coss 0.4.0 → 0.6.0

package/dist/client-D1WNvd8c.js

@@ -0,0 +1,2893 @@
+//#region src/api-version.ts
+/**
+* API versions this SDK knows, oldest first: a hand-written mirror of `API_VERSIONS` in the API
+* (`apps/api/test/sdk-contract.test.ts` keeps them equal).
+*/
+const API_VERSIONS = ["2026-10-10"];
+/** The version this SDK's types describe, sent with every request unless `apiVersion` overrides it. */
+const API_VERSION = "2026-10-10";
+//#endregion
+//#region src/version.ts
+/** SDK version, sent in the User-Agent. A test keeps it equal to package.json's `version`. */
+const VERSION = "0.6.0";
+//#endregion
+//#region src/core/errors.ts
+const API_ERROR_TYPES = /* @__PURE__ */ new Set([
+	"invalid_request_error",
+	"authentication_error",
+	"permission_error",
+	"not_found_error",
+	"idempotency_error",
+	"rate_limit_error",
+	"billing_error",
+	"api_error"
+]);
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseIssues(value) {
+	if (!Array.isArray(value)) return void 0;
+	const issues = [];
+	for (const item of value) if (isRecord(item) && typeof item.path === "string" && typeof item.message === "string") issues.push({
+		path: item.path,
+		message: item.message
+	});
+	return issues;
+}
+/**
+* Maps a non-2xx response to a `CossError`. Bodies that are not the API's error envelope (a proxy's
+* HTML 502, an empty 503) become `api_error` / `unexpected_response`.
+*/
+function errorFromResponse(status, statusText, body, headerRequestId) {
+	let parsed;
+	try {
+		parsed = JSON.parse(body);
+	} catch {
+		parsed = void 0;
+	}
+	const envelope = isRecord(parsed) ? parsed.error : void 0;
+	if (!isRecord(envelope) || typeof envelope.message !== "string") return {
+		type: "api_error",
+		code: "unexpected_response",
+		message: `The coss.com API returned an unexpected HTTP ${status}${statusText ? ` (${statusText})` : ""} response.`,
+		status,
+		request_id: headerRequestId
+	};
+	const error = {
+		type: typeof envelope.type === "string" && API_ERROR_TYPES.has(envelope.type) ? envelope.type : "api_error",
+		code: typeof envelope.code === "string" ? envelope.code : "unknown_error",
+		message: envelope.message,
+		status,
+		request_id: typeof envelope.request_id === "string" ? envelope.request_id : headerRequestId
+	};
+	if (typeof envelope.param === "string") error.param = envelope.param;
+	const issues = parseIssues(envelope.issues);
+	if (issues) error.issues = issues;
+	return error;
+}
+/** Builds an error for a failure that happened on the client (no HTTP response to read). */
+function clientError(type, code, message) {
+	return {
+		type,
+		code,
+		message,
+		status: null,
+		request_id: null
+	};
+}
+//#endregion
+//#region src/core/http.ts
+const INITIAL_RETRY_DELAY_MS = 500;
+const MAX_RETRY_DELAY_MS = 8e3;
+const MAX_RETRY_AFTER_MS = 6e4;
+/** Exponential backoff (500ms, 1s, 2s … capped at 8s) minus up to 25% random jitter. */
+function backoffDelay(retry, random = Math.random) {
+	return Math.min(INITIAL_RETRY_DELAY_MS * 2 ** retry, MAX_RETRY_DELAY_MS) * (1 - random() * .25);
+}
+/** `Retry-After` as milliseconds. Accepts delay-seconds or an HTTP date; `null` if absent/invalid. */
+function parseRetryAfter(value, now = Date.now()) {
+	const trimmed = value?.trim();
+	if (!trimmed) return null;
+	const seconds = Number(trimmed);
+	if (Number.isFinite(seconds)) return seconds >= 0 ? seconds * 1e3 : null;
+	const date = Date.parse(trimmed);
+	return Number.isNaN(date) ? null : Math.max(0, date - now);
+}
+/** 409 (idempotent request still in progress), 429 and 5xx are transient. */
+function isRetryableStatus(status) {
+	return status === 409 || status === 429 || status >= 500;
+}
+function sleep(ms, signal) {
+	return new Promise((resolve) => {
+		if (signal?.aborted) {
+			resolve();
+			return;
+		}
+		const done = () => {
+			clearTimeout(timer);
+			signal?.removeEventListener("abort", done);
+			resolve();
+		};
+		const timer = setTimeout(done, ms);
+		signal?.addEventListener("abort", done, { once: true });
+	});
+}
+/** Error message plus the underlying cause (undici's "fetch failed" hides ECONNREFUSED there). */
+function describe(error) {
+	if (!(error instanceof Error)) return String(error);
+	const cause = error.cause instanceof Error ? error.cause.message : void 0;
+	return cause && cause !== error.message ? `${error.message} (${cause})` : error.message;
+}
+function abortedError() {
+	return clientError("connection_error", "aborted", "The request was aborted.");
+}
+/**
+* The request pipeline shared by all resources: auth + JSON, a per-attempt timeout, retries with
+* backoff, and mapping every failure to a `CossError`. It never throws for API or network errors.
+*/
+var HttpClient = class {
+	#apiKey;
+	#baseUrl;
+	#fetch;
+	#timeout;
+	#maxRetries;
+	#apiVersion;
+	#userAgent;
+	#sleep;
+	constructor(options) {
+		this.#apiKey = options.apiKey;
+		this.#baseUrl = options.baseUrl.replace(/\/+$/, "");
+		this.#fetch = options.fetch;
+		this.#timeout = options.timeout;
+		this.#maxRetries = options.maxRetries;
+		this.#apiVersion = options.apiVersion;
+		this.#userAgent = options.integration ? `coss-typescript/${VERSION} (${options.integration})` : `coss-typescript/${VERSION}`;
+		this.#sleep = options.sleep ?? sleep;
+	}
+	async request(request) {
+		let url = `${this.#baseUrl}${request.path}`;
+		const query = new URLSearchParams();
+		for (const [name, value] of Object.entries(request.query ?? {})) if (value !== void 0) query.set(name, String(value));
+		const search = query.toString();
+		if (search) url += `?${search}`;
+		const headers = {
+			Accept: request.responseType === "text" || request.responseType === "bytes" ? "*/*" : "application/json",
+			Authorization: `Bearer ${this.#apiKey}`,
+			"User-Agent": this.#userAgent,
+			"Coss-Version": this.#apiVersion
+		};
+		let body;
+		if (request.body !== void 0) {
+			headers["Content-Type"] = "application/json";
+			body = JSON.stringify(request.body);
+		}
+		if (request.method === "POST") headers["Idempotency-Key"] = request.idempotencyKey ?? crypto.randomUUID();
+		try {
+			new Headers(headers);
+		} catch (cause) {
+			return {
+				data: null,
+				error: clientError("invalid_request_error", "invalid_header", `Invalid request header: ${describe(cause)}`)
+			};
+		}
+		const init = {
+			method: request.method,
+			headers,
+			body
+		};
+		for (let retry = 0;; retry++) {
+			if (request.signal?.aborted) return {
+				data: null,
+				error: abortedError()
+			};
+			const attempt = await this.#attempt(url, init, request.signal, request.responseType);
+			if (request.retry === false || !attempt.retry || retry >= this.#maxRetries) return attempt.result;
+			const delay = attempt.retryAfterMs ?? backoffDelay(retry);
+			if (delay > MAX_RETRY_AFTER_MS) return attempt.result;
+			await this.#sleep(delay, request.signal);
+		}
+	}
+	async #attempt(url, init, callerSignal, responseType) {
+		const timeoutSignal = AbortSignal.timeout(this.#timeout);
+		const signal = callerSignal ? AbortSignal.any([callerSignal, timeoutSignal]) : timeoutSignal;
+		let response;
+		let text;
+		let bytes = null;
+		try {
+			response = await this.#fetch(url, {
+				...init,
+				signal
+			});
+			if (responseType === "bytes") {
+				bytes = new Uint8Array(await response.arrayBuffer());
+				text = response.ok ? "" : new TextDecoder().decode(bytes);
+			} else text = await response.text();
+		} catch (cause) {
+			if (callerSignal?.aborted) return {
+				result: failed(abortedError()),
+				retry: false,
+				retryAfterMs: null
+			};
+			const timeoutMessage = `Request timed out after ${this.#timeout}ms.`;
+			return {
+				result: failed(timeoutSignal.aborted ? clientError("timeout_error", "request_timeout", timeoutMessage) : clientError("connection_error", "network_error", `Could not reach the coss.com API at ${this.#baseUrl}: ${describe(cause)}`)),
+				retry: true,
+				retryAfterMs: null
+			};
+		}
+		const requestId = response.headers.get("x-request-id");
+		if (!response.ok) return {
+			result: failed(errorFromResponse(response.status, response.statusText, text, requestId)),
+			retry: isRetryableStatus(response.status),
+			retryAfterMs: parseRetryAfter(response.headers.get("retry-after"))
+		};
+		if (responseType === "text") return {
+			result: {
+				data: text,
+				error: null
+			},
+			retry: false,
+			retryAfterMs: null
+		};
+		if (responseType === "bytes") return {
+			result: {
+				data: bytes,
+				error: null
+			},
+			retry: false,
+			retryAfterMs: null
+		};
+		try {
+			return {
+				result: {
+					data: JSON.parse(text),
+					error: null
+				},
+				retry: false,
+				retryAfterMs: null
+			};
+		} catch {
+			return {
+				result: failed({
+					type: "api_error",
+					code: "invalid_response",
+					message: `The coss.com API returned an HTTP ${response.status} response that is not valid JSON.`,
+					status: response.status,
+					request_id: requestId
+				}),
+				retry: false,
+				retryAfterMs: null
+			};
+		}
+	}
+};
+function failed(error) {
+	return {
+		data: null,
+		error
+	};
+}
+//#endregion
+//#region src/resources/api-key.ts
+/** `coss.apiKey`: the API key the client was created with. */
+var ApiKeyResource = class {
+	#http;
+	/** @internal Use `new Coss().apiKey`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Revokes the client's own API key, at once: every later request with it fails. */
+	revoke(options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: "/v1/api_key",
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/list-query.ts
+/** One query parameter: lists are comma-joined (an empty one is left out), dates ISO 8601. */
+function joined(value) {
+	if (value === void 0) return void 0;
+	if (value instanceof Date) return value.toISOString();
+	if (Array.isArray(value)) return value.length === 0 ? void 0 : value.join(",");
+	return String(value);
+}
+/** The query string of a list method whose filters accept arrays and dates. */
+function listQuery(params) {
+	const query = {};
+	for (const [name, value] of Object.entries(params)) query[name] = joined(value);
+	return query;
+}
+//#endregion
+//#region src/resources/audit-events.ts
+/**
+* `coss.auditEvents`: the organization's audit log, newest first: changes made by members, API
+* keys and coss.com support. Organization-wide, whichever environment the key belongs to.
+*/
+var AuditEventsResource = class {
+	#http;
+	/** @internal Use `new Coss().auditEvents`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Lists audit events, newest first. Pass the last `id` as `after` while `has_more` is true. */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/audit_events",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	/** Retrieves one audit event. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/audit_events/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/billing.ts
+/** `coss.billing.invoices`: the organization's invoices, newest first. */
+var BillingInvoicesResource = class {
+	#http;
+	/** @internal Use `new Coss().billing.invoices`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Lists invoices (without lines). Pass the last `id` as `after` while `has_more` is true. */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/billing/invoices",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	/** Retrieves one invoice with its lines. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/billing/invoices/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.billing.credits`: the organization's credits and what's left of them. */
+var BillingCreditsResource = class {
+	#http;
+	/** @internal Use `new Coss().billing.credits`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Lists credits, newest first (usable ones by default). */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/billing/credits",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+};
+/**
+* `coss.billing`: the organization's plan, usage, invoices and credits (read only; plan changes
+* are made in the dashboard). Organization-wide, whichever environment the key belongs to.
+*/
+var BillingResource = class {
+	#http;
+	invoices;
+	credits;
+	/** @internal Use `new Coss().billing`. */
+	constructor(http) {
+		this.#http = http;
+		this.invoices = new BillingInvoicesResource(http);
+		this.credits = new BillingCreditsResource(http);
+	}
+	/** The plan, the current month's usage and estimate, standing and what the plan includes. */
+	get(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/billing",
+			signal: options?.signal
+		});
+	}
+	/** Billable usage per meter and bucket (the current month, by day, by default), oldest first. */
+	usage(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/billing/usage",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/dmarc.ts
+const dmarcPath = (domainId) => `/v1/domains/${encodeURIComponent(domainId)}/dmarc`;
+/** `coss.domains.dmarc.reports`: the aggregate reports received about a domain. */
+var DmarcReportsResource = class {
+	#http;
+	/** @internal Use `new Coss().domains.dmarc.reports`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Lists the domain's reports, newest first, without their rows. */
+	list(domainId, params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${dmarcPath(domainId)}/reports`,
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	/** Retrieves one report with its rows. */
+	get(domainId, reportId, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${dmarcPath(domainId)}/reports/${encodeURIComponent(reportId)}`,
+			signal: options?.signal
+		});
+	}
+};
+/**
+* `coss.domains.dmarc`: a domain's DMARC record, the guided path from `p=none` to `p=reject`, and
+* the aggregate reports mailbox providers send to its `report_address`.
+*/
+var DmarcResource = class {
+	#http;
+	/** The domain's aggregate reports. */
+	reports;
+	/** @internal Use `new Coss().domains.dmarc`. */
+	constructor(http) {
+		this.#http = http;
+		this.reports = new DmarcReportsResource(http);
+	}
+	/**
+	* The domain's DMARC status: its published record, the record to publish next and whether
+	* the last 14 days of reports say that is safe (`ready`), and a summary of those reports.
+	*/
+	get(domainId, options) {
+		return this.#http.request({
+			method: "GET",
+			path: dmarcPath(domainId),
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/receiving-domains.ts
+const receivingPath = (domainId) => `/v1/domains/${encodeURIComponent(domainId)}/receiving`;
+/**
+* `coss.domains.receiving`: a domain's receiving hostname (the domain itself or a subdomain, e.g.
+* `inbound.acme.com`). Email sent to any address at it is received by the API key's environment.
+*/
+var ReceivingDomainsResource = class {
+	#http;
+	/** @internal Use `new Coss().domains.receiving`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/**
+	* Starts receiving at a hostname of the domain, for the API key's environment, and returns the
+	* domain with the MX record to publish in `data.receiving.record`.
+	*/
+	create(domainId, params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: receivingPath(domainId),
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Stops receiving at the domain's hostname. Emails already received are kept. */
+	delete(domainId, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: receivingPath(domainId),
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/tracking-domains.ts
+const trackingPath = (domainId) => `/v1/domains/${encodeURIComponent(domainId)}/tracking`;
+/**
+* `coss.domains.tracking`: a domain's custom tracking domain (e.g. `links.acme.com`). Open pixels
+* and click redirects of emails sent from the domain use it while it is `active`.
+*/
+var TrackingDomainsResource = class {
+	#http;
+	/** @internal Use `new Coss().domains.tracking`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/**
+	* Sets up a subdomain of the domain as its tracking domain and returns the domain, with the
+	* CNAME to publish in `data.tracking.record`. Setup gives up after 72 hours.
+	*/
+	create(domainId, params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: trackingPath(domainId),
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Removes the domain's tracking domain. Later emails use the default tracking host; links in
+	* emails already sent through it stop working.
+	*/
+	delete(domainId, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: trackingPath(domainId),
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/domains.ts
+/**
+* `coss.domains`: the domains live (`coss_live_…`) keys may send from. Domains belong to the
+* organization, so every API key of the organization sees the same ones.
+*/
+var DomainsResource = class {
+	#http;
+	/** Each domain's custom tracking domain: add and remove it. */
+	tracking;
+	/** Each domain's receiving hostname: start and stop receiving email at it. */
+	receiving;
+	/** Each domain's DMARC status, guidance and aggregate reports. */
+	dmarc;
+	/** @internal Use `new Coss().domains`. */
+	constructor(http) {
+		this.#http = http;
+		this.tracking = new TrackingDomainsResource(http);
+		this.receiving = new ReceivingDomainsResource(http);
+		this.dmarc = new DmarcResource(http);
+	}
+	/**
+	* Adds a domain and returns the DNS records to publish (`data.records`). The records are
+	* checked in the background; verification gives up after 72 hours.
+	*/
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/domains",
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Lists the organization's domains, ordered by name. */
+	list(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/domains",
+			signal: options?.signal
+		});
+	}
+	/** Retrieves a domain with the result of the last DNS check. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/domains/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Checks the domain's records now instead of waiting for the next background check. A `failed`
+	* domain starts verification over with fresh DKIM records, which have to be published again.
+	* Its tracking domain, if any, is checked too.
+	*/
+	verify(id, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/domains/${encodeURIComponent(id)}/verify`,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Removes the domain. Emails already sent are unaffected; live keys can no longer use it. */
+	delete(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/domains/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/react.ts
+/**
+* React Email: a send's `react` is rendered into `html` (and `text`, unless given) by
+* `@react-email/render`, an optional peer dependency imported only when a send has `react`, so the
+* SDK itself keeps zero dependencies.
+*/
+let renderer;
+/** Imports `@react-email/render` once; `null` when it isn't installed. */
+function loadReactEmailRenderer() {
+	renderer ??= (async () => {
+		try {
+			return await import("@react-email/render");
+		} catch {
+			return null;
+		}
+	})();
+	return renderer;
+}
+/**
+* Turns `react` into `html` and `text`; params without it pass through. Rendering mistakes come back
+* as `invalid_request_error`s naming `param`, like the API's validation errors, never thrown.
+*/
+async function renderReactEmail(params, param, load = loadReactEmailRenderer) {
+	const { react, ...body } = params;
+	if (react === void 0) return {
+		body,
+		error: null
+	};
+	if (body.template_id !== void 0) return failure("validation_error", "Pass either `react` or `template_id`, not both.", param);
+	if (body.html !== void 0) return failure("validation_error", "Pass either `react` or `html`, not both.", param);
+	const renderer = await load();
+	if (!renderer) return failure("react_renderer_missing", "Sending `react` needs the `@react-email/render` package: install it next to `coss`.", param);
+	try {
+		const html = await renderer.render(react);
+		if (body.text !== void 0) return {
+			body: {
+				...body,
+				html
+			},
+			error: null
+		};
+		const text = renderer.toPlainText ? renderer.toPlainText(html) : await renderer.render(react, { plainText: true });
+		return {
+			body: {
+				...body,
+				html,
+				text
+			},
+			error: null
+		};
+	} catch (cause) {
+		return failure("react_render_failed", `Rendering \`react\` failed: ${cause instanceof Error ? cause.message : String(cause)}`, param);
+	}
+}
+function failure(code, message, param) {
+	return {
+		body: null,
+		error: {
+			...clientError("invalid_request_error", code, message),
+			param
+		}
+	};
+}
+//#endregion
+//#region src/resources/broadcasts.ts
+const path$1 = (id) => encodeURIComponent(id);
+/**
+* `coss.email.broadcasts`: one marketing email to an audience or a segment, sent to each
+* subscribed contact at the plan's marketing rate, with per-broadcast stats.
+*/
+var BroadcastsResource = class {
+	#http;
+	/** @internal Use `new Coss().email.broadcasts`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Newest first, with their stats. */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/broadcasts",
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+	/**
+	* Creates a draft, or with `send` / `scheduled_at` a broadcast that starts sending. Retries
+	* reuse one `Idempotency-Key`, so a retried create never makes two.
+	*/
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/broadcasts",
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/broadcasts/${path$1(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** Changes a draft. */
+	update(id, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: `/v1/broadcasts/${path$1(id)}`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Deletes a draft (or a broadcast canceled before it sent anything). */
+	remove(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/broadcasts/${path$1(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** Starts sending a draft, now or at `scheduled_at`. */
+	send(id, params = {}, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/broadcasts/${path$1(id)}/send`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Stops it for good; emails not yet handed to the provider are dropped. */
+	cancel(id, options) {
+		return this.#action(id, "cancel", options);
+	}
+	pause(id, options) {
+		return this.#action(id, "pause", options);
+	}
+	/** Resumes a paused broadcast where it stopped. */
+	resume(id, options) {
+		return this.#action(id, "resume", options);
+	}
+	/**
+	* Sends its content to up to 5 addresses (subject prefixed `[Test]`). Not retried
+	* automatically: test emails are not deduplicated.
+	*/
+	test(id, params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/broadcasts/${path$1(id)}/test`,
+			body: params,
+			retry: false,
+			signal: options?.signal
+		});
+	}
+	/** The emails made so far, one per contact, newest first. */
+	listEmails(id, params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/broadcasts/${path$1(id)}/emails`,
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+	#action(id, action, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/broadcasts/${path$1(id)}/${action}`,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/contacts.ts
+/** The API's per-request maximum for imports. */
+const IMPORT_BATCH_SIZE$1 = 1e3;
+const path = (...parts) => parts.map(encodeURIComponent).join("/");
+/** `coss.email.contacts.properties`: the environment's custom contact properties. */
+var ContactPropertiesResource = class {
+	#http;
+	/** @internal Use `new Coss().email.contacts.properties`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Every property (at most 50), by key. */
+	list(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/contact_properties",
+			signal: options?.signal
+		});
+	}
+	/** Defines a property contacts can have; its key and type can't change. */
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/contact_properties",
+			retry: false,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/contact_properties/${path(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** Changes the fallback templates use for contacts without a value. */
+	update(id, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: `/v1/contact_properties/${path(id)}`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Deletes the property and its values; refused while a segment filters on it. */
+	remove(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/contact_properties/${path(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+/**
+* `coss.email.contacts`: the people marketing email goes to, in the API key's environment, with
+* custom properties and consent (overall, and per topic). Methods taking an id also take the
+* contact's address.
+*/
+var ContactsResource = class {
+	#http;
+	/** Custom contact properties. */
+	properties;
+	/** @internal Use `new Coss().email.contacts`. */
+	constructor(http) {
+		this.#http = http;
+		this.properties = new ContactPropertiesResource(http);
+	}
+	/**
+	* Creates the contact with this address, or updates the existing one (names replaced,
+	* properties merged, audiences added, topic choices recorded; `status` only when passed).
+	* Safe to retry.
+	*/
+	upsert(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/contacts",
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Lists contacts, newest first. Pass the last `id` as `after` while `has_more` is true. */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/contacts",
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+	get(idOrEmail, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/contacts/${path(idOrEmail)}`,
+			signal: options?.signal
+		});
+	}
+	update(idOrEmail, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: `/v1/contacts/${path(idOrEmail)}`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Deletes the contact (its suppressions stay: they are about the address). */
+	remove(idOrEmail, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/contacts/${path(idOrEmail)}`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Creates or updates many contacts, 1,000 per request. Invalid entries are skipped and reported
+	* in `invalid`; an import never re-subscribes an unsubscribed contact. If a request fails, the
+	* earlier batches stay imported: importing everything again is safe.
+	*/
+	async import(params, options) {
+		const total = {
+			object: "contact_import",
+			created: 0,
+			updated: 0,
+			kept_unsubscribed: 0,
+			invalid: []
+		};
+		for (let start = 0; start === 0 || start < params.contacts.length;) {
+			const result = await this.#http.request({
+				method: "POST",
+				path: "/v1/contacts/import",
+				body: {
+					contacts: params.contacts.slice(start, start + IMPORT_BATCH_SIZE$1),
+					...params.audience_id === void 0 ? {} : { audience_id: params.audience_id }
+				},
+				signal: options?.signal
+			});
+			if (result.error) return result;
+			total.created += result.data.created;
+			total.updated += result.data.updated;
+			total.kept_unsubscribed += result.data.kept_unsubscribed;
+			for (const entry of result.data.invalid) total.invalid.push({
+				...entry,
+				index: entry.index + start
+			});
+			start += IMPORT_BATCH_SIZE$1;
+		}
+		return {
+			data: total,
+			error: null
+		};
+	}
+	/** The contacts as CSV (one column per custom property), which `import` accepts again. */
+	export(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/contacts/export",
+			query: { ...params },
+			responseType: "text",
+			signal: options?.signal
+		});
+	}
+	/** Every topic with the contact's choice and whether its emails reach them. */
+	getTopics(idOrEmail, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/contacts/${path(idOrEmail)}/topics`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Sends a pending contact (double opt-in) its confirmation email again: at most once a day and
+	* three times before it confirms (`status` says what happened).
+	*/
+	resendConfirmation(idOrEmail, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/contacts/${path(idOrEmail)}/confirmation`,
+			signal: options?.signal
+		});
+	}
+	/** The contact's preference center and unsubscribe links, for emails you build yourself. */
+	createPreferenceLinks(idOrEmail, params = {}, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/contacts/${path(idOrEmail)}/preference_links`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Records the contact's choices for some topics. */
+	updateTopics(idOrEmail, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: `/v1/contacts/${path(idOrEmail)}/topics`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.email.audiences`: static lists of contacts. */
+var AudiencesResource = class {
+	#http;
+	/** @internal Use `new Coss().email.audiences`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/audiences",
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/audiences",
+			retry: false,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/audiences/${path(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** Renames the audience. */
+	update(id, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: `/v1/audiences/${path(id)}`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Deletes the audience (its contacts stay); refused while a segment filters on it. */
+	remove(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/audiences/${path(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** The audience's members, newest first. */
+	listContacts(id, params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/audiences/${path(id)}/contacts`,
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+	/** Adds existing contacts, by id or address (up to 1,000 per call). */
+	addContacts(id, params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/audiences/${path(id)}/contacts`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	removeContact(id, contactIdOrEmail, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/audiences/${path(id)}/contacts/${path(contactIdOrEmail)}`,
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.email.segments`: filters over the environment's contacts, always current. */
+var SegmentsResource = class {
+	#http;
+	/** @internal Use `new Coss().email.segments`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/segments",
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/segments",
+			retry: false,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/segments/${path(id)}`,
+			signal: options?.signal
+		});
+	}
+	update(id, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: `/v1/segments/${path(id)}`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	remove(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/segments/${path(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** The contacts the filter matches now, whatever their status, newest first. */
+	listContacts(id, params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/segments/${path(id)}/contacts`,
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.email.topics`: what contacts subscribe to (a topic's key is a send's `category`). */
+var TopicsResource = class {
+	#http;
+	/** @internal Use `new Coss().email.topics`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/topics",
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/topics",
+			retry: false,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/topics/${path(id)}`,
+			signal: options?.signal
+		});
+	}
+	update(id, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: `/v1/topics/${path(id)}`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Deletes the topic and every contact's choice for it. */
+	remove(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/topics/${path(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.email.marketingSettings`: the sender name and postal address of marketing email. */
+var MarketingSettingsResource = class {
+	#http;
+	/** @internal Use `new Coss().email.marketingSettings`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	get(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/marketing_settings",
+			signal: options?.signal
+		});
+	}
+	/** Changes the fields given (`null` clears one). */
+	update(params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: "/v1/marketing_settings",
+			body: params,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/dedicated-ips.ts
+/**
+* `coss.email.dedicatedIps`: the organization's own sending IPs (the Dedicated IPs add-on),
+* managed and warmed up automatically.
+*/
+var DedicatedIpsResource = class {
+	#http;
+	/** @internal Use `new Coss().email.dedicatedIps`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** The pool's status and IPs (`not_enabled` without the add-on). */
+	get(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/dedicated_ips",
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/email-templates.ts
+const templatePath = (template) => `/v1/email_templates/${encodeURIComponent(template)}`;
+/** `coss.email.templates.versions`: a template's published versions. */
+var EmailTemplateVersionsResource = class {
+	#http;
+	/** @internal Use `new Coss().email.templates.versions`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Published versions, newest first. */
+	list(template, params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${templatePath(template)}/versions`,
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	get(template, version, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${templatePath(template)}/versions/${version}`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Replaces the draft with this version's content; publish the draft to send it again. Never
+	* automatically retried: every restore is a new draft revision, so a repeat could overwrite an
+	* edit saved in between.
+	*/
+	restore(template, version, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `${templatePath(template)}/versions/${version}/restore`,
+			retry: false,
+			signal: options?.signal
+		});
+	}
+};
+/**
+* `coss.email.templates`: the environment's email templates. Templates are addressed by id or
+* alias. Edit the draft, publish it, then send with `coss.email.send({ template_id, variables })`.
+*/
+var EmailTemplatesResource = class {
+	#http;
+	/** Published versions. */
+	versions;
+	/** @internal Use `new Coss().email.templates`. */
+	constructor(http) {
+		this.#http = http;
+		this.versions = new EmailTemplateVersionsResource(http);
+	}
+	/**
+	* Creates a template and its draft. Never automatically retried: the API doesn't deduplicate it
+	* (a template with an `alias` can't be created twice, though).
+	*/
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/email_templates",
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** The environment's templates, newest first. */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/email_templates",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	get(template, options) {
+		return this.#http.request({
+			method: "GET",
+			path: templatePath(template),
+			signal: options?.signal
+		});
+	}
+	/** Changes its name, alias or description. */
+	update(template, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: templatePath(template),
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Deletes it with every version. Emails already sent keep their content. */
+	delete(template, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: templatePath(template),
+			signal: options?.signal
+		});
+	}
+	/** The draft, with `problems` that keep it from being published. */
+	getDraft(template, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${templatePath(template)}/draft`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Replaces the whole draft. Sends keep using the published version until you publish. Never
+	* automatically retried: every save is a new revision, so a repeat whose first attempt was saved
+	* would fail with `template_revision_mismatch` (or, without `revision`, overwrite an edit saved
+	* in between). Read the draft again before retrying.
+	*/
+	updateDraft(template, params, options) {
+		return this.#http.request({
+			method: "PUT",
+			path: `${templatePath(template)}/draft`,
+			retry: false,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Publishes the draft as the next version, which sends use from then on. Automatically retried
+	* only with a `revision`: a draft without changes since the last publish returns that version,
+	* and one saved again since is refused. Without it, a retry could publish someone else's newer
+	* edits as yet another version.
+	*/
+	publish(template, params = {}, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `${templatePath(template)}/publish`,
+			retry: params.revision !== void 0,
+			body: params,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/received-emails.ts
+const emailPath = (id) => `/v1/received_emails/${encodeURIComponent(id)}`;
+/**
+* `coss.email.received`: emails received by the API key's environment, at its inbound address
+* (`address()`) or at a receiving domain (`coss.domains.receiving`). An `email.received` webhook
+* announces each one.
+*/
+var ReceivedEmailsResource = class {
+	#http;
+	/** @internal Use `new Coss().email.received`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Lists received emails, newest first, without bodies. Pass the last `id` as `after` while `has_more` is true. */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/received_emails",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	/** Retrieves a received email with its headers and bodies. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: emailPath(id),
+			signal: options?.signal
+		});
+	}
+	/** The whole message as received (`message/rfc822` bytes). */
+	getRaw(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${emailPath(id)}/raw`,
+			responseType: "bytes",
+			signal: options?.signal
+		});
+	}
+	/** An attachment's bytes (untrusted: its declared type is the attachment's `content_type`). */
+	getAttachment(id, attachmentId, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${emailPath(id)}/attachments/${encodeURIComponent(attachmentId)}`,
+			responseType: "bytes",
+			signal: options?.signal
+		});
+	}
+	/**
+	* The environment's inbound domain: email to any address at it (`support@<domain>`) is
+	* received, with no DNS setup.
+	*/
+	address(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/received_emails/address",
+			signal: options?.signal
+		});
+	}
+	/** Deletes a received email with its raw message and attachments right away. */
+	delete(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: emailPath(id),
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/suppressions.ts
+/** The API's per-request maximum for imports. */
+const IMPORT_BATCH_SIZE = 1e3;
+/**
+* `coss.email.suppressions`: the suppression list of the API key's environment. Sends skip
+* suppressed recipients; permanent bounces and complaints are added automatically.
+*/
+var SuppressionResource = class {
+	#http;
+	/** @internal Use `new Coss().email.suppressions`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/**
+	* Suppresses an address for every email (`scope: "*"`, the default) or for one category, e.g.
+	* when a recipient unsubscribes. Returns the existing entry if there already is one.
+	*/
+	add(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/suppressions",
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Adds many entries at once (reason `import`), 1,000 per request. Invalid entries are skipped
+	* and reported in `invalid`; entries already on the list count as `existing`. If a request
+	* fails, the earlier batches stay imported: importing everything again is safe.
+	*/
+	async import(params, options) {
+		const total = {
+			object: "suppression_import",
+			created: 0,
+			existing: 0,
+			invalid: []
+		};
+		for (let start = 0; start === 0 || start < params.suppressions.length;) {
+			const batch = params.suppressions.slice(start, start + IMPORT_BATCH_SIZE);
+			const result = await this.#http.request({
+				method: "POST",
+				path: "/v1/suppressions/import",
+				body: { suppressions: batch },
+				signal: options?.signal
+			});
+			if (result.error) return result;
+			total.created += result.data.created;
+			total.existing += result.data.existing;
+			for (const entry of result.data.invalid) total.invalid.push({
+				...entry,
+				index: entry.index + start
+			});
+			start += IMPORT_BATCH_SIZE;
+		}
+		return {
+			data: total,
+			error: null
+		};
+	}
+	/**
+	* The whole list as CSV (`address,scope,reason,created_at,email_id,id`, oldest first), which
+	* `import` (or the dashboard) accepts again.
+	*/
+	export(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/suppressions/export",
+			query: { ...params },
+			responseType: "text",
+			signal: options?.signal
+		});
+	}
+	/** Lists entries, newest first. Pass the last `id` as `after` while `has_more` is true. */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/suppressions",
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+	/** Whether a send to `address` (with `category`, if given) would skip it. */
+	check(params, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/suppressions/check",
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+	/** Retrieves one entry. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/suppressions/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** Removes an entry, so later sends reach the address again (e.g. when a recipient resubscribes). */
+	remove(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/suppressions/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/tracking.ts
+const categoryPath = (category) => `/v1/tracking_settings/categories/${encodeURIComponent(category)}`;
+/**
+* `coss.email.tracking`: which emails of the API key's environment have their opens and clicks
+* tracked and get one-click unsubscribe headers. Emails keep the settings that applied when they
+* were sent; a send's own `tracking` option wins over them.
+*/
+var TrackingResource = class {
+	#http;
+	/** @internal Use `new Coss().email.tracking`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** The environment default and the category rules. */
+	get(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/tracking_settings",
+			signal: options?.signal
+		});
+	}
+	/**
+	* Sets the environment default, which applies to emails without a rule for their category.
+	* Fields left out keep their value; a new default starts with both off.
+	*/
+	updateDefault(params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: "/v1/tracking_settings/default",
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Removes the environment default: emails without a category rule are then not tracked. */
+	removeDefault(options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: "/v1/tracking_settings/default",
+			signal: options?.signal
+		});
+	}
+	/**
+	* Sets the rule for emails sent with `category`, which wins over the default. Fields left out
+	* keep their value; a new rule starts with both off.
+	*/
+	updateCategory(category, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: categoryPath(category),
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Removes a category's rule: its emails follow the environment default again. */
+	removeCategory(category, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: categoryPath(category),
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/email.ts
+/** `coss.email`: transactional email. */
+var EmailResource = class {
+	#http;
+	/** The environment's suppression list. */
+	suppressions;
+	/** The environment's open and click tracking settings. */
+	tracking;
+	/** Emails the environment received. */
+	received;
+	/** The environment's email templates. */
+	templates;
+	/** The organization's dedicated IPs. */
+	dedicatedIps;
+	/** The environment's contacts, with custom properties and consent. */
+	contacts;
+	/** Static lists of contacts. */
+	audiences;
+	/** Filters over the contacts. */
+	segments;
+	/** What contacts subscribe to. */
+	topics;
+	/** The sender name and postal address of marketing email. */
+	marketingSettings;
+	/** Marketing emails to an audience or a segment. */
+	broadcasts;
+	/** @internal Use `new Coss().email`. */
+	constructor(http) {
+		this.#http = http;
+		this.suppressions = new SuppressionResource(http);
+		this.tracking = new TrackingResource(http);
+		this.received = new ReceivedEmailsResource(http);
+		this.templates = new EmailTemplatesResource(http);
+		this.dedicatedIps = new DedicatedIpsResource(http);
+		this.contacts = new ContactsResource(http);
+		this.audiences = new AudiencesResource(http);
+		this.segments = new SegmentsResource(http);
+		this.topics = new TopicsResource(http);
+		this.marketingSettings = new MarketingSettingsResource(http);
+		this.broadcasts = new BroadcastsResource(http);
+	}
+	/**
+	* Sends an email, with its own subject and body or from a published template (`template_id`
+	* and `variables`). It is returned `queued` and handed to the delivery provider moments later:
+	* `get` it or listen for the `email.sent` / `email.failed` webhooks for the outcome. Safe to
+	* retry: the request always carries an `Idempotency-Key` (yours, or a generated one reused
+	* across automatic retries), so the API never sends it twice. A `react` component is rendered
+	* once, before the first attempt.
+	*/
+	async send(params, options) {
+		const { body, error } = await renderReactEmail(params, "react");
+		if (error) return {
+			data: null,
+			error
+		};
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/emails",
+			body,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Sends up to 100 emails in one request, each as `send` would. The batch is all or nothing: if
+	* any email is invalid (the error's `issues` name it, e.g. `emails.3.to`), none is sent. Its
+	* recipients count against the send quota together. Safe to retry: one `Idempotency-Key` covers
+	* the whole batch. Larger lists need several calls, each with its own key.
+	*/
+	async sendBatch(emails, options) {
+		const rendered = await Promise.all(emails.map((email, index) => renderReactEmail(email, `emails.${index}.react`)));
+		const bodies = [];
+		for (const { body, error } of rendered) {
+			if (error) return {
+				data: null,
+				error
+			};
+			bodies.push(body);
+		}
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/emails/batch",
+			body: { emails: bodies },
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Retrieves a batch sent by `sendBatch`, with its emails' current statuses in request order. */
+	getBatch(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/emails/batch/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** Retrieves an email sent from the same environment as the API key. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/emails/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Lists emails sent from the same environment as the API key, newest first and without their
+	* content (`get` one for `html`, `text`, `headers` and `attachments`). Pass the last `id` as
+	* `after` while `has_more` is true.
+	*/
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/emails",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	/**
+	* Cancels a scheduled email. Canceling an already canceled email returns it; any other email
+	* fails with `email_not_cancelable`.
+	*/
+	cancel(id, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/emails/${encodeURIComponent(id)}/cancel`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Moves a scheduled email to a new time and records an `email.rescheduled` event. The time it
+	* already has returns it unchanged; an email that is no longer scheduled fails with
+	* `email_not_reschedulable`.
+	*/
+	reschedule(id, params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/emails/${encodeURIComponent(id)}/reschedule`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Lists an email's delivery events, oldest first. */
+	listEvents(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/emails/${encodeURIComponent(id)}/events`,
+			signal: options?.signal
+		});
+	}
+	/** Lists the links tracked for clicks in an email, in document order, with click counts. */
+	listLinks(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/emails/${encodeURIComponent(id)}/links`,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/environment.ts
+/** `coss.environment`: which environment, project and organization the API key belongs to. */
+var EnvironmentResource = class {
+	#http;
+	/** @internal Use `new Coss().environment`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** The API key's environment, its project and organization, and the key itself. */
+	get(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/environment",
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/hooks.ts
+const segment = encodeURIComponent;
+const applicationPath = (application) => `/v1/hooks/applications/${segment(application)}`;
+const endpointPath = (application, id) => `${applicationPath(application)}/endpoints/${segment(id)}`;
+/** `coss.hooks.applications`: your customers, each with their own endpoints and portal. */
+var HookApplicationsResource = class {
+	#http;
+	/** @internal Use `new Coss().hooks.applications`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Creates an application. Never automatically retried (the API does not deduplicate it). */
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/hooks/applications",
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Lists the environment's applications, newest first. */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/hooks/applications",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	/** Retrieves an application by its id or uid. */
+	get(application, options) {
+		return this.#http.request({
+			method: "GET",
+			path: applicationPath(application),
+			signal: options?.signal
+		});
+	}
+	update(application, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: applicationPath(application),
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Deletes the application with its endpoints and portal sessions. */
+	delete(application, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: applicationPath(application),
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.hooks.eventTypes`: the catalog of messages you send, which your users subscribe from. */
+var HookEventTypesResource = class {
+	#http;
+	/** @internal Use `new Coss().hooks.eventTypes`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Creates an event type. Never automatically retried (a retry would find it existing). */
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/hooks/event_types",
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Lists event types by name (archived ones only with `include_archived`). */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/hooks/event_types",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	get(name, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/hooks/event_types/${segment(name)}`,
+			signal: options?.signal
+		});
+	}
+	/** Changes its description, schema or examples, or archives or restores it. */
+	update(name, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: `/v1/hooks/event_types/${segment(name)}`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Archives it: hidden from the portal and new subscriptions. */
+	archive(name, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/hooks/event_types/${segment(name)}`,
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.hooks.endpoints`: an application's endpoints (usually added by its users in the portal). */
+var HookEndpointsResource = class {
+	#http;
+	/** @internal Use `new Coss().hooks.endpoints`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Creates an endpoint; the result carries its secret. Never automatically retried. */
+	create(application, params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `${applicationPath(application)}/endpoints`,
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	list(application, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${applicationPath(application)}/endpoints`,
+			signal: options?.signal
+		});
+	}
+	get(application, id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: endpointPath(application, id),
+			signal: options?.signal
+		});
+	}
+	update(application, id, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: endpointPath(application, id),
+			body: params,
+			signal: options?.signal
+		});
+	}
+	delete(application, id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: endpointPath(application, id),
+			signal: options?.signal
+		});
+	}
+	/** The endpoint's current signing secret. */
+	getSecret(application, id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${endpointPath(application, id)}/secret`,
+			signal: options?.signal
+		});
+	}
+	/** Replaces the signing secret. Never automatically retried (a second roll would stop the first). */
+	rollSecret(application, id, params = {}, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `${endpointPath(application, id)}/roll_secret`,
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Requeues the endpoint's failed deliveries of messages sent since `since` (in the background). */
+	recover(application, id, params, options) {
+		const since = params.since instanceof Date ? params.since.toISOString() : params.since;
+		return this.#http.request({
+			method: "POST",
+			path: `${endpointPath(application, id)}/recover`,
+			body: { since },
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	getRecovery(application, id, recoveryId, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${endpointPath(application, id)}/recoveries/${segment(recoveryId)}`,
+			signal: options?.signal
+		});
+	}
+	/** Sends a message to this endpoint only. Never automatically retried. */
+	sendTest(application, id, params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `${endpointPath(application, id)}/test`,
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** The endpoint's deliveries, newest first. */
+	listDeliveries(application, id, params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${endpointPath(application, id)}/deliveries`,
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.hooks.messages`: send a message once; coss.com delivers it to every subscribed endpoint. */
+var HookMessagesResource = class {
+	#http;
+	/** @internal Use `new Coss().hooks.messages`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/**
+	* Sends a message to an application. Safe to retry: every attempt carries the same
+	* `Idempotency-Key`, so a retried send is delivered once.
+	*/
+	send(params, options) {
+		const { application, ...body } = params;
+		return this.#http.request({
+			method: "POST",
+			path: `${applicationPath(application)}/messages`,
+			body,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** The application's messages, newest first. */
+	list(application, params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${applicationPath(application)}/messages`,
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	get(application, id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${applicationPath(application)}/messages/${segment(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** One delivery per endpoint the message went to. */
+	listDeliveries(application, id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${applicationPath(application)}/messages/${segment(id)}/deliveries`,
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.hooks.deliveries`: one message's delivery to one endpoint. */
+var HookDeliveriesResource = class {
+	#http;
+	/** @internal Use `new Coss().hooks.deliveries`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	get(application, id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${applicationPath(application)}/deliveries/${segment(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** Every HTTP request of the delivery, oldest first. */
+	listAttempts(application, id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${applicationPath(application)}/deliveries/${segment(id)}/attempts`,
+			signal: options?.signal
+		});
+	}
+	/** Queues a finished delivery for one more attempt. Never automatically retried. */
+	retry(application, id, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `${applicationPath(application)}/deliveries/${segment(id)}/retry`,
+			retry: false,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.hooks.portal`: a ready-made page for an application's user to manage their endpoints. */
+var HookPortalResource = class {
+	#http;
+	/** @internal Use `new Coss().hooks.portal`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/**
+	* Signs the application's user in to the portal: open or embed the returned `url`. Call it from
+	* your backend each time the user opens the portal.
+	*/
+	createSession(params, options) {
+		const { application, ...body } = params;
+		return this.#http.request({
+			method: "POST",
+			path: `${applicationPath(application)}/portal_sessions`,
+			body,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+};
+/**
+* `coss.hooks`: webhooks as a service. Send a message to one of your applications once
+* (`coss.hooks.messages.send`); coss.com delivers it to every endpoint its users registered, signed
+* (Standard Webhooks), with retries, and gives them a portal to manage it all.
+*/
+var HooksResource = class {
+	applications;
+	eventTypes;
+	endpoints;
+	messages;
+	deliveries;
+	portal;
+	/** @internal Use `new Coss().hooks`. */
+	constructor(http) {
+		this.applications = new HookApplicationsResource(http);
+		this.eventTypes = new HookEventTypesResource(http);
+		this.endpoints = new HookEndpointsResource(http);
+		this.messages = new HookMessagesResource(http);
+		this.deliveries = new HookDeliveriesResource(http);
+		this.portal = new HookPortalResource(http);
+	}
+};
+//#endregion
+//#region src/resources/log-drains.ts
+const drainPath = (id) => `/v1/log_drains/${encodeURIComponent(id)}`;
+/** `coss.logDrains.batches`: a drain's delivery log, each batch with every HTTP attempt. */
+var LogDrainBatchesResource = class {
+	#http;
+	/** @internal Use `new Coss().logDrains.batches`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Lists the drain's batches, newest first. Pass the last `id` as `after` while `has_more` is true. */
+	list(drainId, params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${drainPath(drainId)}/batches`,
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+	/** Retrieves one batch of the drain. */
+	get(drainId, id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${drainPath(drainId)}/batches/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+/**
+* `coss.logDrains`: HTTPS endpoints the environment's log is streamed to (API requests, email
+* events, webhook attempts and audit events), in signed NDJSON batches. Drains belong to the API
+* key's own environment, so a `coss_test_…` key only ever manages sandbox drains.
+*/
+var LogDrainsResource = class {
+	#http;
+	/** Each drain's delivery log. */
+	batches;
+	/** @internal Use `new Coss().logDrains`. */
+	constructor(http) {
+		this.#http = http;
+		this.batches = new LogDrainBatchesResource(http);
+	}
+	/**
+	* Creates a drain. The result carries its `secret` (returned only here) — store it and pass it
+	* to `verifyLogDrainBatch` for every request. Creation is never automatically retried: the API
+	* does not deduplicate it. After a lost response, list drains and remove the one with the
+	* unknown secret before creating a replacement.
+	*/
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/log_drains",
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Lists the environment's drains, oldest first. Secrets are never included. */
+	list(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/log_drains",
+			signal: options?.signal
+		});
+	}
+	/** Retrieves a drain of the API key's environment. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: drainPath(id),
+			signal: options?.signal
+		});
+	}
+	/**
+	* Changes the URL, description, sources or `enabled` flag. The signing secret stays the same.
+	* Disabling drops the lines still waiting for the drain; enabling it again (also after coss.com
+	* disabled it for failing) sends lines logged from then on.
+	*/
+	update(id, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: drainPath(id),
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Deletes the drain and its batch log. To pause it instead, update `enabled` to false. */
+	delete(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: drainPath(id),
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/logs.ts
+/**
+* `coss.logs`: the API key's environment log, newest first: API requests made with its keys,
+* email events and webhook delivery attempts.
+*/
+var LogsResource = class {
+	#http;
+	/** @internal Use `new Coss().logs`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/**
+	* Lists log lines, newest first (the last hour unless `from`/`to` say otherwise). Pass the last
+	* `id` as `after` while `has_more` is true.
+	*/
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/logs",
+			query: listQuery(params),
+			signal: options?.signal
+		});
+	}
+	/** Retrieves one log line. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/logs/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/reputation.ts
+/**
+* `coss.reputation`: the organization's standing with the coss.com reputation guard, which suspends
+* live sending automatically when bounce or complaint rates cross its thresholds.
+*/
+var ReputationResource = class {
+	#http;
+	/** @internal Use `new Coss().reputation`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** The current status and the latest rates measured over live environments. */
+	get(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/reputation",
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/risk.ts
+const LIST_ENTRY_TYPES = [
+	"email",
+	"domain",
+	"ip",
+	"asn",
+	"country",
+	"user"
+];
+/** `coss.risk.assessments`: reading past assessments (`assess` lives on `coss.risk`). */
+var RiskAssessmentsResource = class {
+	#http;
+	/** @internal Use `new Coss().risk.assessments`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Retrieves one assessment. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/risk/assessments/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Lists assessments, newest first (`review_status: "open"` is the review queue). Pass the last
+	* `id` as `after` while `has_more` is true.
+	*/
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/risk/assessments",
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.risk.lists`: the environment's allow and block lists. */
+var RiskListsResource = class {
+	#http;
+	/** @internal Use `new Coss().risk.lists`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/**
+	* Adds an entry: `coss.risk.lists.add("block", { domain: "evil.example" })`. An allow-list match
+	* makes decisions `allow`, a block-list match `block`. Returns the existing entry if there is one.
+	*/
+	add(list, entry, options) {
+		const type = LIST_ENTRY_TYPES.find((name) => name in entry);
+		const body = {
+			list,
+			type,
+			value: String(entry[type] ?? ""),
+			...entry.note === void 0 ? {} : { note: entry.note },
+			...entry.expires_at === void 0 ? {} : { expires_at: entry.expires_at instanceof Date ? entry.expires_at.toISOString() : entry.expires_at }
+		};
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/risk/list_entries",
+			body,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Lists entries, newest first. Pass the last `id` as `after` while `has_more` is true. */
+	list(params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/risk/list_entries",
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+	/** Retrieves one entry. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/risk/list_entries/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** Removes an entry. */
+	remove(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/risk/list_entries/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.risk.settings`: the environment's thresholds, disabled reasons and captcha provider. */
+var RiskSettingsResource = class {
+	#http;
+	/** @internal Use `new Coss().risk.settings`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	get(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/risk/settings",
+			signal: options?.signal
+		});
+	}
+	/** Changes the fields given. The captcha secret is write-only. */
+	update(params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: "/v1/risk/settings",
+			body: params,
+			signal: options?.signal
+		});
+	}
+};
+/**
+* `coss.risk.rules`: the environment's rules. After the lists, the first enabled rule whose
+* conditions match an event decides it.
+*/
+var RiskRulesResource = class {
+	#http;
+	/** @internal Use `new Coss().risk.rules`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Creates a rule. Not retried automatically: a retry could create it twice. */
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/risk/rules",
+			body: params,
+			retry: false,
+			signal: options?.signal
+		});
+	}
+	/** Every rule, in evaluation order. */
+	list(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/risk/rules",
+			signal: options?.signal
+		});
+	}
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/risk/rules/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** Changes the fields given; `conditions` replaces the whole list. */
+	update(id, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: `/v1/risk/rules/${encodeURIComponent(id)}`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	delete(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/risk/rules/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+/**
+* `coss.risk.limitBuckets`: your rate limit buckets, which `coss.risk.limit()` charges per key.
+*/
+var RiskLimitBucketsResource = class {
+	#http;
+	/** @internal Use `new Coss().risk.limitBuckets`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Creates a bucket. Not retried automatically: a retry would find its name taken. */
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/risk/limit_buckets",
+			body: params,
+			retry: false,
+			signal: options?.signal
+		});
+	}
+	/** Every bucket, by name. */
+	list(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/risk/limit_buckets",
+			signal: options?.signal
+		});
+	}
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/risk/limit_buckets/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/** Changes the fields given; the next check uses them. */
+	update(id, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: `/v1/risk/limit_buckets/${encodeURIComponent(id)}`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	delete(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/risk/limit_buckets/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+/** `coss.risk.users`: what coss.com remembers about your users. */
+var RiskUsersResource = class {
+	#http;
+	/** @internal Use `new Coss().risk.users`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/**
+	* Call when you delete a user: coss.com deletes what identifies them (their mailbox, fraud reports,
+	* and the user id, email, IP and user agent on their assessments). Safe to repeat.
+	*/
+	forget(userId, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/risk/users/${encodeURIComponent(userId)}`,
+			signal: options?.signal
+		});
+	}
+};
+/**
+* `coss.risk`: assess sign-ups, logins and other events. Call it from your server and treat an
+* error as `allow` (fail open), so an outage never locks your users out.
+*
+* ```ts
+* const { data } = await coss.risk.assess({ event: "signup", user: { email }, ip, user_agent });
+* if (data?.decision === "block") return refuse();
+* ```
+*/
+var RiskResource = class {
+	/** Past assessments (`get`, `list`). */
+	assessments;
+	/** Allow and block lists (`add`, `list`, `get`, `remove`). */
+	lists;
+	/** Forgetting deleted users. */
+	users;
+	/** Thresholds, disabled reasons and the captcha provider (`get`, `update`). */
+	settings;
+	/** Rules (`create`, `list`, `get`, `update`, `delete`). */
+	rules;
+	/** Your rate limit buckets (`create`, `list`, `get`, `update`, `delete`). */
+	limitBuckets;
+	#http;
+	/** @internal Use `new Coss().risk`. */
+	constructor(http) {
+		this.#http = http;
+		this.assessments = new RiskAssessmentsResource(http);
+		this.lists = new RiskListsResource(http);
+		this.users = new RiskUsersResource(http);
+		this.settings = new RiskSettingsResource(http);
+		this.rules = new RiskRulesResource(http);
+		this.limitBuckets = new RiskLimitBucketsResource(http);
+	}
+	/**
+	* Assesses an event and returns the decision with its score and reasons. Retries reuse one
+	* `Idempotency-Key`, so an event is never counted twice.
+	*/
+	assess(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/risk/assessments",
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Reports what an assessed user turned out to be: `fraud` and `abuse` teach later assessments to
+	* flag the same mailbox, user, card, device, IP and subnet; `legitimate` takes that back.
+	* Resolves a review, and counts in `calibration()`.
+	*/
+	feedback(id, params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/risk/assessments/${encodeURIComponent(id)}/feedback`,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/**
+	* How often each reason and rule was right over the last 90 days, by your feedback, and the
+	* reason weights that supports. Apply them with `settings.update({ reason_weights })`.
+	*/
+	calibration(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/risk/calibration",
+			signal: options?.signal
+		});
+	}
+	/**
+	* Checks an email address on its own: syntax, disposable domains, deliverability, role
+	* accounts, free providers, the canonical mailbox, typos and domain age. Nothing is stored.
+	*/
+	checkEmail(email, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/risk/email/check",
+			body: { email },
+			signal: options?.signal
+		});
+	}
+	/**
+	* Checks an IP address on its own: Tor, cloud, hosting and VPN networks, ASN and country, and
+	* VPN, proxy and relay exits when coss.com's privacy data is available.
+	*/
+	checkIp(ip, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/risk/ip/check",
+			body: { ip },
+			signal: options?.signal
+		});
+	}
+	/**
+	* Scores text for spam, phishing, malware and fraud. Scores only, never a verdict: you choose
+	* the thresholds. The text is neither stored nor logged.
+	*/
+	classify(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/risk/content/classify",
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Takes `cost` tokens (default 1) from `key`'s share of one of your buckets
+	* (`coss.risk.limitBuckets`). Retries reuse one `Idempotency-Key`, so they are charged once.
+	*
+	* ```ts
+	* const { data } = await coss.risk.limit({ bucket: "password_reset", key: email });
+	* if (data && !data.allowed) return tooManyRequests(data.retry_after_ms);
+	* ```
+	*/
+	limit(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/risk/limits",
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/webhook-deliveries.ts
+const deliveriesPath = (endpointId) => `/v1/webhook_endpoints/${encodeURIComponent(endpointId)}/deliveries`;
+/**
+* `coss.webhookEndpoints.deliveries`: an endpoint's delivery log. Each delivery carries every
+* HTTP attempt and the payload as sent.
+*/
+var WebhookDeliveriesResource = class {
+	#http;
+	/** @internal Use `new Coss().webhookEndpoints.deliveries`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Lists the endpoint's deliveries, newest first. Pass the last `id` as `after` while `has_more` is true. */
+	list(endpointId, params = {}, options) {
+		return this.#http.request({
+			method: "GET",
+			path: deliveriesPath(endpointId),
+			query: { ...params },
+			signal: options?.signal
+		});
+	}
+	/** Retrieves one delivery of the endpoint. */
+	get(endpointId, id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `${deliveriesPath(endpointId)}/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Queues a finished delivery for one more attempt, made within seconds. A delivery that is
+	* still `pending` is returned unchanged (it is already scheduled for `next_attempt_at`).
+	* Never automatically retried: the API does not deduplicate replay requests, even with an
+	* idempotency key.
+	*/
+	retry(endpointId, id, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `${deliveriesPath(endpointId)}/${encodeURIComponent(id)}/retry`,
+			retry: false,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/webhook-endpoints.ts
+/**
+* `coss.webhookEndpoints`: the URLs that receive signed event notifications. Endpoints belong to
+* the API key's own environment, so a `coss_test_…` key only ever manages sandbox endpoints.
+*/
+var WebhookEndpointsResource = class {
+	#http;
+	/** Each endpoint's delivery log: list, retrieve and retry deliveries. */
+	deliveries;
+	/** @internal Use `new Coss().webhookEndpoints`. */
+	constructor(http) {
+		this.#http = http;
+		this.deliveries = new WebhookDeliveriesResource(http);
+	}
+	/**
+	* Creates an endpoint. The result carries its `secret` (returned again only by `rollSecret`) —
+	* store it and pass it to `verifyWebhook` for every delivery. Creation is never automatically retried:
+	* the API does not deduplicate it, even with an idempotency key. After a lost response,
+	* list endpoints and remove the endpoint with the unknown secret before creating a replacement.
+	*/
+	create(params, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/webhook_endpoints",
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Lists the environment's endpoints, oldest first. Secrets are never included. */
+	list(options) {
+		return this.#http.request({
+			method: "GET",
+			path: "/v1/webhook_endpoints",
+			signal: options?.signal
+		});
+	}
+	/** Retrieves an endpoint of the API key's environment. */
+	get(id, options) {
+		return this.#http.request({
+			method: "GET",
+			path: `/v1/webhook_endpoints/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Changes the URL, description, subscribed event types or `enabled` flag. The signing secret
+	* stays the same (see `rollSecret`), so receivers keep verifying deliveries.
+	*/
+	update(id, params, options) {
+		return this.#http.request({
+			method: "PATCH",
+			path: `/v1/webhook_endpoints/${encodeURIComponent(id)}`,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Replaces the endpoint's signing secret; the result carries the new `secret`. Until
+	* `previous_secret_expires_at` (a day by default), deliveries are signed with both secrets, so
+	* `verifyWebhook` accepts them with either: deploy the new one, then let the old one expire.
+	* Never automatically retried (a second roll would stop the original secret at once): after a
+	* lost response, roll again and deploy that secret.
+	*/
+	rollSecret(id, params = {}, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/webhook_endpoints/${encodeURIComponent(id)}/roll_secret`,
+			retry: false,
+			body: params,
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Queues the endpoint's deliveries that failed since `since` for one more attempt each (at most
+	* 1,000 per call; while `has_more` is true, call again with the same `since`), e.g. after fixing a
+	* receiver that was down. The endpoint must be enabled.
+	*/
+	recover(id, params, options) {
+		const since = params.since instanceof Date ? params.since.toISOString() : params.since;
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/webhook_endpoints/${encodeURIComponent(id)}/recover`,
+			body: { since },
+			idempotencyKey: options?.idempotencyKey,
+			signal: options?.signal
+		});
+	}
+	/** Deletes the endpoint and its delivery log. To pause it instead, update `enabled` to false. */
+	delete(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/webhook_endpoints/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/webhook-listeners.ts
+/**
+* `coss.webhookListeners`: what `coss listen` uses to forward an environment's events to a local
+* server. A listener receives events created after it opens, while it is polled; it is closed by
+* `delete` or after 10 minutes without a poll.
+*/
+var WebhookListenersResource = class {
+	#http;
+	/** @internal Use `new Coss().webhookListeners`. */
+	constructor(http) {
+		this.#http = http;
+	}
+	/** Opens a listener. Never retried automatically: a lost answer leaves one to expire. */
+	create(params = {}, options) {
+		return this.#http.request({
+			method: "POST",
+			path: "/v1/webhook_listeners",
+			retry: false,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/**
+	* Acknowledges earlier deliveries and waits (up to `wait_ms`) for more. Never retried
+	* automatically: call it in a loop, and keep unacknowledged acks for the next call after an error.
+	*/
+	poll(id, params = {}, options) {
+		return this.#http.request({
+			method: "POST",
+			path: `/v1/webhook_listeners/${encodeURIComponent(id)}/poll`,
+			retry: false,
+			body: params,
+			signal: options?.signal
+		});
+	}
+	/** Closes a listener: it receives nothing more. */
+	delete(id, options) {
+		return this.#http.request({
+			method: "DELETE",
+			path: `/v1/webhook_listeners/${encodeURIComponent(id)}`,
+			signal: options?.signal
+		});
+	}
+};
+//#endregion
+//#region src/client.ts
+/**
+* @internal Names the integration (`coss/nodemailer`, …) that created a client, for its
+* `User-Agent`. A symbol rather than a `CossOptions` field so it stays out of the public options.
+*/
+const INTEGRATION = Symbol("coss.integration");
+const DEFAULT_BASE_URL = "https://api.coss.com";
+const DEFAULT_TIMEOUT_MS = 3e4;
+const DEFAULT_MAX_RETRIES = 2;
+const MAX_TIMEOUT_MS = 2147483647;
+/** Reads an env variable where one exists (Node, Bun, Deno's `process`), never throwing. */
+function readEnv(name) {
+	try {
+		return (globalThis.process?.env)?.[name]?.trim() || void 0;
+	} catch {
+		return;
+	}
+}
+function retries(value) {
+	return value !== void 0 && Number.isFinite(value) && value >= 0 ? Math.floor(value) : DEFAULT_MAX_RETRIES;
+}
+function timeoutMs(value) {
+	return value !== void 0 && Number.isFinite(value) && value > 0 ? Math.min(Math.ceil(value), MAX_TIMEOUT_MS) : DEFAULT_TIMEOUT_MS;
+}
+/**
+* The coss.com client. One API key covers every product.
+*
+* ```ts
+* const coss = new Coss({ apiKey: "coss_test_…" });
+* const { data, error } = await coss.email.send({ from, to, subject, html });
+* ```
+*/
+var Coss = class {
+	email;
+	/** The API key's environment, project and organization (`coss.environment.get()`). */
+	environment;
+	/** The client's own API key (`coss.apiKey.revoke()`). */
+	apiKey;
+	/** Sending domains of the organization (`coss.domains.create`, `.verify`, …). */
+	domains;
+	/** Webhook endpoints of the API key's environment. */
+	webhookEndpoints;
+	/** Temporary listeners `coss listen` pulls the environment's events from. */
+	webhookListeners;
+	/** The organization's sending reputation (`coss.reputation.get()`). */
+	reputation;
+	/** The environment's log: API requests, email events, webhook attempts (`coss.logs.list()`). */
+	logs;
+	/** HTTPS endpoints the environment's log is streamed to (`coss.logDrains.create()`). */
+	logDrains;
+	/** The organization's audit log: changes by members, API keys and coss.com support (`coss.auditEvents.list()`). */
+	auditEvents;
+	/** Hooks, webhooks as a service: `coss.hooks.messages.send()` delivers to your users' endpoints. */
+	hooks;
+	/** Risk assessments of sign-ups, logins and other events (`coss.risk.assess()`). */
+	risk;
+	/** The organization's plan, usage, invoices and credits (`coss.billing.get()`). */
+	billing;
+	/**
+	* Throws only for programmer errors: no API key, or running in a browser without
+	* `dangerouslyAllowBrowser`. Request failures are returned as `{ data: null, error }`.
+	*/
+	constructor(options = {}) {
+		if (typeof globalThis.document !== "undefined" && !options.dangerouslyAllowBrowser) throw new Error("Refusing to create a coss.com client in a browser-like environment: coss.com API keys are secret, and any key sent to the browser can be read by anyone using the page. Call coss.com from your server instead, or pass `dangerouslyAllowBrowser: true` if you understand the risk.");
+		const apiKey = options.apiKey?.trim() || readEnv("COSS_API_KEY");
+		if (!apiKey) throw new Error("Missing coss.com API key. Pass `apiKey` to `new Coss({ apiKey })` or set the COSS_API_KEY environment variable.");
+		const http = new HttpClient({
+			apiKey,
+			baseUrl: options.baseUrl?.trim() || readEnv("COSS_BASE_URL") || DEFAULT_BASE_URL,
+			fetch: options.fetch ?? ((input, init) => globalThis.fetch(input, init)),
+			timeout: timeoutMs(options.timeout),
+			maxRetries: retries(options.maxRetries),
+			apiVersion: options.apiVersion?.trim() || "2026-10-10",
+			integration: options[INTEGRATION]
+		});
+		this.email = new EmailResource(http);
+		this.environment = new EnvironmentResource(http);
+		this.apiKey = new ApiKeyResource(http);
+		this.domains = new DomainsResource(http);
+		this.webhookEndpoints = new WebhookEndpointsResource(http);
+		this.webhookListeners = new WebhookListenersResource(http);
+		this.reputation = new ReputationResource(http);
+		this.logs = new LogsResource(http);
+		this.logDrains = new LogDrainsResource(http);
+		this.auditEvents = new AuditEventsResource(http);
+		this.hooks = new HooksResource(http);
+		this.risk = new RiskResource(http);
+		this.billing = new BillingResource(http);
+	}
+};
+//#endregion
+export { API_VERSIONS as a, API_VERSION as i, INTEGRATION as n, VERSION as r, Coss as t };