samva 0.15.0 → 0.17.0

package/AGENTS.md

@@ -8,7 +8,10 @@ Effect applications should import Pascal-cased domain modules from focused subpa
 `samva/effect/email` and provide `Client.layerFetch` from `samva/effect/client`. Install the optional
 peer `effect` at the exact version this package's `peerDependencies` names when using those
 entrypoints; a different release candidate is unsupported. Tagged API failures remain in the
-Effect error channel and can be handled with `Effect.catchTag`.
+Effect error channel and can be handled with `Effect.catchTag`. In Cloudflare Workers and Lambda,
+import focused entrypoints rather than the `samva/effect` barrel, which loads every domain. In a
+Worker, provide the client Layer per request with the request's abort signal; in Lambda or another
+long-lived process, build it once in a module-scope `ManagedRuntime`.
 
 Treat exported request and response types as the API contract. Do not import package-internal files
 or generated implementation paths; use only the subpaths declared in `package.json`.

package/README.md

@@ -83,6 +83,49 @@ const program = Email.send({
 const message = await Effect.runPromise(program);
 ```
 
+### Serverless Runtimes
+
+Each `samva/effect/<domain>` entrypoint loads only that domain's part of the API, so a Cloudflare
+Worker or Lambda function pays at startup only for the domains it imports. `Email.send` and
+`Messages.send` also load Media, because an oversized inline attachment is uploaded as media. The
+`samva/effect` barrel loads every domain; import focused entrypoints in serverless code.
+
+`Client.layerFetch` does no work until the first call, and the first call to a domain prepares only
+that domain, so providing the Layer costs little. In a Cloudflare Worker, provide it per request and
+pass the request's abort signal, so no request waits on work another request started:
+
+```typescript
+import { Effect } from "effect";
+import * as Client from "samva/effect/client";
+import * as Contacts from "samva/effect/contacts";
+
+export default {
+  async fetch(request: Request, env: { SAMVA_API_KEY: string }): Promise<Response> {
+    const page = await Effect.runPromise(
+      Contacts.list({}).pipe(Effect.provide(Client.layerFetch({ apiKey: env.SAMVA_API_KEY }))),
+      { signal: request.signal },
+    );
+    return Response.json(page.items);
+  },
+};
+```
+
+In Lambda or another runtime that keeps one process alive across invocations, build the Layer once
+in a `ManagedRuntime` at module scope so each domain is prepared once for the life of the process:
+
+```typescript
+import { ManagedRuntime } from "effect";
+import * as Client from "samva/effect/client";
+import * as Contacts from "samva/effect/contacts";
+
+const runtime = ManagedRuntime.make(Client.layerFetch({ apiKey: process.env.SAMVA_API_KEY! }));
+
+export const handler = async () => {
+  const page = await runtime.runPromise(Contacts.list({}));
+  return page.items;
+};
+```
+
 ## Authentication
 
 Samva supports two client auth modes. Use one per `createClient` instance.
@@ -166,6 +209,7 @@ The Promise client exposes:
 - `templates`
 - `unsubscribeGroups`
 - `webhooks`
+- `whoami`
 
 The Effect SDK exposes Pascal-cased domain modules with lower-camel operations:
 
@@ -192,8 +236,9 @@ The Effect SDK exposes Pascal-cased domain modules with lower-camel operations:
 - `Templates`
 - `UnsubscribeGroups`
 - `Webhooks`
+- `Whoami`
 
-Effect operations take direct parameter objects: body, path, and query fields are not wrapped in `payload` or `params` envelopes. Import the modules you use from `samva/effect/<lower-kebab>` and provide `Client.layerFetch` once at the program boundary. `Client.raw` exposes the underlying generated client for advanced access, but ordinary workflows do not require it.
+Effect operations take direct parameter objects: body, path, and query fields are not wrapped in `payload` or `params` envelopes. Import the modules you use from `samva/effect/<lower-kebab>` and provide `Client.layerFetch` once at the program boundary.
 
 Email attachments use organization-owned media. Call `media.create`, upload the bytes with the
 returned instruction, call `media.complete`, and pass the ready `mediaId` to `email.send` or

package/dist/analytics-CaqPRsry.js

@@ -0,0 +1,207 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
+import { t as AbsoluteInstant } from "./runtime-P0l1_2-C.js";
+import { Jt as UnauthorizedError, K as ForbiddenError, Y as InternalError, en as ValidationError, i as AnalyticsQueryError, q as GatewayTimeoutError, s as ApiKeySecurityMiddleware } from "./client-DOzUrdTE.js";
+import { n as forGroup } from "./operation-n_IYgNVK.js";
+import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/http-api";
+import * as Schema from "effect/Schema";
+//#region src/effect/generated/analytics.ts
+const AnalyticsGetChannelStatsQuery = /* @__PURE__ */ Schema.Struct({
+	after: Schema.optionalKey(Schema.Union([AbsoluteInstant, Schema.Null])),
+	before: Schema.optionalKey(Schema.Union([AbsoluteInstant, Schema.Null]))
+});
+const AnalyticsGetChannelStats200 = /* @__PURE__ */ Schema.Struct({ email: Schema.Struct({
+	sent: Schema.Finite.check(Schema.isInt().annotate({ expected: "an integer" })).check(Schema.isGreaterThanOrEqualTo(0).annotate({ expected: "a value greater than or equal to 0" })),
+	deliveryRate: Schema.Finite.check(Schema.isFinite().annotate({ expected: "a finite number" })),
+	uniqueOpenedMessages: Schema.Finite.check(Schema.isInt().annotate({ expected: "an integer" })).check(Schema.isGreaterThanOrEqualTo(0).annotate({ expected: "a value greater than or equal to 0" })),
+	openTrackingEligibleDeliveredMessages: Schema.Finite.check(Schema.isInt().annotate({ expected: "an integer" })).check(Schema.isGreaterThanOrEqualTo(0).annotate({ expected: "a value greater than or equal to 0" })),
+	uniqueMessageOpenRate: Schema.Finite.check(Schema.isFinite().annotate({ expected: "a finite number" })),
+	uniqueClickedMessages: Schema.Finite.check(Schema.isInt().annotate({ expected: "an integer" })).check(Schema.isGreaterThanOrEqualTo(0).annotate({ expected: "a value greater than or equal to 0" })),
+	clickTrackingEligibleDeliveredMessages: Schema.Finite.check(Schema.isInt().annotate({ expected: "an integer" })).check(Schema.isGreaterThanOrEqualTo(0).annotate({ expected: "a value greater than or equal to 0" })),
+	uniqueMessageClickRate: Schema.Finite.check(Schema.isFinite().annotate({ expected: "a finite number" })),
+	bounceRate: Schema.Finite.check(Schema.isFinite().annotate({ expected: "a finite number" }))
+}) });
+const AnalyticsGetChannelStats400 = AnalyticsQueryError;
+const AnalyticsGetChannelStats401 = UnauthorizedError;
+const AnalyticsGetChannelStats403 = ForbiddenError;
+const AnalyticsGetChannelStats422 = ValidationError;
+const AnalyticsGetChannelStats500 = InternalError;
+const AnalyticsGetChannelStats504 = GatewayTimeoutError;
+const AnalyticsGetDeliveryMetricsQuery = /* @__PURE__ */ Schema.Struct({
+	after: Schema.optionalKey(Schema.Union([AbsoluteInstant, Schema.Null])),
+	before: Schema.optionalKey(Schema.Union([AbsoluteInstant, Schema.Null])),
+	channel: Schema.optionalKey(Schema.Union([Schema.Literal("email"), Schema.Null]))
+});
+const AnalyticsGetDeliveryMetrics200 = /* @__PURE__ */ Schema.Struct({
+	deliveredRate: Schema.Finite.check(Schema.isFinite().annotate({ expected: "a finite number" })),
+	failedRate: Schema.Finite.check(Schema.isFinite().annotate({ expected: "a finite number" })),
+	pendingRate: Schema.Finite.check(Schema.isFinite().annotate({ expected: "a finite number" })),
+	avgDeliveryTimeMs: Schema.Finite.check(Schema.isFinite().annotate({ expected: "a finite number" }))
+});
+const AnalyticsGetDeliveryMetrics400 = AnalyticsQueryError;
+const AnalyticsGetDeliveryMetrics401 = UnauthorizedError;
+const AnalyticsGetDeliveryMetrics403 = ForbiddenError;
+const AnalyticsGetDeliveryMetrics422 = ValidationError;
+const AnalyticsGetDeliveryMetrics500 = InternalError;
+const AnalyticsGetDeliveryMetrics504 = GatewayTimeoutError;
+const AnalyticsExportDataRequestJson = /* @__PURE__ */ Schema.Struct({
+	after: AbsoluteInstant,
+	before: AbsoluteInstant,
+	format: Schema.optionalKey(Schema.Union([Schema.Union([Schema.Literal("csv"), Schema.Literal("json")]), Schema.Null])),
+	includeChannels: Schema.optionalKey(Schema.Union([Schema.Array(Schema.Literal("email")), Schema.Null]))
+});
+const AnalyticsExportData200 = /* @__PURE__ */ Schema.Struct({
+	content: Schema.String,
+	mimeType: Schema.String,
+	filename: Schema.String
+});
+const AnalyticsExportData400 = AnalyticsQueryError;
+const AnalyticsExportData401 = UnauthorizedError;
+const AnalyticsExportData403 = ForbiddenError;
+const AnalyticsExportData422 = ValidationError;
+const AnalyticsExportData500 = InternalError;
+const AnalyticsExportData504 = GatewayTimeoutError;
+const AnalyticsGetHourlyDistributionQuery = /* @__PURE__ */ Schema.Struct({
+	after: Schema.optionalKey(Schema.Union([AbsoluteInstant, Schema.Null])),
+	before: Schema.optionalKey(Schema.Union([AbsoluteInstant, Schema.Null]))
+});
+const AnalyticsGetHourlyDistribution200 = /* @__PURE__ */ Schema.Array(Schema.Struct({
+	hour: Schema.String,
+	count: Schema.Finite.check(Schema.isInt().annotate({ expected: "an integer" })).check(Schema.isGreaterThanOrEqualTo(0).annotate({ expected: "a value greater than or equal to 0" }))
+}));
+const AnalyticsGetHourlyDistribution400 = AnalyticsQueryError;
+const AnalyticsGetHourlyDistribution401 = UnauthorizedError;
+const AnalyticsGetHourlyDistribution403 = ForbiddenError;
+const AnalyticsGetHourlyDistribution422 = ValidationError;
+const AnalyticsGetHourlyDistribution500 = InternalError;
+const AnalyticsGetHourlyDistribution504 = GatewayTimeoutError;
+const AnalyticsGetStatsQuery = /* @__PURE__ */ Schema.Struct({
+	after: Schema.optionalKey(Schema.Union([AbsoluteInstant, Schema.Null])),
+	before: Schema.optionalKey(Schema.Union([AbsoluteInstant, Schema.Null])),
+	groupBy: Schema.optionalKey(Schema.Union([Schema.Union([
+		Schema.Literal("day"),
+		Schema.Literal("week"),
+		Schema.Literal("month")
+	]), Schema.Null])),
+	channel: Schema.optionalKey(Schema.Union([Schema.Literal("email"), Schema.Null]))
+});
+const AnalyticsGetStats200 = /* @__PURE__ */ Schema.Struct({ volumeHistory: Schema.Array(Schema.Struct({
+	date: Schema.String,
+	email: Schema.Finite.check(Schema.isInt().annotate({ expected: "an integer" })).check(Schema.isGreaterThanOrEqualTo(0).annotate({ expected: "a value greater than or equal to 0" }))
+})) });
+const AnalyticsGetStats400 = AnalyticsQueryError;
+const AnalyticsGetStats401 = UnauthorizedError;
+const AnalyticsGetStats403 = ForbiddenError;
+const AnalyticsGetStats422 = ValidationError;
+const AnalyticsGetStats500 = InternalError;
+const AnalyticsGetStats504 = GatewayTimeoutError;
+const AnalyticsGetTopContactsQuery = /* @__PURE__ */ Schema.Struct({
+	after: Schema.optionalKey(Schema.Union([AbsoluteInstant, Schema.Null])),
+	before: Schema.optionalKey(Schema.Union([AbsoluteInstant, Schema.Null])),
+	limit: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
+	sortBy: Schema.optionalKey(Schema.Union([Schema.Union([
+		Schema.Literal("sent"),
+		Schema.Literal("received"),
+		Schema.Literal("total")
+	]), Schema.Null]))
+});
+const AnalyticsGetTopContacts200 = /* @__PURE__ */ Schema.Array(Schema.Struct({
+	id: Schema.String,
+	name: Schema.Union([Schema.String, Schema.Null]),
+	email: Schema.Union([Schema.String, Schema.Null]),
+	phone: Schema.Union([Schema.String, Schema.Null]),
+	messageCount: Schema.Finite.check(Schema.isInt().annotate({ expected: "an integer" })).check(Schema.isGreaterThanOrEqualTo(0).annotate({ expected: "a value greater than or equal to 0" }))
+}));
+const AnalyticsGetTopContacts400 = AnalyticsQueryError;
+const AnalyticsGetTopContacts401 = UnauthorizedError;
+const AnalyticsGetTopContacts403 = ForbiddenError;
+const AnalyticsGetTopContacts422 = ValidationError;
+const AnalyticsGetTopContacts500 = InternalError;
+const AnalyticsGetTopContacts504 = GatewayTimeoutError;
+var AnalyticsGroup = class extends HttpApiGroup.make("Analytics").add(HttpApiEndpoint.get("analyticsGetChannelStats", "/v1/analytics/channel-stats", {
+	query: AnalyticsGetChannelStatsQuery,
+	success: AnalyticsGetChannelStats200,
+	error: [
+		AnalyticsGetChannelStats400.pipe(HttpApiSchema.status(400)),
+		AnalyticsGetChannelStats401.pipe(HttpApiSchema.status(401)),
+		AnalyticsGetChannelStats403.pipe(HttpApiSchema.status(403)),
+		AnalyticsGetChannelStats422.pipe(HttpApiSchema.status(422)),
+		AnalyticsGetChannelStats500,
+		AnalyticsGetChannelStats504.pipe(HttpApiSchema.status(504))
+	]
+}).middleware(ApiKeySecurityMiddleware).annotate(OpenApi.Identifier, "analytics.getChannelStats").annotate(OpenApi.Summary, "Get channel performance analytics").annotate(OpenApi.Description, "Returns aggregate delivery metrics plus unique-message email Open and Click rates over the selected date range. `sent` counts every outbound message accepted in the range; each rate is taken over the messages the channel actually attempted, so one still waiting to be sent neither helps nor hurts it. Each engagement rate uses the corresponding tracking-eligible delivered-message cohort; repeated provider observations do not inflate the numerator."), HttpApiEndpoint.get("analyticsGetDeliveryMetrics", "/v1/analytics/delivery-metrics", {
+	query: AnalyticsGetDeliveryMetricsQuery,
+	success: AnalyticsGetDeliveryMetrics200,
+	error: [
+		AnalyticsGetDeliveryMetrics400.pipe(HttpApiSchema.status(400)),
+		AnalyticsGetDeliveryMetrics401.pipe(HttpApiSchema.status(401)),
+		AnalyticsGetDeliveryMetrics403.pipe(HttpApiSchema.status(403)),
+		AnalyticsGetDeliveryMetrics422.pipe(HttpApiSchema.status(422)),
+		AnalyticsGetDeliveryMetrics500,
+		AnalyticsGetDeliveryMetrics504.pipe(HttpApiSchema.status(504))
+	]
+}).middleware(ApiKeySecurityMiddleware).annotate(OpenApi.Identifier, "analytics.getDeliveryMetrics").annotate(OpenApi.Summary, "Get message delivery metrics").annotate(OpenApi.Description, "Returns delivered, failed, and pending rates plus average delivery time for the outbound messages accepted in the selected date range, optionally filtered by channel. Every accepted message falls into exactly one of the three, so they always sum to 100%: a complaint counts as delivered because the message arrived, a bounce counts as failed, and anything the provider has not resolved yet counts as pending. Mail your organization received is not rated here."), HttpApiEndpoint.post("analyticsExportData", "/v1/analytics/export", {
+	payload: AnalyticsExportDataRequestJson,
+	success: AnalyticsExportData200,
+	error: [
+		AnalyticsExportData400.pipe(HttpApiSchema.status(400)),
+		AnalyticsExportData401.pipe(HttpApiSchema.status(401)),
+		AnalyticsExportData403.pipe(HttpApiSchema.status(403)),
+		AnalyticsExportData422.pipe(HttpApiSchema.status(422)),
+		AnalyticsExportData500,
+		AnalyticsExportData504.pipe(HttpApiSchema.status(504))
+	]
+}).middleware(ApiKeySecurityMiddleware).annotate(OpenApi.Identifier, "analytics.exportData").annotate(OpenApi.Summary, "Export messaging analytics data").annotate(OpenApi.Description, "Exports one record per outbound message accepted in the given date range as CSV or JSON and returns the file content inline. CSV follows RFC 4180: fields containing a quote, comma, or line break are quoted with embedded quotes doubled, and records are separated by CRLF. At most 10,000 records are returned, newest first."), HttpApiEndpoint.get("analyticsGetHourlyDistribution", "/v1/analytics/hourly-distribution", {
+	query: AnalyticsGetHourlyDistributionQuery,
+	success: AnalyticsGetHourlyDistribution200,
+	error: [
+		AnalyticsGetHourlyDistribution400.pipe(HttpApiSchema.status(400)),
+		AnalyticsGetHourlyDistribution401.pipe(HttpApiSchema.status(401)),
+		AnalyticsGetHourlyDistribution403.pipe(HttpApiSchema.status(403)),
+		AnalyticsGetHourlyDistribution422.pipe(HttpApiSchema.status(422)),
+		AnalyticsGetHourlyDistribution500,
+		AnalyticsGetHourlyDistribution504.pipe(HttpApiSchema.status(504))
+	]
+}).middleware(ApiKeySecurityMiddleware).annotate(OpenApi.Identifier, "analytics.getHourlyDistribution").annotate(OpenApi.Summary, "Get hourly message distribution").annotate(OpenApi.Description, "Returns outbound message counts over the half-open selected instant range, bucketed by organization-local hour. Empty ranges return no rows; non-empty ranges include all 24 hours."), HttpApiEndpoint.get("analyticsGetStats", "/v1/analytics/stats", {
+	query: AnalyticsGetStatsQuery,
+	success: AnalyticsGetStats200,
+	error: [
+		AnalyticsGetStats400.pipe(HttpApiSchema.status(400)),
+		AnalyticsGetStats401.pipe(HttpApiSchema.status(401)),
+		AnalyticsGetStats403.pipe(HttpApiSchema.status(403)),
+		AnalyticsGetStats422.pipe(HttpApiSchema.status(422)),
+		AnalyticsGetStats500,
+		AnalyticsGetStats504.pipe(HttpApiSchema.status(504))
+	]
+}).middleware(ApiKeySecurityMiddleware).annotate(OpenApi.Identifier, "analytics.getStats").annotate(OpenApi.Summary, "Get message volume analytics").annotate(OpenApi.Description, "Returns outbound message counts over the half-open selected instant range, grouped by organization-local calendar day, week, or month. A range with traffic returns every bucket in it, including the ones that saw none; a range with no outbound traffic at all returns no buckets. A range with no `before` runs through the current instant, so its quiet trailing buckets are reported as zero."), HttpApiEndpoint.get("analyticsGetTopContacts", "/v1/analytics/top-contacts", {
+	query: AnalyticsGetTopContactsQuery,
+	success: AnalyticsGetTopContacts200,
+	error: [
+		AnalyticsGetTopContacts400.pipe(HttpApiSchema.status(400)),
+		AnalyticsGetTopContacts401.pipe(HttpApiSchema.status(401)),
+		AnalyticsGetTopContacts403.pipe(HttpApiSchema.status(403)),
+		AnalyticsGetTopContacts422.pipe(HttpApiSchema.status(422)),
+		AnalyticsGetTopContacts500,
+		AnalyticsGetTopContacts504.pipe(HttpApiSchema.status(504))
+	]
+}).middleware(ApiKeySecurityMiddleware).annotate(OpenApi.Identifier, "analytics.getTopContacts").annotate(OpenApi.Summary, "List top contacts by message volume").annotate(OpenApi.Description, "Returns the contacts your organization exchanged the most messages with over the selected date range. `sortBy` chooses the traffic `messageCount` reports and ranks by: `sent` counts outbound messages addressed to the contact, `received` counts inbound messages the contact sent you, and `total` (the default) counts both. Contacts with no traffic in the range are omitted, and at most 100 are returned.")).annotate(OpenApi.Description, "Messaging analytics, channel stats, and data export. Every date range is half-open — `after` inclusive, `before` exclusive — and may span at most 366 days. Both bounds are absolute ISO-8601 instants carrying `Z` or a numeric offset; a bare calendar date is rejected, because reading it as UTC midnight would shift every bucket for an organization outside UTC. `AnalyticsQueryError` refuses a longer span and a `before` sent without an `after`, which bounds nothing. Omitting both bounds reports the organization's whole history. Calendar buckets follow the organization's timezone.") {};
+//#endregion
+//#region src/effect/analytics.ts
+var analytics_exports = /* @__PURE__ */ __exportAll({
+	exportData: () => exportData,
+	getChannelStats: () => getChannelStats,
+	getDeliveryMetrics: () => getDeliveryMetrics,
+	getHourlyDistribution: () => getHourlyDistribution,
+	getStats: () => getStats,
+	getTopContacts: () => getTopContacts
+});
+const make = forGroup(AnalyticsGroup);
+const getStats = make("analyticsGetStats");
+const getChannelStats = make("analyticsGetChannelStats");
+const getTopContacts = make("analyticsGetTopContacts");
+const getHourlyDistribution = make("analyticsGetHourlyDistribution");
+const getDeliveryMetrics = make("analyticsGetDeliveryMetrics");
+const exportData = make("analyticsExportData");
+//#endregion
+export { getHourlyDistribution as a, getDeliveryMetrics as i, exportData as n, getStats as o, getChannelStats as r, getTopContacts as s, analytics_exports as t };
+
+//# sourceMappingURL=analytics-CaqPRsry.js.map

package/dist/api-keys-Ce1Y4_Ip.js

@@ -0,0 +1,274 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
+import { n as SensitiveString } from "./runtime-P0l1_2-C.js";
+import { D as Cursor, Ht as SuccessResponse, Jt as UnauthorizedError, K as ForbiddenError, Lt as ResourceNotFoundError, Nt as PaymentRequiredError, Pt as RateLimitedError, Y as InternalError, a as ApiKeyAccess, en as ValidationError, ht as MailboxSendMode, l as BillingProviderError, o as ApiKeyId, q as GatewayTimeoutError, s as ApiKeySecurityMiddleware } from "./client-DOzUrdTE.js";
+import { n as forGroup } from "./operation-n_IYgNVK.js";
+import { HttpApiEndpoint, HttpApiGroup, HttpApiSchema, OpenApi } from "effect/http-api";
+import * as Schema from "effect/Schema";
+//#region src/effect/generated/api-keys.ts
+const ApiKeyOwner = /* @__PURE__ */ Schema.Struct({
+	id: Schema.String,
+	name: Schema.String,
+	email: Schema.String
+}).annotate({ identifier: "ApiKeyOwner" });
+const ApiKeyActivityPage = /* @__PURE__ */ Schema.Struct({
+	items: Schema.Array(Schema.Struct({
+		id: Schema.String,
+		timestamp: Schema.String,
+		method: Schema.String,
+		endpoint: Schema.String,
+		statusCode: Schema.Finite.check(Schema.isInt().annotate({ expected: "an integer" })).check(Schema.isGreaterThanOrEqualTo(100).annotate({ expected: "a value greater than or equal to 100" })).check(Schema.isLessThanOrEqualTo(599).annotate({ expected: "a value less than or equal to 599" })),
+		latency: Schema.Finite.check(Schema.isFinite().annotate({ expected: "a finite number" })).check(Schema.isGreaterThanOrEqualTo(0).annotate({ expected: "a value greater than or equal to 0" }))
+	})),
+	nextCursor: Schema.Union([Schema.String, Schema.Null])
+}).annotate({ identifier: "ApiKeyActivityPage" });
+const ApiKeyMailboxAccessUpdate = /* @__PURE__ */ Schema.Struct({ sendMode: MailboxSendMode }).annotate({ identifier: "ApiKeyMailboxAccessUpdate" });
+const ApiKey = /* @__PURE__ */ Schema.Struct({
+	id: Schema.String,
+	name: Schema.String,
+	key: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
+	start: Schema.Union([Schema.String, Schema.Null]),
+	description: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
+	createdAt: Schema.String,
+	expiresAt: Schema.Union([Schema.String, Schema.Null]),
+	lastUsedAt: Schema.Union([Schema.String, Schema.Null]),
+	isActive: Schema.Boolean,
+	access: ApiKeyAccess,
+	owner: Schema.Union([ApiKeyOwner, Schema.Null])
+}).annotate({ identifier: "ApiKey" });
+const ApiKeyWithSecret = /* @__PURE__ */ Schema.Struct({
+	id: Schema.String,
+	name: Schema.String,
+	key: SensitiveString,
+	start: Schema.Union([Schema.String, Schema.Null]),
+	description: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
+	createdAt: Schema.String,
+	expiresAt: Schema.Union([Schema.String, Schema.Null]),
+	lastUsedAt: Schema.Union([Schema.String, Schema.Null]),
+	isActive: Schema.Boolean,
+	access: ApiKeyAccess,
+	owner: Schema.Union([ApiKeyOwner, Schema.Null])
+}).annotate({ identifier: "ApiKeyWithSecret" });
+const ApiKeyPage = /* @__PURE__ */ Schema.Struct({
+	items: Schema.Array(ApiKey),
+	nextCursor: Schema.Union([Schema.String, Schema.Null])
+}).annotate({ identifier: "ApiKeyPage" });
+const ApiKeysListQuery = /* @__PURE__ */ Schema.Struct({
+	limit: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
+	cursor: Schema.optionalKey(Schema.Union([Cursor, Schema.Null])),
+	status: Schema.optionalKey(Schema.Union([Schema.Union([Schema.Literal("active"), Schema.Literal("revoked")]), Schema.Null])),
+	search: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null]))
+});
+const ApiKeysList200 = ApiKeyPage;
+const ApiKeysList401 = UnauthorizedError;
+const ApiKeysList403 = ForbiddenError;
+const ApiKeysList422 = ValidationError;
+const ApiKeysList500 = InternalError;
+const ApiKeysList504 = GatewayTimeoutError;
+const ApiKeysCreateRequestJson = /* @__PURE__ */ Schema.Struct({
+	name: Schema.String.check(Schema.isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(Schema.isMaxCodePoints(32).annotate({ expected: "a string with at most 32 code points" })).check(Schema.isMaxLength(32).annotate({ expected: "a value with a length of at most 32" })),
+	description: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
+	expiresAt: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
+	access: Schema.optionalKey(Schema.Union([ApiKeyAccess, Schema.Null]).annotate({ description: "Defaults to full access. A restricted API key creating a key defaults to its own grants and cannot issue full access." }))
+});
+const ApiKeysCreate201 = ApiKeyWithSecret;
+const ApiKeysCreate401 = UnauthorizedError;
+const ApiKeysCreate402 = PaymentRequiredError;
+const ApiKeysCreate403 = ForbiddenError;
+const ApiKeysCreate404 = ResourceNotFoundError;
+const ApiKeysCreate422 = ValidationError;
+const ApiKeysCreate429 = RateLimitedError;
+const ApiKeysCreate500 = InternalError;
+const ApiKeysCreate502 = BillingProviderError;
+const ApiKeysCreate504 = GatewayTimeoutError;
+const ApiKeysGetPathParams = /* @__PURE__ */ Schema.Struct({ id: ApiKeyId });
+const ApiKeysGet200 = ApiKey;
+const ApiKeysGet401 = UnauthorizedError;
+const ApiKeysGet403 = ForbiddenError;
+const ApiKeysGet404 = ResourceNotFoundError;
+const ApiKeysGet422 = ValidationError;
+const ApiKeysGet500 = InternalError;
+const ApiKeysGet504 = GatewayTimeoutError;
+const ApiKeysUpdatePathParams = /* @__PURE__ */ Schema.Struct({ id: ApiKeyId });
+const ApiKeysUpdateRequestJson = /* @__PURE__ */ Schema.Struct({
+	name: Schema.optionalKey(Schema.Union([Schema.String.check(Schema.isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(Schema.isMaxCodePoints(32).annotate({ expected: "a string with at most 32 code points" })).check(Schema.isMaxLength(32).annotate({ expected: "a value with a length of at most 32" })), Schema.Null])),
+	description: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
+	mailboxes: Schema.optionalKey(Schema.Union([ApiKeyMailboxAccessUpdate, Schema.Null]).annotate({ description: "Changes the mailbox send mode of a key that holds mailbox access. Only a person can change it; the change applies to the key's next request." }))
+});
+const ApiKeysUpdate200 = ApiKey;
+const ApiKeysUpdate401 = UnauthorizedError;
+const ApiKeysUpdate403 = ForbiddenError;
+const ApiKeysUpdate404 = ResourceNotFoundError;
+const ApiKeysUpdate422 = ValidationError;
+const ApiKeysUpdate500 = InternalError;
+const ApiKeysUpdate504 = GatewayTimeoutError;
+const ApiKeysGetActivityPathParams = /* @__PURE__ */ Schema.Struct({ id: ApiKeyId });
+const ApiKeysGetActivityQuery = /* @__PURE__ */ Schema.Struct({
+	limit: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
+	cursor: Schema.optionalKey(Schema.Union([Cursor, Schema.Null]))
+});
+const ApiKeysGetActivity200 = ApiKeyActivityPage;
+const ApiKeysGetActivity401 = UnauthorizedError;
+const ApiKeysGetActivity403 = ForbiddenError;
+const ApiKeysGetActivity404 = ResourceNotFoundError;
+const ApiKeysGetActivity422 = ValidationError;
+const ApiKeysGetActivity500 = InternalError;
+const ApiKeysGetActivity504 = GatewayTimeoutError;
+const ApiKeysRevokePathParams = /* @__PURE__ */ Schema.Struct({ id: ApiKeyId });
+const ApiKeysRevoke200 = SuccessResponse;
+const ApiKeysRevoke401 = UnauthorizedError;
+const ApiKeysRevoke403 = ForbiddenError;
+const ApiKeysRevoke404 = ResourceNotFoundError;
+const ApiKeysRevoke422 = ValidationError;
+const ApiKeysRevoke500 = InternalError;
+const ApiKeysRevoke502 = BillingProviderError;
+const ApiKeysRevoke504 = GatewayTimeoutError;
+const ApiKeysRotatePathParams = /* @__PURE__ */ Schema.Struct({ id: ApiKeyId });
+const ApiKeysRotate200 = ApiKeyWithSecret;
+const ApiKeysRotate401 = UnauthorizedError;
+const ApiKeysRotate403 = ForbiddenError;
+const ApiKeysRotate404 = ResourceNotFoundError;
+const ApiKeysRotate422 = ValidationError;
+const ApiKeysRotate500 = InternalError;
+const ApiKeysRotate504 = GatewayTimeoutError;
+const ApiKeysGetStatsPathParams = /* @__PURE__ */ Schema.Struct({ id: ApiKeyId });
+const ApiKeysGetStatsQuery = /* @__PURE__ */ Schema.Struct({
+	after: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null])),
+	before: Schema.optionalKey(Schema.Union([Schema.String, Schema.Null]))
+});
+const ApiKeysGetStats200 = /* @__PURE__ */ Schema.Struct({
+	totalRequests: Schema.Finite.check(Schema.isInt().annotate({ expected: "an integer" })).check(Schema.isGreaterThanOrEqualTo(0).annotate({ expected: "a value greater than or equal to 0" })),
+	successfulRequests: Schema.Finite.check(Schema.isInt().annotate({ expected: "an integer" })).check(Schema.isGreaterThanOrEqualTo(0).annotate({ expected: "a value greater than or equal to 0" })),
+	failedRequests: Schema.Finite.check(Schema.isInt().annotate({ expected: "an integer" })).check(Schema.isGreaterThanOrEqualTo(0).annotate({ expected: "a value greater than or equal to 0" })),
+	dailyVolume: Schema.Array(Schema.Struct({
+		date: Schema.String,
+		requests: Schema.Finite.check(Schema.isInt().annotate({ expected: "an integer" })).check(Schema.isGreaterThanOrEqualTo(0).annotate({ expected: "a value greater than or equal to 0" }))
+	}))
+});
+const ApiKeysGetStats401 = UnauthorizedError;
+const ApiKeysGetStats403 = ForbiddenError;
+const ApiKeysGetStats404 = ResourceNotFoundError;
+const ApiKeysGetStats422 = ValidationError;
+const ApiKeysGetStats500 = InternalError;
+const ApiKeysGetStats504 = GatewayTimeoutError;
+var APIKeysGroup = class extends HttpApiGroup.make("API Keys").add(HttpApiEndpoint.get("apiKeysList", "/v1/api-keys", {
+	query: ApiKeysListQuery,
+	success: ApiKeysList200,
+	error: [
+		ApiKeysList401.pipe(HttpApiSchema.status(401)),
+		ApiKeysList403.pipe(HttpApiSchema.status(403)),
+		ApiKeysList422.pipe(HttpApiSchema.status(422)),
+		ApiKeysList500,
+		ApiKeysList504.pipe(HttpApiSchema.status(504))
+	]
+}).middleware(ApiKeySecurityMiddleware).annotate(OpenApi.Identifier, "apiKeys.list").annotate(OpenApi.Summary, "List API keys").annotate(OpenApi.Description, "Returns the organization's API keys, newest first, filterable by status and a search term matched against name and description. Pass `nextCursor` back as `cursor` for the next page; it is null on the last page."), HttpApiEndpoint.post("apiKeysCreate", "/v1/api-keys", {
+	payload: ApiKeysCreateRequestJson,
+	success: ApiKeysCreate201.pipe(HttpApiSchema.status(201)),
+	error: [
+		ApiKeysCreate401.pipe(HttpApiSchema.status(401)),
+		ApiKeysCreate402.pipe(HttpApiSchema.status(402)),
+		ApiKeysCreate403.pipe(HttpApiSchema.status(403)),
+		ApiKeysCreate404.pipe(HttpApiSchema.status(404)),
+		ApiKeysCreate422.pipe(HttpApiSchema.status(422)),
+		ApiKeysCreate429.pipe(HttpApiSchema.status(429)),
+		ApiKeysCreate500,
+		ApiKeysCreate502.pipe(HttpApiSchema.status(502)),
+		ApiKeysCreate504.pipe(HttpApiSchema.status(504))
+	]
+}).middleware(ApiKeySecurityMiddleware).annotate(OpenApi.Identifier, "apiKeys.create").annotate(OpenApi.Summary, "Create an API key").annotate(OpenApi.Description, "Creates a new API key for the organization and returns the created key, including the plaintext secret, with a 201 response."), HttpApiEndpoint.get("apiKeysGet", "/v1/api-keys/:id", {
+	params: ApiKeysGetPathParams,
+	success: ApiKeysGet200,
+	error: [
+		ApiKeysGet401.pipe(HttpApiSchema.status(401)),
+		ApiKeysGet403.pipe(HttpApiSchema.status(403)),
+		ApiKeysGet404.pipe(HttpApiSchema.status(404)),
+		ApiKeysGet422.pipe(HttpApiSchema.status(422)),
+		ApiKeysGet500,
+		ApiKeysGet504.pipe(HttpApiSchema.status(504))
+	]
+}).middleware(ApiKeySecurityMiddleware).annotate(OpenApi.Identifier, "apiKeys.get").annotate(OpenApi.Summary, "Get an API key").annotate(OpenApi.Description, "Returns the API key with the given ID, including its metadata and access."), HttpApiEndpoint.patch("apiKeysUpdate", "/v1/api-keys/:id", {
+	params: ApiKeysUpdatePathParams,
+	payload: ApiKeysUpdateRequestJson,
+	success: ApiKeysUpdate200,
+	error: [
+		ApiKeysUpdate401.pipe(HttpApiSchema.status(401)),
+		ApiKeysUpdate403.pipe(HttpApiSchema.status(403)),
+		ApiKeysUpdate404.pipe(HttpApiSchema.status(404)),
+		ApiKeysUpdate422.pipe(HttpApiSchema.status(422)),
+		ApiKeysUpdate500,
+		ApiKeysUpdate504.pipe(HttpApiSchema.status(504))
+	]
+}).middleware(ApiKeySecurityMiddleware).annotate(OpenApi.Identifier, "apiKeys.update").annotate(OpenApi.Summary, "Update an API key").annotate(OpenApi.Description, "Updates an API key's settings and returns the updated key. A field left out keeps its value."), HttpApiEndpoint.get("apiKeysGetActivity", "/v1/api-keys/:id/activity", {
+	params: ApiKeysGetActivityPathParams,
+	query: ApiKeysGetActivityQuery,
+	success: ApiKeysGetActivity200,
+	error: [
+		ApiKeysGetActivity401.pipe(HttpApiSchema.status(401)),
+		ApiKeysGetActivity403.pipe(HttpApiSchema.status(403)),
+		ApiKeysGetActivity404.pipe(HttpApiSchema.status(404)),
+		ApiKeysGetActivity422.pipe(HttpApiSchema.status(422)),
+		ApiKeysGetActivity500,
+		ApiKeysGetActivity504.pipe(HttpApiSchema.status(504))
+	]
+}).middleware(ApiKeySecurityMiddleware).annotate(OpenApi.Identifier, "apiKeys.getActivity").annotate(OpenApi.Summary, "List API key activity").annotate(OpenApi.Description, "Returns the sends attributed to an API key, newest first. Pass `nextCursor` back as `cursor` for the next page; it is null on the last page."), HttpApiEndpoint.post("apiKeysRevoke", "/v1/api-keys/:id/revoke", {
+	params: ApiKeysRevokePathParams,
+	success: ApiKeysRevoke200,
+	error: [
+		ApiKeysRevoke401.pipe(HttpApiSchema.status(401)),
+		ApiKeysRevoke403.pipe(HttpApiSchema.status(403)),
+		ApiKeysRevoke404.pipe(HttpApiSchema.status(404)),
+		ApiKeysRevoke422.pipe(HttpApiSchema.status(422)),
+		ApiKeysRevoke500,
+		ApiKeysRevoke502.pipe(HttpApiSchema.status(502)),
+		ApiKeysRevoke504.pipe(HttpApiSchema.status(504))
+	]
+}).middleware(ApiKeySecurityMiddleware).annotate(OpenApi.Identifier, "apiKeys.revoke").annotate(OpenApi.Summary, "Revoke an API key").annotate(OpenApi.Description, "Deactivates an API key so it can no longer authenticate requests. Revocation is final: a revoked key never authenticates again. Its record stays listable, so the messages it sent stay attributed to it."), HttpApiEndpoint.post("apiKeysRotate", "/v1/api-keys/:id/rotate", {
+	params: ApiKeysRotatePathParams,
+	success: ApiKeysRotate200,
+	error: [
+		ApiKeysRotate401.pipe(HttpApiSchema.status(401)),
+		ApiKeysRotate403.pipe(HttpApiSchema.status(403)),
+		ApiKeysRotate404.pipe(HttpApiSchema.status(404)),
+		ApiKeysRotate422.pipe(HttpApiSchema.status(422)),
+		ApiKeysRotate500,
+		ApiKeysRotate504.pipe(HttpApiSchema.status(504))
+	]
+}).middleware(ApiKeySecurityMiddleware).annotate(OpenApi.Identifier, "apiKeys.rotate").annotate(OpenApi.Summary, "Rotate an API key").annotate(OpenApi.Description, "Issues a replacement with the same owner, name, and access, then deactivates the existing key. Returns the new key, including the plaintext secret."), HttpApiEndpoint.get("apiKeysGetStats", "/v1/api-keys/:id/stats", {
+	params: ApiKeysGetStatsPathParams,
+	query: ApiKeysGetStatsQuery,
+	success: ApiKeysGetStats200,
+	error: [
+		ApiKeysGetStats401.pipe(HttpApiSchema.status(401)),
+		ApiKeysGetStats403.pipe(HttpApiSchema.status(403)),
+		ApiKeysGetStats404.pipe(HttpApiSchema.status(404)),
+		ApiKeysGetStats422.pipe(HttpApiSchema.status(422)),
+		ApiKeysGetStats500,
+		ApiKeysGetStats504.pipe(HttpApiSchema.status(504))
+	]
+}).middleware(ApiKeySecurityMiddleware).annotate(OpenApi.Identifier, "apiKeys.getStats").annotate(OpenApi.Summary, "Get API key send statistics").annotate(OpenApi.Description, "Returns aggregate send counts and daily volume attributed to an API key between `after` and `before`, a window of at most 90 days that defaults to the last 30 days.")).annotate(OpenApi.Description, "API key management, rotation, and usage statistics") {};
+//#endregion
+//#region src/effect/api-keys.ts
+var api_keys_exports = /* @__PURE__ */ __exportAll({
+	CreatePayload: () => ApiKeysCreateRequestJson,
+	UpdatePayload: () => ApiKeysUpdateRequestJson,
+	create: () => create,
+	get: () => get,
+	getActivity: () => getActivity,
+	getStats: () => getStats,
+	list: () => list,
+	revoke: () => revoke,
+	rotate: () => rotate,
+	update: () => update
+});
+const make = forGroup(APIKeysGroup);
+const list = make("apiKeysList");
+const create = make("apiKeysCreate");
+const get = make("apiKeysGet");
+const revoke = make("apiKeysRevoke");
+const update = make("apiKeysUpdate");
+const rotate = make("apiKeysRotate");
+const getStats = make("apiKeysGetStats");
+const getActivity = make("apiKeysGetActivity");
+//#endregion
+export { getStats as a, rotate as c, ApiKeysUpdateRequestJson as d, getActivity as i, update as l, create as n, list as o, get as r, revoke as s, api_keys_exports as t, ApiKeysCreateRequestJson as u };
+
+//# sourceMappingURL=api-keys-Ce1Y4_Ip.js.map