useyuva 0.0.16 → 0.0.18

package/dist/types/schema.gen.d.ts

@@ -301,10 +301,12 @@ export interface paths {
         /**
          * Register a push subscription
          * @description Saves the browser's `PushSubscription` (`subscription.toJSON()`) for the current session.
-         *     Registering an endpoint that is already saved updates it and moves it to this session and
-         *     person, so call it on every panel start while notification permission is granted. The
-         *     endpoint must be an `https` URL on a public address. At most 20 subscriptions per person.
-         *     404 `push_disabled` when the server has no VAPID keys.
+         *     Registering an endpoint the caller already saved updates it and moves it to this session,
+         *     so call it on every panel start while notification permission is granted. An endpoint
+         *     saved by another person is never taken over: 409 `push_endpoint_taken`. Signing out or
+         *     removing the subscription frees the endpoint. The endpoint must be an `https` URL on a
+         *     public address. At most 20 subscriptions per person. 404 `push_disabled` when the server
+         *     has no VAPID keys.
          */
         post: operations["createPushSubscription"];
         delete?: never;
@@ -887,7 +889,7 @@ export interface paths {
         /**
          * Delete an inbox
          * @description Owners, admins and API keys. Deletes its channels, conversations,
-         *     messages and attachments.
+         *     messages and attachments, and its Amazon SES tenant, when the server manages one.
          *
          *     Scope: `inboxes:manage`.
          */
@@ -1489,9 +1491,10 @@ export interface paths {
          * Export a contact's consent records
          * @description Every consent event of the contact's subscriptions to the lists the caller can see, oldest
          *     first, in the rows of `exportListConsent`: for answering a data subject's access request
-         *     (GDPR Art. 15, KVKK Art. 11).
+         *     (GDPR Art. 15, KVKK Art. 11). The rows carry IP addresses and user agents, so agents are
+         *     refused with `403 forbidden`.
          *
-         *     Scopes: `contacts:read` and `lists:read`.
+         *     Owners, admins and API keys. Scopes: `contacts:read` and `lists:read`.
          */
         get: operations["exportContactConsent"];
         put?: never;
@@ -2455,8 +2458,9 @@ export interface paths {
          *     from the public (its author no longer sees it either). On the opening post this approves or
          *     hides the whole thread. Approving a reply notifies the thread's followers.
          *
-         *     `body` (and `title` on the opening post) edits a post the calling member wrote; other
-         *     posts answer `403 forbidden`. Member sessions only.
+         *     `state` needs an owner or admin; an agent answers `403 forbidden`. `body` (and `title` on
+         *     the opening post) edits a post the calling member wrote, any role; other posts answer
+         *     `403 forbidden`. Member sessions only.
          */
         patch: operations["updateDiscussionPost"];
         trace?: never;
@@ -2474,8 +2478,8 @@ export interface paths {
          * Mark a post as spam
          * @description Hides the post (the thread, for an opening post) and every post of its author in the
          *     workspace still waiting for approval, and makes the author's later posts wait for a member
-         *     whatever the channel's setting. A member's post answers `400 validation_failed`.
-         *     Member sessions only.
+         *     whatever the channel's setting. A member's post answers `400 validation_failed`. Needs an
+         *     owner or admin; an agent answers `403 forbidden`. Member sessions only.
          */
         post: operations["markDiscussionPostSpam"];
         delete?: never;
@@ -2661,7 +2665,10 @@ export interface paths {
         };
         /**
          * A subscription with its consent events
-         * @description Scope: `lists:read`.
+         * @description The events carry the subscriber's IP address and user agent and the acting member or key,
+         *     so agents are refused with `403 forbidden`.
+         *
+         *     Owners, admins and API keys. Scope: `lists:read`.
          */
         get: operations["getSubscription"];
         put?: never;
@@ -2735,7 +2742,8 @@ export interface paths {
          *     agreed or refused from then on. Pending subscriptions are left out. Check the rows against
          *     your own records before uploading; only commercial lists need registering.
          *
-         *     Scope: `lists:read`.
+         *     The rows carry IP addresses and user agents, so agents are refused with `403 forbidden`.
+         *     Owners, admins and API keys. Scope: `lists:read`.
          */
         get: operations["exportListConsent"];
         put?: never;
@@ -3157,7 +3165,8 @@ export interface paths {
          *     (`422 image_too_large`).
          *
          *     The same image uploaded again answers `200` with the existing one. `409 image_quota` when
-         *     the workspace's images would exceed the server's limit.
+         *     the workspace's images would exceed the server's limit. A workspace can upload 30 images a
+         *     minute; more are refused with `429 rate_limited` and `Retry-After`.
          *
          *     Owners, admins and API keys. Scope: `broadcasts:write`.
          */
@@ -3214,8 +3223,9 @@ export interface paths {
          * @description A draft of an inbox. `channel_id` names the inbox's e-mail channel that sends it: one with
          *     an SMTP account and an address to send from (`409 email_channel_required`). The audience
          *     names up to 10 lists of the same inbox, up to 10 attribute conditions and the contact
-         *     languages to keep. Everything can be changed while the broadcast is a draft; the review
-         *     (`GET .../review`) says what is still missing before it can be scheduled.
+         *     languages to keep. `pace` sets its own pace (`BroadcastPace`). Everything can be changed
+         *     while the broadcast is a draft; the review (`GET .../review`) says what is still missing
+         *     before it can be scheduled.
          *
          *     Owners, admins and API keys. Scope: `broadcasts:write`. With `YUVA_BROADCASTS=off` every
          *     broadcast write answers `403 broadcasts_disabled`.
@@ -3255,7 +3265,11 @@ export interface paths {
         /**
          * Change a draft
          * @description Changes the given fields of a draft (`409 not_draft` otherwise). `channel_id: null` and
-         *     `design_id: null` clear them; `audience` replaces the whole audience.
+         *     `design_id: null` clear them; `audience` replaces the whole audience; `pace` replaces the
+         *     whole pace and `{}` removes it. While the broadcast is scheduled, preparing, sending or
+         *     paused, `pace` alone can still change (`409 invalid_state` once it finished); it applies to
+         *     the next mail, and `409 pace_too_slow` (with `days`, the estimate) refuses a pace under which
+         *     the mail still to go out would take more than 365 days.
          *
          *     Owners, admins and API keys. Scope: `broadcasts:write`.
          */
@@ -3303,9 +3317,10 @@ export interface paths {
          *     `audience_nonempty`, `merge_fields` (no field without a fallback is empty for anyone),
          *     `html_size` (at most 102 KB, where Gmail clips; a warning above 90 KB), `images_alt`
          *     (warning), `links` (warning for `http:` links), `subject` (1 to 300 characters; a warning
-         *     above 80), `daily_cap` (warning when the send will take more than one day),
-         *     `test_sent` (warning when no test went out since the last change) and `click_tracking`
-         *     (warning: links point at the server's link domain).
+         *     above 80), `daily_cap` (warning when the send will take more than one day), `pace`
+         *     (blocking when sending at the broadcast's pace, or the channel's rate if slower, would
+         *     take more than 365 days), `test_sent` (warning when no test went out since the last change)
+         *     and `click_tracking` (warning: links point at the server's link domain).
          *
          *     Owners, admins, agents of its inbox and API keys. Scope: `broadcasts:read`.
          */
@@ -3436,8 +3451,10 @@ export interface paths {
          * Resume sending
          * @description A paused broadcast continues where it stopped, whatever paused it; the bounce and
          *     complaint rates that pause it on their own count again from now. Refused like scheduling
-         *     while the workspace is suspended or keys may not schedule (`403`), and `409 invalid_state`
-         *     when it is not paused.
+         *     while the workspace is suspended or keys may not schedule (`403`), `409 invalid_state`
+         *     when it is not paused, and `409 ses_tenant_blocked` while the review item `ses_tenant`
+         *     would block it (the inbox's Amazon SES tenant is paused, or its channel lost its tenant
+         *     isolation).
          *
          *     Owners, admins and API keys. Scope: `broadcasts:send`.
          */
@@ -6486,17 +6503,25 @@ export interface paths {
         /**
          * Receive an e-mail
          * @description Called by the edge Email Worker or any MTA with the raw message and its envelope. The
-         *     signature is `v2=` and the lowercase hex HMAC-SHA256, keyed with the server's
-         *     `YUVA_INGRESS_SECRET`, over
-         *     `<X-Yuva-Timestamp>.<X-Yuva-Envelope-To>.<X-Yuva-Envelope-From>.<raw body>` (an empty
-         *     envelope sender leaves its place empty). The deprecated `v1=`, over
-         *     `<X-Yuva-Timestamp>.<X-Yuva-Envelope-To>.<raw body>`, is accepted only when
-         *     `YUVA_INGRESS_ACCEPT_V1` is set, and then the envelope sender is not trusted (it never marks
-         *     a delivery report or automatic mail). The headers and the timestamp, which must be within 5
-         *     minutes of the server's clock, are checked before the body is read. A message with a
-         *     Message-ID seen before on the same channel is accepted again without being stored twice.
-         *     At most `YUVA_INGRESS_MAX_CONCURRENT` messages are processed at once; more are answered
-         *     `503 unavailable`.
+         *     signature is `v3=<head MAC>.<body MAC>`, both lowercase hex HMAC-SHA256 keyed with the
+         *     server's `YUVA_INGRESS_SECRET`. The head MAC covers
+         *     `v3\n<X-Yuva-Timestamp>\n<X-Yuva-Envelope-To>\n<X-Yuva-Envelope-From>\n<Content-Length>`
+         *     (fields joined by a newline, the length in decimal without leading zeros, an empty envelope
+         *     sender leaving its place empty); the body MAC covers the same text, a newline and the raw
+         *     body. `Content-Length` is required. The headers, the timestamp, which must be within 5
+         *     minutes of the server's clock, and the head MAC are checked before the body is read; the
+         *     body must arrive within 30 seconds.
+         *
+         *     The deprecated `v2=`, the hex HMAC over
+         *     `<X-Yuva-Timestamp>.<X-Yuva-Envelope-To>.<X-Yuva-Envelope-From>.<raw body>`, is accepted
+         *     while `YUVA_INGRESS_ACCEPT_V2` is on (the default for now); its body is read before it is
+         *     authenticated. The deprecated `v1=`, over `<X-Yuva-Timestamp>.<X-Yuva-Envelope-To>.<raw body>`,
+         *     is accepted only when `YUVA_INGRESS_ACCEPT_V1` is set, and then the envelope sender is not
+         *     trusted (it never marks a delivery report or automatic mail). A version that is not accepted
+         *     is refused before the body is read. A message with a Message-ID seen before on the same
+         *     channel is accepted again without being stored twice. At most `YUVA_INGRESS_MAX_CONCURRENT`
+         *     messages are processed at once, counted from the signature header check, before the body is
+         *     read; more are answered `503 unavailable` without the body being read.
          *
          *     The recipient selects the channel: its exact address, then `local@` for `local+tag@`, then
          *     the domain's catch-all channel (`*@domain`). Volume never bounces mail: a sender over the
@@ -7045,7 +7070,8 @@ export interface webhooks {
         /**
          * A broadcast changed state
          * @description Scheduled, back to draft, preparing, sending (started or resumed), paused (with
-         *     `pause_reason`), sent, cancelled or failed; `previous_state` is the state before. Endpoints
+         *     `pause_reason`), sent, cancelled or failed; `previous_state` is the state before. A pace
+         *     change of a broadcast that is no longer a draft comes without `previous_state`. Endpoints
          *     of an inbox get the broadcasts of that inbox.
          */
         post: operations["webhookBroadcastUpdated"];
@@ -7640,6 +7666,7 @@ export interface components {
             ask_for_rating: boolean;
             sender: components["schemas"]["InboxSender"];
             import?: components["schemas"]["InboxImport"];
+            ses_tenant?: components["schemas"]["SesTenantStatus"];
             /** Format: date-time */
             created_at: string;
             /** Format: date-time */
@@ -7799,6 +7826,7 @@ export interface components {
             broadcast_rate: number;
             /** @description The channel's Yuva DKIM key; absent without one. */
             dkim?: components["schemas"]["EmailDkim"];
+            ses?: components["schemas"]["EmailSes"];
         };
         EmailChannelInput: {
             /**
@@ -7826,6 +7854,69 @@ export interface components {
              */
             broadcast_rate?: number;
             dkim?: components["schemas"]["EmailDkimInput"];
+            ses?: components["schemas"]["EmailSesInput"];
+        };
+        /**
+         * @description How the channel's mail through Amazon SES is isolated in an SES tenant. Absent when neither SMTP
+         *     account is Amazon SES. `source: server`: the server manages a tenant for the channel's inbox in
+         *     its own AWS account and writes `X-SES-TENANT` and `X-SES-CONFIGURATION-SET`; `channel`: the
+         *     tenant typed on the channel is written as is; `none`: no tenant header.
+         */
+        EmailSes: {
+            /** @enum {string} */
+            source: "server" | "channel" | "none";
+            /**
+             * @description `isolated`: mail carries the tenant. `pending`: Yuva is setting the tenant up.
+             *     `identity_missing`: the sending address and domain are not a verified identity in the
+             *     server's SES account; mail goes out without the tenant and broadcasts are blocked.
+             *     `paused`: Amazon SES paused the inbox's tenant; mail is refused until it is reinstated.
+             *     `not_isolated`: SES through another AWS account or region and no tenant typed.
+             *     `error`: AWS refused a step (`detail`).
+             * @enum {string}
+             */
+            state: "isolated" | "pending" | "identity_missing" | "paused" | "not_isolated" | "error";
+            /** @description The `X-SES-TENANT` value written; absent unless `isolated` or `paused`. */
+            tenant?: string;
+            /** @description The `X-SES-CONFIGURATION-SET` value written; absent without one. */
+            configuration_set?: string;
+            detail?: string;
+            /** @description The tenant typed on the channel; used when `source` is not `server`. */
+            channel_tenant?: string;
+            channel_configuration_set?: string;
+        };
+        /**
+         * @description A tenant of your own SES account for this channel's mail, for servers that do not manage
+         *     tenants. Absent keeps the stored values; an empty string removes one. Ignored while the server
+         *     manages the inbox's tenant.
+         */
+        EmailSesInput: {
+            tenant?: string;
+            configuration_set?: string;
+        };
+        /**
+         * @description The inbox's Amazon SES tenant, when the server manages one. `sending_status: disabled` means SES
+         *     paused it: the inbox's mail through the server's SES account is refused and its broadcasts pause
+         *     until the server's operator reinstates it. Other inboxes are not affected. `state: missing`
+         *     means the tenant is gone from SES: broadcasts are blocked and mail goes out without the tenant
+         *     until the server has set it up again.
+         */
+        SesTenantStatus: {
+            /** @enum {string} */
+            state: "pending" | "ready" | "error" | "missing";
+            /** @enum {string} */
+            sending_status: "enabled" | "reinstated" | "disabled";
+            /** @enum {string} */
+            reputation_impact: "none" | "low" | "high";
+            /**
+             * @description `policy`: the reputation policy or the operator; `aws`: Amazon SES itself. Only while disabled.
+             * @enum {string}
+             */
+            paused_by?: "policy" | "aws";
+            cause?: string;
+            /** Format: date-time */
+            status_at?: string;
+            /** Format: date-time */
+            checked_at?: string;
         };
         /**
          * @description A DKIM key Yuva signs the channel's broadcast mail with. `dns_name` and `dns_value` are the
@@ -11217,9 +11308,11 @@ export interface components {
          *     spam (after at least 1,000). `sender_error`: the SMTP server refused the account, its TLS or
          *     too many mails in a row (`state_detail` has its answer). `workspace_suspended`: the
          *     workspace was suspended from sending. `operator`: the server's operator paused it.
+         *     `ses_tenant`: Amazon SES paused the inbox's tenant, or the channel lost its tenant isolation;
+         *     `state_detail` says which.
          * @enum {string}
          */
-        BroadcastPauseReason: "member" | "bounce_rate" | "complaint_rate" | "sender_error" | "workspace_suspended" | "operator";
+        BroadcastPauseReason: "member" | "bounce_rate" | "complaint_rate" | "sender_error" | "workspace_suspended" | "operator" | "ses_tenant";
         /**
          * @description Compares the contact attribute named by `attribute`: `eq`, `neq`, `contains` (text,
          *     ignoring case) and `gt`, `lt` (as numbers when both sides are numbers, else as text) with
@@ -11344,8 +11437,15 @@ export interface components {
             /**
              * Format: date-time
              * @description The workspace's daily limit is reached; sending continues at this time (the next 00:00 UTC).
+             *     The broadcast's own pace shows in `pace_next_at`.
              */
             waiting_until?: string;
+            pace?: components["schemas"]["BroadcastPace"];
+            /**
+             * Format: date-time
+             * @description While sending with at least a minute between mails: the earliest time the next mail may go out.
+             */
+            pace_next_at?: string;
             /** Format: date-time */
             started_at?: string;
             /** Format: date-time */
@@ -11394,6 +11494,7 @@ export interface components {
             utm?: boolean;
             /** @description Lowercase letters, digits, `-`, `_` and `.`; made from `name` when absent at creation. */
             utm_campaign?: string;
+            pace?: components["schemas"]["BroadcastPace"];
         };
         BroadcastUpdate: {
             /** Format: uuid */
@@ -11409,6 +11510,26 @@ export interface components {
             utm?: boolean;
             /** @description Lowercase letters, digits, `-`, `_` and `.`; made from `name` when absent at creation. */
             utm_campaign?: string;
+            /** @description Replaces the whole pace; `{}` removes it. */
+            pace?: components["schemas"]["BroadcastPace"];
+        };
+        /**
+         * @description The broadcast's own pace, below the channel's `broadcast_rate` and the workspace's daily limit:
+         *     at most `per_hour` mails in any 60 minutes, `per_day` in any 24 hours and `per_month` in any
+         *     30 days. Mails are spaced evenly at the gap of the tightest one (3,600 / `per_hour`,
+         *     86,400 / `per_day` or 2,592,000 / `per_month` seconds). Every SMTP attempt counts, retries
+         *     included; skipped recipients do not. An empty object is no pace.
+         */
+        BroadcastPace: {
+            /** Format: int32 */
+            per_hour?: number;
+            /** Format: int32 */
+            per_day?: number;
+            /**
+             * Format: int32
+             * @description Any 30 days, not a calendar month.
+             */
+            per_month?: number;
         };
         BroadcastPage: {
             items: components["schemas"]["Broadcast"][];
@@ -11454,7 +11575,7 @@ export interface components {
             by_list: components["schemas"]["BroadcastListCount"][];
         };
         /** @enum {string} */
-        BroadcastReviewKey: "sender_identity" | "sender_ready" | "approval" | "design" | "audience_nonempty" | "merge_fields" | "html_size" | "images_alt" | "links" | "subject" | "deliverability" | "daily_cap" | "test_sent" | "click_tracking";
+        BroadcastReviewKey: "sender_identity" | "sender_ready" | "approval" | "design" | "audience_nonempty" | "merge_fields" | "html_size" | "images_alt" | "links" | "subject" | "deliverability" | "daily_cap" | "pace" | "test_sent" | "click_tracking" | "ses_tenant";
         /** @enum {string} */
         BroadcastReviewStatus: "ok" | "warning" | "blocking";
         BroadcastReviewItem: {
@@ -11478,6 +11599,12 @@ export interface components {
              * @description How many UTC days sending takes under the workspace's daily limit; absent without a limit.
              */
             days?: number;
+            /**
+             * Format: int64
+             * @description About how long sending takes from its start: the slowest of the pace, the channel's rate and
+             *     the workspace's daily limit (as if no other broadcast used it). Absent when nobody would get it.
+             */
+            duration_seconds?: number;
             items: components["schemas"]["BroadcastReviewItem"][];
         };
         BroadcastProblem: components["schemas"]["Problem"] & {
@@ -11636,7 +11763,7 @@ export interface components {
             previous_state?: components["schemas"]["BroadcastState"];
         };
         /**
-         * @description `broadcast.updated`: the broadcast changed state. Delivered to callers who hold
+         * @description `broadcast.updated`: the broadcast changed state or its pace. Delivered to callers who hold
          *     `broadcasts:read` and can see its inbox.
          */
         BroadcastEvent: {
@@ -11662,6 +11789,11 @@ export interface components {
             counts: components["schemas"]["BroadcastCounts"];
             /** Format: date-time */
             waiting_until?: string;
+            /**
+             * Format: date-time
+             * @description While sending with at least a minute between mails: the earliest time the next mail may go out.
+             */
+            pace_next_at?: string;
         };
         /**
          * @description `broadcast.progress`, on `/v1/realtime` only: the counts of a preparing or sending broadcast,
@@ -15546,6 +15678,7 @@ export interface operations {
             400: components["responses"]["Problem"];
             401: components["responses"]["Problem"];
             404: components["responses"]["Problem"];
+            409: components["responses"]["Problem"];
         };
     };
     deletePushSubscription: {
@@ -20233,6 +20366,7 @@ export interface operations {
             413: components["responses"]["Problem"];
             415: components["responses"]["Problem"];
             422: components["responses"]["Problem"];
+            429: components["responses"]["Problem"];
         };
     };
     deleteEmailImage: {
@@ -24736,6 +24870,8 @@ export interface operations {
                 /** @description Unix time in seconds. */
                 "X-Yuva-Timestamp": string;
                 "X-Yuva-Signature": string;
+                /** @description The body length in bytes; covered by the `v3` head MAC. */
+                "Content-Length": number;
             };
             path?: never;
             cookie?: never;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "useyuva",
-  "version": "0.0.16",
+  "version": "0.0.18",
   "description": "Yuva for the web: a headless client for contacts, the <yuva-chat> element, documentation page feedback and discussions, the <yuva-subscribe> mailing list form, cookieless web analytics, React hooks, a Nuxt module, a typed /v1 client and server helpers for identity tokens, webhooks and server-side analytics.",
   "license": "MIT",
   "repository": {