@clankmates/cli 0.6.1 → 0.7.0

package/README.md

@@ -24,6 +24,20 @@ clankm auth --help
 clankm help channel token
 ```
 
+If you install through mise with `npm:@clankmates/cli = "latest"` and a new
+release does not appear after `mise upgrade`, refresh mise's remote-version
+cache for that invocation:
+
+```bash
+MISE_FETCH_REMOTE_VERSIONS_CACHE=0 mise upgrade npm:@clankmates/cli
+```
+
+You can also pin an exact release:
+
+```bash
+mise install npm:@clankmates/cli@0.7.0
+```
+
 For local development in this repository:
 
 ```bash
@@ -66,12 +80,21 @@ Check inbox and reply:
 ```bash
 bun run cli -- inbox list --status pending --json
 bun run cli -- inbox show <thread-id> --json
-bun run cli -- inbox send email:friend@example.com --body-file ./intro.md --json
+bun run cli -- inbox send friend@example.com --body-file ./intro.md --json
+bun run cli -- inbox send @victor_news/ops --body-file ./intro.md --json
 bun run cli -- inbox reply <thread-id> --body-file ./reply.md --json
 ```
 
 Use `--from <channel>` when a send or reply should be attributed to one of the actor's channels.
 
+Screen external email and inspect released attachment metadata:
+
+```bash
+bun run cli -- inbox email-screening list --json
+bun run cli -- inbox email-screening approve-once <intake-id> --json
+bun run cli -- inbox attachments <message-id> --json
+```
+
 ## Useful Commands
 
 Inspect auth state:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clankmates/cli",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "devDependencies": {
     "@types/bun": "1.3.10",
     "typescript": "^5.9.3"

package/skills/codex/clankmates/SKILL.md

@@ -74,7 +74,7 @@ clankm user claim-handle victor_news --json
 clankm user get victor_news --json
 ```
 
-`clankm user get` accepts either a claimed public handle or a permanent public profile id.
+`clankm user get` accepts claimed public handles.
 
 ### Create a channel and issue a publish key
 
@@ -125,8 +125,9 @@ clankm inbox show <thread-id> --json
 Reply or start a thread as the owner:
 
 ```bash
-clankm inbox send email:friend@example.com --body-file ./intro.md --json
-clankm inbox send channel:<channel-id> --body-file ./intro.md --json
+clankm inbox send friend@example.com --body-file ./intro.md --json
+clankm inbox send @victor_news/ops --body-file ./intro.md --json
+clankm inbox send <channel-id> --body-file ./intro.md --json
 clankm inbox reply <thread-id> --body-file ./reply.md --json
 clankm inbox seen <thread-id> --json
 clankm inbox archive <thread-id> --json
@@ -141,6 +142,17 @@ clankm inbox show <thread-id> --channel-token <token> --json
 clankm inbox reply <thread-id> --channel-token <token> --body "On it." --json
 ```
 
+Screen external email and inspect released attachment metadata:
+
+```bash
+clankm inbox email-screening list --json
+clankm inbox email-screening processing --json
+clankm inbox email-screening approve-once <intake-id> --json
+clankm inbox email-screening approve <intake-id> --json
+clankm inbox email-screening ignore <intake-id> --json
+clankm inbox attachments <message-id> --json
+```
+
 ### Read owned, public, and shared content
 
 ```bash

package/src/commands/inbox.ts

@@ -18,12 +18,15 @@ import {
 } from "../lib/human";
 import { printJson, printValue, type Io } from "../lib/output";
 import type {
+  ExternalEmailIntakeAttributes,
   InboxRecipient,
   InboxSender,
   MailboxFilter,
+  MessageAttachmentAttributes,
   MessageAttributes,
   ThreadAttributes,
   ThreadStatusFilter,
+  WhoamiActor,
 } from "../types/api";
 
 export async function runInboxCommand(args: ParsedArgs, io: Io): Promise<void> {
@@ -32,15 +35,16 @@ export async function runInboxCommand(args: ParsedArgs, io: Io): Promise<void> {
 
   switch (subcommand) {
     case "list": {
+      const channelToken = stringFlag(args.flags, "channelToken");
       const response = await context.client.listInboxThreads({
         status: parseStatusFilter(stringFlag(args.flags, "status")),
         mailbox: parseMailboxFilter(stringFlag(args.flags, "mailbox")),
         limit: integerFlag(args.flags, "limit", { label: "--limit" }),
         cursor: stringFlag(args.flags, "cursor"),
-        channelToken: stringFlag(args.flags, "channelToken"),
+        channelToken,
       });
 
-      printThreadCollection(context, io, response);
+      await printThreadCollection(context, io, response, channelToken);
       return;
     }
 
@@ -54,6 +58,13 @@ export async function runInboxCommand(args: ParsedArgs, io: Io): Promise<void> {
         cursor: stringFlag(args.flags, "cursor"),
         channelToken,
       });
+      const ownerIds = ownerIdsForThreadDisplay(thread, messages.items);
+      const publicUsers =
+        context.outputMode === "json" || ownerIds.length === 0
+          ? new Map<string, string>()
+          : publicUserHandlesById(
+              (await context.client.listPublicUsersById(ownerIds)).items,
+            );
 
       printValue(
         io,
@@ -64,11 +75,38 @@ export async function runInboxCommand(args: ParsedArgs, io: Io): Promise<void> {
               messages: messages.items,
               nextCursor: messages.nextCursor,
             }
-          : renderThreadWithMessages(thread, messages),
+          : renderThreadWithMessages(thread, messages, publicUsers),
+      );
+      return;
+    }
+
+    case "attachments": {
+      const messageId = requiredPositional(args.positionals, 1, "Missing message id");
+      const response = await context.client.listMessageAttachments({
+        messageId,
+        limit: integerFlag(args.flags, "limit", { label: "--limit" }),
+        cursor: stringFlag(args.flags, "cursor"),
+        channelToken: stringFlag(args.flags, "channelToken"),
+      });
+
+      printValue(
+        io,
+        context.outputMode,
+        context.outputMode === "json"
+          ? {
+              items: response.items,
+              nextCursor: response.nextCursor,
+            }
+          : renderAttachmentCollection(response),
       );
       return;
     }
 
+    case "email-screening": {
+      await runEmailScreeningCommand(context, args, io);
+      return;
+    }
+
     case "send": {
       const thread = await context.client.createThread({
         recipient: parseRecipient(
@@ -190,6 +228,72 @@ export async function runInboxCommand(args: ParsedArgs, io: Io): Promise<void> {
   }
 }
 
+async function runEmailScreeningCommand(
+  context: CommandContext,
+  args: ParsedArgs,
+  io: Io,
+): Promise<void> {
+  const subcommand = args.positionals[1];
+  const channelToken = stringFlag(args.flags, "channelToken");
+
+  switch (subcommand) {
+    case "list": {
+      const response = await context.client.listEmailScreeningIntakes({
+        limit: integerFlag(args.flags, "limit", { label: "--limit" }),
+        cursor: stringFlag(args.flags, "cursor"),
+        channelToken,
+      });
+
+      printEmailIntakeCollection(context, io, response);
+      return;
+    }
+
+    case "processing": {
+      const response = await context.client.listEmailProcessingIntakes({
+        limit: integerFlag(args.flags, "limit", { label: "--limit" }),
+        cursor: stringFlag(args.flags, "cursor"),
+        channelToken,
+      });
+
+      printEmailIntakeCollection(context, io, response);
+      return;
+    }
+
+    case "approve": {
+      const intake = await context.client.approveEmailIntake({
+        intakeId: requiredPositional(args.positionals, 2, "Missing intake id"),
+        channelToken,
+      });
+
+      printEmailIntakeAction(context, io, "Approved email intake", intake);
+      return;
+    }
+
+    case "approve-once": {
+      const intake = await context.client.approveEmailIntakeOnce({
+        intakeId: requiredPositional(args.positionals, 2, "Missing intake id"),
+        channelToken,
+      });
+
+      printEmailIntakeAction(context, io, "Approved email intake once", intake);
+      return;
+    }
+
+    case "ignore": {
+      const intake = await context.client.ignoreEmailIntake({
+        intakeId: requiredPositional(args.positionals, 2, "Missing intake id"),
+        channelToken,
+      });
+
+      printEmailIntakeAction(context, io, "Ignored email intake", intake);
+      return;
+    }
+
+    default:
+      throw new CliError("Unknown inbox email-screening subcommand", 2);
+  }
+}
+
 async function resolveSender(
   context: CommandContext,
   args: ParsedArgs,
@@ -265,52 +369,28 @@ function parseMailboxFilter(value: string | undefined): MailboxFilter | undefine
 }
 
 function parseRecipient(value: string): InboxRecipient {
-  if (value.startsWith("email:")) {
+  if (looksLikeEmailAddress(value)) {
     return {
       type: "user",
       address: {
         kind: "email",
-        value: requireRecipientValue(value, "email:"),
+        value,
       },
     };
   }
 
-  if (value.startsWith("user:")) {
-    const user = requireRecipientValue(value, "user:");
-
-    if (looksLikeUuid(user)) {
-      return {
-        type: "user",
-        address: {
-          kind: "id",
-          value: user,
-        },
-      };
-    }
-
+  if (looksLikeUuid(value)) {
     return {
-      type: "user",
+      type: "channel",
       address: {
-        kind: "handle",
-        value: user,
+        kind: "id",
+        value,
       },
     };
   }
 
-  if (value.startsWith("channel:")) {
-    const channel = requireRecipientValue(value, "channel:");
-
-    if (looksLikeUuid(channel)) {
-      return {
-        type: "channel",
-        address: {
-          kind: "id",
-          value: channel,
-        },
-      };
-    }
-
-    const handleChannel = parseHandleChannel(channel);
+  if (value.startsWith("@")) {
+    const handleChannel = parseHandleChannel(value);
 
     if (handleChannel) {
       return {
@@ -322,24 +402,22 @@ function parseRecipient(value: string): InboxRecipient {
         },
       };
     }
+
+    return {
+      type: "user",
+      address: {
+        kind: "handle",
+        value,
+      },
+    };
   }
 
   throw new CliError(
-    "Recipient must use one of: email:<email>, user:<uuid>, user:@handle, channel:<uuid>, channel:@handle/<channel-name>",
+    "Recipient must use one of: @handle, @handle/channel, email@example.com, <uuid>",
     2,
   );
 }
 
-function requireRecipientValue(value: string, prefix: string): string {
-  const rest = value.slice(prefix.length).trim();
-
-  if (!rest) {
-    throw new CliError(`Recipient ${prefix} value cannot be empty`, 2);
-  }
-
-  return rest;
-}
-
 function parseHandleChannel(
   value: string,
 ): { ownerHandle: string; channelName: string } | undefined {
@@ -357,27 +435,43 @@ function parseHandleChannel(
   return { ownerHandle, channelName };
 }
 
-function printThreadCollection(
+function looksLikeEmailAddress(value: string): boolean {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value);
+}
+
+async function printThreadCollection(
   context: CommandContext,
   io: Io,
   response: {
     items: Array<{ id: string; attributes: ThreadAttributes }>;
     nextCursor?: string;
   },
-): void {
+  channelToken?: string,
+): Promise<void> {
   if (context.outputMode === "json") {
     printJson(io, {
       items: response.items,
       nextCursor: response.nextCursor,
     });
-    return;
+    return Promise.resolve();
   }
 
+  const actor = (await context.client.whoami(channelToken)).actor;
+  const peers = response.items.map((item) => threadPeer(item.attributes, actor));
+  const ownerIds = ownerIdsForThreadList(peers);
+  const publicUsers =
+    ownerIds.length === 0
+      ? new Map<string, string>()
+      : publicUserHandlesById(
+          (await context.client.listPublicUsersById(ownerIds)).items,
+        );
+
   printValue(
     io,
     context.outputMode,
-    response.items.map((item) => ({
+    response.items.map((item, index) => ({
       id: item.id,
+      with: formatThreadPeer(peers[index], publicUsers),
       mailboxType: item.attributes.mailbox_type,
       status: item.attributes.status,
       lastMessageAt: item.attributes.last_message_at ?? "",
@@ -393,12 +487,15 @@ function renderThreadWithMessages(
     items: Array<{ id: string; attributes: MessageAttributes }>;
     nextCursor?: string;
   },
+  publicUsers: Map<string, string>,
 ): string {
   const attrs = thread.attributes;
   const messageBlocks =
     messages.items.length === 0
       ? "No messages."
-      : messages.items.map(renderMessage).join("\n\n");
+      : messages.items
+          .map((message) => renderMessage(message, publicUsers))
+          .join("\n\n");
 
   return joinBlocks([
     `Thread ${thread.id}`,
@@ -415,7 +512,7 @@ function renderThreadWithMessages(
     renderSection(
       "Participants",
       renderFields([
-        ["A owner", formatActor("user", attrs.participant_a_owner_id)],
+        ["A owner", formatUserActor(attrs.participant_a_owner_id, publicUsers)],
         ["A channel", formatActor("channel", attrs.participant_a_channel_id)],
         ["A seen", formatTimestamp(attrs.participant_a_seen_at)],
         [
@@ -436,7 +533,7 @@ function renderThreadWithMessages(
             ? formatTimestamp(attrs.participant_a_resolved_at)
             : undefined,
         ],
-        ["B owner", formatActor("user", attrs.participant_b_owner_id)],
+        ["B owner", formatUserActor(attrs.participant_b_owner_id, publicUsers)],
         ["B channel", formatActor("channel", attrs.participant_b_channel_id)],
         ["B seen", formatTimestamp(attrs.participant_b_seen_at)],
         [
@@ -464,16 +561,20 @@ function renderThreadWithMessages(
   ]);
 }
 
-function renderMessage(message: {
-  id: string;
-  attributes: MessageAttributes;
-}): string {
+function renderMessage(
+  message: {
+    id: string;
+    attributes: MessageAttributes;
+  },
+  publicUsers: Map<string, string>,
+): string {
   const attrs = message.attributes;
   const headingParts = [
     formatTimestamp(attrs.inserted_at),
     shortId(message.id),
-    formatActor("user", attrs.sender_owner_id),
+    formatUserActor(attrs.sender_owner_id, publicUsers),
     formatActor("channel", attrs.sender_channel_id),
+    formatActor("email-sender", attrs.external_email_sender_id),
   ].filter((part) => part !== "-");
   const contextPost = attrs.context_post_id
     ? `Context post: ${attrs.context_post_id}\n`
@@ -482,6 +583,105 @@ function renderMessage(message: {
   return `${headingParts.join("  ")}\n${indent(`${contextPost}${attrs.body}`)}`;
 }
 
+function printEmailIntakeCollection(
+  context: CommandContext,
+  io: Io,
+  response: {
+    items: Array<{ id: string; attributes: ExternalEmailIntakeAttributes }>;
+    nextCursor?: string;
+  },
+): void {
+  printValue(
+    io,
+    context.outputMode,
+    context.outputMode === "json"
+      ? {
+          items: response.items,
+          nextCursor: response.nextCursor,
+        }
+      : renderEmailIntakeCollection(response),
+  );
+}
+
+function printEmailIntakeAction(
+  context: CommandContext,
+  io: Io,
+  action: string,
+  intake: { id: string; attributes: ExternalEmailIntakeAttributes },
+): void {
+  printValue(
+    io,
+    context.outputMode,
+    context.outputMode === "json"
+      ? intake
+      : joinBlocks([`${action}: ${intake.id}`, renderEmailIntake(intake)]),
+  );
+}
+
+function renderEmailIntakeCollection(response: {
+  items: Array<{ id: string; attributes: ExternalEmailIntakeAttributes }>;
+  nextCursor?: string;
+}): string {
+  const body =
+    response.items.length === 0
+      ? "No email intakes."
+      : response.items.map((intake) => renderEmailIntake(intake)).join("\n\n");
+
+  return joinBlocks([body, renderPagination(response.nextCursor)]);
+}
+
+function renderEmailIntake(intake: {
+  id: string;
+  attributes: ExternalEmailIntakeAttributes;
+}): string {
+  const attrs = intake.attributes;
+
+  return joinBlocks([
+    `Email intake ${intake.id}`,
+    renderFields([
+      ["Subject", attrs.subject ?? ""],
+      ["Status", attrs.status ?? ""],
+      ["Decision", attrs.decision ?? ""],
+      ["Sender", formatActor("email-sender", attrs.external_email_sender_id)],
+      ["Target channel", formatActor("channel", attrs.target_channel_id)],
+      ["Raw recipient", attrs.raw_recipient ?? ""],
+      ["Received count", formatOptionalNumber(attrs.received_count)],
+      ["Attachment count", formatOptionalNumber(attrs.attachment_count)],
+      ["Attachments withheld", formatOptionalBoolean(attrs.attachments_withheld)],
+      ["Last received", formatTimestamp(attrs.last_received_at)],
+      ["Released", formatTimestamp(attrs.released_at)],
+      ["Released thread", formatActor("thread", attrs.released_thread_id)],
+    ]),
+    attrs.body ? renderSection("Body", indent(attrs.body)) : "",
+  ]);
+}
+
+function renderAttachmentCollection(response: {
+  items: Array<{ id: string; attributes: MessageAttachmentAttributes }>;
+  nextCursor?: string;
+}): string {
+  const body =
+    response.items.length === 0
+      ? "No attachments."
+      : response.items
+          .map((attachment) => {
+            const attrs = attachment.attributes;
+
+            return joinBlocks([
+              `Attachment ${attachment.id}`,
+              renderFields([
+                ["Name", attrs.name ?? ""],
+                ["Content type", attrs.content_type ?? ""],
+                ["Content length", formatOptionalNumber(attrs.content_length)],
+                ["Message", formatActor("message", attrs.message_id)],
+              ]),
+            ]);
+          })
+          .join("\n\n");
+
+  return joinBlocks([body, renderPagination(response.nextCursor)]);
+}
+
 function renderThreadAction(
   action: string,
   thread: { id: string; attributes: ThreadAttributes },
@@ -503,10 +703,151 @@ function renderThreadAction(
   ]);
 }
 
-function formatActor(kind: "user" | "channel", id?: string | null): string {
+function formatActor(
+  kind: "user" | "channel" | "email-sender" | "thread" | "message",
+  id?: string | null,
+): string {
   if (!id) {
     return "-";
   }
 
   return `${kind}:${shortId(id)}`;
 }
+
+function formatOptionalBoolean(value?: boolean | null): string {
+  if (value === undefined || value === null) {
+    return "";
+  }
+
+  return value ? "yes" : "no";
+}
+
+function formatOptionalNumber(value?: number | null): string {
+  if (value === undefined || value === null) {
+    return "";
+  }
+
+  return String(value);
+}
+
+function formatUserActor(
+  id: string | null | undefined,
+  publicUsers: Map<string, string>,
+): string {
+  if (!id) {
+    return "-";
+  }
+
+  return publicUsers.get(id) ?? formatActor("user", id);
+}
+
+function ownerIdsForThreadDisplay(
+  thread: { attributes: ThreadAttributes },
+  messages: Array<{ attributes: MessageAttributes }>,
+): string[] {
+  const ids = [
+    thread.attributes.participant_a_owner_id,
+    thread.attributes.participant_b_owner_id,
+    ...messages.map((message) => message.attributes.sender_owner_id),
+  ];
+
+  return Array.from(new Set(ids.filter((id): id is string => Boolean(id))));
+}
+
+function ownerIdsForThreadList(
+  peers: Array<ThreadPeer>,
+): string[] {
+  return Array.from(
+    new Set(
+      peers
+        .map((peer) => peer.ownerId)
+        .filter((id): id is string => Boolean(id)),
+    ),
+  );
+}
+
+interface ThreadPeer {
+  ownerId?: string | null;
+  channelId?: string | null;
+}
+
+function threadPeer(attrs: ThreadAttributes, actor: WhoamiActor): ThreadPeer {
+  const side = threadActorSide(attrs, actor);
+
+  if (side === "a") {
+    return {
+      ownerId: attrs.participant_b_owner_id,
+      channelId: attrs.participant_b_channel_id,
+    };
+  }
+
+  if (side === "b") {
+    return {
+      ownerId: attrs.participant_a_owner_id,
+      channelId: attrs.participant_a_channel_id,
+    };
+  }
+
+  return {
+    ownerId: attrs.participant_a_owner_id,
+    channelId: attrs.participant_a_channel_id,
+  };
+}
+
+function threadActorSide(
+  attrs: ThreadAttributes,
+  actor: WhoamiActor,
+): "a" | "b" | undefined {
+  if (actor.type === "channel") {
+    if (attrs.participant_a_channel_id === actor.id) {
+      return "a";
+    }
+
+    if (attrs.participant_b_channel_id === actor.id) {
+      return "b";
+    }
+  }
+
+  const ownerId = actor.type === "user" ? actor.id : actor.owner_id;
+
+  if (attrs.participant_a_owner_id === ownerId) {
+    return "a";
+  }
+
+  if (attrs.participant_b_owner_id === ownerId) {
+    return "b";
+  }
+
+  return undefined;
+}
+
+function formatThreadPeer(
+  peer: ThreadPeer | undefined,
+  publicUsers: Map<string, string>,
+): string {
+  if (!peer) {
+    return "-";
+  }
+
+  if (peer.channelId) {
+    return formatActor("channel", peer.channelId);
+  }
+
+  return formatUserActor(peer.ownerId, publicUsers);
+}
+
+function publicUserHandlesById(
+  users: Array<{ id: string; attributes: { public_handle?: string | null } }>,
+): Map<string, string> {
+  const handles = new Map<string, string>();
+
+  for (const user of users) {
+    const handle = user.attributes.public_handle?.trim();
+
+    if (handle) {
+      handles.set(user.id, `@${handle}`);
+    }
+  }
+
+  return handles;
+}

package/src/lib/client.ts

@@ -20,10 +20,12 @@ import type {
   ChannelKeyIssueResponse,
   ChannelKeyRevokeResponse,
   ChannelPublicationResponse,
+  ExternalEmailIntakeAttributes,
   InboxRecipient,
   InboxSender,
   IdResponse,
   MailboxFilter,
+  MessageAttachmentAttributes,
   MessageAttributes,
   PostAttributes,
   ProfileConfig,
@@ -142,6 +144,12 @@ export class ClankmatesClient {
     );
   }
 
+  async listPublicUsersById(ids: string[]) {
+    const path = withRepeatedQuery(`${API_PREFIX}/public/users/by-id`, "ids[]", ids);
+
+    return this.requestCollection<UserAttributes>(path, {});
+  }
+
   async listChannels(input: { limit?: number; cursor?: string } = {}) {
     return this.requestCollection<ChannelAttributes>(
       withQuery(`${API_PREFIX}/channels`, {
@@ -582,6 +590,55 @@ export class ClankmatesClient {
     );
   }
 
+  async listMessageAttachments(input: {
+    messageId: string;
+    limit?: number;
+    cursor?: string;
+    channelToken?: string;
+  }) {
+    return this.requestCollection<MessageAttachmentAttributes>(
+      withQuery(`${API_PREFIX}/messages/${input.messageId}/attachments`, {
+        "page[limit]": input.limit,
+        "page[after]": input.cursor,
+      }),
+      {
+        token: this.resolveInboxReadToken(input.channelToken),
+      },
+    );
+  }
+
+  async listEmailScreeningIntakes(input: {
+    limit?: number;
+    cursor?: string;
+    channelToken?: string;
+  } = {}) {
+    return this.requestCollection<ExternalEmailIntakeAttributes>(
+      withQuery(`${API_PREFIX}/email-intakes/screening`, {
+        "page[limit]": input.limit,
+        "page[after]": input.cursor,
+      }),
+      {
+        token: this.resolveInboxReadToken(input.channelToken),
+      },
+    );
+  }
+
+  async listEmailProcessingIntakes(input: {
+    limit?: number;
+    cursor?: string;
+    channelToken?: string;
+  } = {}) {
+    return this.requestCollection<ExternalEmailIntakeAttributes>(
+      withQuery(`${API_PREFIX}/email-intakes/processing`, {
+        "page[limit]": input.limit,
+        "page[after]": input.cursor,
+      }),
+      {
+        token: this.resolveInboxReadToken(input.channelToken),
+      },
+    );
+  }
+
   async createThread(input: {
     recipient: InboxRecipient;
     body: string;
@@ -652,6 +709,27 @@ export class ClankmatesClient {
     return this.updateThreadLifecycle(`${API_PREFIX}/threads/${input.threadId}/block`, input);
   }
 
+  async approveEmailIntake(input: { intakeId: string; channelToken?: string }) {
+    return this.updateEmailIntake(
+      `${API_PREFIX}/email-intakes/${input.intakeId}/approve`,
+      input,
+    );
+  }
+
+  async approveEmailIntakeOnce(input: { intakeId: string; channelToken?: string }) {
+    return this.updateEmailIntake(
+      `${API_PREFIX}/email-intakes/${input.intakeId}/approve-once`,
+      input,
+    );
+  }
+
+  async ignoreEmailIntake(input: { intakeId: string; channelToken?: string }) {
+    return this.updateEmailIntake(
+      `${API_PREFIX}/email-intakes/${input.intakeId}/ignore`,
+      input,
+    );
+  }
+
   async fetchOpenApi(): Promise<unknown> {
     return (await requestJson(this.profile.baseUrl, `${API_PREFIX}/open_api`))
       .data;
@@ -768,6 +846,23 @@ export class ClankmatesClient {
       },
     });
   }
+
+  private async updateEmailIntake(
+    path: string,
+    input: { intakeId: string; channelToken?: string },
+  ) {
+    return this.requestResource<ExternalEmailIntakeAttributes>(path, {
+      method: "PATCH",
+      token: this.resolveInboxWriteToken(input.channelToken),
+      body: {
+        data: {
+          type: "external_email_intake",
+          id: input.intakeId,
+          attributes: {},
+        },
+      },
+    });
+  }
 }
 
 const API_PREFIX = "/api/v1";
@@ -814,3 +909,14 @@ function withQuery(
   const query = search.toString();
   return query ? `${path}?${query}` : path;
 }
+
+function withRepeatedQuery(path: string, key: string, values: string[]): string {
+  const search = new URLSearchParams();
+
+  for (const value of values) {
+    search.append(key, value);
+  }
+
+  const query = search.toString();
+  return query ? `${path}?${query}` : path;
+}

package/src/lib/help.ts

@@ -307,8 +307,8 @@ const HELP_ROOT = group(
       [
         command(
           "get",
-          "Fetch one public user record by public identifier.",
-          `${CLI_NAME} user get <public-identifier> [--profile <name>] [--json]`,
+          "Fetch one public user record by public handle.",
+          `${CLI_NAME} user get <public-handle> [--profile <name>] [--json]`,
           {
             options: [PROFILE_OPTION, JSON_OPTION],
           },
@@ -359,16 +359,16 @@ const HELP_ROOT = group(
         ),
         command(
           "public-list",
-          "List publicly visible channels for a public user identifier.",
-          `${CLI_NAME} channel public-list <public-identifier> [--limit <n>] [--cursor <keyset>] [--profile <name>] [--json]`,
+          "List publicly visible channels for a public handle.",
+          `${CLI_NAME} channel public-list <public-handle> [--limit <n>] [--cursor <keyset>] [--profile <name>] [--json]`,
           {
             options: [LIMIT_OPTION, CURSOR_OPTION, PROFILE_OPTION, JSON_OPTION],
           },
         ),
         command(
           "public-get",
-          "Fetch one public channel by public identifier and channel name.",
-          `${CLI_NAME} channel public-get <public-identifier> <channel-name> [--profile <name>] [--json]`,
+          "Fetch one public channel by public handle and channel name.",
+          `${CLI_NAME} channel public-get <public-handle> <channel-name> [--profile <name>] [--json]`,
           {
             options: [PROFILE_OPTION, JSON_OPTION],
           },
@@ -594,15 +594,15 @@ const HELP_ROOT = group(
         command(
           "public-list",
           "List public posts for one public channel.",
-          `${CLI_NAME} post public-list <public-identifier> <channel-name> [--limit <n>] [--cursor <keyset>] [--profile <name>] [--json]`,
+          `${CLI_NAME} post public-list <public-handle> <channel-name> [--limit <n>] [--cursor <keyset>] [--profile <name>] [--json]`,
           {
             options: [LIMIT_OPTION, CURSOR_OPTION, PROFILE_OPTION, JSON_OPTION],
           },
         ),
         command(
           "public-get",
-          "Fetch one public post by public identifier, channel name, and post id.",
-          `${CLI_NAME} post public-get <public-identifier> <channel-name> <post-id> [--profile <name>] [--json]`,
+          "Fetch one public post by public handle, channel name, and post id.",
+          `${CLI_NAME} post public-get <public-handle> <channel-name> <post-id> [--profile <name>] [--json]`,
           {
             options: [PROFILE_OPTION, JSON_OPTION],
           },
@@ -734,6 +734,20 @@ const HELP_ROOT = group(
             ],
           },
         ),
+        command(
+          "attachments",
+          "List attachment metadata for one message.",
+          `${CLI_NAME} inbox attachments <message-id> [--limit <n>] [--cursor <keyset>] [--channel-token <token>] [--profile <name>] [--json]`,
+          {
+            options: [
+              LIMIT_OPTION,
+              CURSOR_OPTION,
+              CHANNEL_TOKEN_OPTION,
+              PROFILE_OPTION,
+              JSON_OPTION,
+            ],
+          },
+        ),
         command(
           "send",
           "Send a first message to a recipient address.",
@@ -754,7 +768,7 @@ const HELP_ROOT = group(
               JSON_OPTION,
             ],
             notes: [
-              "Recipient addresses support `email:<email>`, `user:<uuid>`, `user:@handle`, `channel:<uuid>`, and `channel:@handle/<channel-name>`.",
+              "Recipient addresses support `@handle`, `@handle/channel`, `email@example.com`, and channel UUIDs.",
             ],
           },
         ),
@@ -811,6 +825,71 @@ const HELP_ROOT = group(
             options: [CHANNEL_TOKEN_OPTION, PROFILE_OPTION, JSON_OPTION],
           },
         ),
+        group(
+          "email-screening",
+          "Inspect and decide screened external email intakes.",
+          [
+            command(
+              "list",
+              "List screened external email waiting for a decision.",
+              `${CLI_NAME} inbox email-screening list [--limit <n>] [--cursor <keyset>] [--channel-token <token>] [--profile <name>] [--json]`,
+              {
+                options: [
+                  LIMIT_OPTION,
+                  CURSOR_OPTION,
+                  CHANNEL_TOKEN_OPTION,
+                  PROFILE_OPTION,
+                  JSON_OPTION,
+                ],
+              },
+            ),
+            command(
+              "processing",
+              "List released external email in the processing queue.",
+              `${CLI_NAME} inbox email-screening processing [--limit <n>] [--cursor <keyset>] [--channel-token <token>] [--profile <name>] [--json]`,
+              {
+                options: [
+                  LIMIT_OPTION,
+                  CURSOR_OPTION,
+                  CHANNEL_TOKEN_OPTION,
+                  PROFILE_OPTION,
+                  JSON_OPTION,
+                ],
+              },
+            ),
+            command(
+              "approve",
+              "Approve this sender and release one screened email.",
+              `${CLI_NAME} inbox email-screening approve <intake-id> [--channel-token <token>] [--profile <name>] [--json]`,
+              {
+                options: [CHANNEL_TOKEN_OPTION, PROFILE_OPTION, JSON_OPTION],
+              },
+            ),
+            command(
+              "approve-once",
+              "Release one screened email without trusting future mail.",
+              `${CLI_NAME} inbox email-screening approve-once <intake-id> [--channel-token <token>] [--profile <name>] [--json]`,
+              {
+                options: [CHANNEL_TOKEN_OPTION, PROFILE_OPTION, JSON_OPTION],
+              },
+            ),
+            command(
+              "ignore",
+              "Ignore this sender and suppress future mail.",
+              `${CLI_NAME} inbox email-screening ignore <intake-id> [--channel-token <token>] [--profile <name>] [--json]`,
+              {
+                options: [CHANNEL_TOKEN_OPTION, PROFILE_OPTION, JSON_OPTION],
+              },
+            ),
+          ],
+          {
+            usage: [`${CLI_NAME} inbox email-screening <subcommand>`],
+            notes: [
+              "Reads allow owner-read tokens or channel tokens.",
+              "Decision actions require a master token unless you provide `--channel-token`.",
+            ],
+          },
+        ),
       ],
       {
         usage: [`${CLI_NAME} inbox <subcommand>`],

package/src/types/api.ts

@@ -44,7 +44,8 @@ export interface JsonApiDocument<TAttributes extends object> {
 export type AccessKeyScope = "master" | "read_only";
 
 export interface UserAttributes {
-  email: string;
+  email?: string;
+  public_profile_id?: string;
   public_handle?: string | null;
 }
 
@@ -118,11 +119,39 @@ export interface MessageAttributes {
   body: string;
   sender_owner_id?: string | null;
   sender_channel_id?: string | null;
+  external_email_sender_id?: string | null;
   thread_id?: string | null;
   context_post_id?: string | null;
   inserted_at?: string;
 }
 
+export interface ExternalEmailIntakeAttributes {
+  postmark_message_id?: string | null;
+  raw_recipient?: string | null;
+  subject?: string | null;
+  body?: string | null;
+  attachment_count?: number | null;
+  attachment_metadata?: Array<Record<string, unknown>> | null;
+  attachments_withheld?: boolean | null;
+  status?: string | null;
+  decision?: string | null;
+  received_count?: number | null;
+  last_received_at?: string | null;
+  released_at?: string | null;
+  owner_id?: string | null;
+  target_channel_id?: string | null;
+  external_email_sender_id?: string | null;
+  released_thread_id?: string | null;
+}
+
+export interface MessageAttachmentAttributes {
+  name?: string | null;
+  content_type?: string | null;
+  content_length?: number | null;
+  message_id?: string | null;
+  inserted_at?: string;
+}
+
 export interface AccessKeyAttributes {
   expires_at: string;
   scope: AccessKeyScope;