reported in `invalid`; entries already on the list count as `existing`. If a request
-   * fails, the earlier batches stay imported: importing everything again is safe.
-   */
-  import(params: ImportSuppressionsParams, options?: ReadOptions$8): Promise<CossResult<SuppressionImport>>;
-  /**
-   * The whole list as CSV (`address,scope,reason,created_at,email_id,id`, oldest first), which
-   * `import` (or the dashboard) accepts again.
-   */
-  export(params?: ExportSuppressionsParams, options?: ReadOptions$8): Promise<CossResult<string>>;
-  /** Lists entries, newest first. Pass the last `id` as `after` while `has_more` is true. */
-  list(params?: ListSuppressionsParams, options?: ReadOptions$8): Promise<CossResult<List<Suppression>>>;
-  /** Whether a send to `address` (with `category`, if given) would skip it. */
-  check(params: CheckSuppressionParams, options?: ReadOptions$8): Promise<CossResult<SuppressionCheck>>;
-  /** Retrieves one entry. */
-  get(id: string, options?: ReadOptions$8): Promise<CossResult<Suppression>>;
-  /** Removes an entry, so later sends reach the address again (e.g. when a recipient resubscribes). */
-  remove(id: string, options?: ReadOptions$8): Promise<CossResult<DeletedSuppression>>;
-}
-//#endregion
-//#region src/types/tracking.d.ts
-/** Tracking settings wire types (hand-written mirrors of the API's schemas). */
-/** An environment's tracking default (`category: null`) or the rule for one category. */
-interface TrackingRule {
-  object: "tracking_rule";
-  id: string;
-  /** The category the rule applies to; `null` for the environment default. */
-  category: string | null;
-  /** Whether opens are tracked. */
-  opens: boolean;
-  /** Whether clicks are tracked. */
-  clicks: boolean;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-  /** ISO 8601 timestamp. */
-  updated_at: string;
-}
-/**
- * Open and click tracking settings of the API key's environment. For each of `opens` and
- * `clicks`, a send's own `tracking` wins, then its category's rule, then `default`, then off.
- */
-interface TrackingSettings {
-  object: "tracking_settings";
-  /** The environment default; `null` when none is set. */
-  default: TrackingRule | null;
-  /** Category rules, by category name. */
-  categories: TrackingRule[];
-}
-/**
- * Body of `PATCH /v1/tracking_settings/default` and `…/categories/{category}`: at least one
- * field. Fields left out keep their value; a new rule starts with both off.
- */
-interface UpdateTrackingRuleParams {
-  opens?: boolean;
-  clicks?: boolean;
-}
-/** Returned when a rule is removed. */
-interface DeletedTrackingRule {
-  object: "tracking_rule";
-  id: string;
-  category: string | null;
-  deleted: true;
-}
-//#endregion
-//#region src/resources/tracking.d.ts
-type ReadOptions$7 = Pick<RequestOptions, "signal">;
-/**
- * `coss.email.tracking`: which emails of the API key's environment have their opens and clicks
- * tracked. Emails keep the settings that applied when they were sent; a send's own `tracking`
- * option wins over them.
- */
-declare class TrackingResource {
-  #private;
-  /** @internal Use `new Coss().email.tracking`. */
-  constructor(http: HttpClient);
-  /** The environment default and the category rules. */
-  get(options?: ReadOptions$7): Promise<CossResult<TrackingSettings>>;
-  /**
-   * Sets the environment default, which applies to emails without a rule for their category.
-   * Fields left out keep their value; a new default starts with both off.
-   */
-  updateDefault(params: UpdateTrackingRuleParams, options?: ReadOptions$7): Promise<CossResult<TrackingRule>>;
-  /** Removes the environment default: emails without a category rule are then not tracked. */
-  removeDefault(options?: ReadOptions$7): Promise<CossResult<DeletedTrackingRule>>;
-  /**
-   * Sets the rule for emails sent with `category`, which wins over the default. Fields left out
-   * keep their value; a new rule starts with both off.
-   */
-  updateCategory(category: string, params: UpdateTrackingRuleParams, options?: ReadOptions$7): Promise<CossResult<TrackingRule>>;
-  /** Removes a category's rule: its emails follow the environment default again. */
-  removeCategory(category: string, options?: ReadOptions$7): Promise<CossResult<DeletedTrackingRule>>;
-}
-//#endregion
-//#region src/resources/email.d.ts
-/** `coss.email`: transactional email. */
-declare class EmailResource {
-  #private;
-  /** The environment's suppression list. */
-  readonly suppressions: SuppressionResource;
-  /** The environment's open and click tracking settings. */
-  readonly tracking: TrackingResource;
-  /** Emails the environment received. */
-  readonly received: ReceivedEmailsResource;
-  /** @internal Use `new Coss().email`. */
-  constructor(http: HttpClient);
-  /**
-   * Sends an email. It is returned `queued` and handed to the delivery provider moments later:
-   * `get` it or listen for the `email.sent` / `email.failed` webhooks for the outcome. Safe to
-   * retry: the request always carries an `Idempotency-Key` (yours, or a generated one reused
-   * across automatic retries), so the API never sends it twice.
-   */
-  send(params: SendEmailParams, options?: RequestOptions): Promise<CossResult<Email>>;
-  /**
-   * Sends up to 100 emails in one request, each as `send` would. The batch is all or nothing: if
-   * any email is invalid (the error's `issues` name it, e.g. `emails.3.to`), none is sent. Its
-   * recipients count against the send quota together. Safe to retry: one `Idempotency-Key` covers
-   * the whole batch. Larger lists need several calls, each with its own key.
-   */
-  sendBatch(emails: SendEmailParams[], options?: RequestOptions): Promise<CossResult<EmailBatch>>;
-  /** Retrieves an email sent from the same environment as the API key. */
-  get(id: string, options?: Pick<RequestOptions, "signal">): Promise<CossResult<Email>>;
-  /**
-   * Lists emails sent from the same environment as the API key, newest first and without their
-   * content (`get` one for `html`, `text`, `headers` and `attachments`). Pass the last `id` as
-   * `after` while `has_more` is true.
-   */
-  list(params?: ListEmailsParams, options?: Pick<RequestOptions, "signal">): Promise<CossResult<List<EmailSummary>>>;
-  /**
-   * Cancels a scheduled email. Canceling an already canceled email returns it; any other email
-   * fails with `email_not_cancelable`.
-   */
-  cancel(id: string, options?: Pick<RequestOptions, "signal">): Promise<CossResult<Email>>;
-  /**
-   * Moves a scheduled email to a new time and records an `email.rescheduled` event. The time it
-   * already has returns it unchanged; an email that is no longer scheduled fails with
-   * `email_not_reschedulable`.
-   */
-  reschedule(id: string, params: RescheduleEmailParams, options?: Pick<RequestOptions, "signal">): Promise<CossResult<Email>>;
-  /** Lists an email's delivery events, oldest first. */
-  listEvents(id: string, options?: Pick<RequestOptions, "signal">): Promise<CossResult<List<EmailEvent>>>;
-  /** Lists the links tracked for clicks in an email, in document order, with click counts. */
-  listLinks(id: string, options?: Pick<RequestOptions, "signal">): Promise<CossResult<List<EmailLink>>>;
-}
-//#endregion
-//#region src/types/hooks.d.ts
-/**
- * Hooks wire types (webhooks as a service): you send a message to one of your applications once,
- * COSS delivers it to every endpoint its users registered, signed, with retries.
- */
-/** One of your customers (or users), with their own endpoints and portal. */
-interface HookApplication {
-  object: "hook_application";
-  id: string;
-  /** Your own id for it, unique in the environment; every method that takes an application accepts it. */
-  uid: string | null;
-  name: string;
-  metadata: Record<string, string>;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-  updated_at: string;
-}
-/** Body of `POST /v1/hooks/applications`. */
-interface CreateHookApplicationParams {
-  /** Shown to the application's users in the portal. */
-  name: string;
-  /** Your own id for it (1-256 letters, digits and `. _ : @ | -`). */
-  uid?: string;
-  /** Up to 16 keys (up to 40 characters) with string values (up to 500). */
-  metadata?: Record<string, string>;
-}
-/** Body of `PATCH /v1/hooks/applications/{application}`. Omitted fields keep their value. */
-interface UpdateHookApplicationParams {
-  name?: string;
-  /** `null` removes it. */
-  uid?: string | null;
-  /** Replaces the metadata. */
-  metadata?: Record<string, string>;
-}
-/** Query of `GET /v1/hooks/applications`. */
-interface ListHookApplicationsParams {
-  /** 1-100, default 50. */
-  limit?: number;
-  /** Cursor: the `id` of the last application of the previous page. */
-  after?: string;
-}
-/** Returned by `hooks.applications.delete`. */
-interface DeletedHookApplication {
-  object: "hook_application";
-  id: string;
-  deleted: true;
-}
-/** A type of message you send (e.g. `invoice.paid`): the catalog your users subscribe from. */
-interface HookEventType {
-  object: "hook_event_type";
-  name: string;
-  description: string | null;
-  /** A JSON Schema of the payload, shown to your users (not enforced). */
-  schema: Record<string, unknown> | null;
-  /** Example payloads; the first is what a test send delivers. */
-  examples: Record<string, unknown>[];
-  /** Hidden from the portal and new subscriptions; already subscribed endpoints still receive it. */
-  archived: boolean;
-  created_at: string;
-  updated_at: string;
-}
-/** Body of `POST /v1/hooks/event_types`. */
-interface CreateHookEventTypeParams {
-  /** 1-64 letters, digits and `. _ -`. */
-  name: string;
-  description?: string;
-  schema?: Record<string, unknown>;
-  /** Up to 5. */
-  examples?: Record<string, unknown>[];
-}
-/** Body of `PATCH /v1/hooks/event_types/{name}`. */
-interface UpdateHookEventTypeParams {
-  description?: string | null;
-  schema?: Record<string, unknown> | null;
-  examples?: Record<string, unknown>[];
-  /** `false` restores an archived type. */
-  archived?: boolean;
-}
-/** Query of `GET /v1/hooks/event_types`. */
-interface ListHookEventTypesParams {
-  /** Also list archived types. */
-  include_archived?: boolean;
-  /** 1-100, default 50. */
-  limit?: number;
-  /** Cursor: the `name` of the last type of the previous page. */
-  after?: string;
-}
-/** Why an endpoint is disabled. */
-type HookEndpointDisabledReason = "manual" | "failing";
-/** A URL of an application's user that receives its messages, signed with its own secret. */
-interface HookEndpoint {
-  object: "hook_endpoint";
-  id: string;
-  application_id: string;
-  url: string;
-  description: string | null;
-  /** Event types delivered; empty means every type. */
-  filter_types: string[];
-  rate_limit_per_second: number | null;
-  enabled: boolean;
-  /** `manual`, or `failing` (its deliveries failed every attempt for five days); `null` while enabled. */
-  disabled_reason: HookEndpointDisabledReason | null;
-  disabled_at: string | null;
-  /** When its current run of failed deliveries began; `null` while healthy. */
-  failing_since: string | null;
-  /** After a secret roll, requests are also signed with the previous secret until then. */
-  previous_secret_expires_at: string | null;
-  metadata: Record<string, string>;
-  created_at: string;
-  updated_at: string;
-}
-/** A created endpoint, or one whose secret was just rolled. */
-interface HookEndpointWithSecret extends HookEndpoint {
-  /** The `whsec_…` signing secret (Standard Webhooks). */
-  secret: string;
-}
-/** Body of `POST /v1/hooks/applications/{application}/endpoints`. */
-interface CreateHookEndpointParams {
-  /** An `https://` URL. */
-  url: string;
-  description?: string;
-  /** Existing, unarchived event types; omitted or empty means every type. */
-  filter_types?: string[];
-  /** A `whsec_` + base64 secret of 24-64 bytes (e.g. migrated from another provider). */
-  secret?: string;
-  /** 1-1000. */
-  rate_limit_per_second?: number;
-  metadata?: Record<string, string>;
-  enabled?: boolean;
-}
-/** Body of `PATCH /v1/hooks/applications/{application}/endpoints/{id}`. */
-interface UpdateHookEndpointParams {
-  url?: string;
-  description?: string | null;
-  filter_types?: string[];
-  rate_limit_per_second?: number | null;
-  metadata?: Record<string, string>;
-  enabled?: boolean;
-}
-/** Returned by `hooks.endpoints.delete`. */
-interface DeletedHookEndpoint {
-  object: "hook_endpoint";
-  id: string;
-  deleted: true;
-}
-/** Returned by `hooks.endpoints.getSecret`. */
-interface HookEndpointSecret {
-  object: "hook_endpoint_secret";
-  secret: string;
-}
-/** Body of `POST …/endpoints/{id}/roll_secret`. */
-interface RollHookEndpointSecretParams {
-  /** Seconds the current secret keeps signing next to the new one: default 86400, at most 604800, `0` stops it now. */
-  previous_secret_expires_in?: number;
-}
-/** Body of `POST …/endpoints/{id}/recover`. */
-interface RecoverHookEndpointParams {
-  /** Requeue failed deliveries of messages sent since then (ISO 8601 string or `Date`). */
-  since: string | Date;
-}
-/** A recovery: COSS requeues the matching failed deliveries in the background. */
-interface HookEndpointRecovery {
-  object: "hook_endpoint_recovery";
-  id: string;
-  endpoint_id: string;
-  since: string;
-  until: string;
-  status: "pending" | "completed";
-  requeued: number;
-  created_at: string;
-  completed_at: string | null;
-}
-/** Body of `POST …/endpoints/{id}/test`. */
-interface SendHookTestParams {
-  event_type: string;
-  /** Defaults to the event type's first example. */
-  payload?: Record<string, unknown>;
-}
-/** A message sent to an application. */
-interface HookMessage {
-  object: "hook_message";
-  /** Also the `webhook-id` header of every request delivering it. */
-  id: string;
-  application_id: string;
-  event_type: string;
-  /** The JSON body delivered to each endpoint. */
-  payload: Record<string, unknown>;
-  created_at: string;
-}
-/** Params of `hooks.messages.send`: the application, then the body of `POST …/messages`. */
-interface SendHookMessageParams {
-  /** The application's id or uid. */
-  application: string;
-  /** e.g. `invoice.paid`; endpoints filtering by type only get the types they chose. */
-  event_type: string;
-  /** At most 256 KB serialized; send integers beyond 2^53 as strings. */
-  payload: Record<string, unknown>;
-}
-/** Query of `GET …/messages`. */
-interface ListHookMessagesParams {
-  /** Only messages of this type. */
-  event_type?: string;
-  /** 1-100, default 50. */
-  limit?: number;
-  /** Cursor: the `id` of the last message of the previous page. */
-  after?: string;
-}
-/**
- * `pending`: waiting for its next attempt. `succeeded`: the endpoint answered 2xx. `failed`: every
- * attempt failed, or the endpoint was disabled or deleted.
- */
-type HookDeliveryStatus = "pending" | "succeeded" | "failed";
-/** One message's delivery to one endpoint. */
-interface HookDelivery {
-  object: "hook_delivery";
-  id: string;
-  application_id: string;
-  message_id: string;
-  endpoint_id: string;
-  status: HookDeliveryStatus;
-  attempt_count: number;
-  next_attempt_at: string | null;
-  last_status_code: number | null;
-  last_error: string | null;
-  created_at: string;
-  finished_at: string | null;
-}
-/** Query of `GET …/endpoints/{id}/deliveries`. */
-interface ListHookDeliveriesParams {
-  status?: HookDeliveryStatus;
-  /** 1-100, default 50. */
-  limit?: number;
-  /** Cursor: the `id` of the last delivery of the previous page. */
-  after?: string;
-}
-/** One HTTP request of a delivery. */
-interface HookAttempt {
-  object: "hook_attempt";
-  id: string;
-  delivery_id: string;
-  endpoint_id: string;
-  attempted_at: string;
-  /** `null` when no response arrived. */
-  status_code: number | null;
-  duration_ms: number;
-  error: string | null;
-  /** At most 1 KB of the response body. */
-  response_excerpt: string | null;
-}
-/** Params of `hooks.portal.createSession`. */
-interface CreateHookPortalSessionParams {
-  /** The application's id or uid. */
-  application: string;
-  /** Seconds until it expires: default 3600, 60-86400. */
-  expires_in?: number;
-  /** The user can look but not change anything. */
-  read_only?: boolean;
-}
-/** A portal sign-in for one application's user. */
-interface HookPortalSession {
-  object: "hook_portal_session";
-  id: string;
-  application_id: string;
-  /** Open it or embed it (from an allowed origin); the token is in its fragment. */
-  url: string;
-  /** The secret part of `url`. */
-  token: string;
-  read_only: boolean;
-  expires_at: string;
-}
-//#endregion
-//#region src/resources/hooks.d.ts
-type ReadOptions$6 = Pick<RequestOptions, "signal">;
-/** `coss.hooks.applications`: your customers, each with their own endpoints and portal. */
-declare class HookApplicationsResource {
-  #private;
-  /** @internal Use `new Coss().hooks.applications`. */
-  constructor(http: HttpClient);
-  /** Creates an application. Never automatically retried (the API does not deduplicate it). */
-  create(params: CreateHookApplicationParams, options?: RequestOptions): Promise<CossResult<HookApplication>>;
-  /** Lists the environment's applications, newest first. */
-  list(params?: ListHookApplicationsParams, options?: ReadOptions$6): Promise<CossResult<List<HookApplication>>>;
-  /** Retrieves an application by its id or uid. */
-  get(application: string, options?: ReadOptions$6): Promise<CossResult<HookApplication>>;
-  update(application: string, params: UpdateHookApplicationParams, options?: ReadOptions$6): Promise<CossResult<HookApplication>>;
-  /** Deletes the application with its endpoints and portal sessions. */
-  delete(application: string, options?: ReadOptions$6): Promise<CossResult<DeletedHookApplication>>;
-}
-/** `coss.hooks.eventTypes`: the catalog of messages you send, which your users subscribe from. */
-declare class HookEventTypesResource {
-  #private;
-  /** @internal Use `new Coss().hooks.eventTypes`. */
-  constructor(http: HttpClient);
-  /** Creates an event type. Never automatically retried (a retry would find it existing). */
-  create(params: CreateHookEventTypeParams, options?: RequestOptions): Promise<CossResult<HookEventType>>;
-  /** Lists event types by name (archived ones only with `include_archived`). */
-  list(params?: ListHookEventTypesParams, options?: ReadOptions$6): Promise<CossResult<List<HookEventType>>>;
-  get(name: string, options?: ReadOptions$6): Promise<CossResult<HookEventType>>;
-  /** Changes its description, schema or examples, or archives or restores it. */
-  update(name: string, params: UpdateHookEventTypeParams, options?: ReadOptions$6): Promise<CossResult<HookEventType>>;
-  /** Archives it: hidden from the portal and new subscriptions. */
-  archive(name: string, options?: ReadOptions$6): Promise<CossResult<HookEventType>>;
-}
-/** `coss.hooks.endpoints`: an application's endpoints (usually added by its users in the portal). */
-declare class HookEndpointsResource {
-  #private;
-  /** @internal Use `new Coss().hooks.endpoints`. */
-  constructor(http: HttpClient);
-  /** Creates an endpoint; the result carries its secret. Never automatically retried. */
-  create(application: string, params: CreateHookEndpointParams, options?: RequestOptions): Promise<CossResult<HookEndpointWithSecret>>;
-  list(application: string, options?: ReadOptions$6): Promise<CossResult<List<HookEndpoint>>>;
-  get(application: string, id: string, options?: ReadOptions$6): Promise<CossResult<HookEndpoint>>;
-  update(application: string, id: string, params: UpdateHookEndpointParams, options?: ReadOptions$6): Promise<CossResult<HookEndpoint>>;
-  delete(application: string, id: string, options?: ReadOptions$6): Promise<CossResult<DeletedHookEndpoint>>;
-  /** The endpoint's current signing secret. */
-  getSecret(application: string, id: string, options?: ReadOptions$6): Promise<CossResult<HookEndpointSecret>>;
-  /** Replaces the signing secret. Never automatically retried (a second roll would stop the first). */
-  rollSecret(application: string, id: string, params?: RollHookEndpointSecretParams, options?: RequestOptions): Promise<CossResult<HookEndpointWithSecret>>;
-  /** Requeues the endpoint's failed deliveries of messages sent since `since` (in the background). */
-  recover(application: string, id: string, params: RecoverHookEndpointParams, options?: RequestOptions): Promise<CossResult<HookEndpointRecovery>>;
-  getRecovery(application: string, id: string, recoveryId: string, options?: ReadOptions$6): Promise<CossResult<HookEndpointRecovery>>;
-  /** Sends a message to this endpoint only. Never automatically retried. */
-  sendTest(application: string, id: string, params: SendHookTestParams, options?: RequestOptions): Promise<CossResult<HookMessage>>;
-  /** The endpoint's deliveries, newest first. */
-  listDeliveries(application: string, id: string, params?: ListHookDeliveriesParams, options?: ReadOptions$6): Promise<CossResult<List<HookDelivery>>>;
-}
-/** `coss.hooks.messages`: send a message once; COSS delivers it to every subscribed endpoint. */
-declare class HookMessagesResource {
-  #private;
-  /** @internal Use `new Coss().hooks.messages`. */
-  constructor(http: HttpClient);
-  /**
-   * Sends a message to an application. Safe to retry: every attempt carries the same
-   * `Idempotency-Key`, so a retried send is delivered once.
-   */
-  send(params: SendHookMessageParams, options?: RequestOptions): Promise<CossResult<HookMessage>>;
-  /** The application's messages, newest first. */
-  list(application: string, params?: ListHookMessagesParams, options?: ReadOptions$6): Promise<CossResult<List<HookMessage>>>;
-  get(application: string, id: string, options?: ReadOptions$6): Promise<CossResult<HookMessage>>;
-  /** One delivery per endpoint the message went to. */
-  listDeliveries(application: string, id: string, options?: ReadOptions$6): Promise<CossResult<List<HookDelivery>>>;
-}
-/** `coss.hooks.deliveries`: one message's delivery to one endpoint. */
-declare class HookDeliveriesResource {
-  #private;
-  /** @internal Use `new Coss().hooks.deliveries`. */
-  constructor(http: HttpClient);
-  get(application: string, id: string, options?: ReadOptions$6): Promise<CossResult<HookDelivery>>;
-  /** Every HTTP request of the delivery, oldest first. */
-  listAttempts(application: string, id: string, options?: ReadOptions$6): Promise<CossResult<List<HookAttempt>>>;
-  /** Queues a finished delivery for one more attempt. Never automatically retried. */
-  retry(application: string, id: string, options?: RequestOptions): Promise<CossResult<HookDelivery>>;
-}
-/** `coss.hooks.portal`: a ready-made page for an application's user to manage their endpoints. */
-declare class HookPortalResource {
-  #private;
-  /** @internal Use `new Coss().hooks.portal`. */
-  constructor(http: HttpClient);
-  /**
-   * Signs the application's user in to the portal: open or embed the returned `url`. Call it from
-   * your backend each time the user opens the portal.
-   */
-  createSession(params: CreateHookPortalSessionParams, options?: RequestOptions): Promise<CossResult<HookPortalSession>>;
-}
-/**
- * `coss.hooks`: webhooks as a service. Send a message to one of your applications once
- * (`coss.hooks.messages.send`); COSS delivers it to every endpoint its users registered, signed
- * (Standard Webhooks), with retries, and gives them a portal to manage it all.
- */
-declare class HooksResource {
-  readonly applications: HookApplicationsResource;
-  readonly eventTypes: HookEventTypesResource;
-  readonly endpoints: HookEndpointsResource;
-  readonly messages: HookMessagesResource;
-  readonly deliveries: HookDeliveriesResource;
-  readonly portal: HookPortalResource;
-  /** @internal Use `new Coss().hooks`. */
-  constructor(http: HttpClient);
-}
-//#endregion
-//#region src/types/log.d.ts
-/** Log wire types (hand-written mirrors of the API's schemas). */
-/**
- * `api`: a request to the API. `email`: an email event. `webhook`: a webhook delivery attempt.
- * `risk`: a risk assessment or its feedback.
- */
-type LogSource = "api" | "email" | "webhook" | "risk";
-/**
- * `error`: 5xx responses, bounces, complaints, failures. `warning`: 4xx responses, delays,
- * suppressions, failed webhook attempts that will be retried. `info`: everything else.
- */
-type LogLevel = "info" | "warning" | "error";
-/** One line of the API key's environment's log. */
-interface Log {
-  object: "log";
-  id: string;
-  /** ISO 8601 timestamp. */
-  occurred_at: string;
-  source: LogSource;
-  level: LogLevel;
-  /** `api.request`, `webhook.attempt`, or an email event type such as `email.delivered`. */
-  type: string;
-  /** A one-line summary. */
-  message: string;
-  /** The `X-Request-Id` of the API request this line belongs to. */
-  request_id: string | null;
-  api_key_id: string | null;
-  method: string | null;
-  path: string | null;
-  /** The matched route, e.g. `/v1/emails/:id`. */
-  route: string | null;
-  /** The API response status, or the webhook endpoint's response status. */
-  status_code: number | null;
-  duration_ms: number | null;
-  client_ip: string | null;
-  user_agent: string | null;
-  error_code: string | null;
-  /** What the line is about: `email`, `domain`, `webhook_endpoint`… */
-  resource_type: string | null;
-  resource_id: string | null;
-  recipient: string | null;
-  /**
-   * Details: redacted request and response bodies for API requests, event data for emails and
-   * webhooks.
-   */
-  attributes: Record<string, unknown>;
-}
-type OneOrMany<T> = T | readonly T[];
-/** Query of `GET /v1/logs`. Lists may be given as arrays or comma-separated strings. */
-interface ListLogsParams {
-  /** Start of the range (inclusive). Defaults to an hour before `to`. */
-  from?: string | Date;
-  /** End of the range (exclusive). Defaults to now. At most 31 days after `from`. */
-  to?: string | Date;
-  source?: OneOrMany<LogSource>;
-  level?: OneOrMany<LogLevel>;
-  /** e.g. `"email.bounced"`. */
-  type?: OneOrMany<string>;
-  /** Status codes or classes, e.g. `["4xx", "503"]`. */
-  status?: OneOrMany<string | number>;
-  method?: OneOrMany<string>;
-  /** Routes such as `/v1/emails/:id`. */
-  route?: OneOrMany<string>;
-  api_key_id?: OneOrMany<string>;
-  request_id?: string;
-  /** Only lines about this resource, e.g. an `email_…` id. */
-  resource_id?: string;
-  /** Free text, matched against the message, path, ids and recipient. */
-  q?: string;
-  /** 1-100, default 50. */
-  limit?: number;
-  /** The `id` of the last line of the previous page. */
-  after?: string;
-}
-//#endregion
-//#region src/types/log-drain.d.ts
-/**
- * What a drain forwards: `api` (requests made with the environment's API keys), `email` (email
- * events), `webhook` (webhook delivery attempts) and `audit` (changes to the environment, from
- * the organization's audit log).
- */
-type LogDrainSource = LogSource | "audit";
-/** An HTTPS endpoint the environment's log is streamed to, in signed NDJSON batches. */
-interface LogDrain {
-  object: "log_drain";
-  id: string;
-  url: string;
-  description: string | null;
-  /** Empty means every source, including ones added later. */
-  sources: LogDrainSource[];
-  /** A disabled drain receives nothing, and lines logged meanwhile are not kept for it. */
-  enabled: boolean;
-  /** `manual`, or `failing`: a batch failed every attempt, so COSS disabled it. */
-  disabled_reason: "manual" | "failing" | null;
-  /** ISO 8601 timestamp; `null` while enabled. */
-  disabled_at: string | null;
-  created_at: string;
-  updated_at: string;
-}
-/** A drain with its `whsec_…` signing secret, returned only when it is created. */
-interface LogDrainWithSecret extends LogDrain {
-  secret: string;
-}
-interface DeletedLogDrain {
-  object: "log_drain";
-  id: string;
-  deleted: true;
-}
-interface CreateLogDrainParams {
-  /** An `https://` URL COSS posts batches to. */
-  url: string;
-  description?: string | null;
-  /** Defaults to every source. */
-  sources?: LogDrainSource[];
-}
-interface UpdateLogDrainParams {
-  url?: string;
-  /** `null` clears it. */
-  description?: string | null;
-  sources?: LogDrainSource[];
-  /** Disabling drops the lines still waiting for the drain. */
-  enabled?: boolean;
-}
-type LogDrainBatchStatus = "pending" | "succeeded" | "failed";
-/** One HTTP attempt of a batch. */
-interface LogDrainAttempt {
-  object: "log_drain_attempt";
-  id: string;
-  attempted_at: string;
-  /** `null` when no response arrived. */
-  status_code: number | null;
-  duration_ms: number;
-  error: string | null;
-  /** At most 1 KB of the response body, as text. */
-  response_excerpt: string | null;
-}
-/** One NDJSON request; its `id` is the `webhook-id` header, the same on every attempt. */
-interface LogDrainBatch {
-  object: "log_drain_batch";
-  id: string;
-  drain_id: string;
-  status: LogDrainBatchStatus;
-  line_count: number;
-  byte_size: number;
-  attempt_count: number;
-  next_attempt_at: string | null;
-  last_status_code: number | null;
-  last_error: string | null;
-  /** Oldest first. */
-  attempts: LogDrainAttempt[];
-  created_at: string;
-  updated_at: string;
-}
-interface ListLogDrainBatchesParams {
-  status?: LogDrainBatchStatus;
-  /** 1-100, default 50. */
-  limit?: number;
-  /** The `id` of the last batch of the previous page. */
-  after?: string;
-}
-/**
- * One line of a log drain batch: a log line (as `coss.logs.list()` returns it) or an audit event
- * of the environment (as `coss.auditEvents.list()` returns it).
- */
-type LogDrainLine = Log | AuditEvent;
-//#endregion
-//#region src/resources/log-drains.d.ts
-type ReadOptions$5 = Pick<RequestOptions, "signal">;
-/** `coss.logDrains.batches`: a drain's delivery log, each batch with every HTTP attempt. */
-declare class LogDrainBatchesResource {
-  #private;
-  /** @internal Use `new Coss().logDrains.batches`. */
-  constructor(http: HttpClient);
-  /** Lists the drain's batches, newest first. Pass the last `id` as `after` while `has_more` is true. */
-  list(drainId: string, params?: ListLogDrainBatchesParams, options?: ReadOptions$5): Promise<CossResult<List<LogDrainBatch>>>;
-  /** Retrieves one batch of the drain. */
-  get(drainId: string, id: string, options?: ReadOptions$5): Promise<CossResult<LogDrainBatch>>;
-}
-/**
- * `coss.logDrains`: HTTPS endpoints the environment's log is streamed to (API requests, email
- * events, webhook attempts and audit events), in signed NDJSON batches. Drains belong to the API
- * key's own environment, so a `coss_test_…` key only ever manages sandbox drains.
- */
-declare class LogDrainsResource {
-  #private;
-  /** Each drain's delivery log. */
-  readonly batches: LogDrainBatchesResource;
-  /** @internal Use `new Coss().logDrains`. */
-  constructor(http: HttpClient);
-  /**
-   * Creates a drain. The result carries its `secret` (returned only here) — store it and pass it
-   * to `verifyLogDrainBatch` for every request. Creation is never automatically retried: the API
-   * does not deduplicate it. After a lost response, list drains and remove the one with the
-   * unknown secret before creating a replacement.
-   */
-  create(params: CreateLogDrainParams, options?: RequestOptions): Promise<CossResult<LogDrainWithSecret>>;
-  /** Lists the environment's drains, oldest first. Secrets are never included. */
-  list(options?: ReadOptions$5): Promise<CossResult<List<LogDrain>>>;
-  /** Retrieves a drain of the API key's environment. */
-  get(id: string, options?: ReadOptions$5): Promise<CossResult<LogDrain>>;
-  /**
-   * Changes the URL, description, sources or `enabled` flag. The signing secret stays the same.
-   * Disabling drops the lines still waiting for the drain; enabling it again (also after COSS
-   * disabled it for failing) sends lines logged from then on.
-   */
-  update(id: string, params: UpdateLogDrainParams, options?: ReadOptions$5): Promise<CossResult<LogDrain>>;
-  /** Deletes the drain and its batch log. To pause it instead, update `enabled` to false. */
-  delete(id: string, options?: ReadOptions$5): Promise<CossResult<DeletedLogDrain>>;
-}
-//#endregion
-//#region src/resources/logs.d.ts
-type ReadOptions$4 = Pick<RequestOptions, "signal">;
-/**
- * `coss.logs`: the API key's environment log, newest first: API requests made with its keys,
- * email events and webhook delivery attempts.
- */
-declare class LogsResource {
-  #private;
-  /** @internal Use `new Coss().logs`. */
-  constructor(http: HttpClient);
-  /**
-   * Lists log lines, newest first (the last hour unless `from`/`to` say otherwise). Pass the last
-   * `id` as `after` while `has_more` is true.
-   */
-  list(params?: ListLogsParams, options?: ReadOptions$4): Promise<CossResult<List<Log>>>;
-  /** Retrieves one log line. */
-  get(id: string, options?: ReadOptions$4): Promise<CossResult<Log>>;
-}
-//#endregion
-//#region src/types/reputation.d.ts
-/** Reputation wire types (hand-written mirrors of the API's `Reputation` schema). */
-type ReputationStatus = "good" | "warning" | "suspended";
-type ReputationCheckSeverity = "ok" | "warning" | "suspend";
-/** One signal the reputation guard measured, e.g. the bounce rate. */
-interface ReputationCheck {
-  /** What was measured, e.g. `bounce_rate` or `complaint_rate`. */
-  trigger: string;
-  severity: ReputationCheckSeverity;
-  message: string;
-  /** `count / volume`; `null` with no volume. */
-  rate: number | null;
-  count: number;
-  /** Recipients sent to (live environments) in the window. */
-  volume: number;
-  warning_threshold: number | null;
-  suspend_threshold: number | null;
-  /** Below this volume the rate is reported but never acted on. */
-  minimum_volume: number | null;
-}
-/** `GET /v1/reputation`: the organization's standing with the reputation guard. */
-interface Reputation {
-  object: "reputation";
-  /**
-   * `suspended` means live sending is refused (`account_suspended`) until COSS support
-   * reinstates the organization; sandbox keys keep working.
-   */
-  status: ReputationStatus;
-  /** The trigger behind a `warning` or `suspended` status. */
-  reason: string | null;
-  /** ISO 8601 timestamp. */
-  status_changed_at: string | null;
-  /** When `checks` were computed; `null` before the first evaluation. */
-  evaluated_at: string | null;
-  /** The period `checks` cover. */
-  window: {
-    start: string;
-    end: string;
-  } | null;
-  checks: ReputationCheck[];
-}
-//#endregion
-//#region src/resources/reputation.d.ts
-type ReadOptions$3 = Pick<RequestOptions, "signal">;
-/**
- * `coss.reputation`: the organization's standing with the COSS reputation guard, which suspends
- * live sending automatically when bounce or complaint rates cross its thresholds.
- */
-declare class ReputationResource {
-  #private;
-  /** @internal Use `new Coss().reputation`. */
-  constructor(http: HttpClient);
-  /** The current status and the latest rates measured over live environments. */
-  get(options?: ReadOptions$3): Promise<CossResult<Reputation>>;
-}
-//#endregion
-//#region src/types/risk.d.ts
-/** Risk wire types (hand-written mirrors of the API's schemas). */
-/** What is being assessed. Velocity is counted per event (`custom` events per `event_name`). */
-type RiskEvent = "signup" | "login" | "message" | "checkout" | "custom";
-/** `allow`: go ahead. `review`: suspicious; limit or hold it for a person. `block`: refuse it. */
-type RiskDecision = "allow" | "review" | "block";
-/** What really happened: `legitimate`, `fraud`, or `abuse` (spam, free-tier abuse…). */
-type RiskOutcome = "legitimate" | "fraud" | "abuse";
-type RiskList = "allow" | "block";
-/**
- * `email` (matched by mailbox, dots and `+tags` folded), `domain` (subdomains included), `ip` (an
- * address or CIDR range), `asn`, `country` (ISO 3166-1 alpha-2), `user` (your user id).
- */
-type RiskListEntryType = "email" | "domain" | "ip" | "asn" | "country" | "user";
-/** Signal groups an assessment was made without (a lookup failed or timed out). */
-type RiskDegradedSignal = "email_dns" | "domain_age" | "ip_data" | "velocity" | "captcha" | "content" | "ip_privacy";
-/** What content classification scores. */
-type RiskContentCategory = "spam" | "phishing" | "malware" | "fraud";
-/**
- * Per category, the model's probability (0-1) that the content belongs to it. Not calibrated:
- * pick thresholds by looking at your own traffic.
- */
-type RiskContentScores = Record<RiskContentCategory, number>;
-/** Every reason an assessment can give (see the reason catalog in the docs). */
-type RiskReasonCode = "email.invalid" | "email.disposable" | "email.undeliverable" | "email.role_account" | "email.typo" | "email.domain_new" | "ip.tor" | "ip.vpn_network" | "ip.hosting_provider" | "ip.vpn" | "ip.proxy" | "ip.relay" | "ip.private" | "velocity.signups_per_ip_1h" | "velocity.signups_per_ip_24h" | "velocity.signups_per_subnet_1h" | "velocity.signups_per_email_domain_1h" | "velocity.signups_per_mailbox_24h" | "velocity.signups_per_device_24h" | "velocity.checkouts_per_ip_1h" | "velocity.checkouts_per_user_1h" | "velocity.checkouts_per_card_24h" | "velocity.logins_per_ip_1h" | "velocity.logins_per_user_1h" | "velocity.events_per_ip_1h" | "velocity.events_per_user_1h" | "duplicate.canonical_mailbox" | "duplicate.device" | "history.fraud_mailbox" | "history.fraud_user" | "history.fraud_ip" | "history.fraud_subnet" | "history.fraud_card" | "history.fraud_device" | "checkout.card_country_mismatch" | "checkout.billing_country_mismatch" | "checkout.prepaid_card" | "device.automation" | "device.invalid" | "login.new_country" | "login.new_network" | "captcha.failed" | "captcha.missing" | "content.spam" | "content.phishing" | "content.malware" | "content.fraud" | "rule.matched" | "list.blocked" | "list.allowed";
-/** Why an assessment decided what it did. Never show reasons to the person being assessed. */
-interface RiskReason {
-  code: RiskReasonCode;
-  /** For developers (dashboards, logs). */
-  message: string;
-  /** The count behind a `velocity.*` reason. */
-  value?: number;
-  /** The count a `velocity.*` reason fires at. */
-  threshold?: number;
-  window?: "1h" | "24h";
-  /** `email.typo`: the likely domain, which you may show the user ("Did you mean …?"). */
-  suggestion?: string;
-  /** `ip.hosting_provider`, `ip.vpn_network`: the network's operator; `ip.vpn`: the VPN service. */
-  provider?: string;
-  /** `duplicate.*`: your id of the user who has the mailbox or device, if known. */
-  previous_user?: string | null;
-  /** `duplicate.*`: the assessment that first saw the mailbox or device. */
-  previous_assessment?: string;
-  /** `list.*`: the matching list entry. */
-  entry?: string;
-  /** `list.*`: what matched. */
-  type?: RiskListEntryType;
-  /** `rule.matched`: the rule's id. */
-  rule?: string;
-  /** `rule.matched`: the rule's name. */
-  name?: string;
-}
-interface RiskEmailSignals {
-  /** `null` once the address is removed (90 days after the assessment). */
-  domain: string | null;
-  valid: boolean;
-  disposable: boolean;
-  /** From DNS (MX, A, AAAA). `unknown` when the lookup failed or timed out. */
-  deliverability: "deliverable" | "undeliverable" | "unknown";
-  role_account: boolean;
-  free_provider: boolean;
-  suggestion: string | null;
-  /**
-   * Days since the domain was registered (RDAP); `null` when unknown or not looked up (free
-   * providers, disposable domains).
-   */
-  domain_age_days: number | null;
-}
-interface RiskCaptchaSignals {
-  provided: boolean;
-  /** `null` when it couldn't be checked (no captcha configured, or the provider was unreachable). */
-  passed: boolean | null;
-}
-/** Logins of a user with history: whether the country or network is new for them. */
-interface RiskLoginSignals {
-  new_country: boolean;
-  new_network: boolean;
-}
-interface RiskIpSignals {
-  version: 4 | 6;
-  private: boolean;
-  tor: boolean;
-  hosting: boolean;
-  hosting_provider: string | null;
-  hosting_kind: "cloud" | "hosting" | "vpn" | null;
-  asn: number | null;
-  as_name: string | null;
-  /** ISO 3166-1 alpha-2. */
-  country: string | null;
-  /**
-   * From COSS's IP privacy data provider; `null` when it isn't available or was not asked
-   * (private addresses).
-   */
-  privacy: RiskIpPrivacy | null;
-}
-/** Whether an address is a VPN exit, a proxy or a privacy relay (iCloud Private Relay…). */
-interface RiskIpPrivacy {
-  vpn: boolean;
-  proxy: boolean;
-  relay: boolean;
-  /** The VPN or proxy service. */
-  service: string | null;
-}
-/** How a card is funded, as your payment processor reports it. */
-type RiskCardFunding = "credit" | "debit" | "prepaid" | "unknown";
-/** What you sent in `checkout` (never the card). */
-interface RiskCheckoutSignals {
-  amount: number;
-  currency: string;
-  card_country: string | null;
-  card_funding: RiskCardFunding | null;
-  billing_country: string | null;
-  shipping_country: string | null;
-}
-/** What the browser reported through `coss/device` (its device id is only kept as a keyed hash). */
-interface RiskDeviceSignals {
-  /** `false`: the token was malformed or too old. */
-  valid: boolean;
-  /** WebDriver control or a headless browser. */
-  automation: boolean;
-  /** IANA time zone (`Europe/London`). */
-  timezone: string | null;
-  /** The browser's first language. */
-  language: string | null;
-  platform: string | null;
-  /** `<width>x<height>` in CSS pixels. */
-  screen: string | null;
-  touch: boolean | null;
-}
-/** An assessment of one event. */
-interface RiskAssessment {
-  object: "risk_assessment";
-  id: string;
-  event: RiskEvent;
-  event_name: string | null;
-  decision: RiskDecision;
-  /** 0-1: how risky the signals are together. Lists can decide regardless of the score. */
-  score: number;
-  /** Why, most significant first. */
-  reasons: RiskReason[];
-  signals: {
-    email: RiskEmailSignals | null;
-    ip: RiskIpSignals | null;
-    /**
-     * Events of the same kind in this environment, this one included, keyed
-     * `<dimension>_<window>` (e.g. `ip_1h`, `mailbox_24h`); `null` when unavailable.
-     */
-    velocity: Record<string, number> | null;
-    captcha: RiskCaptchaSignals | null;
-    login: RiskLoginSignals | null;
-    /** `null` when no content was given or it couldn't be classified. */
-    content: RiskContentScores | null;
-    checkout: RiskCheckoutSignals | null;
-    device: RiskDeviceSignals | null;
-  };
-  user: {
-    id: string | null;
-    email: string | null;
-  };
-  /** `null` once removed (90 days after the assessment). */
-  ip: string | null;
-  degraded: RiskDegradedSignal[];
-  /** The latest outcome you reported with `coss.risk.feedback`. */
-  outcome: RiskOutcome | null;
-  /** `open` for `review` decisions until you send feedback, then `resolved`. */
-  review_status: "open" | "resolved" | null;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-}
-/** Body of `POST /v1/risk/assessments`. */
-interface AssessRiskParams {
-  event: RiskEvent;
-  /** Required for `custom` events (e.g. `invite_sent`), not allowed otherwise. */
-  event_name?: string;
-  user?: {
-    /** Your id for the user, when it exists (logins always; sign-ups once the account exists). */
-    id?: string;
-    /** The email address the user gave. */
-    email?: string;
-  };
-  /** The client's IP address (not your server's or proxy's). */
-  ip?: string;
-  /** The client's user agent. */
-  user_agent?: string;
-  /**
-   * The token your captcha widget (Turnstile or hCaptcha, set in the risk settings) gave the
-   * browser. Verified once: don't reuse it.
-   */
-  captcha?: {
-    token: string;
-  };
-  /**
-   * Text the user wrote (a bio, a message, a listing), classified with the event and never
-   * stored: its scores go in `signals.content`, and `content.*` reasons fire only at thresholds
-   * you set.
-   */
-  content?: {
-    text: string;
-  };
-  /** Only with `checkout` events: what is being paid for, and with which card. */
-  checkout?: {
-    /** In the currency's minor unit (cents for USD: 1999 is $19.99). */
-    amount: number;
-    /** ISO 4217, upper-case (`USD`). */
-    currency: string;
-    /** What your payment processor tells you about the card. */
-    card?: {
-      /**
-       * Your processor's fingerprint of the card number (Stripe: `card.fingerprint`), kept as a
-       * keyed hash only. Never send the card number.
-       */
-      fingerprint?: string;
-      /** Where the card was issued (ISO 3166-1 alpha-2, upper-case). */
-      country?: string;
-      funding?: RiskCardFunding;
-    };
-    billing_country?: string;
-    shipping_country?: string;
-  };
-  /** What `collectDevice()` from `coss/device` returned in the user's browser. */
-  device?: {
-    token: string;
-  };
-}
-/** Query of `GET /v1/risk/assessments`. */
-interface ListRiskAssessmentsParams {
-  event?: RiskEvent;
-  decision?: RiskDecision;
-  user_id?: string;
-  /** `open`: the review queue. */
-  review_status?: "open" | "resolved";
-  /** 1-100, default 50. */
-  limit?: number;
-  /** The `id` of the last assessment of the previous page. */
-  after?: string;
-}
-/** Body of `POST /v1/risk/assessments/{id}/feedback`. */
-interface RiskFeedbackParams {
-  outcome: RiskOutcome;
-  /** For your team; never shared. */
-  note?: string;
-}
-/** An entry of the environment's allow or block list. */
-interface RiskListEntry {
-  object: "risk_list_entry";
-  id: string;
-  list: RiskList;
-  type: RiskListEntryType;
-  /** Normalized: emails as their mailbox, CIDR ranges canonical, ASNs as numbers. */
-  value: string;
-  note: string | null;
-  /** ISO 8601 timestamp: the entry stops matching then. */
-  expires_at: string | null;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-}
-/** Body of `POST /v1/risk/list_entries` (`coss.risk.lists.add` builds it). */
-interface CreateRiskListEntryParams {
-  list: RiskList;
-  type: RiskListEntryType;
-  value: string;
-  note?: string;
-  /** ISO 8601 timestamp with an offset. */
-  expires_at?: string;
-}
-/** What `coss.risk.lists.add` matches on: exactly one of these. */
-type RiskListEntryValue = {
-  email: string;
-} | {
-  domain: string;
-} | {
-  ip: string;
-} | {
-  asn: string | number;
-} | {
-  country: string;
-} | {
-  user: string;
-};
-/** Query of `GET /v1/risk/list_entries`. */
-interface ListRiskListEntriesParams {
-  list?: RiskList;
-  type?: RiskListEntryType;
-  /** 1-100, default 50. */
-  limit?: number;
-  after?: string;
-}
-/** Response of `DELETE /v1/risk/list_entries/{id}`. */
-interface DeletedRiskListEntry {
-  object: "risk_list_entry";
-  id: string;
-  deleted: true;
-}
-/** Response of `DELETE /v1/risk/users/{user_id}`. */
-interface ForgottenRiskUser {
-  object: "risk_user";
-  /** Your user id. */
-  id: string;
-  deleted: true;
-}
-type RiskCaptchaProvider = "turnstile" | "hcaptcha";
-/** The environment's risk settings. */
-interface RiskSettings {
-  object: "risk_settings";
-  /** Scores at or above it are `review`. */
-  review_threshold: number;
-  /** Scores at or above it are `block`. */
-  block_threshold: number;
-  /** Reasons that never fire in this environment. */
-  disabled_reasons: RiskReasonCode[];
-  /** The captcha provider assessments verify tokens with (never the secret). */
-  captcha: {
-    provider: RiskCaptchaProvider;
-    required: boolean;
-  } | null;
-  /** Per content category, the score at which `content.<category>` fires; `null`: never. */
-  content_thresholds: Record<RiskContentCategory, number | null>;
-  /** Reasons whose weight this environment changed; the rest weigh what the catalog says. */
-  reason_weights: Partial<Record<RiskReasonCode, number>>;
-  /** ISO 8601 timestamp; `null` while on the defaults. */
-  updated_at: string | null;
-}
-/** Body of `PATCH /v1/risk/settings`: only the fields given change. */
-interface UpdateRiskSettingsParams {
-  review_threshold?: number;
-  block_threshold?: number;
-  disabled_reasons?: RiskReasonCode[];
-  /** `null` turns captcha verification off and deletes the secret. */
-  captcha?: {
-    provider: RiskCaptchaProvider;
-    /** Required when setting a provider for the first time or changing it. */
-    secret?: string;
-    /** Assessments without a token get `captcha.missing`. */
-    required?: boolean;
-  } | null;
-  /** Changes the categories given: a score in (0, 1] sets the threshold, `null` removes it. */
-  content_thresholds?: Partial<Record<RiskContentCategory, number | null>>;
-  /**
-   * Changes the reasons given: a weight in [0, 0.99] replaces the default (for example
-   * calibration's `suggested_weight`), `null` restores it. Not `list.*` or `rule.matched`.
-   */
-  reason_weights?: Partial<Record<RiskReasonCode, number | null>>;
-}
-/** Feedback counted against one reason or rule (`fraud` includes `abuse`). */
-interface RiskCalibrationCounts {
-  fraud: number;
-  legitimate: number;
-  /** `fraud / (fraud + legitimate)`; `null` without feedback. */
-  precision: number | null;
-}
-/** How often each reason and rule was right over the last 90 days, by your feedback. */
-interface RiskCalibration {
-  object: "risk_calibration";
-  window_days: number;
-  /** Assessments in the window. */
-  assessments: number;
-  /** Of those, with feedback. */
-  labeled: number;
-  reasons: (RiskCalibrationCounts & {
-    code: RiskReasonCode;
-    /** Assessments it fired in. */
-    fired: number;
-    default_weight: number;
-    /** Its weight in this environment now. */
-    weight: number;
-    /** What feedback supports; `null` with fewer than 20 assessments with feedback. */
-    suggested_weight: number | null;
-  })[];
-  rules: (RiskCalibrationCounts & {
-    rule: string;
-    name: string;
-    /** Assessments it decided. */
-    matched: number;
-  })[];
-}
-/** A field a rule condition can test (see the rules guide). */
-type RiskRuleField = "email.valid" | "email.disposable" | "email.undeliverable" | "email.role_account" | "email.free_provider" | "email.typo" | "email.domain_new" | "email.domain" | "email.domain_age_days" | "ip.tor" | "ip.hosting" | "ip.vpn" | "ip.proxy" | "ip.relay" | "ip.private" | "ip.country" | "ip.asn" | "ip.hosting_provider" | "captcha.passed" | "duplicate.canonical_mailbox" | "duplicate.device" | "history.fraud" | "login.new_country" | "login.new_network" | "content.spam" | "content.phishing" | "content.malware" | "content.fraud" | "checkout.amount" | "checkout.currency" | "checkout.card_country" | "checkout.card_funding" | "checkout.billing_country" | "checkout.shipping_country" | "device.automation" | "device.timezone" | "device.language" | "score" | "velocity.ip_1h" | "velocity.ip_24h" | "velocity.subnet_1h" | "velocity.subnet_24h" | "velocity.email_domain_1h" | "velocity.email_domain_24h" | "velocity.mailbox_1h" | "velocity.mailbox_24h" | "velocity.user_1h" | "velocity.user_24h" | "velocity.card_1h" | "velocity.card_24h" | "velocity.device_1h" | "velocity.device_24h";
-/** A test of one field. A field without a value (no IP, no email…) never matches. */
-interface RiskRuleCondition {
-  field: RiskRuleField;
-  /** `is` (booleans); `eq`, `neq`, `gt`, `gte`, `lt`, `lte` (numbers); `eq`, `neq`, `in`, `not_in` (strings). */
-  operator: "is" | "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "not_in";
-  value: boolean | number | string | string[];
-}
-/** A rule: the first enabled one whose conditions match decides (after the lists). */
-interface RiskRule {
-  object: "risk_rule";
-  id: string;
-  name: string;
-  enabled: boolean;
-  /** Rules are tried in ascending order. */
-  position: number;
-  /** Events it applies to; empty: every event. */
-  events: RiskEvent[];
-  /** `all`: every condition must hold. `any`: one is enough. */
-  match: "all" | "any";
-  conditions: RiskRuleCondition[];
-  action: RiskDecision;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-  /** ISO 8601 timestamp. */
-  updated_at: string;
-}
-/** Body of `POST /v1/risk/rules`. */
-interface CreateRiskRuleParams {
-  name: string;
-  enabled?: boolean;
-  /** Default 0. */
-  position?: number;
-  events?: RiskEvent[];
-  /** Default `all`. */
-  match?: "all" | "any";
-  conditions: RiskRuleCondition[];
-  action: RiskDecision;
-}
-/** Body of `PATCH /v1/risk/rules/{id}`: only the fields given change. */
-type UpdateRiskRuleParams = Partial<CreateRiskRuleParams>;
-/** Response of `DELETE /v1/risk/rules/{id}`. */
-interface DeletedRiskRule {
-  object: "risk_rule";
-  id: string;
-  deleted: true;
-}
-/** Result of `coss.risk.checkEmail()`: what COSS knows about an address. Nothing is stored. */
-interface RiskEmailCheck {
-  object: "risk_email_check";
-  email: string;
-  valid: boolean;
-  domain: string | null;
-  /** The mailbox with the provider's aliasing folded (dots and `+tags` at Gmail…). */
-  canonical: string | null;
-  disposable: boolean;
-  /** From DNS (MX, A, AAAA). `unknown` when the lookup failed or timed out. */
-  deliverability: "deliverable" | "undeliverable" | "unknown";
-  role_account: boolean;
-  free_provider: boolean;
-  /** The likely intended domain when this one looks like a typo of a popular one. */
-  suggestion: string | null;
-  /** Days since the domain was registered (RDAP); `null` when unknown or not looked up. */
-  domain_age_days: number | null;
-  /** Lookups that failed or timed out. */
-  degraded: ("email_dns" | "domain_age")[];
-}
-/** Result of `coss.risk.checkIp()`. Nothing is stored. */
-interface RiskIpCheck extends RiskIpSignals {
-  object: "risk_ip_check";
-  ip: string;
-  /**
-   * `ip_data` when some IP data is unavailable at the moment; `ip_privacy` when the privacy data
-   * provider failed or timed out.
-   */
-  degraded: ("ip_data" | "ip_privacy")[];
-}
-/** Result of `coss.risk.classify()`: scores only, neither stored nor logged. */
-interface RiskContentClassification {
-  object: "risk_content_classification";
-  scores: RiskContentScores;
-  /** The text was longer than the model reads (8,000 characters): only its beginning counted. */
-  truncated: boolean;
-}
-/** What `on_failure` answers while COSS can't count. */
-type RiskLimitFailureMode = "allow" | "deny";
-/** One of your rate limit buckets: each key gets `burst` tokens, refilling `limit` per period. */
-interface RiskLimitBucket {
-  object: "risk_limit_bucket";
-  id: string;
-  /** What `coss.risk.limit({ bucket })` names it by. */
-  name: string;
-  /** Tokens added per `period_seconds`. */
-  limit: number;
-  period_seconds: number;
-  /** How many requests a key can make at once. */
-  burst: number;
-  on_failure: RiskLimitFailureMode;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-  /** ISO 8601 timestamp. */
-  updated_at: string;
-}
-/** Body of `POST /v1/risk/limit_buckets`. */
-interface CreateRiskLimitBucketParams {
-  /** 1-64 lower-case letters, digits, `.`, `_` or `-`; unique in the environment. */
-  name: string;
-  limit: number;
-  /** 1 second to 1 day. */
-  period_seconds: number;
-  /** Defaults to `limit`. */
-  burst?: number;
-  /** Defaults to `allow`. */
-  on_failure?: RiskLimitFailureMode;
-}
-/** Body of `PATCH /v1/risk/limit_buckets/{id}` (the name can't change). */
-type UpdateRiskLimitBucketParams = Partial<Omit<CreateRiskLimitBucketParams, "name">>;
-interface DeletedRiskLimitBucket {
-  object: "risk_limit_bucket";
-  id: string;
-  deleted: true;
-}
-/** Body of `POST /v1/risk/limits`. */
-interface CheckRiskLimitParams {
-  /** The bucket's name. */
-  bucket: string;
-  /** Who or what is limited (a user id, an email or IP address…); COSS keeps only a hash. */
-  key: string;
-  /** Tokens this request takes. Default 1. */
-  cost?: number;
-}
-/** Result of `coss.risk.limit()`. */
-interface RiskLimit {
-  object: "risk_limit";
-  bucket: string;
-  /** Whether to let the request through. Denied requests take no tokens. */
-  allowed: boolean;
-  /** The bucket's size (`burst`). */
-  limit: number;
-  /** Tokens left for this key. */
-  remaining: number;
-  /** Milliseconds until the key's bucket is full again. */
-  reset_ms: number;
-  /** When denied: milliseconds until the same request would fit; `null` if it never would. */
-  retry_after_ms: number | null;
-  /** COSS couldn't count: `allowed` is the bucket's `on_failure`. */
-  degraded: boolean;
-}
-//#endregion
-//#region src/resources/risk.d.ts
-type ReadOptions$2 = Pick<RequestOptions, "signal">;
-/** `coss.risk.assessments`: reading past assessments (`assess` lives on `coss.risk`). */
-declare class RiskAssessmentsResource {
-  #private;
-  /** @internal Use `new Coss().risk.assessments`. */
-  constructor(http: HttpClient);
-  /** Retrieves one assessment. */
-  get(id: string, options?: ReadOptions$2): Promise<CossResult<RiskAssessment>>;
-  /**
-   * Lists assessments, newest first (`review_status: "open"` is the review queue). Pass the last
-   * `id` as `after` while `has_more` is true.
-   */
-  list(params?: ListRiskAssessmentsParams, options?: ReadOptions$2): Promise<CossResult<List<RiskAssessment>>>;
-}
-/** `coss.risk.lists`: the environment's allow and block lists. */
-declare class RiskListsResource {
-  #private;
-  /** @internal Use `new Coss().risk.lists`. */
-  constructor(http: HttpClient);
-  /**
-   * Adds an entry: `coss.risk.lists.add("block", { domain: "evil.example" })`. An allow-list match
-   * makes decisions `allow`, a block-list match `block`. Returns the existing entry if there is one.
-   */
-  add(list: RiskList, entry: RiskListEntryValue & {
-    note?: string;
-    expires_at?: string | Date;
-  }, options?: RequestOptions): Promise<CossResult<RiskListEntry>>;
-  /** Lists entries, newest first. Pass the last `id` as `after` while `has_more` is true. */
-  list(params?: ListRiskListEntriesParams, options?: ReadOptions$2): Promise<CossResult<List<RiskListEntry>>>;
-  /** Retrieves one entry. */
-  get(id: string, options?: ReadOptions$2): Promise<CossResult<RiskListEntry>>;
-  /** Removes an entry. */
-  remove(id: string, options?: ReadOptions$2): Promise<CossResult<DeletedRiskListEntry>>;
-}
-/** `coss.risk.settings`: the environment's thresholds, disabled reasons and captcha provider. */
-declare class RiskSettingsResource {
-  #private;
-  /** @internal Use `new Coss().risk.settings`. */
-  constructor(http: HttpClient);
-  get(options?: ReadOptions$2): Promise<CossResult<RiskSettings>>;
-  /** Changes the fields given. The captcha secret is write-only. */
-  update(params: UpdateRiskSettingsParams, options?: ReadOptions$2): Promise<CossResult<RiskSettings>>;
-}
-/**
- * `coss.risk.rules`: the environment's rules. After the lists, the first enabled rule whose
- * conditions match an event decides it.
- */
-declare class RiskRulesResource {
-  #private;
-  /** @internal Use `new Coss().risk.rules`. */
-  constructor(http: HttpClient);
-  /** Creates a rule. Not retried automatically: a retry could create it twice. */
-  create(params: CreateRiskRuleParams, options?: ReadOptions$2): Promise<CossResult<RiskRule>>;
-  /** Every rule, in evaluation order. */
-  list(options?: ReadOptions$2): Promise<CossResult<List<RiskRule>>>;
-  get(id: string, options?: ReadOptions$2): Promise<CossResult<RiskRule>>;
-  /** Changes the fields given; `conditions` replaces the whole list. */
-  update(id: string, params: UpdateRiskRuleParams, options?: ReadOptions$2): Promise<CossResult<RiskRule>>;
-  delete(id: string, options?: ReadOptions$2): Promise<CossResult<DeletedRiskRule>>;
-}
-/**
- * `coss.risk.limitBuckets`: your rate limit buckets, which `coss.risk.limit()` charges per key.
- */
-declare class RiskLimitBucketsResource {
-  #private;
-  /** @internal Use `new Coss().risk.limitBuckets`. */
-  constructor(http: HttpClient);
-  /** Creates a bucket. Not retried automatically: a retry would find its name taken. */
-  create(params: CreateRiskLimitBucketParams, options?: ReadOptions$2): Promise<CossResult<RiskLimitBucket>>;
-  /** Every bucket, by name. */
-  list(options?: ReadOptions$2): Promise<CossResult<List<RiskLimitBucket>>>;
-  get(id: string, options?: ReadOptions$2): Promise<CossResult<RiskLimitBucket>>;
-  /** Changes the fields given; the next check uses them. */
-  update(id: string, params: UpdateRiskLimitBucketParams, options?: ReadOptions$2): Promise<CossResult<RiskLimitBucket>>;
-  delete(id: string, options?: ReadOptions$2): Promise<CossResult<DeletedRiskLimitBucket>>;
-}
-/** `coss.risk.users`: what COSS remembers about your users. */
-declare class RiskUsersResource {
-  #private;
-  /** @internal Use `new Coss().risk.users`. */
-  constructor(http: HttpClient);
-  /**
-   * Call when you delete a user: COSS deletes what identifies them (their mailbox, fraud reports,
-   * and the user id, email, IP and user agent on their assessments). Safe to repeat.
-   */
-  forget(userId: string, options?: ReadOptions$2): Promise<CossResult<ForgottenRiskUser>>;
-}
-/**
- * `coss.risk`: assess sign-ups, logins and other events. Call it from your server and treat an
- * error as `allow` (fail open), so an outage never locks your users out.
- *
- * ```ts
- * const { data } = await coss.risk.assess({ event: "signup", user: { email }, ip, user_agent });
- * if (data?.decision === "block") return refuse();
- * ```
- */
-declare class RiskResource {
-  #private;
-  /** Past assessments (`get`, `list`). */
-  readonly assessments: RiskAssessmentsResource;
-  /** Allow and block lists (`add`, `list`, `get`, `remove`). */
-  readonly lists: RiskListsResource;
-  /** Forgetting deleted users. */
-  readonly users: RiskUsersResource;
-  /** Thresholds, disabled reasons and the captcha provider (`get`, `update`). */
-  readonly settings: RiskSettingsResource;
-  /** Rules (`create`, `list`, `get`, `update`, `delete`). */
-  readonly rules: RiskRulesResource;
-  /** Your rate limit buckets (`create`, `list`, `get`, `update`, `delete`). */
-  readonly limitBuckets: RiskLimitBucketsResource;
-  /** @internal Use `new Coss().risk`. */
-  constructor(http: HttpClient);
-  /**
-   * Assesses an event and returns the decision with its score and reasons. Retries reuse one
-   * `Idempotency-Key`, so an event is never counted twice.
-   */
-  assess(params: AssessRiskParams, options?: RequestOptions): Promise<CossResult<RiskAssessment>>;
-  /**
-   * Reports what an assessed user turned out to be: `fraud` and `abuse` teach later assessments to
-   * flag the same mailbox, user, card, device, IP and subnet; `legitimate` takes that back.
-   * Resolves a review, and counts in `calibration()`.
-   */
-  feedback(id: string, params: RiskFeedbackParams, options?: RequestOptions): Promise<CossResult<RiskAssessment>>;
-  /**
-   * How often each reason and rule was right over the last 90 days, by your feedback, and the
-   * reason weights that supports. Apply them with `settings.update({ reason_weights })`.
-   */
-  calibration(options?: ReadOptions$2): Promise<CossResult<RiskCalibration>>;
-  /**
-   * Checks an email address on its own: syntax, disposable domains, deliverability, role
-   * accounts, free providers, the canonical mailbox, typos and domain age. Nothing is stored.
-   */
-  checkEmail(email: string, options?: ReadOptions$2): Promise<CossResult<RiskEmailCheck>>;
-  /**
-   * Checks an IP address on its own: Tor, cloud, hosting and VPN networks, ASN and country, and
-   * VPN, proxy and relay exits when COSS's privacy data is available.
-   */
-  checkIp(ip: string, options?: ReadOptions$2): Promise<CossResult<RiskIpCheck>>;
-  /**
-   * Scores text for spam, phishing, malware and fraud. Scores only, never a verdict: you choose
-   * the thresholds. The text is neither stored nor logged.
-   */
-  classify(params: {
-    text: string;
-  }, options?: ReadOptions$2): Promise<CossResult<RiskContentClassification>>;
-  /**
-   * Takes `cost` tokens (default 1) from `key`'s share of one of your buckets
-   * (`coss.risk.limitBuckets`). Retries reuse one `Idempotency-Key`, so they are charged once.
-   *
-   * ```ts
-   * const { data } = await coss.risk.limit({ bucket: "password_reset", key: email });
-   * if (data && !data.allowed) return tooManyRequests(data.retry_after_ms);
-   * ```
-   */
-  limit(params: CheckRiskLimitParams, options?: RequestOptions): Promise<CossResult<RiskLimit>>;
-}
-//#endregion
-//#region src/types/webhook.d.ts
-/** What a webhook says about the email; never its content, cc or bcc. */
-interface EmailWebhookEventData extends EmailEventData {
-  email_id: string;
-  from: string;
-  to: string[];
-  subject: string;
-  tags: EmailTag[];
-  category: string | null;
-  /** `true` for emails sent with a sandbox (`coss_test_…`) key. */
-  sandbox: boolean;
-  /** The recipient this event is about; `null` for the whole email. */
-  recipient: string | null;
-  /** ISO 8601 timestamp of the event itself (deliveries can arrive later, and out of order). */
-  occurred_at: string;
-}
-/** An email event. `id` equals the `webhook-id` header and `EmailEvent.id`. */
-interface EmailWebhookEvent {
-  id: string;
-  object: "event";
-  type: EmailEventType;
-  /** The API version this event is rendered in: the receiving endpoint's `api_version`. */
-  api_version: string;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-  data: EmailWebhookEventData;
-}
-/** Events about received (inbound) emails. */
-type ReceivedEmailEventType = "email.received";
-/** What a webhook says about a received email; never its content, headers or cc. */
-interface ReceivedEmailWebhookEventData {
-  /** Retrieve the email (bodies, headers, attachments) with `coss.email.received.get`. */
-  received_email_id: string;
-  /** The `From` header. */
-  from: string | null;
-  /** The `To` header's addresses. */
-  to: string[];
-  /** The envelope recipients this environment received it for. */
-  recipients: string[];
-  subject: string | null;
-  message_id: string | null;
-  attachment_count: number;
-  size: number;
-  /** Whether the spam verdict is `fail`. */
-  spam: boolean;
-  verdicts: ReceivedEmailVerdicts;
-  sandbox: boolean;
-  /** ISO 8601 timestamp. */
-  received_at: string;
-}
-/** An email arrived. `id` equals the `webhook-id` header. */
-interface ReceivedEmailWebhookEvent {
-  id: string;
-  object: "event";
-  type: ReceivedEmailEventType;
-  /** The API version this event is rendered in: the receiving endpoint's `api_version`. */
-  api_version: string;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-  data: ReceivedEmailWebhookEventData;
-}
-/** Changes of the organization's reputation standing (sent to live environments only). */
-type AccountEventType = "account.reputation_warning" | "account.reputation_recovered" | "account.suspended" | "account.reinstated";
-interface AccountWebhookEventData {
-  organization_id: string;
-  status: ReputationStatus;
-  previous_status: ReputationStatus;
-  /** The trigger behind a `warning` or `suspended` status, e.g. `complaint_rate`. */
-  reason: string | null;
-  /** ISO 8601 timestamp. */
-  occurred_at: string;
-  /** The measurements behind the change (see `coss.reputation.get()`). */
-  checks: ReputationCheck[];
-}
-/** A reputation change. `id` equals the `webhook-id` header. */
-interface AccountWebhookEvent {
-  id: string;
-  object: "event";
-  type: AccountEventType;
-  /** The API version this event is rendered in: the receiving endpoint's `api_version`. */
-  api_version: string;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-  data: AccountWebhookEventData;
-}
-/** Billing events (organization-wide; sent to live environments only). */
-type BillingEventType = "billing.invoice_finalized" | "billing.invoice_paid" | "billing.invoice_payment_failed" | "billing.invoice_voided" | "billing.plan_changed" | "billing.usage_threshold_reached" | "billing.hold_placed" | "billing.hold_lifted" | "billing.credit_granted";
-interface BillingEventFields {
-  /** Equals the `webhook-id` header. */
-  id: string;
-  object: "event";
-  /** The API version this event is rendered in: the receiving endpoint's `api_version`. */
-  api_version: string;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-}
-/** Every billing event's `data` has these. */
-interface BillingEventData {
-  organization_id: string;
-  /** When it happened (ISO 8601): sort events by it. */
-  occurred_at: string;
-}
-/** A billing event; narrow on `type` for its `data`. */
-type BillingWebhookEvent = (BillingEventFields & {
-  type: "billing.invoice_finalized" | "billing.invoice_paid" | "billing.invoice_voided";
-  data: BillingEventData & {
-    invoice: InvoiceSummary;
-  };
-}) | (BillingEventFields & {
-  type: "billing.invoice_payment_failed";
-  data: BillingEventData & {
-    invoice: InvoiceSummary;
-    failure: {
-      message: string;
-    };
-  };
-}) | (BillingEventFields & {
-  type: "billing.plan_changed";
-  data: BillingEventData & {
-    /**
-     * `upgrade` (in effect now), `downgrade`/`cancellation` (scheduled), `reverted` (a
-     * scheduled change was undone), `contract` (a contract changed).
-     */
-    change: "upgrade" | "downgrade" | "cancellation" | "reverted" | "contract";
-    /** The plan from `effective_at`. */
-    plan: PlanKey;
-    previous_plan: PlanKey;
-    effective_at: string;
-  };
-}) | (BillingEventFields & {
-  type: "billing.usage_threshold_reached";
-  data: BillingEventData & {
-    /** The threshold crossed, e.g. 80. */
-    percent: number;
-    /** `credit`: the month's usage credit; `allowance`: a capped plan's included units. */
-    of: "credit" | "allowance";
-    meter: Meter | null;
-    period: {
-      start: string;
-      end: string;
-    };
-  };
-}) | (BillingEventFields & {
-  type: "billing.hold_placed" | "billing.hold_lifted";
-  data: BillingEventData & {
-    reason: BillingHoldReason;
-  };
-}) | (BillingEventFields & {
-  type: "billing.credit_granted";
-  data: BillingEventData & {
-    credit: Credit;
-  };
-});
-/** Risk events: `review` decisions, and their resolution, for a queue you work through. */
-type RiskEventType = "risk.assessment.review" | "risk.assessment.reviewed";
-interface RiskWebhookEventData {
-  assessment_id: string;
-  event: RiskEvent;
-  event_name: string | null;
-  decision: RiskDecision;
-  score: number;
-  reasons: RiskReason[];
-  /** Your user id, if the assessment had one. Never the email or IP address. */
-  user_id: string | null;
-  /** `risk.assessment.reviewed`: the outcome that resolved the review. */
-  outcome: RiskOutcome | null;
-  /** ISO 8601 timestamp. */
-  occurred_at: string;
-}
-/** A risk review opened or resolved. `id` equals the `webhook-id` header. */
-interface RiskWebhookEvent {
-  id: string;
-  object: "event";
-  type: RiskEventType;
-  /** The API version this event is rendered in: the receiving endpoint's `api_version`. */
-  api_version: string;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-  data: RiskWebhookEventData;
-}
-/** Events about Hooks: an endpoint of one of your applications was disabled for failing. */
-type HookOperationalEventType = "hook_endpoint.disabled";
-interface HookEndpointWebhookEventData {
-  application_id: string;
-  /** Your uid for the application, when it has one. */
-  application_uid: string | null;
-  endpoint_id: string;
-  url: string;
-  /** ISO 8601 timestamp: when its deliveries started failing every attempt. */
-  failing_since: string;
-  /** ISO 8601 timestamp. */
-  occurred_at: string;
-}
-/** A Hooks endpoint of one of your applications was disabled. `id` equals the `webhook-id` header. */
-interface HookEndpointWebhookEvent {
-  id: string;
-  object: "event";
-  type: HookOperationalEventType;
-  /** The API version this event is rendered in: the receiving endpoint's `api_version`. */
-  api_version: string;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-  data: HookEndpointWebhookEventData;
-}
-/** The JSON body of a webhook request; narrow on `type`. */
-type WebhookEvent = EmailWebhookEvent | ReceivedEmailWebhookEvent | AccountWebhookEvent | BillingWebhookEvent | RiskWebhookEvent | HookEndpointWebhookEvent;
-//#endregion
-//#region src/types/webhook-endpoint.d.ts
-/** Every event type an endpoint can subscribe to. */
-type WebhookEventType = EmailEventType | ReceivedEmailEventType | AccountEventType | BillingEventType | RiskEventType | HookOperationalEventType;
-/** Why an endpoint is disabled. */
-type WebhookEndpointDisabledReason = "manual" | "failing";
-/** A URL of the API key's environment that receives signed event notifications. */
-interface WebhookEndpoint {
-  object: "webhook_endpoint";
-  id: string;
-  url: string;
-  description: string | null;
-  /**
-   * Event types delivered to this endpoint. An empty array means every event type, including
-   * ones added later.
-   */
-  event_types: string[];
-  /** The API version events are rendered in for this endpoint (each event's `api_version`). */
-  api_version: string;
-  /** A disabled endpoint receives nothing until it is enabled again. */
-  enabled: boolean;
-  /**
-   * `manual`: someone disabled it. `failing`: its deliveries failed every attempt for five days,
-   * so COSS disabled it. `null` while enabled.
-   */
-  disabled_reason: WebhookEndpointDisabledReason | null;
-  /** When it was disabled (ISO 8601); `null` while enabled. */
-  disabled_at: string | null;
-  /**
-   * When the endpoint's current run of failed deliveries began (ISO 8601); cleared by the next
-   * successful delivery. An endpoint failing for five days is disabled. `null` while healthy.
-   */
-  failing_since: string | null;
-  /**
-   * After a secret roll, deliveries are also signed with the previous secret until this time
-   * (ISO 8601). `null` when only the current secret signs.
-   */
-  previous_secret_expires_at: string | null;
-  /** ISO 8601 timestamp. */
-  created_at: string;
-  updated_at: string;
-}
-/** A freshly created endpoint, or one whose secret was just rolled: the only responses with the signing secret. */
-interface WebhookEndpointWithSecret extends WebhookEndpoint {
-  /**
-   * The endpoint's `whsec_…` signing secret, for `verifyWebhook`. Returned only on creation and
-   * on a roll — store it now; it cannot be read back through the API.
-   */
-  secret: string;
-}
-/** Body of `POST /v1/webhook_endpoints`. */
-interface CreateWebhookEndpointParams {
-  /** An `https://` URL COSS posts events to. */
-  url: string;
-  /** A note for your own reference. */
-  description?: string | null;
-  /** Defaults to every event type, including ones added later. */
-  event_types?: WebhookEventType[];
-  /**
-   * The API version events are rendered in. Defaults to the client's `apiVersion`, so events match
-   * this SDK's `WebhookEvent` types.
-   */
-  api_version?: ApiVersion;
-}
-/** Body of `PATCH /v1/webhook_endpoints/{id}`. Omitted fields keep their current value. */
-interface UpdateWebhookEndpointParams {
-  url?: string;
-  /** `null` clears the description. */
-  description?: string | null;
-  event_types?: WebhookEventType[];
-  api_version?: ApiVersion;
-  enabled?: boolean;
-}
-/** Body of `POST /v1/webhook_endpoints/{id}/roll_secret`. */
-interface RollWebhookEndpointSecretParams {
-  /**
-   * Seconds the current secret keeps signing deliveries next to the new one, so receivers can
-   * switch without rejecting anything. Default 86400 (a day), at most 604800 (a week). `0` stops
-   * it immediately, e.g. after a leak.
-   */
-  previous_secret_expires_in?: number;
-}
-/** Body of `POST /v1/webhook_endpoints/{id}/recover`. */
-interface RecoverWebhookEndpointParams {
-  /**
-   * Requeue the deliveries that failed and were created at or after this time (ISO 8601 string or
-   * `Date`). Deliveries are kept for 30 days.
-   */
-  since: string | Date;
-}
-/** Returned by `webhookEndpoints.recover`. */
-interface WebhookEndpointRecovery {
-  object: "webhook_endpoint_recovery";
-  endpoint_id: string;
-  /** How many failed deliveries were queued for one more attempt (spread over the next minute). */
-  requeued: number;
-  /** At most 1,000 are requeued per call; `true` means call again with the same `since`. */
-  has_more: boolean;
-}
-/** Returned by `webhookEndpoints.delete`. */
-interface DeletedWebhookEndpoint {
-  object: "webhook_endpoint";
-  id: string;
-  deleted: true;
-}
-/**
- * `pending`: waiting for its next attempt. `succeeded`: the endpoint answered with a 2xx status.
- * `failed`: every attempt failed, or the endpoint was disabled.
- */
-type WebhookDeliveryStatus = "pending" | "succeeded" | "failed";
-/** One HTTP request of a delivery. */
-interface WebhookAttempt {
-  object: "webhook_attempt";
-  id: string;
-  /** ISO 8601 timestamp. */
-  attempted_at: string;
-  /** The endpoint's HTTP status; `null` when no response arrived. */
-  status_code: number | null;
-  duration_ms: number;
-  /** Why the attempt failed (e.g. `HTTP 500`, a timeout); `null` on success. */
-  error: string | null;
-  /** At most 1 KB of the response body, as text. */
-  response_excerpt: string | null;
-}
-/** One event sent to one endpoint, retried with backoff until it succeeds or gives up. */
-interface WebhookDelivery {
-  object: "webhook_delivery";
-  id: string;
-  endpoint_id: string;
-  /** The event's id: the `id` of the payload and the `webhook-id` header. */
-  event_id: string;
-  event_type: string;
-  status: WebhookDeliveryStatus;
-  attempt_count: number;
-  /** When the next attempt is due; `null` once the delivery is finished. */
-  next_attempt_at: string | null;
-  last_status_code: number | null;
-  last_error: string | null;
-  /** The event body, exactly as posted to the endpoint (a `WebhookEvent`). */
-  payload: Record<string, unknown>;
-  /** Every HTTP attempt of this delivery, oldest first. */
-  attempts: WebhookAttempt[];
-  created_at: string;
-  updated_at: string;
-}
-/** Query of `GET /v1/webhook_endpoints/{id}/deliveries`. */
-interface ListWebhookDeliveriesParams {
-  /** Only deliveries with this status. */
-  status?: WebhookDeliveryStatus;
-  /** Only the delivery of this event. */
-  event_id?: string;
-  /** 1-100, default 50. */
-  limit?: number;
-  /** Cursor: the `id` of the last delivery of the previous page. */
-  after?: string;
-}
-//#endregion
-//#region src/resources/webhook-deliveries.d.ts
-type ReadOptions$1 = Pick<RequestOptions, "signal">;
-/**
- * `coss.webhookEndpoints.deliveries`: an endpoint's delivery log. Each delivery carries every
- * HTTP attempt and the payload as sent.
- */
-declare class WebhookDeliveriesResource {
-  #private;
-  /** @internal Use `new Coss().webhookEndpoints.deliveries`. */
-  constructor(http: HttpClient);
-  /** Lists the endpoint's deliveries, newest first. Pass the last `id` as `after` while `has_more` is true. */
-  list(endpointId: string, params?: ListWebhookDeliveriesParams, options?: ReadOptions$1): Promise<CossResult<List<WebhookDelivery>>>;
-  /** Retrieves one delivery of the endpoint. */
-  get(endpointId: string, id: string, options?: ReadOptions$1): Promise<CossResult<WebhookDelivery>>;
-  /**
-   * Queues a finished delivery for one more attempt, made within seconds. A delivery that is
-   * still `pending` is returned unchanged (it is already scheduled for `next_attempt_at`).
-   * Never automatically retried: the API does not deduplicate replay requests, even with an
-   * idempotency key.
-   */
-  retry(endpointId: string, id: string, options?: RequestOptions): Promise<CossResult<WebhookDelivery>>;
-}
-//#endregion
-//#region src/resources/webhook-endpoints.d.ts
-type ReadOptions = Pick<RequestOptions, "signal">;
-/**
- * `coss.webhookEndpoints`: the URLs that receive signed event notifications. Endpoints belong to
- * the API key's own environment, so a `coss_test_…` key only ever manages sandbox endpoints.
- */
-declare class WebhookEndpointsResource {
-  #private;
-  /** Each endpoint's delivery log: list, retrieve and retry deliveries. */
-  readonly deliveries: WebhookDeliveriesResource;
-  /** @internal Use `new Coss().webhookEndpoints`. */
-  constructor(http: HttpClient);
-  /**
-   * Creates an endpoint. The result carries its `secret` (returned again only by `rollSecret`) —
-   * store it and pass it to `verifyWebhook` for every delivery. Creation is never automatically retried:
-   * the API does not deduplicate it, even with an idempotency key. After a lost response,
-   * list endpoints and remove the endpoint with the unknown secret before creating a replacement.
-   */
-  create(params: CreateWebhookEndpointParams, options?: RequestOptions): Promise<CossResult<WebhookEndpointWithSecret>>;
-  /** Lists the environment's endpoints, oldest first. Secrets are never included. */
-  list(options?: ReadOptions): Promise<CossResult<List<WebhookEndpoint>>>;
-  /** Retrieves an endpoint of the API key's environment. */
-  get(id: string, options?: ReadOptions): Promise<CossResult<WebhookEndpoint>>;
-  /**
-   * Changes the URL, description, subscribed event types or `enabled` flag. The signing secret
-   * stays the same (see `rollSecret`), so receivers keep verifying deliveries.
-   */
-  update(id: string, params: UpdateWebhookEndpointParams, options?: ReadOptions): Promise<CossResult<WebhookEndpoint>>;
-  /**
-   * Replaces the endpoint's signing secret; the result carries the new `secret`. Until
-   * `previous_secret_expires_at` (a day by default), deliveries are signed with both secrets, so
-   * `verifyWebhook` accepts them with either: deploy the new one, then let the old one expire.
-   * Never automatically retried (a second roll would stop the original secret at once): after a
-   * lost response, roll again and deploy that secret.
-   */
-  rollSecret(id: string, params?: RollWebhookEndpointSecretParams, options?: RequestOptions): Promise<CossResult<WebhookEndpointWithSecret>>;
-  /**
-   * Queues the endpoint's deliveries that failed since `since` for one more attempt each (at most
-   * 1,000 per call; while `has_more` is true, call again with the same `since`), e.g. after fixing a
-   * receiver that was down. The endpoint must be enabled.
-   */
-  recover(id: string, params: RecoverWebhookEndpointParams, options?: RequestOptions): Promise<CossResult<WebhookEndpointRecovery>>;
-  /** Deletes the endpoint and its delivery log. To pause it instead, update `enabled` to false. */
-  delete(id: string, options?: ReadOptions): Promise<CossResult<DeletedWebhookEndpoint>>;
-}
-//#endregion
-//#region src/client.d.ts
-interface CossOptions {
-  /** Secret API key (`coss_live_…` or `coss_test_…`). Defaults to the `COSS_API_KEY` env variable. */
-  apiKey?: string;
-  /** Defaults to the `COSS_BASE_URL` env variable, then `https://api.coss.com`. */
-  baseUrl?: string;
-  /** Custom `fetch` implementation. Defaults to the global `fetch`. */
-  fetch?: FetchLike;
-  /** Per-attempt timeout in milliseconds. Default `30000`. */
-  timeout?: number;
-  /** Retries for connection errors, timeouts, 409, 429 and 5xx. Default `2`; excludes webhook creation. */
-  maxRetries?: number;
-  /**
-   * The API version (`Coss-Version`) to request. Defaults to `API_VERSION`, the version this SDK's
-   * types describe; requests never fall back to your organization's pinned version.
-   */
-  apiVersion?: ApiVersion;
-  /**
-   * Allow use where a `document` global exists. Off by default because shipping a secret API key
-   * to a browser exposes it to anyone who opens the page.
-   */
-  dangerouslyAllowBrowser?: boolean;
-}
-/**
- * The COSS client. One API key covers every product.
- *
- * ```ts
- * const coss = new Coss({ apiKey: "coss_test_…" });
- * const { data, error } = await coss.email.send({ from, to, subject, html });
- * ```
- */
-export declare class Coss {
-  readonly email: EmailResource;
-  /** Sending domains of the organization (`coss.domains.create`, `.verify`, …). */
-  readonly domains: DomainsResource;
-  /** Webhook endpoints of the API key's environment. */
-  readonly webhookEndpoints: WebhookEndpointsResource;
-  /** The organization's sending reputation (`coss.reputation.get()`). */
-  readonly reputation: ReputationResource;
-  /** The environment's log: API requests, email events, webhook attempts (`coss.logs.list()`). */
-  readonly logs: LogsResource;
-  /** HTTPS endpoints the environment's log is streamed to (`coss.logDrains.create()`). */
-  readonly logDrains: LogDrainsResource;
-  /** The organization's audit log: changes by members, API keys and COSS support (`coss.auditEvents.list()`). */
-  readonly auditEvents: AuditEventsResource;
-  /** Hooks, webhooks as a service: `coss.hooks.messages.send()` delivers to your users' endpoints. */
-  readonly hooks: HooksResource;
-  /** Risk assessments of sign-ups, logins and other events (`coss.risk.assess()`). */
-  readonly risk: RiskResource;
-  /** The organization's plan, usage, invoices and credits (`coss.billing.get()`). */
-  readonly billing: BillingResource;
-  /**
-   * Throws only for programmer errors: no API key, or running in a browser without
-   * `dangerouslyAllowBrowser`. Request failures are returned as `{ data: null, error }`.
-   */
-  constructor(options?: CossOptions);
-}
-//#endregion
+import { $ as RiskUsersResource, $i as ListSuppressionsParams, $n as EnvironmentResource, $r as MailFromStatus, $t as LogsResource, A as BillingEventType, Aa as CossError, Ai as EmailFailure, An as HookApplication, Ar as DmarcNextStepKind, At as RiskLimit, B as ReceivedEmailEventType, Bi as ReactEmailElement, Bn as HookMessage, Br as ListDmarcReportsParams, Bt as RiskReasonCode, C as WebhookEndpointDisabledReason, Ca as ListAuditEventsParams, Ci as Email, Cn as HooksResource, Cr as TrackingDomainsResource, Ct as RiskEmailCheck, D as AccountEventType, Da as NamedResource, Di as EmailEvent, Dn as CreateHookPortalSessionParams, Dr as DmarcCheck, Dt as RiskIpCheck, E as WebhookEventType, Ea as Environment, Ei as EmailBatch, En as CreateHookEventTypeParams, Er as DmarcResource, Et as RiskFeedbackParams, F as EmailWebhookEvent, Fa as API_VERSIONS, Fi as EmailSummary, Fn as HookEndpointDisabledReason, Fr as DmarcReportRecord, Ft as RiskListEntryType, G as RiskWebhookEventData, Gi as SendEmailTemplateParams, Gn as ListHookMessagesParams, Gr as CreateTrackingDomainParams, Gt as UpdateRiskLimitBucketParams, H as ReceivedEmailWebhookEventData, Hi as SendEmailBaseParams, Hn as ListHookApplicationsParams, Hr as BimiStatus, Ht as RiskRuleCondition, I as EmailWebhookEventData, Ia as ApiVersion, Ii as EmailTag, In as HookEndpointRecovery, Ir as DmarcReportSummary, It as RiskListEntryValue, J as RiskLimitBucketsResource, Ji as CreateSuppressionParams, Jn as SendHookMessageParams, Jr as DomainBimi, Jt as ReputationResource, K as WebhookEvent, Ki as TrackingOptions, Kn as RecoverHookEndpointParams, Kr as DeletedDomain, Kt as UpdateRiskRuleParams, L as HookEndpointWebhookEvent, Li as EmailTracking, Ln as HookEndpointSecret, Lr as DmarcSource, Lt as RiskLoginSignals, M as DomainEventType, Ma as CossErrorType, Mi as EmailRecipient, Mn as HookDelivery, Mr as DmarcPolicyPublished, Mt as RiskLimitFailureMode, N as DomainWebhookEvent, Na as CossResult, Ni as EmailRecipientStatus, Nn as HookDeliveryStatus, Nr as DmarcPublishedRecord, Nt as RiskList, O as AccountWebhookEvent, Oa as FetchLike, Oi as EmailEventData, On as DeletedHookApplication, Or as DmarcCheckId, Ot as RiskIpPrivacy, P as DomainWebhookEventData, Pa as API_VERSION, Pi as EmailStatus, Pn as HookEndpoint, Pr as DmarcReport, Pt as RiskListEntry, Q as RiskSettingsResource, Qi as ImportSuppressionsParams, Qn as UpdateHookEventTypeParams, Qr as DomainStatus, Qt as ReputationStatus, R as HookEndpointWebhookEventData, Ri as List, Rn as HookEndpointWithSecret, Rr as DmarcStage, Rt as RiskOutcome, S as WebhookEndpoint, Sa as AuditEvent, Si as AuditEventsResource, Sn as HookPortalResource, Sr as DomainsResource, St as RiskDeviceSignals, T as WebhookEndpointWithSecret, Ta as DeletedApiKey, Ti as EmailAttachmentParams, Tn as CreateHookEndpointParams, Tr as DmarcReportsResource, Tt as RiskEvent, U as RiskEventType, Ui as SendEmailContentParams, Un as ListHookDeliveriesParams, Ur as CreateDomainParams, Ut as RiskRuleField, V as ReceivedEmailWebhookEvent, Vi as RescheduleEmailParams, Vn as HookPortalSession, Vr as BimiIssueCode, Vt as RiskRule, W as RiskWebhookEvent, Wi as SendEmailParams, Wn as ListHookEventTypesParams, Wr as CreateReceivingDomainParams, Wt as RiskSettings, X as RiskResource, Xi as ExportSuppressionsParams, Xn as UpdateHookApplicationParams, Xr as DomainRecordPurpose, Xt as ReputationCheck, Y as RiskListsResource, Yi as DeletedSuppression, Yn as SendHookTestParams, Yr as DomainRecord, Yt as Reputation, Z as RiskRulesResource, Zi as ImportSuppressionEntry, Zn as UpdateHookEndpointParams, Zr as DomainRecordStatus, Zt as ReputationCheckSeverity, _ as RollWebhookEndpointSecretParams, _a as TemplateVariableParams, _i as ListInvoicesParams, _n as HookApplicationsResource, _r as EmailTemplateVersionsResource, _t as RiskContentCategory, a as DeletedWebhookListener, aa as DeletedEmailTemplate, ai as BillingCreditsResource, an as LogDrain, ar as UpdateTrackingRuleParams, at as DeletedRiskLimitBucket, b as WebhookDelivery, ba as UpdateEmailTemplateParams, bi as PlanKey, bn as HookEventTypesResource, br as DedicatedIpPool, bt as RiskDecision, c as WebhookListenerAck, ca as EmailTemplateVersion, ci as Billing, cn as LogDrainBatchStatus, cr as DeletedReceivedEmail, ct as ForgottenRiskUser, d as WebhookEndpointsResource, da as PublishEmailTemplateParams, di as Invoice, dn as LogDrainWithSecret, dr as ReceivedEmail, dt as RiskAssessment, ea as Suppression, ei as ReceivingDomain, en as LogDrainBatchesResource, er as EmailResource, et as AssessRiskParams, f as WebhookDeliveriesResource, fa as TemplateContent, fi as InvoiceLine, fn as UpdateLogDrainParams, fr as ReceivedEmailAttachment, ft as RiskCalibration, g as RecoverWebhookEndpointParams, ga as TemplateVariable, gi as ListCreditsParams, gn as LogSource, gr as VerdictStatus, gt as RiskCheckoutSignals, h as ListWebhookDeliveriesParams, ha as TemplateScalarType, hi as InvoiceSummary, hn as LogLevel, hr as ReceivedEmailVerdicts, ht as RiskCardFunding, i as CreateWebhookListenerParams, ia as CreateEmailTemplateParams, ii as TrackingDomainStatus, in as ListLogDrainBatchesParams, ir as TrackingSettings, it as CreateRiskRuleParams, j as BillingWebhookEvent, ja as CossErrorIssue, ji as EmailLink, jn as HookAttempt, jr as DmarcPolicy, jt as RiskLimitBucket, k as AccountWebhookEventData, ka as RequestOptions, ki as EmailEventType, kn as DeletedHookEndpoint, kr as DmarcNextStep, kt as RiskIpSignals, l as WebhookListenerDelivery, la as ListEmailTemplateVersionsParams, li as BillingHoldReason, ln as LogDrainLine, lr as InboundAddress, lt as ListRiskAssessmentsParams, m as DeletedWebhookEndpoint, ma as TemplateProblem, mi as InvoiceStatus, mn as Log, mr as ReceivedEmailSummary, mt as RiskCaptchaSignals, n as CossOptions, na as SuppressionImport, ni as TrackingDomain, nn as CreateLogDrainParams, nr as DeletedTrackingRule, nt as CreateRiskLimitBucketParams, o as PollWebhookListenerParams, oa as EmailTemplate, oi as BillingInvoicesResource, on as LogDrainAttempt, or as SuppressionResource, ot as DeletedRiskListEntry, p as CreateWebhookEndpointParams, pa as TemplateContentParams, pi as InvoiceLineKind, pn as ListLogsParams, pr as ReceivedEmailStatus, pt as RiskCaptchaProvider, q as RiskAssessmentsResource, qi as CheckSuppressionParams, qn as RollHookEndpointSecretParams, qr as Domain, qt as UpdateRiskSettingsParams, r as WebhookListenersResource, ra as SuppressionReason, ri as TrackingDomainRecord, rn as DeletedLogDrain, rr as TrackingRule, rt as CreateRiskListEntryParams, s as WebhookListener, sa as EmailTemplateReference, si as BillingResource, sn as LogDrainBatch, sr as ReceivedEmailsResource, st as DeletedRiskRule, t as Coss, ta as SuppressionCheck, ti as ReceivingDomainRecord, tn as LogDrainsResource, tr as TrackingResource, tt as CheckRiskLimitParams, u as WebhookListenerPoll, ua as ListEmailTemplatesParams, ui as Credit, un as LogDrainSource, ur as ListReceivedEmailsParams, ut as ListRiskListEntriesParams, v as UpdateWebhookEndpointParams, va as TemplateVariableType, vi as ListUsageParams, vn as HookDeliveriesResource, vr as EmailTemplatesResource, vt as RiskContentClassification, w as WebhookEndpointRecovery, wa as ApiKeyResource, wi as EmailAttachment, wn as CreateHookApplicationParams, wr as ReceivingDomainsResource, wt as RiskEmailSignals, x as WebhookDeliveryStatus, xa as AuditActorType, xi as Usage, xn as HookMessagesResource, xr as DedicatedIpPoolStatus, xt as RiskDegradedSignal, y as WebhookAttempt, ya as UpdateEmailTemplateDraftParams, yi as Meter, yn as HookEndpointsResource, yr as DedicatedIpsResource, yt as RiskContentScores, z as HookOperationalEventType, zi as ListEmailsParams, zn as HookEventType, zr as DomainDmarc, zt as RiskReason } from "./client-avnHVMry.js";
 //#region src/version.d.ts
 /** SDK version, sent in the User-Agent. A test keeps it equal to package.json's `version`. */
-export declare const VERSION = "0.3.0";
+export declare const VERSION = "0.5.0";
 //#endregion
 //#region src/webhooks.d.ts
 /** A webhook request failed verification: reject it (e.g. respond 400). */
@@ -3122,7 +25,7 @@ interface VerifyWebhookOptions {
  * const event = await verifyWebhook(await request.text(), request.headers, process.env.COSS_WEBHOOK_SECRET);
  * ```
  *
- * The same check verifies messages your own users receive from COSS Hooks (`coss.hooks`): pass
+ * The same check verifies messages your own users receive from coss.com Hooks (`coss.hooks`): pass
  * the endpoint's secret and name your payload type, e.g. `verifyWebhook<InvoicePaid>(…)`.
  */
 export declare function verifyWebhook<T = WebhookEvent>(payload: string, headers: WebhookHeaders, secret: string, options?: VerifyWebhookOptions): Promise<T>;
@@ -3139,4 +42,4 @@ export declare function verifyWebhook<T = WebhookEvent>(payload: string, headers
  */
 export declare function verifyLogDrainBatch(payload: string, headers: WebhookHeaders, secret: string, options?: VerifyWebhookOptions): Promise<LogDrainLine[]>;
 //#endregion
-export type { AccountEventType, AccountWebhookEvent, AccountWebhookEventData, ApiVersion, AssessRiskParams, AuditActorType, AuditEvent, AuditEventsResource, Billing, BillingCreditsResource, BillingEventType, BillingHoldReason, BillingInvoicesResource, BillingResource, BillingWebhookEvent, CheckRiskLimitParams, CheckSuppressionParams, CossError, CossErrorIssue, CossErrorType, CossOptions, CossResult, CreateDomainParams, CreateHookApplicationParams, CreateHookEndpointParams, CreateHookEventTypeParams, CreateHookPortalSessionParams, CreateLogDrainParams, CreateReceivingDomainParams, CreateRiskLimitBucketParams, CreateRiskListEntryParams, CreateRiskRuleParams, CreateSuppressionParams, CreateTrackingDomainParams, CreateWebhookEndpointParams, Credit, DeletedDomain, DeletedHookApplication, DeletedHookEndpoint, DeletedLogDrain, DeletedReceivedEmail, DeletedRiskLimitBucket, DeletedRiskListEntry, DeletedRiskRule, DeletedSuppression, DeletedTrackingRule, DeletedWebhookEndpoint, Domain, DomainRecord, DomainRecordPurpose, DomainRecordStatus, DomainStatus, DomainsResource, Email, EmailAttachment, EmailAttachmentParams, EmailBatch, EmailEvent, EmailEventData, EmailEventType, EmailFailure, EmailLink, EmailRecipient, EmailRecipientStatus, EmailResource, EmailStatus, EmailSummary, EmailTag, EmailTracking, EmailWebhookEvent, EmailWebhookEventData, ExportSuppressionsParams, FetchLike, ForgottenRiskUser, HookApplication, HookApplicationsResource, HookAttempt, HookDeliveriesResource, HookDelivery, HookDeliveryStatus, HookEndpoint, HookEndpointDisabledReason, HookEndpointRecovery, HookEndpointSecret, HookEndpointWebhookEvent, HookEndpointWebhookEventData, HookEndpointWithSecret, HookEndpointsResource, HookEventType, HookEventTypesResource, HookMessage, HookMessagesResource, HookOperationalEventType, HookPortalResource, HookPortalSession, HooksResource, ImportSuppressionEntry, ImportSuppressionsParams, InboundAddress, Invoice, InvoiceLine, InvoiceLineKind, InvoiceStatus, InvoiceSummary, List, ListAuditEventsParams, ListCreditsParams, ListEmailsParams, ListHookApplicationsParams, ListHookDeliveriesParams, ListHookEventTypesParams, ListHookMessagesParams, ListInvoicesParams, ListLogDrainBatchesParams, ListLogsParams, ListReceivedEmailsParams, ListRiskAssessmentsParams, ListRiskListEntriesParams, ListSuppressionsParams, ListUsageParams, ListWebhookDeliveriesParams, Log, LogDrain, LogDrainAttempt, LogDrainBatch, LogDrainBatchStatus, LogDrainBatchesResource, LogDrainLine, LogDrainSource, LogDrainWithSecret, LogDrainsResource, LogLevel, LogSource, LogsResource, MailFromStatus, Meter, PlanKey, ReceivedEmail, ReceivedEmailAttachment, ReceivedEmailEventType, ReceivedEmailStatus, ReceivedEmailSummary, ReceivedEmailVerdicts, ReceivedEmailWebhookEvent, ReceivedEmailWebhookEventData, ReceivedEmailsResource, ReceivingDomain, ReceivingDomainRecord, ReceivingDomainsResource, RecoverHookEndpointParams, RecoverWebhookEndpointParams, Reputation, ReputationCheck, ReputationCheckSeverity, ReputationResource, ReputationStatus, RequestOptions, RescheduleEmailParams, RiskAssessment, RiskAssessmentsResource, RiskCalibration, RiskCaptchaProvider, RiskCaptchaSignals, RiskCardFunding, RiskCheckoutSignals, RiskContentCategory, RiskContentClassification, RiskContentScores, RiskDecision, RiskDegradedSignal, RiskDeviceSignals, RiskEmailCheck, RiskEmailSignals, RiskEvent, RiskEventType, RiskFeedbackParams, RiskIpCheck, RiskIpPrivacy, RiskIpSignals, RiskLimit, RiskLimitBucket, RiskLimitBucketsResource, RiskLimitFailureMode, RiskList, RiskListEntry, RiskListEntryType, RiskListEntryValue, RiskListsResource, RiskLoginSignals, RiskOutcome, RiskReason, RiskReasonCode, RiskResource, RiskRule, RiskRuleCondition, RiskRuleField, RiskRulesResource, RiskSettings, RiskSettingsResource, RiskUsersResource, RiskWebhookEvent, RiskWebhookEventData, RollHookEndpointSecretParams, RollWebhookEndpointSecretParams, SendEmailParams, SendHookMessageParams, SendHookTestParams, Suppression, SuppressionCheck, SuppressionImport, SuppressionReason, SuppressionResource, TrackingDomain, TrackingDomainRecord, TrackingDomainStatus, TrackingDomainsResource, TrackingOptions, TrackingResource, TrackingRule, TrackingSettings, UpdateHookApplicationParams, UpdateHookEndpointParams, UpdateHookEventTypeParams, UpdateLogDrainParams, UpdateRiskLimitBucketParams, UpdateRiskRuleParams, UpdateRiskSettingsParams, UpdateTrackingRuleParams, UpdateWebhookEndpointParams, Usage, VerdictStatus, VerifyWebhookOptions, WebhookAttempt, WebhookDeliveriesResource, WebhookDelivery, WebhookDeliveryStatus, WebhookEndpoint, WebhookEndpointDisabledReason, WebhookEndpointRecovery, WebhookEndpointWithSecret, WebhookEndpointsResource, WebhookEvent, WebhookEventType, WebhookHeaders };
+export { API_VERSION, API_VERSIONS, type AccountEventType, type AccountWebhookEvent, type AccountWebhookEventData, type ApiKeyResource, type ApiVersion, type AssessRiskParams, type AuditActorType, type AuditEvent, type AuditEventsResource, type Billing, type BillingCreditsResource, type BillingEventType, type BillingHoldReason, type BillingInvoicesResource, type BillingResource, type BillingWebhookEvent, type BimiIssueCode, type BimiStatus, type CheckRiskLimitParams, type CheckSuppressionParams, Coss, type CossError, type CossErrorIssue, type CossErrorType, type CossOptions, type CossResult, type CreateDomainParams, type CreateEmailTemplateParams, type CreateHookApplicationParams, type CreateHookEndpointParams, type CreateHookEventTypeParams, type CreateHookPortalSessionParams, type CreateLogDrainParams, type CreateReceivingDomainParams, type CreateRiskLimitBucketParams, type CreateRiskListEntryParams, type CreateRiskRuleParams, type CreateSuppressionParams, type CreateTrackingDomainParams, type CreateWebhookEndpointParams, type CreateWebhookListenerParams, type Credit, type DedicatedIpPool, type DedicatedIpPoolStatus, type DedicatedIpsResource, type DeletedApiKey, type DeletedDomain, type DeletedEmailTemplate, type DeletedHookApplication, type DeletedHookEndpoint, type DeletedLogDrain, type DeletedReceivedEmail, type DeletedRiskLimitBucket, type DeletedRiskListEntry, type DeletedRiskRule, type DeletedSuppression, type DeletedTrackingRule, type DeletedWebhookEndpoint, type DeletedWebhookListener, type DmarcCheck, type DmarcCheckId, type DmarcNextStep, type DmarcNextStepKind, type DmarcPolicy, type DmarcPolicyPublished, type DmarcPublishedRecord, type DmarcReport, type DmarcReportRecord, type DmarcReportSummary, type DmarcReportsResource, type DmarcResource, type DmarcSource, type DmarcStage, type Domain, type DomainBimi, type DomainDmarc, type DomainEventType, type DomainRecord, type DomainRecordPurpose, type DomainRecordStatus, type DomainStatus, type DomainWebhookEvent, type DomainWebhookEventData, type DomainsResource, type Email, type EmailAttachment, type EmailAttachmentParams, type EmailBatch, type EmailEvent, type EmailEventData, type EmailEventType, type EmailFailure, type EmailLink, type EmailRecipient, type EmailRecipientStatus, type EmailResource, type EmailStatus, type EmailSummary, type EmailTag, type EmailTemplate, type EmailTemplateReference, type EmailTemplateVersion, type EmailTemplateVersionsResource, type EmailTemplatesResource, type EmailTracking, type EmailWebhookEvent, type EmailWebhookEventData, type Environment, type EnvironmentResource, type ExportSuppressionsParams, type FetchLike, type ForgottenRiskUser, type HookApplication, type HookApplicationsResource, type HookAttempt, type HookDeliveriesResource, type HookDelivery, type HookDeliveryStatus, type HookEndpoint, type HookEndpointDisabledReason, type HookEndpointRecovery, type HookEndpointSecret, type HookEndpointWebhookEvent, type HookEndpointWebhookEventData, type HookEndpointWithSecret, type HookEndpointsResource, type HookEventType, type HookEventTypesResource, type HookMessage, type HookMessagesResource, type HookOperationalEventType, type HookPortalResource, type HookPortalSession, type HooksResource, type ImportSuppressionEntry, type ImportSuppressionsParams, type InboundAddress, type Invoice, type InvoiceLine, type InvoiceLineKind, type InvoiceStatus, type InvoiceSummary, type List, type ListAuditEventsParams, type ListCreditsParams, type ListDmarcReportsParams, type ListEmailTemplateVersionsParams, type ListEmailTemplatesParams, type ListEmailsParams, type ListHookApplicationsParams, type ListHookDeliveriesParams, type ListHookEventTypesParams, type ListHookMessagesParams, type ListInvoicesParams, type ListLogDrainBatchesParams, type ListLogsParams, type ListReceivedEmailsParams, type ListRiskAssessmentsParams, type ListRiskListEntriesParams, type ListSuppressionsParams, type ListUsageParams, type ListWebhookDeliveriesParams, type Log, type LogDrain, type LogDrainAttempt, type LogDrainBatch, type LogDrainBatchStatus, type LogDrainBatchesResource, type LogDrainLine, type LogDrainSource, type LogDrainWithSecret, type LogDrainsResource, type LogLevel, type LogSource, type LogsResource, type MailFromStatus, type Meter, type NamedResource, type PlanKey, type PollWebhookListenerParams, type PublishEmailTemplateParams, type ReactEmailElement, type ReceivedEmail, type ReceivedEmailAttachment, type ReceivedEmailEventType, type ReceivedEmailStatus, type ReceivedEmailSummary, type ReceivedEmailVerdicts, type ReceivedEmailWebhookEvent, type ReceivedEmailWebhookEventData, type ReceivedEmailsResource, type ReceivingDomain, type ReceivingDomainRecord, type ReceivingDomainsResource, type RecoverHookEndpointParams, type RecoverWebhookEndpointParams, type Reputation, type ReputationCheck, type ReputationCheckSeverity, type ReputationResource, type ReputationStatus, type RequestOptions, type RescheduleEmailParams, type RiskAssessment, type RiskAssessmentsResource, type RiskCalibration, type RiskCaptchaProvider, type RiskCaptchaSignals, type RiskCardFunding, type RiskCheckoutSignals, type RiskContentCategory, type RiskContentClassification, type RiskContentScores, type RiskDecision, type RiskDegradedSignal, type RiskDeviceSignals, type RiskEmailCheck, type RiskEmailSignals, type RiskEvent, type RiskEventType, type RiskFeedbackParams, type RiskIpCheck, type RiskIpPrivacy, type RiskIpSignals, type RiskLimit, type RiskLimitBucket, type RiskLimitBucketsResource, type RiskLimitFailureMode, type RiskList, type RiskListEntry, type RiskListEntryType, type RiskListEntryValue, type RiskListsResource, type RiskLoginSignals, type RiskOutcome, type RiskReason, type RiskReasonCode, type RiskResource, type RiskRule, type RiskRuleCondition, type RiskRuleField, type RiskRulesResource, type RiskSettings, type RiskSettingsResource, type RiskUsersResource, type RiskWebhookEvent, type RiskWebhookEventData, type RollHookEndpointSecretParams, type RollWebhookEndpointSecretParams, type SendEmailBaseParams, type SendEmailContentParams, type SendEmailParams, type SendEmailTemplateParams, type SendHookMessageParams, type SendHookTestParams, type Suppression, type SuppressionCheck, type SuppressionImport, type SuppressionReason, type SuppressionResource, type TemplateContent, type TemplateContentParams, type TemplateProblem, type TemplateScalarType, type TemplateVariable, type TemplateVariableParams, type TemplateVariableType, type TrackingDomain, type TrackingDomainRecord, type TrackingDomainStatus, type TrackingDomainsResource, type TrackingOptions, type TrackingResource, type TrackingRule, type TrackingSettings, type UpdateEmailTemplateDraftParams, type UpdateEmailTemplateParams, type UpdateHookApplicationParams, type UpdateHookEndpointParams, type UpdateHookEventTypeParams, type UpdateLogDrainParams, type UpdateRiskLimitBucketParams, type UpdateRiskRuleParams, type UpdateRiskSettingsParams, type UpdateTrackingRuleParams, type UpdateWebhookEndpointParams, type Usage, type VerdictStatus, type VerifyWebhookOptions, type WebhookAttempt, type WebhookDeliveriesResource, type WebhookDelivery, type WebhookDeliveryStatus, type WebhookEndpoint, type WebhookEndpointDisabledReason, type WebhookEndpointRecovery, type WebhookEndpointWithSecret, type WebhookEndpointsResource, type WebhookEvent, type WebhookEventType, type WebhookHeaders, type WebhookListener, type WebhookListenerAck, type WebhookListenerDelivery, type WebhookListenerPoll, type WebhookListenersResource };