lockally 0.3.1 → 0.3.3

data/lib/lockally/models/whoami_key.rb

@@ -0,0 +1,157 @@
+=begin
+#lockally control plane
+
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+
+The version of the OpenAPI document: 0.1.0
+Contact: support@lockally.com
+Generated by: https://openapi-generator.tech
+Generator version: 7.23.0
+
+=end
+
+require 'date'
+require 'time'
+
+module Lockally
+  # Present only when auth is api_key.
+  class WhoamiKey < ApiModelBase
+    attr_accessor :id
+
+    attr_accessor :label
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    def self.attribute_map
+      {
+        :'id' => :'id',
+        :'label' => :'label'
+      }
+    end
+
+    # Returns attribute mapping this model knows about
+    def self.acceptable_attribute_map
+      attribute_map
+    end
+
+    # Returns all the JSON keys this model knows about
+    def self.acceptable_attributes
+      acceptable_attribute_map.values
+    end
+
+    # Attribute type mapping.
+    def self.openapi_types
+      {
+        :'id' => :'String',
+        :'label' => :'String'
+      }
+    end
+
+    # List of attributes with nullable: true
+    def self.openapi_nullable
+      Set.new([
+      ])
+    end
+
+    # Initializes the object
+    # @param [Hash] attributes Model attributes in the form of hash
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `Lockally::WhoamiKey` initialize method"
+      end
+
+      # check to see if the attribute exists and convert string to symbol for hash key
+      acceptable_attribute_map = self.class.acceptable_attribute_map
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!acceptable_attribute_map.key?(k.to_sym))
+          fail ArgumentError, "`#{k}` is not a valid attribute in `Lockally::WhoamiKey`. Please check the name to make sure it's valid. List of attributes: " + acceptable_attribute_map.keys.inspect
+        end
+        h[k.to_sym] = v
+      }
+
+      if attributes.key?(:'id')
+        self.id = attributes[:'id']
+      end
+
+      if attributes.key?(:'label')
+        self.label = attributes[:'label']
+      end
+    end
+
+    # Show invalid properties with the reasons. Usually used together with valid?
+    # @return Array for valid properties with the reasons
+    def list_invalid_properties
+      warn '[DEPRECATED] the `list_invalid_properties` method is obsolete'
+      invalid_properties = Array.new
+      invalid_properties
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    def valid?
+      warn '[DEPRECATED] the `valid?` method is obsolete'
+      true
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param [Object] Object to be compared
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          id == o.id &&
+          label == o.label
+    end
+
+    # @see the `==` method
+    # @param [Object] Object to be compared
+    def eql?(o)
+      self == o
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    def hash
+      [id, label].hash
+    end
+
+    # Builds the object from hash
+    # @param [Hash] attributes Model attributes in the form of hash
+    # @return [Object] Returns the model itself
+    def self.build_from_hash(attributes)
+      return nil unless attributes.is_a?(Hash)
+      attributes = attributes.transform_keys(&:to_sym)
+      transformed_hash = {}
+      openapi_types.each_pair do |key, type|
+        if attributes.key?(attribute_map[key]) && attributes[attribute_map[key]].nil?
+          transformed_hash["#{key}"] = nil
+        elsif type =~ /\AArray<(.*)>/i
+          # check to ensure the input is an array given that the attribute
+          # is documented as an array but the input is not
+          if attributes[attribute_map[key]].is_a?(Array)
+            transformed_hash["#{key}"] = attributes[attribute_map[key]].map { |v| _deserialize($1, v) }
+          end
+        elsif !attributes[attribute_map[key]].nil?
+          transformed_hash["#{key}"] = _deserialize(type, attributes[attribute_map[key]])
+        end
+      end
+      new(transformed_hash)
+    end
+
+    # Returns the object in the form of hash
+    # @return [Hash] Returns the object in the form of hash
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      hash
+    end
+
+  end
+
+end

data/lib/lockally/models/whoami_tenant.rb

@@ -0,0 +1,166 @@
+=begin
+#lockally control plane
+
+#The lockally control plane lets integrators and direct customers manage everything except actual mail data flow (which uses standard JMAP / IMAP / SMTP-submission against the data plane endpoints).  **Authentication.** All `/v1/*` endpoints require a Bearer API key in the `Authorization` header. Keys are formatted `lk_live_<8-char-prefix>_<32-char-secret>`, or `lk_test_<...>` for a test key. Create keys in the dashboard, or with `POST /v1/api-keys` using a key that holds `tenant:admin`.  The key's plan is checked on every request, so a key stops working if the account moves to a plan without API access, and works again if it moves back.  **Errors.** Failures return [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457) `application/problem+json` documents.  **Scopes.** Each endpoint requires a specific scope on the presented key. Insufficient scope returns `403` with the required scope name in `detail`. 
+
+The version of the OpenAPI document: 0.1.0
+Contact: support@lockally.com
+Generated by: https://openapi-generator.tech
+Generator version: 7.23.0
+
+=end
+
+require 'date'
+require 'time'
+
+module Lockally
+  class WhoamiTenant < ApiModelBase
+    attr_accessor :slug
+
+    # What the account calls itself.
+    attr_accessor :name
+
+    attr_accessor :plan
+
+    # Attribute mapping from ruby-style variable name to JSON key.
+    def self.attribute_map
+      {
+        :'slug' => :'slug',
+        :'name' => :'name',
+        :'plan' => :'plan'
+      }
+    end
+
+    # Returns attribute mapping this model knows about
+    def self.acceptable_attribute_map
+      attribute_map
+    end
+
+    # Returns all the JSON keys this model knows about
+    def self.acceptable_attributes
+      acceptable_attribute_map.values
+    end
+
+    # Attribute type mapping.
+    def self.openapi_types
+      {
+        :'slug' => :'String',
+        :'name' => :'String',
+        :'plan' => :'String'
+      }
+    end
+
+    # List of attributes with nullable: true
+    def self.openapi_nullable
+      Set.new([
+      ])
+    end
+
+    # Initializes the object
+    # @param [Hash] attributes Model attributes in the form of hash
+    def initialize(attributes = {})
+      if (!attributes.is_a?(Hash))
+        fail ArgumentError, "The input argument (attributes) must be a hash in `Lockally::WhoamiTenant` initialize method"
+      end
+
+      # check to see if the attribute exists and convert string to symbol for hash key
+      acceptable_attribute_map = self.class.acceptable_attribute_map
+      attributes = attributes.each_with_object({}) { |(k, v), h|
+        if (!acceptable_attribute_map.key?(k.to_sym))
+          fail ArgumentError, "`#{k}` is not a valid attribute in `Lockally::WhoamiTenant`. Please check the name to make sure it's valid. List of attributes: " + acceptable_attribute_map.keys.inspect
+        end
+        h[k.to_sym] = v
+      }
+
+      if attributes.key?(:'slug')
+        self.slug = attributes[:'slug']
+      end
+
+      if attributes.key?(:'name')
+        self.name = attributes[:'name']
+      end
+
+      if attributes.key?(:'plan')
+        self.plan = attributes[:'plan']
+      end
+    end
+
+    # Show invalid properties with the reasons. Usually used together with valid?
+    # @return Array for valid properties with the reasons
+    def list_invalid_properties
+      warn '[DEPRECATED] the `list_invalid_properties` method is obsolete'
+      invalid_properties = Array.new
+      invalid_properties
+    end
+
+    # Check to see if the all the properties in the model are valid
+    # @return true if the model is valid
+    def valid?
+      warn '[DEPRECATED] the `valid?` method is obsolete'
+      true
+    end
+
+    # Checks equality by comparing each attribute.
+    # @param [Object] Object to be compared
+    def ==(o)
+      return true if self.equal?(o)
+      self.class == o.class &&
+          slug == o.slug &&
+          name == o.name &&
+          plan == o.plan
+    end
+
+    # @see the `==` method
+    # @param [Object] Object to be compared
+    def eql?(o)
+      self == o
+    end
+
+    # Calculates hash code according to all attributes.
+    # @return [Integer] Hash code
+    def hash
+      [slug, name, plan].hash
+    end
+
+    # Builds the object from hash
+    # @param [Hash] attributes Model attributes in the form of hash
+    # @return [Object] Returns the model itself
+    def self.build_from_hash(attributes)
+      return nil unless attributes.is_a?(Hash)
+      attributes = attributes.transform_keys(&:to_sym)
+      transformed_hash = {}
+      openapi_types.each_pair do |key, type|
+        if attributes.key?(attribute_map[key]) && attributes[attribute_map[key]].nil?
+          transformed_hash["#{key}"] = nil
+        elsif type =~ /\AArray<(.*)>/i
+          # check to ensure the input is an array given that the attribute
+          # is documented as an array but the input is not
+          if attributes[attribute_map[key]].is_a?(Array)
+            transformed_hash["#{key}"] = attributes[attribute_map[key]].map { |v| _deserialize($1, v) }
+          end
+        elsif !attributes[attribute_map[key]].nil?
+          transformed_hash["#{key}"] = _deserialize(type, attributes[attribute_map[key]])
+        end
+      end
+      new(transformed_hash)
+    end
+
+    # Returns the object in the form of hash
+    # @return [Hash] Returns the object in the form of hash
+    def to_hash
+      hash = {}
+      self.class.attribute_map.each_pair do |attr, param|
+        value = self.send(attr)
+        if value.nil?
+          is_nullable = self.class.openapi_nullable.include?(attr)
+          next if !is_nullable || (is_nullable && !instance_variable_defined?(:"@#{attr}"))
+        end
+
+        hash[param] = _to_hash(value)
+      end
+      hash
+    end
+
+  end
+
+end

data/lib/lockally/version.rb

@@ -11,5 +11,5 @@ Generator version: 7.23.0
 =end
 
 module Lockally
-  VERSION = '0.3.1'
+  VERSION = '0.3.3'
 end

data/lib/lockally.rb

@@ -203,7 +203,7 @@ require 'lockally/models/thread_classification'
 require 'lockally/models/thread_list'
 require 'lockally/models/thread_message'
 require 'lockally/models/thread_message_body'
-require 'lockally/models/thread_message_body_all_of_body'
+require 'lockally/models/thread_message_body_body'
 require 'lockally/models/thread_summary'
 require 'lockally/models/unit_bundle'
 require 'lockally/models/update_admin_request'
@@ -228,6 +228,8 @@ require 'lockally/models/vacation_params'
 require 'lockally/models/vacation_responder'
 require 'lockally/models/webhook'
 require 'lockally/models/whoami'
+require 'lockally/models/whoami_key'
+require 'lockally/models/whoami_tenant'
 
 # APIs
 require 'lockally/api/add_ons_api'

data/spec/api/admin_api_spec.rb

@@ -34,7 +34,7 @@ describe 'AdminApi' do
 
   # unit tests for admin_login
   # Tenant-admin email+password login
-  # Exchanges an admin's email + password for a session token. The web console at `app.lockally.com` posts this on form submission and stores the returned token in an httpOnly cookie.  **No enumeration leak.** Wrong-email and wrong-password both return the same 401 with title \"Invalid credentials\". The argon2id verify runs even on lookup miss (well, structurally — the lookup fails fast but the response shape is constant) so timing leaks are bounded.  Tokens are prefixed `adm_sess_` and valid for 7 days. Use as the `Authorization: Bearer` value on all subsequent calls. 
+  # Exchanges an admin's email + password for a session token. The web console at `app.lockally.com` posts this on form submission and stores the returned token in an httpOnly cookie.  **No enumeration leak.** Wrong-email and wrong-password both return the same 401 with title \"Invalid credentials\". The argon2id verify runs even on lookup miss (well, structurally, the lookup fails fast but the response shape is constant) so timing leaks are bounded.  Tokens are prefixed `adm_sess_` and valid for 7 days. Use as the `Authorization: Bearer` value on all subsequent calls. 
   # @param admin_login_request 
   # @param [Hash] opts the optional parameters
   # @return [AdminLogin200Response]
@@ -46,7 +46,7 @@ describe 'AdminApi' do
 
   # unit tests for admin_logout
   # Invalidate the current admin session
-  # Deletes the session row from the database. Idempotent — calling logout on an already-invalid token returns 204 anyway. 
+  # Deletes the session row from the database. Idempotent, calling logout on an already-invalid token returns 204 anyway. 
   # @param [Hash] opts the optional parameters
   # @return [nil]
   describe 'admin_logout test' do
@@ -57,7 +57,7 @@ describe 'AdminApi' do
 
   # unit tests for get_current_admin
   # Get the current admin + tenant
-  # Returns the admin profile + tenant for the session token presented in `Authorization: Bearer`. Used by the web console's layout load function to populate the sidebar.  Returns 403 if called with an API key (lk_live_*) bearer — admin context only exists for session tokens. 
+  # Returns the admin profile + tenant for the session token presented in `Authorization: Bearer`. Used by the web console's layout load function to populate the sidebar.  Returns 403 if called with an API key (lk_live_*) bearer, admin context only exists for session tokens. 
   # @param [Hash] opts the optional parameters
   # @return [GetCurrentAdmin200Response]
   describe 'get_current_admin test' do

data/spec/api/admins_api_spec.rb

@@ -68,7 +68,7 @@ describe 'AdminsApi' do
 
   # unit tests for update_admin
   # Update an admin
-  # Supply at least one of `password`, `display_name`, `role`, `disabled`.  **Safety rails.** A session bearer (adm_sess_*) cannot disable itself — use another admin or an API key (which bypasses the self-rail). Disabling the last active admin returns 409 to prevent orphaning the tenant from its console. 
+  # Supply at least one of `password`, `display_name`, `role`, `disabled`.  **Safety rails.** A session bearer (adm_sess_*) cannot disable itself, use another admin or an API key (which bypasses the self-rail). Disabling the last active admin returns 409 to prevent orphaning the tenant from its console. 
   # @param id 
   # @param update_admin_request 
   # @param [Hash] opts the optional parameters

data/spec/api/agents_api_spec.rb

@@ -72,7 +72,7 @@ describe 'AgentsApi' do
 
   # unit tests for grant_api_key_mailbox
   # Grant a mailbox to a key
-  # Body: {\"mailbox\": \"email or id\"}. Refused (422) for mailboxes with agent access disabled or an active E2E encryption key — the server cannot read E2E mailboxes.
+  # Body: {\"mailbox\": \"email or id\"}. Refused (422) for mailboxes with agent access disabled or an active E2E encryption key, the server cannot read E2E mailboxes.
   # @param key_id 
   # @param [Hash] opts the optional parameters
   # @return [MailboxGrant]
@@ -146,7 +146,7 @@ describe 'AgentsApi' do
 
   # unit tests for reply_to_thread
   # Reply in-thread (agent stream)
-  # The server builds In-Reply-To/References and defaults recipients + subject from the conversation — a minimal call is {\"text\": \"...\"}. Guarded by the reply-loop detector (≥5 outbound/10min → 429 + agent.loop_detected). Idempotency-Key required.
+  # The server builds In-Reply-To/References and defaults recipients + subject from the conversation, a minimal call is {\"text\": \"...\"}. Guarded by the reply-loop detector (≥5 outbound/10min → 429 + agent.loop_detected). Idempotency-Key required.
   # @param thread_id 
   # @param idempotency_key 
   # @param [Hash] opts the optional parameters

data/spec/api/ai_api_spec.rb

@@ -34,7 +34,7 @@ describe 'AiApi' do
 
   # unit tests for classify_thread
   # LLM-classify a thread
-  # Returns {intent, urgency, summary, suggested_action} via the tenant's AI tier (BYOK or prepaid units — see /v1/ai-config). Cached per thread state: unchanged threads return the cache free; ?refresh=true forces a re-run. A failed model call charges nothing. 402 when the AI tier is off.
+  # Returns {intent, urgency, summary, suggested_action} via the tenant's AI tier (BYOK or prepaid units, see /v1/ai-config). Cached per thread state: unchanged threads return the cache free; ?refresh=true forces a re-run. A failed model call charges nothing. 402 when the AI tier is off.
   # @param thread_id 
   # @param [Hash] opts the optional parameters
   # @option opts [Boolean] :refresh 

data/spec/api/aliases_api_spec.rb

@@ -46,7 +46,7 @@ describe 'AliasesApi' do
 
   # unit tests for delete_alias
   # Delete an alias
-  # Hard-delete (no soft-delete window — aliases are cheap to recreate).
+  # Hard-delete (no soft-delete window, aliases are cheap to recreate).
   # @param address 
   # @param [Hash] opts the optional parameters
   # @return [nil]

data/spec/api/api_keys_api_spec.rb

@@ -34,7 +34,7 @@ describe 'ApiKeysApi' do
 
   # unit tests for create_api_key
   # Create an API key
-  # Provisions a fresh API key for the calling tenant.  **The full `secret` is included in this response ONLY** — store it immediately. The cleartext secret is not recoverable from the argon2id hash kept server-side; rotate by creating a new key and revoking the old one. 
+  # Provisions a fresh API key for the calling tenant.  **The full `secret` is included in this response ONLY**, store it immediately. The cleartext secret is not recoverable from the argon2id hash kept server-side; rotate by creating a new key and revoking the old one. 
   # @param create_api_key_request 
   # @param [Hash] opts the optional parameters
   # @return [CreateApiKey201Response]
@@ -46,7 +46,7 @@ describe 'ApiKeysApi' do
 
   # unit tests for list_api_keys
   # List API keys
-  # Returns all API keys (active and revoked) belonging to the calling tenant. The `secret` is **never** returned — only prefix + metadata. 
+  # Returns all API keys (active and revoked) belonging to the calling tenant. The `secret` is **never** returned, only prefix + metadata. 
   # @param [Hash] opts the optional parameters
   # @return [ListApiKeys200Response]
   describe 'list_api_keys test' do
@@ -57,7 +57,7 @@ describe 'ApiKeysApi' do
 
   # unit tests for revoke_api_key
   # Revoke an API key
-  # Soft-deletes (sets `revoked_at`) on the named key. The row stays for audit purposes; the key no longer authenticates.  You **cannot revoke the key currently being used** to make this call — that would lock you out. Use a different `tenant:admin` key. 
+  # Soft-deletes (sets `revoked_at`) on the named key. The row stays for audit purposes; the key no longer authenticates.  You **cannot revoke the key currently being used** to make this call, that would lock you out. Use a different `tenant:admin` key. 
   # @param id 
   # @param [Hash] opts the optional parameters
   # @return [nil]

data/spec/api/domains_api_spec.rb

@@ -34,7 +34,7 @@ describe 'DomainsApi' do
 
   # unit tests for create_domain
   # Register a domain
-  # Registers a new domain for the calling tenant. Generates a DKIM keypair and verification token. Returns DNS instructions the tenant must publish under their own DNS (verification TXT, SPF include, DKIM TXT, MX records to `mx1`/`mx2.lockally.com`, DMARC seed).  **Idempotent** — re-posting the same domain returns the existing record with the same DKIM keys and token (regenerating would break the tenant's published DNS). Returns 200 on idempotent hit, 201 on first create.  Returns 409 if the domain is already claimed by a different tenant. 
+  # Registers a new domain for the calling tenant. Generates a DKIM keypair and verification token. Returns DNS instructions the tenant must publish under their own DNS (verification TXT, SPF include, DKIM TXT, MX records to `mx1`/`mx2.lockally.com`, DMARC seed).  **Idempotent**, re-posting the same domain returns the existing record with the same DKIM keys and token (regenerating would break the tenant's published DNS). Returns 200 on idempotent hit, 201 on first create.  Returns 409 if the domain is already claimed by a different tenant. 
   # @param create_domain_request 
   # @param [Hash] opts the optional parameters
   # @return [Domain]
@@ -46,7 +46,7 @@ describe 'DomainsApi' do
 
   # unit tests for delete_domain
   # Delete a domain
-  # Removes the domain registration. Refuses with 409 if any mailbox is still attached — delete the mailboxes first. 
+  # Removes the domain registration. Refuses with 409 if any mailbox is still attached, delete the mailboxes first. 
   # @param domain 
   # @param [Hash] opts the optional parameters
   # @return [nil]
@@ -116,7 +116,7 @@ describe 'DomainsApi' do
 
   # unit tests for verify_domain
   # Force-poll DNS verification
-  # Synchronously checks the `_lockally-verify.<domain>` TXT record against the stored verification token. Returns 200 either way: the returned `verified` boolean tells you whether DNS now confirms. Caller polls until `verified: true`. In v2 a background worker auto-polls and fires a `domain.verified` webhook. 
+  # Synchronously checks the `_lockally-verify.<domain>` TXT record against the stored verification token. Returns 200 either way: the returned `verified` boolean tells you whether DNS now confirms. Caller polls until `verified: true`. A later version may have the platform auto-polls and fires a `domain.verified` webhook. 
   # @param domain 
   # @param [Hash] opts the optional parameters
   # @return [Domain]

data/spec/api/mailboxes_api_spec.rb

@@ -46,7 +46,7 @@ describe 'MailboxesApi' do
 
   # unit tests for create_mailbox
   # Create a mailbox
-  # Creates a mailbox on a tenant-verified domain. If `password` is omitted, lockally generates a 16-char password and returns it in the response — shown once.  **Gate.** The mailbox's domain must already be registered AND verified for this tenant (via `/v1/domains` + `/v1/domains/{domain}/verify`).  **Idempotent.** Re-posting the same email returns the existing mailbox UNTOUCHED — password is NOT regenerated. To change a password, use PATCH instead. 
+  # Creates a mailbox on a tenant-verified domain. If `password` is omitted, lockally generates a 16-char password and returns it in the response, shown once.  **Gate.** The mailbox's domain must already be registered AND verified for this tenant (via `/v1/domains` + `/v1/domains/{domain}/verify`).  **Idempotent.** Re-posting the same email returns the existing mailbox UNTOUCHED, password is NOT regenerated. To change a password, use PATCH instead. 
   # @param create_mailbox_request 
   # @param [Hash] opts the optional parameters
   # @return [Mailbox]
@@ -70,7 +70,7 @@ describe 'MailboxesApi' do
 
   # unit tests for delete_vacation_responder
   # Remove the vacation responder
-  # Idempotent — 204 whether or not a row existed.
+  # Idempotent, 204 whether or not a row existed.
   # @param email 
   # @param [Hash] opts the optional parameters
   # @return [nil]
@@ -82,7 +82,7 @@ describe 'MailboxesApi' do
 
   # unit tests for download_mailbox_export
   # Download a previously-issued mailbox export
-  # Public endpoint (no Authorization header). Validates the one-shot token from the URL, marks it used, and streams an mbox file. Second GET with the same token returns 404 — tokens are single-use. 
+  # Public endpoint (no Authorization header). Validates the one-shot token from the URL, marks it used, and streams an mbox file. Second GET with the same token returns 404, tokens are single-use. 
   # @param email 
   # @param token 
   # @param [Hash] opts the optional parameters
@@ -95,7 +95,7 @@ describe 'MailboxesApi' do
 
   # unit tests for export_mailbox
   # Request a mailbox export
-  # Issues a one-shot \"presigned\" download URL for the mailbox's content in mbox format. The URL works without an Authorization header — the token in the query string is the authz. TTL is 5 minutes; the token is consumed on first GET.  **v1 caveat:** the synthesized mbox only contains outbound mail (from `lockally.messages`). v2 swaps in Stalwart's export primitive for full inbox + folder structure + flags. The endpoint contract stays unchanged.  **Scope changed:** this used to accept `mailboxes:read`. It takes any mailbox in the tenant and returns that mailbox's mail, so it now requires `tenant:admin`, matching `POST /v1/ediscovery/export`. A key scoped `mailboxes:read` gets 403 and has to be reissued; admin console sessions are unaffected. 
+  # Issues a one-shot \"presigned\" download URL for the mailbox's content in mbox format. The URL works without an Authorization header, the token in the query string is the authz. TTL is 5 minutes; the token is consumed on first GET.  **v1 caveat:** the synthesized mbox only contains outbound mail (sent mail only). A later version will cover received mail for full inbox + folder structure + flags. The endpoint contract stays unchanged.  **Scope changed:** this used to accept `mailboxes:read`. It takes any mailbox in the tenant and returns that mailbox's mail, so it now requires `tenant:admin`, matching `POST /v1/ediscovery/export`. A key scoped `mailboxes:read` gets 403 and has to be reissued; admin console sessions are unaffected. 
   # @param email 
   # @param [Hash] opts the optional parameters
   # @return [ExportMailbox201Response]
@@ -130,7 +130,7 @@ describe 'MailboxesApi' do
 
   # unit tests for list_mailboxes
   # List mailboxes
-  # Returns mailboxes under the calling tenant — active and soft-deleted. `?limit=N` between 1 and 200 (default 50). 
+  # Returns mailboxes under the calling tenant, active and soft-deleted. `?limit=N` between 1 and 200 (default 50). 
   # @param [Hash] opts the optional parameters
   # @option opts [Integer] :limit 
   # @return [ListMailboxes200Response]
@@ -176,7 +176,7 @@ describe 'MailboxesApi' do
 
   # unit tests for set_vacation_responder
   # Set the vacation responder
-  # Upsert — same endpoint creates or replaces the rule. Clears `synced_at`; the rule is staged on lockally until a sync worker pushes it to the mail server. 
+  # Upsert, same endpoint creates or replaces the rule. Clears `synced_at`; the rule is staged until a later sync pushes it to the mail server. 
   # @param email 
   # @param set_vacation_responder_request 
   # @param [Hash] opts the optional parameters

data/spec/api/send_api_spec.rb

@@ -57,7 +57,7 @@ describe 'SendApi' do
 
   # unit tests for get_message_stats
   # Aggregate delivery stats
-  # Counts by delivery outcome (delivered/bounced/deferred/complaint) plus rates over a window, from the delivery-event store. Privacy-first: this reflects what receiving servers reported, NOT whether a human opened the mail — Lockally does no open/click tracking. 
+  # Counts by delivery outcome (delivered/bounced/deferred/complaint) plus rates over a window, from the delivery-event store. Privacy-first: this reflects what receiving servers reported, NOT whether a human opened the mail, Lockally does no open/click tracking. 
   # @param [Hash] opts the optional parameters
   # @option opts [Time] :from Window start (default 7 days ago).
   # @option opts [Time] :to Window end (default now).
@@ -71,7 +71,7 @@ describe 'SendApi' do
 
   # unit tests for list_messages
   # List outbound messages
-  # Returns recent outbound messages for the calling tenant, sorted newest first. Backs the send-status pill in the SvelteKit /sends view and the outbound search box. 
+  # Returns recent outbound messages for the calling tenant, sorted newest first. 
   # @param [Hash] opts the optional parameters
   # @option opts [String] :status 
   # @option opts [String] :sender Exact match against the `from` mailbox.
@@ -88,7 +88,7 @@ describe 'SendApi' do
 
   # unit tests for send_email
   # Send an email
-  # Submits an email for delivery via lockally. Returns 202 immediately once the message is accepted into lockally's queue; the actual SMTP submission to the recipient is async. Track delivery via `GET /v1/messages/{id}` or webhook subscriptions for `delivery.delivered` / `delivery.bounced` / `delivery.complaint`.  **Idempotency-Key required.** Per design L7 — any unique string per send, 24-hour dedupe window. Repeated calls with the same key return byte-exact the original response and do NOT create a duplicate message.  **Sender authorisation.** `from` must be an address the calling tenant owns on a verified domain. A mailbox always qualifies. On business and combined accounts an **alias** qualifies too, so a send-only address such as `no-reply@` need not be a billed seat. An alias on an unverified domain, or one belonging to another account, is refused with `403`. A catch-all creates no aliases and so grants no sending rights.  **Rate cap.** Per-tenant `rate_cap_per_min` (returned on `/v1/tenant`) is enforced — 429 with `Retry-After: 60` once tripped.  **Recipient warning.** Over 25 total recipients (To+Cc+Bcc) sets a `warning` field in the response — large fan-outs queue noticeably at scale. Hard cap is 100/send.  **Not every success is a 202.** Check the status code, not just the body. A `200` means nothing was queued: either every recipient was already suppressed, or the call used a test key and the send was simulated. Both are successes, and neither produces a real delivery. See the `200` response below.  **Warm-up headers.** While the platform is in its outbound warm-up ramp, accepted sends carry `X-Warmup-Day`, `X-Warmup-Daily-Cap` and `X-Warmup-Used-Today`. They describe a platform-wide cap shared by every tenant, not your own allowance, and they disappear once the ramp finishes. Hitting the cap returns 429. 
+  # Submits an email for delivery via lockally. Returns 202 immediately once the message is accepted into lockally's queue; the actual SMTP submission to the recipient is async. Track delivery via `GET /v1/messages/{id}` or webhook subscriptions for `delivery.delivered` / `delivery.bounced` / `delivery.complaint`.  **Idempotency-Key required.** Any unique string per send, 24-hour dedupe window. Repeated calls with the same key return byte-exact the original response and do NOT create a duplicate message.  **Sender authorisation.** `from` must be an address the calling tenant owns on a verified domain. A mailbox always qualifies. On business and combined accounts an **alias** qualifies too, so a send-only address such as `no-reply@` need not be a billed seat. An alias on an unverified domain, or one belonging to another account, is refused with `403`. A catch-all creates no aliases and so grants no sending rights.  **Rate cap.** Per-tenant `rate_cap_per_min` (returned on `/v1/tenant`) is enforced, 429 with `Retry-After: 60` once tripped.  **Recipient warning.** Over 25 total recipients (To+Cc+Bcc) sets a `warning` field in the response, large fan-outs queue noticeably at scale. Hard cap is 100/send.  **Not every success is a 202.** Check the status code, not just the body. A `200` means nothing was queued: either every recipient was already suppressed, or the call used a test key and the send was simulated. Both are successes, and neither produces a real delivery. See the `200` response below.  **Warm-up headers.** While the platform is in its outbound warm-up ramp, accepted sends carry `X-Warmup-Day`, `X-Warmup-Daily-Cap` and `X-Warmup-Used-Today`. They describe a platform-wide cap shared by every tenant, not your own allowance, and they disappear once the ramp finishes. Hitting the cap returns 429. 
   # @param idempotency_key 
   # @param send_email_request 
   # @param [Hash] opts the optional parameters
@@ -101,7 +101,7 @@ describe 'SendApi' do
 
   # unit tests for send_email_batch
   # Send a batch of emails
-  # Sends up to 500 messages in one call. Each is validated and enqueued independently — a bad message fails only its own slot (partial success, HTTP 200). One `Idempotency-Key` header covers the batch; per-message keys are derived as `<key>:<index>`. 
+  # Sends up to 500 messages in one call. Each is validated and enqueued independently, a bad message fails only its own slot (partial success, HTTP 200). One `Idempotency-Key` header covers the batch; per-message keys are derived as `<key>:<index>`. 
   # @param idempotency_key 
   # @param send_email_batch_request 
   # @param [Hash] opts the optional parameters

data/spec/api/tenant_api_spec.rb

@@ -45,7 +45,7 @@ describe 'TenantApi' do
 
   # unit tests for get_usage
   # Usage snapshot
-  # Returns the tenant's current usage + cap consumption. Designed for poll-based alerting on the integrator side (e.g. \"warn when daily quota is 80% used\"). Refreshed live from Postgres — there is no cache, so callers should poll at most once per minute. 
+  # Returns the tenant's current usage + cap consumption. Designed for poll-based alerting on the integrator side (e.g. \"warn when daily quota is 80% used\"). Computed live on request, so there is no cache, so callers should poll at most once per minute. 
   # @param [Hash] opts the optional parameters
   # @return [GetUsage200Response]
   describe 'get_usage test' do

data/spec/api/test_api_spec.rb

@@ -34,7 +34,7 @@ describe 'TestApi' do
 
   # unit tests for simulate_inbound_email
   # Simulate an inbound email (test keys only)
-  # Runs a synthetic message through the REAL indexing pipeline — thread adoption, deterministic extraction (incl. injection_risk), and the message.received webhook — so the whole agent loop is testable without a real domain or MTA. Requires an lk_test_* key (create with {\"test\": true} on POST /v1/api-keys). Body: {mailbox, from, subject, text, in_reply_to?, references?}.
+  # Runs a synthetic message through the REAL indexing pipeline, thread adoption, deterministic extraction (incl. injection_risk), and the message.received webhook, so the whole agent loop is testable without a real domain or MTA. Requires an lk_test_* key (create with {\"test\": true} on POST /v1/api-keys). Body: {mailbox, from, subject, text, in_reply_to?, references?}.
   # @param [Hash] opts the optional parameters
   # @return [SimulatedInbound]
   describe 'simulate_inbound_email test' do

data/spec/api/webhooks_api_spec.rb

@@ -34,7 +34,7 @@ describe 'WebhooksApi' do
 
   # unit tests for create_webhook
   # Create a webhook
-  # Subscribes a URL to one or more event types. Returns the `signing_secret` ONCE in the response — store it immediately. The dispatcher signs every outbound POST per design L3:      X-Lockally-Signature: t=<unix>,v1=<hex(hmac_sha256(secret, t + \".\" + body))>  Verify on your end using HMAC-SHA256 with a 5-minute timestamp window (replay protection). A reference verifier ships in [internal/webhook](https://github.com/ucheigwedinma/lockally/blob/main/internal/webhook/sign.go).  Event names: see the [event catalogue](https://github.com/ucheigwedinma/lockally/blob/main/docs/v1-design.md#64-webhook-event-catalogue-v1). 
+  # Subscribes a URL to one or more event types. Returns the `signing_secret` ONCE in the response, store it immediately. Every outbound POST is signed:      X-Lockally-Signature: t=<unix>,v1=<hex(hmac_sha256(secret, t + \".\" + body))>  Verify on your end using HMAC-SHA256 with a 5-minute timestamp window (replay protection). A reference verifier ships in [Signature verification](https://developers.lockally.com/webhooks/verification/).  Event names: see the [event catalogue](https://developers.lockally.com/webhooks/events/). 
   # @param create_webhook_request 
   # @param [Hash] opts the optional parameters
   # @return [Webhook]
@@ -58,7 +58,7 @@ describe 'WebhooksApi' do
 
   # unit tests for list_webhooks
   # List webhooks
-  # Returns the calling tenant's webhook subscriptions. Never returns the signing secret — only metadata. 
+  # Returns the calling tenant's webhook subscriptions. Never returns the signing secret, only metadata. 
   # @param [Hash] opts the optional parameters
   # @return [ListWebhooks200Response]
   describe 'list_webhooks test' do
@@ -69,7 +69,7 @@ describe 'WebhooksApi' do
 
   # unit tests for update_webhook
   # Update a webhook
-  # Supply at least one of `url`, `events`, `paused`. Setting `paused` to `false` ALSO resets `consecutive_failures` to 0 — re-arms the 50-failure auto-pause counter. 
+  # Supply at least one of `url`, `events`, `paused`. Setting `paused` to `false` ALSO resets `consecutive_failures` to 0, re-arms the 50-failure auto-pause counter. 
   # @param id 
   # @param update_webhook_request 
   # @param [Hash] opts the optional parameters