shipmail 0.3.0 → 0.4.1

package/README.md

@@ -18,6 +18,7 @@ Official TypeScript SDK for the [Shipmail](https://shipmail.to) API. Zero runtim
 - [Domains](#domains)
 - [Mailboxes](#mailboxes)
 - [Messages](#messages)
+- [Scheduled messages and attachments](#scheduled-messages-and-attachments)
 - [Sandbox](#sandbox)
 - [Threads](#threads)
 - [Reply scans](#reply-scans)
@@ -212,6 +213,66 @@ await shipmail.messages.reply("msg_...", {
 });
 ```
 
+## Scheduled messages and attachments
+
+Stage raw files up to 25 MB, then reference their opaque IDs from send or scheduled-update calls.
+The older base64 `attachments` field still works, but staged IDs avoid putting file bytes in JSON.
+
+```ts
+const bytes = await Bun.file("./invoice.pdf").arrayBuffer();
+const attachment = await shipmail.mailboxes.stageAttachment("mbx_...", {
+  filename: "invoice.pdf",
+  content_type: "application/pdf",
+  data: bytes,
+});
+
+const scheduled = await shipmail.messages.send({
+  mailbox_id: "mbx_...",
+  to: ["customer@example.com"],
+  subject: "Invoice",
+  text: "Attached.",
+  staged_attachment_ids: [attachment.id],
+  scheduled_at: "2026-08-01T08:00:00.000Z",
+});
+
+const pending = await shipmail.scheduledMessages.list();
+const detail = await shipmail.scheduledMessages.get(scheduled.id);
+await shipmail.scheduledMessages.update(scheduled.id, {
+  to: detail.to,
+  subject: detail.subject,
+  text: detail.text ?? "",
+  staged_attachment_ids: [attachment.id],
+  scheduled_at: "2026-08-02T08:00:00.000Z",
+});
+await shipmail.scheduledMessages.cancel(scheduled.id);
+```
+
+Staged IDs expire after 24 hours and are bound to the API key, organization, mailbox, and file
+metadata that created them.
+
+For browser-hosted components that must keep the ShipMail API key off the page, prepare a
+five-minute, single-use upload URL:
+
+```ts
+const prepared = await shipmail.mailboxes.prepareStagedAttachmentUpload("mbx_...", {
+  filename: "invoice.pdf",
+  content_type: "application/pdf",
+  size: bytes.byteLength,
+  sha256: "<lowercase SHA-256 of the exact bytes>",
+});
+
+await fetch(prepared.upload_url, {
+  method: "POST",
+  body: bytes,
+  headers: { "Content-Type": prepared.content_type },
+  credentials: "omit",
+  redirect: "error",
+});
+```
+
+The upload succeeds only when filename, MIME type, byte size, and digest match the preparation
+request. The returned upload URL is a secret and cannot be replayed after a successful upload.
+
 ## Sandbox
 
 Create a test API key (`sm_test_...`) to simulate email without contacting real recipients. Test messages, threads, Assistant automations, webhooks, quota, suppressions, and reputation are isolated from live mode.

package/dist/api-key-scopes.cjs

@@ -0,0 +1,86 @@
+'use strict';
+
+// src/api-key-scopes.ts
+var API_KEY_SCOPES = [
+  "*",
+  "audiences:read",
+  "audiences:write",
+  "booking_pages:read",
+  "booking_pages:write",
+  "calendar:read",
+  "calendar:write",
+  "domains:read",
+  "domains:write",
+  "mailboxes:read",
+  "mailboxes:export",
+  "mailboxes:write",
+  "mailbox_credentials:read",
+  "mailbox_credentials:write",
+  "mailbox_forwarding:read",
+  "mailbox_forwarding:write",
+  "messages:read",
+  "messages:write",
+  "drafts:write",
+  "messages:send",
+  "newsletters:read",
+  "newsletters:write",
+  "threads:read",
+  "webhooks:read",
+  "webhooks:write",
+  "suppressions:read",
+  "suppressions:write",
+  "partner:organizations:read",
+  "partner:organizations:write",
+  "partner:organizations:access",
+  "partner:mailbox_credentials:issue",
+  "partner:usage:read"
+];
+var API_KEY_SCOPE_DESCRIPTIONS = {
+  "*": "All non-partner API endpoints in this organization.",
+  "audiences:read": "List and retrieve newsletter audiences and their subscribers.",
+  "audiences:write": "Create audiences and add, update, or remove their subscribers.",
+  "booking_pages:read": "List and retrieve booking pages.",
+  "booking_pages:write": "Create, update, and delete booking pages.",
+  "calendar:read": "List and retrieve calendar events and open availability.",
+  "calendar:write": "Create, update, and delete calendar events.",
+  "domains:read": "List, retrieve, and verify domains.",
+  "domains:write": "Create, update, and delete domains.",
+  "mailboxes:read": "List and retrieve mailboxes.",
+  "mailboxes:export": "Create and download mailbox content exports.",
+  "mailboxes:write": "Create, update, suspend, resume, and delete mailboxes.",
+  "mailbox_credentials:read": "List revocable app passwords for allowed mailboxes.",
+  "mailbox_credentials:write": "Create and revoke app passwords for allowed mailboxes.",
+  "mailbox_forwarding:read": "List forwarding destinations for allowed mailboxes.",
+  "mailbox_forwarding:write": "Create and remove forwarding destinations for allowed mailboxes.",
+  "messages:read": "List and retrieve messages.",
+  "messages:write": "Update, move, delete, and inject sandbox messages.",
+  "drafts:write": "Create agent-safe reply drafts with server-derived recipients.",
+  "messages:send": "Send messages, replies, and approved reply drafts.",
+  "newsletters:read": "List and retrieve newsletter drafts and campaigns.",
+  "newsletters:write": "Create, update, test, schedule, cancel, and resume newsletters.",
+  "threads:read": "List threads and retrieve thread messages.",
+  "webhooks:read": "List webhooks, retrieve webhooks, and list deliveries.",
+  "webhooks:write": "Create, update, delete, test, and rotate webhooks.",
+  "suppressions:read": "List suppressed recipient addresses.",
+  "suppressions:write": "Remove addresses from the suppression list.",
+  "partner:organizations:read": "List and retrieve this partner's child organizations.",
+  "partner:organizations:write": "Create and manage this partner's child organizations.",
+  "partner:organizations:access": "Act on an active child using the delegated organization header.",
+  "partner:mailbox_credentials:issue": "List and consume operator-approved grants for embedded-webmail credentials.",
+  "partner:usage:read": "Read consolidated child and mailbox usage for this partner."
+};
+function isApiKeyScope(value) {
+  return API_KEY_SCOPES.some((scope) => scope === value);
+}
+function apiKeyScopesGrant(grantedScopes, requiredScope) {
+  if (requiredScope === "public") return true;
+  if (requiredScope.startsWith("partner:")) return grantedScopes.includes(requiredScope);
+  return grantedScopes.includes("*") || grantedScopes.includes(requiredScope);
+}
+
+exports.API_KEY_SCOPES = API_KEY_SCOPES;
+exports.API_KEY_SCOPE_DESCRIPTIONS = API_KEY_SCOPE_DESCRIPTIONS;
+exports.apiKeyScopesGrant = apiKeyScopesGrant;
+exports.isApiKeyScope = isApiKeyScope;
+//# sourceMappingURL=api-key-scopes.cjs.map
+//# sourceMappingURL=api-key-scopes.cjs.map

package/dist/api-key-scopes.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/api-key-scopes.ts"],"names":[],"mappings":";;;AAAO,IAAM,cAAA,GAAiB;AAAA,EAC5B,GAAA;AAAA,EACA,gBAAA;AAAA,EACA,iBAAA;AAAA,EACA,oBAAA;AAAA,EACA,qBAAA;AAAA,EACA,eAAA;AAAA,EACA,gBAAA;AAAA,EACA,cAAA;AAAA,EACA,eAAA;AAAA,EACA,gBAAA;AAAA,EACA,kBAAA;AAAA,EACA,iBAAA;AAAA,EACA,0BAAA;AAAA,EACA,2BAAA;AAAA,EACA,yBAAA;AAAA,EACA,0BAAA;AAAA,EACA,eAAA;AAAA,EACA,gBAAA;AAAA,EACA,cAAA;AAAA,EACA,eAAA;AAAA,EACA,kBAAA;AAAA,EACA,mBAAA;AAAA,EACA,cAAA;AAAA,EACA,eAAA;AAAA,EACA,gBAAA;AAAA,EACA,mBAAA;AAAA,EACA,oBAAA;AAAA,EACA,4BAAA;AAAA,EACA,6BAAA;AAAA,EACA,8BAAA;AAAA,EACA,mCAAA;AAAA,EACA;AACF;AAIO,IAAM,0BAAA,GAAoE;AAAA,EAC/E,GAAA,EAAK,qDAAA;AAAA,EACL,gBAAA,EAAkB,+DAAA;AAAA,EAClB,iBAAA,EAAmB,gEAAA;AAAA,EACnB,oBAAA,EAAsB,kCAAA;AAAA,EACtB,qBAAA,EAAuB,2CAAA;AAAA,EACvB,eAAA,EAAiB,0DAAA;AAAA,EACjB,gBAAA,EAAkB,6CAAA;AAAA,EAClB,cAAA,EAAgB,qCAAA;AAAA,EAChB,eAAA,EAAiB,qCAAA;AAAA,EACjB,gBAAA,EAAkB,8BAAA;AAAA,EAClB,kBAAA,EAAoB,8CAAA;AAAA,EACpB,iBAAA,EAAmB,wDAAA;AAAA,EACnB,0BAAA,EAA4B,qDAAA;AAAA,EAC5B,2BAAA,EAA6B,wDAAA;AAAA,EAC7B,yBAAA,EAA2B,qDAAA;AAAA,EAC3B,0BAAA,EAA4B,kEAAA;AAAA,EAC5B,eAAA,EAAiB,6BAAA;AAAA,EACjB,gBAAA,EAAkB,oDAAA;AAAA,EAClB,cAAA,EAAgB,gEAAA;AAAA,EAChB,eAAA,EAAiB,oDAAA;AAAA,EACjB,kBAAA,EAAoB,oDAAA;AAAA,EACpB,mBAAA,EAAqB,iEAAA;AAAA,EACrB,cAAA,EAAgB,4CAAA;AAAA,EAChB,eAAA,EAAiB,wDAAA;AAAA,EACjB,gBAAA,EAAkB,oDAAA;AAAA,EAClB,mBAAA,EAAqB,sCAAA;AAAA,EACrB,oBAAA,EAAsB,6CAAA;AAAA,EACtB,4BAAA,EAA8B,uDAAA;AAAA,EAC9B,6BAAA,EAA+B,uDAAA;AAAA,EAC/B,8BAAA,EAAgC,iEAAA;AAAA,EAChC,mCAAA,EACE,6EAAA;AAAA,EACF,oBAAA,EAAsB;AACxB;AAEO,SAAS,cAAc,KAAA,EAAqC;AACjE,EAAA,OAAO,cAAA,CAAe,IAAA,CAAK,CAAC,KAAA,KAAU,UAAU,KAAK,CAAA;AACvD;AAEO,SAAS,iBAAA,CACd,eACA,aAAA,EACS;AACT,EAAA,IAAI,aAAA,KAAkB,UAAU,OAAO,IAAA;AACvC,EAAA,IAAI,cAAc,UAAA,CAAW,UAAU,GAAG,OAAO,aAAA,CAAc,SAAS,aAAa,CAAA;AACrF,EAAA,OAAO,cAAc,QAAA,CAAS,GAAG,CAAA,IAAK,aAAA,CAAc,SAAS,aAAa,CAAA;AAC5E","file":"api-key-scopes.cjs","sourcesContent":["export const API_KEY_SCOPES = [\n  \"*\",\n  \"audiences:read\",\n  \"audiences:write\",\n  \"booking_pages:read\",\n  \"booking_pages:write\",\n  \"calendar:read\",\n  \"calendar:write\",\n  \"domains:read\",\n  \"domains:write\",\n  \"mailboxes:read\",\n  \"mailboxes:export\",\n  \"mailboxes:write\",\n  \"mailbox_credentials:read\",\n  \"mailbox_credentials:write\",\n  \"mailbox_forwarding:read\",\n  \"mailbox_forwarding:write\",\n  \"messages:read\",\n  \"messages:write\",\n  \"drafts:write\",\n  \"messages:send\",\n  \"newsletters:read\",\n  \"newsletters:write\",\n  \"threads:read\",\n  \"webhooks:read\",\n  \"webhooks:write\",\n  \"suppressions:read\",\n  \"suppressions:write\",\n  \"partner:organizations:read\",\n  \"partner:organizations:write\",\n  \"partner:organizations:access\",\n  \"partner:mailbox_credentials:issue\",\n  \"partner:usage:read\",\n] as const;\n\nexport type ApiKeyScope = (typeof API_KEY_SCOPES)[number];\n\nexport const API_KEY_SCOPE_DESCRIPTIONS: Readonly<Record<ApiKeyScope, string>> = {\n  \"*\": \"All non-partner API endpoints in this organization.\",\n  \"audiences:read\": \"List and retrieve newsletter audiences and their subscribers.\",\n  \"audiences:write\": \"Create audiences and add, update, or remove their subscribers.\",\n  \"booking_pages:read\": \"List and retrieve booking pages.\",\n  \"booking_pages:write\": \"Create, update, and delete booking pages.\",\n  \"calendar:read\": \"List and retrieve calendar events and open availability.\",\n  \"calendar:write\": \"Create, update, and delete calendar events.\",\n  \"domains:read\": \"List, retrieve, and verify domains.\",\n  \"domains:write\": \"Create, update, and delete domains.\",\n  \"mailboxes:read\": \"List and retrieve mailboxes.\",\n  \"mailboxes:export\": \"Create and download mailbox content exports.\",\n  \"mailboxes:write\": \"Create, update, suspend, resume, and delete mailboxes.\",\n  \"mailbox_credentials:read\": \"List revocable app passwords for allowed mailboxes.\",\n  \"mailbox_credentials:write\": \"Create and revoke app passwords for allowed mailboxes.\",\n  \"mailbox_forwarding:read\": \"List forwarding destinations for allowed mailboxes.\",\n  \"mailbox_forwarding:write\": \"Create and remove forwarding destinations for allowed mailboxes.\",\n  \"messages:read\": \"List and retrieve messages.\",\n  \"messages:write\": \"Update, move, delete, and inject sandbox messages.\",\n  \"drafts:write\": \"Create agent-safe reply drafts with server-derived recipients.\",\n  \"messages:send\": \"Send messages, replies, and approved reply drafts.\",\n  \"newsletters:read\": \"List and retrieve newsletter drafts and campaigns.\",\n  \"newsletters:write\": \"Create, update, test, schedule, cancel, and resume newsletters.\",\n  \"threads:read\": \"List threads and retrieve thread messages.\",\n  \"webhooks:read\": \"List webhooks, retrieve webhooks, and list deliveries.\",\n  \"webhooks:write\": \"Create, update, delete, test, and rotate webhooks.\",\n  \"suppressions:read\": \"List suppressed recipient addresses.\",\n  \"suppressions:write\": \"Remove addresses from the suppression list.\",\n  \"partner:organizations:read\": \"List and retrieve this partner's child organizations.\",\n  \"partner:organizations:write\": \"Create and manage this partner's child organizations.\",\n  \"partner:organizations:access\": \"Act on an active child using the delegated organization header.\",\n  \"partner:mailbox_credentials:issue\":\n    \"List and consume operator-approved grants for embedded-webmail credentials.\",\n  \"partner:usage:read\": \"Read consolidated child and mailbox usage for this partner.\",\n};\n\nexport function isApiKeyScope(value: string): value is ApiKeyScope {\n  return API_KEY_SCOPES.some((scope) => scope === value);\n}\n\nexport function apiKeyScopesGrant(\n  grantedScopes: readonly string[],\n  requiredScope: ApiKeyScope | \"public\",\n): boolean {\n  if (requiredScope === \"public\") return true;\n  if (requiredScope.startsWith(\"partner:\")) return grantedScopes.includes(requiredScope);\n  return grantedScopes.includes(\"*\") || grantedScopes.includes(requiredScope);\n}\n"]}

package/dist/api-key-scopes.d.cts

@@ -0,0 +1,7 @@
+declare const API_KEY_SCOPES: readonly ["*", "audiences:read", "audiences:write", "booking_pages:read", "booking_pages:write", "calendar:read", "calendar:write", "domains:read", "domains:write", "mailboxes:read", "mailboxes:export", "mailboxes:write", "mailbox_credentials:read", "mailbox_credentials:write", "mailbox_forwarding:read", "mailbox_forwarding:write", "messages:read", "messages:write", "drafts:write", "messages:send", "newsletters:read", "newsletters:write", "threads:read", "webhooks:read", "webhooks:write", "suppressions:read", "suppressions:write", "partner:organizations:read", "partner:organizations:write", "partner:organizations:access", "partner:mailbox_credentials:issue", "partner:usage:read"];
+type ApiKeyScope = (typeof API_KEY_SCOPES)[number];
+declare const API_KEY_SCOPE_DESCRIPTIONS: Readonly<Record<ApiKeyScope, string>>;
+declare function isApiKeyScope(value: string): value is ApiKeyScope;
+declare function apiKeyScopesGrant(grantedScopes: readonly string[], requiredScope: ApiKeyScope | "public"): boolean;
+
+export { API_KEY_SCOPES, API_KEY_SCOPE_DESCRIPTIONS, type ApiKeyScope, apiKeyScopesGrant, isApiKeyScope };

package/dist/api-key-scopes.d.ts

@@ -0,0 +1,7 @@
+declare const API_KEY_SCOPES: readonly ["*", "audiences:read", "audiences:write", "booking_pages:read", "booking_pages:write", "calendar:read", "calendar:write", "domains:read", "domains:write", "mailboxes:read", "mailboxes:export", "mailboxes:write", "mailbox_credentials:read", "mailbox_credentials:write", "mailbox_forwarding:read", "mailbox_forwarding:write", "messages:read", "messages:write", "drafts:write", "messages:send", "newsletters:read", "newsletters:write", "threads:read", "webhooks:read", "webhooks:write", "suppressions:read", "suppressions:write", "partner:organizations:read", "partner:organizations:write", "partner:organizations:access", "partner:mailbox_credentials:issue", "partner:usage:read"];
+type ApiKeyScope = (typeof API_KEY_SCOPES)[number];
+declare const API_KEY_SCOPE_DESCRIPTIONS: Readonly<Record<ApiKeyScope, string>>;
+declare function isApiKeyScope(value: string): value is ApiKeyScope;
+declare function apiKeyScopesGrant(grantedScopes: readonly string[], requiredScope: ApiKeyScope | "public"): boolean;
+
+export { API_KEY_SCOPES, API_KEY_SCOPE_DESCRIPTIONS, type ApiKeyScope, apiKeyScopesGrant, isApiKeyScope };

package/dist/api-key-scopes.js

@@ -0,0 +1,81 @@
+// src/api-key-scopes.ts
+var API_KEY_SCOPES = [
+  "*",
+  "audiences:read",
+  "audiences:write",
+  "booking_pages:read",
+  "booking_pages:write",
+  "calendar:read",
+  "calendar:write",
+  "domains:read",
+  "domains:write",
+  "mailboxes:read",
+  "mailboxes:export",
+  "mailboxes:write",
+  "mailbox_credentials:read",
+  "mailbox_credentials:write",
+  "mailbox_forwarding:read",
+  "mailbox_forwarding:write",
+  "messages:read",
+  "messages:write",
+  "drafts:write",
+  "messages:send",
+  "newsletters:read",
+  "newsletters:write",
+  "threads:read",
+  "webhooks:read",
+  "webhooks:write",
+  "suppressions:read",
+  "suppressions:write",
+  "partner:organizations:read",
+  "partner:organizations:write",
+  "partner:organizations:access",
+  "partner:mailbox_credentials:issue",
+  "partner:usage:read"
+];
+var API_KEY_SCOPE_DESCRIPTIONS = {
+  "*": "All non-partner API endpoints in this organization.",
+  "audiences:read": "List and retrieve newsletter audiences and their subscribers.",
+  "audiences:write": "Create audiences and add, update, or remove their subscribers.",
+  "booking_pages:read": "List and retrieve booking pages.",
+  "booking_pages:write": "Create, update, and delete booking pages.",
+  "calendar:read": "List and retrieve calendar events and open availability.",
+  "calendar:write": "Create, update, and delete calendar events.",
+  "domains:read": "List, retrieve, and verify domains.",
+  "domains:write": "Create, update, and delete domains.",
+  "mailboxes:read": "List and retrieve mailboxes.",
+  "mailboxes:export": "Create and download mailbox content exports.",
+  "mailboxes:write": "Create, update, suspend, resume, and delete mailboxes.",
+  "mailbox_credentials:read": "List revocable app passwords for allowed mailboxes.",
+  "mailbox_credentials:write": "Create and revoke app passwords for allowed mailboxes.",
+  "mailbox_forwarding:read": "List forwarding destinations for allowed mailboxes.",
+  "mailbox_forwarding:write": "Create and remove forwarding destinations for allowed mailboxes.",
+  "messages:read": "List and retrieve messages.",
+  "messages:write": "Update, move, delete, and inject sandbox messages.",
+  "drafts:write": "Create agent-safe reply drafts with server-derived recipients.",
+  "messages:send": "Send messages, replies, and approved reply drafts.",
+  "newsletters:read": "List and retrieve newsletter drafts and campaigns.",
+  "newsletters:write": "Create, update, test, schedule, cancel, and resume newsletters.",
+  "threads:read": "List threads and retrieve thread messages.",
+  "webhooks:read": "List webhooks, retrieve webhooks, and list deliveries.",
+  "webhooks:write": "Create, update, delete, test, and rotate webhooks.",
+  "suppressions:read": "List suppressed recipient addresses.",
+  "suppressions:write": "Remove addresses from the suppression list.",
+  "partner:organizations:read": "List and retrieve this partner's child organizations.",
+  "partner:organizations:write": "Create and manage this partner's child organizations.",
+  "partner:organizations:access": "Act on an active child using the delegated organization header.",
+  "partner:mailbox_credentials:issue": "List and consume operator-approved grants for embedded-webmail credentials.",
+  "partner:usage:read": "Read consolidated child and mailbox usage for this partner."
+};
+function isApiKeyScope(value) {
+  return API_KEY_SCOPES.some((scope) => scope === value);
+}
+function apiKeyScopesGrant(grantedScopes, requiredScope) {
+  if (requiredScope === "public") return true;
+  if (requiredScope.startsWith("partner:")) return grantedScopes.includes(requiredScope);
+  return grantedScopes.includes("*") || grantedScopes.includes(requiredScope);
+}
+
+export { API_KEY_SCOPES, API_KEY_SCOPE_DESCRIPTIONS, apiKeyScopesGrant, isApiKeyScope };
+//# sourceMappingURL=api-key-scopes.js.map
+//# sourceMappingURL=api-key-scopes.js.map

package/dist/api-key-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/api-key-scopes.ts"],"names":[],"mappings":";AAAO,IAAM,cAAA,GAAiB;AAAA,EAC5B,GAAA;AAAA,EACA,gBAAA;AAAA,EACA,iBAAA;AAAA,EACA,oBAAA;AAAA,EACA,qBAAA;AAAA,EACA,eAAA;AAAA,EACA,gBAAA;AAAA,EACA,cAAA;AAAA,EACA,eAAA;AAAA,EACA,gBAAA;AAAA,EACA,kBAAA;AAAA,EACA,iBAAA;AAAA,EACA,0BAAA;AAAA,EACA,2BAAA;AAAA,EACA,yBAAA;AAAA,EACA,0BAAA;AAAA,EACA,eAAA;AAAA,EACA,gBAAA;AAAA,EACA,cAAA;AAAA,EACA,eAAA;AAAA,EACA,kBAAA;AAAA,EACA,mBAAA;AAAA,EACA,cAAA;AAAA,EACA,eAAA;AAAA,EACA,gBAAA;AAAA,EACA,mBAAA;AAAA,EACA,oBAAA;AAAA,EACA,4BAAA;AAAA,EACA,6BAAA;AAAA,EACA,8BAAA;AAAA,EACA,mCAAA;AAAA,EACA;AACF;AAIO,IAAM,0BAAA,GAAoE;AAAA,EAC/E,GAAA,EAAK,qDAAA;AAAA,EACL,gBAAA,EAAkB,+DAAA;AAAA,EAClB,iBAAA,EAAmB,gEAAA;AAAA,EACnB,oBAAA,EAAsB,kCAAA;AAAA,EACtB,qBAAA,EAAuB,2CAAA;AAAA,EACvB,eAAA,EAAiB,0DAAA;AAAA,EACjB,gBAAA,EAAkB,6CAAA;AAAA,EAClB,cAAA,EAAgB,qCAAA;AAAA,EAChB,eAAA,EAAiB,qCAAA;AAAA,EACjB,gBAAA,EAAkB,8BAAA;AAAA,EAClB,kBAAA,EAAoB,8CAAA;AAAA,EACpB,iBAAA,EAAmB,wDAAA;AAAA,EACnB,0BAAA,EAA4B,qDAAA;AAAA,EAC5B,2BAAA,EAA6B,wDAAA;AAAA,EAC7B,yBAAA,EAA2B,qDAAA;AAAA,EAC3B,0BAAA,EAA4B,kEAAA;AAAA,EAC5B,eAAA,EAAiB,6BAAA;AAAA,EACjB,gBAAA,EAAkB,oDAAA;AAAA,EAClB,cAAA,EAAgB,gEAAA;AAAA,EAChB,eAAA,EAAiB,oDAAA;AAAA,EACjB,kBAAA,EAAoB,oDAAA;AAAA,EACpB,mBAAA,EAAqB,iEAAA;AAAA,EACrB,cAAA,EAAgB,4CAAA;AAAA,EAChB,eAAA,EAAiB,wDAAA;AAAA,EACjB,gBAAA,EAAkB,oDAAA;AAAA,EAClB,mBAAA,EAAqB,sCAAA;AAAA,EACrB,oBAAA,EAAsB,6CAAA;AAAA,EACtB,4BAAA,EAA8B,uDAAA;AAAA,EAC9B,6BAAA,EAA+B,uDAAA;AAAA,EAC/B,8BAAA,EAAgC,iEAAA;AAAA,EAChC,mCAAA,EACE,6EAAA;AAAA,EACF,oBAAA,EAAsB;AACxB;AAEO,SAAS,cAAc,KAAA,EAAqC;AACjE,EAAA,OAAO,cAAA,CAAe,IAAA,CAAK,CAAC,KAAA,KAAU,UAAU,KAAK,CAAA;AACvD;AAEO,SAAS,iBAAA,CACd,eACA,aAAA,EACS;AACT,EAAA,IAAI,aAAA,KAAkB,UAAU,OAAO,IAAA;AACvC,EAAA,IAAI,cAAc,UAAA,CAAW,UAAU,GAAG,OAAO,aAAA,CAAc,SAAS,aAAa,CAAA;AACrF,EAAA,OAAO,cAAc,QAAA,CAAS,GAAG,CAAA,IAAK,aAAA,CAAc,SAAS,aAAa,CAAA;AAC5E","file":"api-key-scopes.js","sourcesContent":["export const API_KEY_SCOPES = [\n  \"*\",\n  \"audiences:read\",\n  \"audiences:write\",\n  \"booking_pages:read\",\n  \"booking_pages:write\",\n  \"calendar:read\",\n  \"calendar:write\",\n  \"domains:read\",\n  \"domains:write\",\n  \"mailboxes:read\",\n  \"mailboxes:export\",\n  \"mailboxes:write\",\n  \"mailbox_credentials:read\",\n  \"mailbox_credentials:write\",\n  \"mailbox_forwarding:read\",\n  \"mailbox_forwarding:write\",\n  \"messages:read\",\n  \"messages:write\",\n  \"drafts:write\",\n  \"messages:send\",\n  \"newsletters:read\",\n  \"newsletters:write\",\n  \"threads:read\",\n  \"webhooks:read\",\n  \"webhooks:write\",\n  \"suppressions:read\",\n  \"suppressions:write\",\n  \"partner:organizations:read\",\n  \"partner:organizations:write\",\n  \"partner:organizations:access\",\n  \"partner:mailbox_credentials:issue\",\n  \"partner:usage:read\",\n] as const;\n\nexport type ApiKeyScope = (typeof API_KEY_SCOPES)[number];\n\nexport const API_KEY_SCOPE_DESCRIPTIONS: Readonly<Record<ApiKeyScope, string>> = {\n  \"*\": \"All non-partner API endpoints in this organization.\",\n  \"audiences:read\": \"List and retrieve newsletter audiences and their subscribers.\",\n  \"audiences:write\": \"Create audiences and add, update, or remove their subscribers.\",\n  \"booking_pages:read\": \"List and retrieve booking pages.\",\n  \"booking_pages:write\": \"Create, update, and delete booking pages.\",\n  \"calendar:read\": \"List and retrieve calendar events and open availability.\",\n  \"calendar:write\": \"Create, update, and delete calendar events.\",\n  \"domains:read\": \"List, retrieve, and verify domains.\",\n  \"domains:write\": \"Create, update, and delete domains.\",\n  \"mailboxes:read\": \"List and retrieve mailboxes.\",\n  \"mailboxes:export\": \"Create and download mailbox content exports.\",\n  \"mailboxes:write\": \"Create, update, suspend, resume, and delete mailboxes.\",\n  \"mailbox_credentials:read\": \"List revocable app passwords for allowed mailboxes.\",\n  \"mailbox_credentials:write\": \"Create and revoke app passwords for allowed mailboxes.\",\n  \"mailbox_forwarding:read\": \"List forwarding destinations for allowed mailboxes.\",\n  \"mailbox_forwarding:write\": \"Create and remove forwarding destinations for allowed mailboxes.\",\n  \"messages:read\": \"List and retrieve messages.\",\n  \"messages:write\": \"Update, move, delete, and inject sandbox messages.\",\n  \"drafts:write\": \"Create agent-safe reply drafts with server-derived recipients.\",\n  \"messages:send\": \"Send messages, replies, and approved reply drafts.\",\n  \"newsletters:read\": \"List and retrieve newsletter drafts and campaigns.\",\n  \"newsletters:write\": \"Create, update, test, schedule, cancel, and resume newsletters.\",\n  \"threads:read\": \"List threads and retrieve thread messages.\",\n  \"webhooks:read\": \"List webhooks, retrieve webhooks, and list deliveries.\",\n  \"webhooks:write\": \"Create, update, delete, test, and rotate webhooks.\",\n  \"suppressions:read\": \"List suppressed recipient addresses.\",\n  \"suppressions:write\": \"Remove addresses from the suppression list.\",\n  \"partner:organizations:read\": \"List and retrieve this partner's child organizations.\",\n  \"partner:organizations:write\": \"Create and manage this partner's child organizations.\",\n  \"partner:organizations:access\": \"Act on an active child using the delegated organization header.\",\n  \"partner:mailbox_credentials:issue\":\n    \"List and consume operator-approved grants for embedded-webmail credentials.\",\n  \"partner:usage:read\": \"Read consolidated child and mailbox usage for this partner.\",\n};\n\nexport function isApiKeyScope(value: string): value is ApiKeyScope {\n  return API_KEY_SCOPES.some((scope) => scope === value);\n}\n\nexport function apiKeyScopesGrant(\n  grantedScopes: readonly string[],\n  requiredScope: ApiKeyScope | \"public\",\n): boolean {\n  if (requiredScope === \"public\") return true;\n  if (requiredScope.startsWith(\"partner:\")) return grantedScopes.includes(requiredScope);\n  return grantedScopes.includes(\"*\") || grantedScopes.includes(requiredScope);\n}\n"]}

package/dist/index.cjs

@@ -2,6 +2,84 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
+// src/api-key-scopes.ts
+var API_KEY_SCOPES = [
+  "*",
+  "audiences:read",
+  "audiences:write",
+  "booking_pages:read",
+  "booking_pages:write",
+  "calendar:read",
+  "calendar:write",
+  "domains:read",
+  "domains:write",
+  "mailboxes:read",
+  "mailboxes:export",
+  "mailboxes:write",
+  "mailbox_credentials:read",
+  "mailbox_credentials:write",
+  "mailbox_forwarding:read",
+  "mailbox_forwarding:write",
+  "messages:read",
+  "messages:write",
+  "drafts:write",
+  "messages:send",
+  "newsletters:read",
+  "newsletters:write",
+  "threads:read",
+  "webhooks:read",
+  "webhooks:write",
+  "suppressions:read",
+  "suppressions:write",
+  "partner:organizations:read",
+  "partner:organizations:write",
+  "partner:organizations:access",
+  "partner:mailbox_credentials:issue",
+  "partner:usage:read"
+];
+var API_KEY_SCOPE_DESCRIPTIONS = {
+  "*": "All non-partner API endpoints in this organization.",
+  "audiences:read": "List and retrieve newsletter audiences and their subscribers.",
+  "audiences:write": "Create audiences and add, update, or remove their subscribers.",
+  "booking_pages:read": "List and retrieve booking pages.",
+  "booking_pages:write": "Create, update, and delete booking pages.",
+  "calendar:read": "List and retrieve calendar events and open availability.",
+  "calendar:write": "Create, update, and delete calendar events.",
+  "domains:read": "List, retrieve, and verify domains.",
+  "domains:write": "Create, update, and delete domains.",
+  "mailboxes:read": "List and retrieve mailboxes.",
+  "mailboxes:export": "Create and download mailbox content exports.",
+  "mailboxes:write": "Create, update, suspend, resume, and delete mailboxes.",
+  "mailbox_credentials:read": "List revocable app passwords for allowed mailboxes.",
+  "mailbox_credentials:write": "Create and revoke app passwords for allowed mailboxes.",
+  "mailbox_forwarding:read": "List forwarding destinations for allowed mailboxes.",
+  "mailbox_forwarding:write": "Create and remove forwarding destinations for allowed mailboxes.",
+  "messages:read": "List and retrieve messages.",
+  "messages:write": "Update, move, delete, and inject sandbox messages.",
+  "drafts:write": "Create agent-safe reply drafts with server-derived recipients.",
+  "messages:send": "Send messages, replies, and approved reply drafts.",
+  "newsletters:read": "List and retrieve newsletter drafts and campaigns.",
+  "newsletters:write": "Create, update, test, schedule, cancel, and resume newsletters.",
+  "threads:read": "List threads and retrieve thread messages.",
+  "webhooks:read": "List webhooks, retrieve webhooks, and list deliveries.",
+  "webhooks:write": "Create, update, delete, test, and rotate webhooks.",
+  "suppressions:read": "List suppressed recipient addresses.",
+  "suppressions:write": "Remove addresses from the suppression list.",
+  "partner:organizations:read": "List and retrieve this partner's child organizations.",
+  "partner:organizations:write": "Create and manage this partner's child organizations.",
+  "partner:organizations:access": "Act on an active child using the delegated organization header.",
+  "partner:mailbox_credentials:issue": "List and consume operator-approved grants for embedded-webmail credentials.",
+  "partner:usage:read": "Read consolidated child and mailbox usage for this partner."
+};
+function isApiKeyScope(value) {
+  return API_KEY_SCOPES.some((scope) => scope === value);
+}
+function apiKeyScopesGrant(grantedScopes, requiredScope) {
+  if (requiredScope === "public") return true;
+  if (requiredScope.startsWith("partner:")) return grantedScopes.includes(requiredScope);
+  return grantedScopes.includes("*") || grantedScopes.includes(requiredScope);
+}
+
 // src/errors.ts
 var ShipMailError = class extends Error {
   constructor(message, options) {
@@ -413,6 +491,17 @@ var Calendar = class extends ApiResource {
   }
 };
 
+// src/resources/capabilities.ts
+var Capabilities = class extends ApiResource {
+  get(options) {
+    return this.client.request({
+      method: "GET",
+      path: "/capabilities",
+      methodOptions: options
+    });
+  }
+};
+
 // src/resources/domains.ts
 var Domains = class extends ApiResource {
   create(params, options) {
@@ -495,6 +584,24 @@ var Domains = class extends ApiResource {
 
 // src/resources/mailboxes.ts
 var Mailboxes = class extends ApiResource {
+  prepareStagedAttachmentUpload(id, params, options) {
+    return this.client.request({
+      method: "POST",
+      path: `/mailboxes/${encodeURIComponent(id)}/staged-attachment-upload-tokens`,
+      body: params,
+      methodOptions: options
+    });
+  }
+  stageAttachment(id, params, options) {
+    return this.client.request({
+      method: "POST",
+      path: `/mailboxes/${encodeURIComponent(id)}/staged-attachments`,
+      query: { filename: params.filename },
+      rawBody: params.data,
+      contentType: params.content_type,
+      methodOptions: options
+    });
+  }
   injectSandboxInbound(id, params, options) {
     return this.client.request({
       method: "POST",
@@ -1157,6 +1264,44 @@ var ReplyScans = class extends ApiResource {
   }
 };
 
+// src/resources/scheduled-messages.ts
+var ScheduledMessages = class extends ApiResource {
+  list(params, options) {
+    return this.client.request({
+      method: "GET",
+      path: "/scheduled-messages",
+      query: {
+        include_held: params?.include_held,
+        search: params?.search,
+        limit: params?.limit
+      },
+      methodOptions: options
+    });
+  }
+  get(id, options) {
+    return this.client.request({
+      method: "GET",
+      path: `/scheduled-messages/${encodeURIComponent(id)}`,
+      methodOptions: options
+    });
+  }
+  update(id, params, options) {
+    return this.client.request({
+      method: "PATCH",
+      path: `/scheduled-messages/${encodeURIComponent(id)}`,
+      body: params,
+      methodOptions: options
+    });
+  }
+  cancel(id, options) {
+    return this.client.request({
+      method: "DELETE",
+      path: `/scheduled-messages/${encodeURIComponent(id)}`,
+      methodOptions: options
+    });
+  }
+};
+
 // src/resources/status.ts
 var Status = class extends ApiResource {
   get(options) {
@@ -1340,7 +1485,7 @@ var Webhooks = class extends ApiResource {
 };
 
 // src/version.ts
-var VERSION = "0.3.0";
+var VERSION = "0.4.1";
 
 // src/client.ts
 var DEFAULT_BASE_URL = "https://shipmail.to/api/v1";
@@ -1395,6 +1540,7 @@ var ShipMailClient = class {
     }
     this.audiences = new Audiences(this);
     this.bookingPages = new BookingPages(this);
+    this.capabilities = new Capabilities(this);
     this.calendar = new Calendar(this);
     this.domains = new Domains(this);
     this.mailboxes = new Mailboxes(this);
@@ -1402,6 +1548,7 @@ var ShipMailClient = class {
     this.newsletters = new Newsletters(this);
     this.partner = new Partner(this);
     this.replyScans = new ReplyScans(this);
+    this.scheduledMessages = new ScheduledMessages(this);
     this.suppressions = new Suppressions(this);
     this.threads = new Threads(this);
     this.webhooks = new Webhooks(this);
@@ -1592,6 +1739,8 @@ async function verifyWebhook(body, headers, secret, options) {
   return parsed;
 }
 
+exports.API_KEY_SCOPES = API_KEY_SCOPES;
+exports.API_KEY_SCOPE_DESCRIPTIONS = API_KEY_SCOPE_DESCRIPTIONS;
 exports.AuthenticationError = AuthenticationError;
 exports.AuthorizationError = AuthorizationError;
 exports.CONFERENCING_PROVIDER_IDS = CONFERENCING_PROVIDER_IDS;
@@ -1612,7 +1761,9 @@ exports.WEBHOOK_DELIVERY_EVENT_TYPES = WEBHOOK_DELIVERY_EVENT_TYPES;
 exports.WEBHOOK_DELIVERY_STATUSES = WEBHOOK_DELIVERY_STATUSES;
 exports.WEBHOOK_EVENT_TYPES = WEBHOOK_EVENT_TYPES;
 exports.WebhookVerificationError = WebhookVerificationError;
+exports.apiKeyScopesGrant = apiKeyScopesGrant;
 exports.default = ShipMailClient;
+exports.isApiKeyScope = isApiKeyScope;
 exports.verifyWebhook = verifyWebhook;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map