@curviate/sdk 0.44.0 → 0.45.0-next.0

package/dist/index.js

@@ -1,11 +1,11 @@
 var __typeError = (msg) => {
   throw TypeError(msg);
 };
-var __accessCheck = (obj2, member, msg) => member.has(obj2) || __typeError("Cannot " + msg);
-var __privateGet = (obj2, member, getter) => (__accessCheck(obj2, member, "read from private field"), getter ? getter.call(obj2) : member.get(obj2));
-var __privateAdd = (obj2, member, value) => member.has(obj2) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj2) : member.set(obj2, value);
-var __privateSet = (obj2, member, value, setter) => (__accessCheck(obj2, member, "write to private field"), setter ? setter.call(obj2, value) : member.set(obj2, value), value);
-var __privateMethod = (obj2, member, method) => (__accessCheck(obj2, member, "access private method"), method);
+var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
+var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
+var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
+var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
+var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
 
 // src/errors.ts
 var ERROR_CODES = [
@@ -67,8 +67,10 @@ var ERROR_CODES = [
   // Curviate's OWN account-safety ceiling, not a request-rate limit and not
   // LinkedIn refusing. A 429 that never reached LinkedIn and spent nothing:
   // the budget row named by `budgetRow` is at its ceiling, set by the account's
-  // safety policy or else the tenant default (`GET`/`PATCH /v1/safety-policy`),
-  // or the account is outside its activity window. Deliberately absent from
+  // safety policy or else the Team default (`GET`/`PATCH /v1/safety-policy`),
+  // or the account is outside its activity window (a live write only; reads
+  // are never refused for the hour). Limits are always
+  // enforced: to send more, raise the limit. Deliberately absent from
   // RETRYABLE_CODES: a monthly row's reset can be weeks out, so backing off
   // is the wrong recovery.
   // Read `resetAt`, `safetyReason` and `safetyHint` instead.
@@ -81,6 +83,9 @@ var ERROR_CODES = [
   // retrying will not help.
   "LINKEDIN_OPERATION_NOT_SUPPORTED",
   // Checkpoint (account connect flow)
+  // `CHECKPOINT_EXPIRED` is 409 on every path (it was 422 on some solve
+  // paths): past `expires_at`, solve, poll, resend and request answer it, and
+  // a pending checkpoint that times out does too. Start the connection again.
   "CHECKPOINT_NOT_FOUND",
   "CHECKPOINT_EXPIRED",
   "CHECKPOINT_INVALID_CODE",
@@ -150,6 +155,9 @@ var ERROR_CODES = [
   "REACTION_NOT_FOUND",
   // Upstream failures on the connect and billing paths. All transient in the
   // ordinary sense (502/503 from a dependency), so a retry is reasonable.
+  // `SUBSTRATE_CAP_REACHED` is no longer sent: the account cap answers
+  // `503 PLATFORM_ERROR` with `retry_likely_to_succeed: false`. Kept for older
+  // deployments; removed in a later release.
   "SUBSTRATE_LINK_FAILED",
   "SUBSTRATE_CAP_REACHED",
   "BILLING_CHECKOUT_FAILED",
@@ -219,14 +227,19 @@ var ERROR_CODES = [
   //   error body names it (`feature`), the lowest Tier that has it
   //   (`required_tier`) and the Tier the team has (`current_tier`), read as
   //   `feature`, `requiredTier` and `currentTier` on {@link CurviateError}; a
-  //   team Owner also gets `upgradeUrl`. Writes in Drafts, Contacts and Motions
-  //   (and Network and Unibox) need Automate; reads, exports, deletes and
-  //   stopping running work pass on any Tier.
+  //   team Owner also gets `upgradeUrl`. When one Account lacks the feature
+  //   while the Team has it (an Account on a seat another Team lent this one
+  //   carries that seat's Tier), `details.account_id` names it: leave it out,
+  //   or ask the Owner who lent the seat. Writes in Drafts, Contacts and
+  //   Motions (and Network and Unibox) need Automate; reads, exports, deletes
+  //   and stopping running work pass on any Tier.
   "INSUFFICIENT_ROLE",
   "TIER_REQUIRED",
   // - `TEAM_ACCESS_DENIED` (403): the request names a team (the `team` client
-  //   option, header `X-Curviate-Team`) this credential cannot act in. An API
-  //   key works in exactly one team. Drop the option, or use that team's key.
+  //   option or `withTeam`, header `X-Curviate-Team`) this credential cannot
+  //   act in. A key may work in one Team or in all of a person's Teams: a Team
+  //   key accepts only its own Team, an All-Teams key only the Teams its person
+  //   belongs to. Name a Team the key works in, or use that Team's key.
   // - `ACCOUNT_NOT_SHARED` (403): the person who connected the account turned
   //   its team access off; only they can use it.
   // - `ACCOUNT_OWNER_ONLY` (403): only the person who connected the account can
@@ -296,12 +309,12 @@ var ERROR_CODES = [
   //
   // - `MOTION_NOT_STARTABLE` (422): `start` or `resume` found gaps; `errors`
   //   lists every one as `{path, rule}` (a Contact list, a sending account, a
-  //   timezone, a Sequence). Fix them and retry.
+  //   Sequence). Fix them and retry.
   // - `MOTION_STATUS_CONFLICT` (409): the operation does not apply in the
   //   Motion's status; the message names it and the operations it allows.
   //   Only a draft can be deleted: archive instead.
   // - `ENROLLMENT_NOT_ACTIVE` (409): the Enrollment's status does not take
-  //   this operation (stop and pause: pending, active or paused; events:
+  //   this operation (stop and pause: queued, active or paused; events:
   //   active or paused; resume: active, paused or finished, not when the
   //   account or Contact is gone).
   // - `STEP_IN_FLIGHT` (409): a Step of the Enrollment is being sent right
@@ -328,6 +341,64 @@ var ERROR_CODES = [
   "KNOWN_CHAT",
   "CONTACT_NOT_ENROLLABLE",
   "CHAT_NOT_ONE_TO_ONE",
+  // Dashboard v2 surface.
+  //
+  // - `CHAT_NOT_VISIBLE` (409): a start-chat or InMail to a person the account
+  //   holds a private 1:1 with that you may not read. Nothing is sent; the body
+  //   reveals nothing of the conversation.
+  // - `DO_NOT_CONTACT` (409): the person is on your team's do-not-contact list
+  //   (an invitation, a chat start or send, InMail, follow, endorse, a reaction
+  //   or comment, a live profile read). Nothing is sent.
+  // - `TEAM_REQUIRED` (400): a key that works in all of your Teams called a
+  //   Team-level operation without naming the Team. Pass `team` in the client
+  //   config, or call through `curviate.withTeam(team)`; `teams.list()` lists
+  //   yours. A call on one of your accounts takes that account's Team.
+  // - `SEAT_LENT` (409): the seat is lent to another Team. A connect naming it,
+  //   a cancel of it, and a connect that finishes just as a lend lands are all
+  //   refused. Move it back first (`billing.seats.return`; only once no Account
+  //   uses it). A suspended lent seat reads `NO_ACTIVE_SEAT` with its own
+  //   message.
+  // - `LINKEDIN_SIGN_IN_REQUIRED` (403, user_fixable): LinkedIn wants the
+  //   person to sign in on linkedin.com before it accepts this connect. Sign
+  //   in there, then retry, or connect with cookies from a browser where it is
+  //   signed in.
+  // - `EXPORT_IN_PROGRESS` (409): your team already has an export queued or
+  //   running (`details.export_id`). Retry when it finishes.
+  // - `EXPORT_NOT_READY` (409): the export is queued, running or failed; its
+  //   file is not there to download yet.
+  // - `EXPORT_EXPIRED` (410): the export's 24 h are over and its file is
+  //   deleted. Run it again.
+  // - `EXPORT_REMOVED` (410): a Contact was deleted, which removes your team's
+  //   Contact-level exports. Run it again.
+  // - `NOTHING_TO_REDELIVER` (409): a redeliver of a delivery that was never
+  //   sent (`skipped_no_email`).
+  // - `REDELIVERY_EXPIRED` (410): a redeliver at or after the delivery's
+  //   `redeliverable_until` (receipt + 24 h); its request is no longer kept.
+  // - `WEBHOOK_DISABLED` (409): a redeliver on a webhook that is switched off.
+  //   Switch it on first.
+  // - `DELIVERY_IN_FLIGHT` (409): an attempt of that delivery is being sent
+  //   right now. Retry shortly.
+  // - `WEBHOOK_TEMPLATE_INVALID` (422): the webhook's `body_template` fails
+  //   the lint; nothing was saved. Every finding is in `errors`, each with
+  //   `line` and `col` (1-based) into the template; `validateWebhookTemplate`
+  //   gives the same verdict offline.
+  // - `INCOMING_URL_RETIRED` (410): a post to an incoming event URL that was
+  //   rotated out (after its 24 h) or deleted.
+  "CHAT_NOT_VISIBLE",
+  "DO_NOT_CONTACT",
+  "TEAM_REQUIRED",
+  "SEAT_LENT",
+  "LINKEDIN_SIGN_IN_REQUIRED",
+  "EXPORT_IN_PROGRESS",
+  "EXPORT_NOT_READY",
+  "EXPORT_EXPIRED",
+  "EXPORT_REMOVED",
+  "NOTHING_TO_REDELIVER",
+  "REDELIVERY_EXPIRED",
+  "WEBHOOK_DISABLED",
+  "DELIVERY_IN_FLIGHT",
+  "WEBHOOK_TEMPLATE_INVALID",
+  "INCOMING_URL_RETIRED",
   // Client-side, never sent by the API. `CLIENT_TIMEOUT`: no response within
   // the client's `timeout` (default 30 s, per attempt). A read is retried
   // first; a write is not, and may still have reached the API, so read back
@@ -360,6 +431,7 @@ var CurviateError = class _CurviateError extends Error {
     this.requiredTier = init.requiredTier;
     this.currentTier = init.currentTier;
     this.upgradeUrl = init.upgradeUrl;
+    this.details = init.details;
     Object.setPrototypeOf(this, _CurviateError.prototype);
   }
   /**
@@ -391,6 +463,7 @@ var CurviateError = class _CurviateError extends Error {
     if (this.requiredTier !== void 0) json.requiredTier = this.requiredTier;
     if (this.currentTier !== void 0) json.currentTier = this.currentTier;
     if (this.upgradeUrl !== void 0) json.upgradeUrl = this.upgradeUrl;
+    if (this.details !== void 0) json.details = this.details;
     return json;
   }
 };
@@ -398,6 +471,9 @@ function isCurviateError(err) {
   return err instanceof CurviateError;
 }
 
+// package.json
+var version = "0.45.0-next.0";
+
 // src/config.ts
 var DEFAULT_BASE_URL = "https://api.curviate.com";
 var DEFAULT_TIMEOUT_MS = 3e4;
@@ -419,13 +495,22 @@ function resolveConfig(config) {
       retryLikelyToSucceed: false
     });
   }
+  if (config.client !== void 0 && !/^[\x21-\x7e]+$/.test(String(config.client))) {
+    throw new CurviateError({
+      code: "INVALID_REQUEST",
+      message: "client, when given, must be <name>/<version>: non-empty, no spaces.",
+      userFixable: true,
+      retryLikelyToSucceed: false
+    });
+  }
   return Object.freeze({
     apiKey: config.apiKey,
     baseUrl: config.baseUrl ?? DEFAULT_BASE_URL,
     timeout: config.timeout ?? DEFAULT_TIMEOUT_MS,
     maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES,
     fetch: config.fetch,
-    ...config.team !== void 0 ? { team: config.team } : {}
+    ...config.team !== void 0 ? { team: config.team } : {},
+    client: config.client ?? `sdk/${version}`
   });
 }
 
@@ -461,7 +546,7 @@ var RETRYABLE_CODES = /* @__PURE__ */ new Set([
 ]);
 var WRITE_METHODS = /* @__PURE__ */ new Set(["POST", "PATCH", "PUT", "DELETE"]);
 function defaultSleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 function parseRetryAfterMs(header) {
   if (header == null) return void 0;
@@ -523,7 +608,8 @@ async function errorFromResponse(res) {
     // which is the field that says what to do instead: switch work.
     ...typeof env?.retry_after === "number" && Number.isFinite(env.retry_after) ? { retryAfterSeconds: env.retry_after } : {},
     // `reset_at` is null-BEARING: null means "no clock frees this" (the
-    // pending_invites gauge, or an InMail credit exhaustion), which is a
+    // pending_invites gauge, an InMail credit exhaustion, or an unknown zone
+    // with no candidate), which is a
     // different fact from the field being absent, so both survive the round
     // trip.
     ...typeof env?.reset_at === "string" || env?.reset_at === null ? { resetAt: env.reset_at } : {},
@@ -539,7 +625,8 @@ async function errorFromResponse(res) {
     ...typeof env?.feature === "string" ? { feature: env.feature } : {},
     ...typeof env?.required_tier === "string" || env?.required_tier === null ? { requiredTier: env.required_tier } : {},
     ...typeof env?.current_tier === "string" || env?.current_tier === null ? { currentTier: env.current_tier } : {},
-    ...typeof env?.upgrade_url === "string" ? { upgradeUrl: env.upgrade_url } : {}
+    ...typeof env?.upgrade_url === "string" ? { upgradeUrl: env.upgrade_url } : {},
+    ...env?.details !== null && typeof env?.details === "object" && !Array.isArray(env.details) ? { details: env.details } : {}
   });
   return { err, refusesRetry: env?.retry_likely_to_succeed === false };
 }
@@ -552,7 +639,8 @@ function retryDelay(err, attempt, jitter) {
 }
 function buildInit(method, opts, signal) {
   const headers = {
-    authorization: `Bearer ${opts.apiKey}`
+    authorization: `Bearer ${opts.apiKey}`,
+    "curviate-client": opts.client
   };
   if (opts.team !== void 0) headers["x-curviate-team"] = opts.team;
   const init = { method, headers, signal };
@@ -588,9 +676,9 @@ function buildUrl(path, opts) {
   }
   return url.toString();
 }
-async function parseSuccess(res) {
+async function parseSuccess(res, bytes) {
   const ct = res.headers.get("content-type") ?? "";
-  if (ct.includes("application/json")) {
+  if (!bytes && ct.includes("application/json")) {
     return await res.json();
   }
   return await res.arrayBuffer();
@@ -627,7 +715,7 @@ async function execute(method, path, opts) {
     }
     clearTimeout(timer);
     if (res.ok) {
-      return parseSuccess(res);
+      return parseSuccess(res, opts.bytes);
     }
     const { err, refusesRetry } = await errorFromResponse(res);
     const namesBudgetRow = err.budgetRow !== void 0;
@@ -687,6 +775,7 @@ function createContext(config, accountId) {
     }
     return execute(args.method, path, {
       apiKey: config.apiKey,
+      client: config.client,
       baseUrl: config.baseUrl,
       timeout: config.timeout,
       maxRetries: config.maxRetries,
@@ -694,7 +783,8 @@ function createContext(config, accountId) {
       ...config.team !== void 0 ? { team: config.team } : {},
       ...args.query !== void 0 ? { query: args.query } : {},
       ...args.body !== void 0 ? { body: args.body } : {},
-      ...args.rawBody !== void 0 ? { rawBody: args.rawBody } : {}
+      ...args.rawBody !== void 0 ? { rawBody: args.rawBody } : {},
+      ...args.bytes ? { bytes: true } : {}
     });
   };
   return { request, accountId };
@@ -730,21 +820,43 @@ function pageable(fetchPage, params) {
   });
 }
 
+// src/internal/query.ts
+function commaLists(params, ...keys) {
+  if (params === void 0) return void 0;
+  const out = { ...params };
+  for (const k of keys) {
+    const v = out[k];
+    if (Array.isArray(v)) out[k] = v.length ? v.join(",") : void 0;
+  }
+  return out;
+}
+
 // src/resources/accounts.ts
 var AccountsResource = class {
   constructor(ctx) {
     this.ctx = ctx;
   }
   /**
-   * List the tenant's connected LinkedIn accounts, cursor-paginated.
+   * List the tenant's connected LinkedIn accounts, cursor-paginated. An
+   * account disconnected when its free trial ended stays listed (`status_reason:
+   * "trial_ended"`); one you disconnected does not.
    *
-   * Each item also carries a small set of cached account-detail fields
-   * (`username`, `premium_id`, `public_identifier`, `substrate_created_at`,
-   * `signatures`, `groups`) populated by an async background enrichment,
-   * `null`/`[]` until the account's first enrichment pass completes.
+   * Each item carries enough to render an account row without a second call:
+   * its profile (`full_name`, `headline`, `photo_url`, `profile_url`,
+   * `public_identifier`, `location`; `photo_url` is a copy we store and refresh
+   * daily, so it does not expire), `status` and
+   * `status_reason` (why it is disconnected or needs a reconnect: `trial_ended`
+   * or `proxy`), `warm_up` (the active ramp), `inmail_balance` (the credits
+   * LinkedIn last reported and when, `null` until observed), `motions_count`
+   * with the first 20 Motions in `motion_refs`, and `quotas`: three of the
+   * account's safety rows (`connection_requests_no_note`,
+   * `messages_first_degree`, `inmail`) with `remaining`, absent on an account
+   * you can see but not operate. `get` carries every row. Reading the list
+   * never calls LinkedIn.
    *
-   * Each item carries `external_id` (your own id for the account's end user,
-   * set on `auth.intent` or `update`) and `metadata`, both `null` when unset.
+   * Each item also carries `external_id` (your own id for the account's end
+   * user, set on `auth.intent` or `update`) and `metadata`, both `null` when
+   * unset.
    *
    * @param params - optional `limit` (1-250), `cursor` (from a prior page), and
    *   `external_id` (exact match: only that end user's accounts).
@@ -794,25 +906,41 @@ var AccountsResource = class {
    * `quotas[]` REPLACED its earlier `quota_name` / `remaining` / `total` /
    * `reset_time` / `recommended_throttle_hint` shape. Each row now reports
    * `budget_row`, `kind`, `used`, `ceiling`, `effective_ceiling`, `band`,
-   * `posture`, `over_default`, `halt` and the window fields. **Compare `used`
-   * against `effective_ceiling`, not `ceiling`**: the effective one is the
-   * ceiling with the account's warm-up ramp applied, and on a new account the
-   * two differ by roughly a factor of seven. `posture` says what happens at the
-   * ceiling and defaults to `warn`, so nothing here refuses until it is
-   * configured to. Two rows are not counters and say so in `kind`:
+   * `over_default`, `halt` and the window fields. **Compare `used` against
+   * `effective_ceiling`, not `ceiling`**: the effective one is the ceiling
+   * with the account's warm-up ramp applied, and on a new account the two
+   * differ by roughly a factor of seven. Limits are always enforced: at the
+   * effective ceiling the action is refused with `BUDGET_EXHAUSTED`; to send
+   * more, raise the limit. Two rows are not counters and say so in `kind`:
    * `total_actions` (`tally`) and `pending_invites` (`gauge`, whose `used` is
    * `null` until something has observed it).
    *
    * The per-minute REQUEST ceiling is a different thing and is deliberately
    * NOT in this array: it protects Curviate's own servers rather than the
-   * LinkedIn account, and it is always enforced with `429` whatever the
-   * posture.
-   *
-   * `activity_window` applies to every account, with or without a zone set.
-   * `timezone` and `timezone_unset` report what YOU set; read
-   * `activity_window.effective_timezone` for the zone the window is actually
-   * read in and `activity_window.source` (`account`, `browser`, `location` or
-   * `default`) for where it came from.
+   * LinkedIn account, and it is answered with `429 RATE_LIMIT_ACCOUNT`.
+   *
+   * `activity_window` says which time zone the account's active hours are
+   * read in. Nobody sets it: it follows where the account connects from.
+   * `effective_timezone` is that IANA zone, or `null` while it is unknown;
+   * `source` says where it came from (`country`, `region`, `detected` or
+   * `none`); `zone_state` is `known`, `pinned` (a check agreed on one zone,
+   * kept until the next location change) or `unknown`, when the account acts
+   * only in the hours every zone in `fallback_timezones` shares (an empty list
+   * means the window is closed). A live write outside the window is refused
+   * with `BUDGET_EXHAUSTED` (`safetyReason: "activity_window"`); reads are
+   * never affected.
+   *
+   * `warm_up` is the account's ramp: `enabled` (the switch, default `true`;
+   * set it with `PATCH /v1/{account_id}/safety-policy` and
+   * `warm_up: { enabled }`), `dormant` (no action for more than 30 days),
+   * `state` and the `triggers` that apply now (`connect`, `dormant`,
+   * `post_restriction`). Off skips the connect and quiet ramps; recovery after
+   * a LinkedIn restriction still applies.
+   *
+   * `connection_location` carries `checked_at` (the last location check, or
+   * `null`), `detected_country` (where your own proxy was found to connect
+   * from, or `null`) and `flags` (`country_mismatch`, `zone_moved`). It never
+   * carries an IP.
    *
    * `account_states[]` lists platform conditions the account is in right now,
    * additive to `status` and independent of it: `recruiter_session_evicted`,
@@ -853,11 +981,20 @@ var AccountsResource = class {
    * proxy can only take a `country` together with `proxy: null`. The
    * `proxy.password`, if given, is never returned.
    *
+   * `save_connections_as_contacts` (Automate; on by default) saves the
+   * account's Connections as Contacts: each person becomes one Contact in your
+   * team, an existing Contact is only filled in, do-not-contact people are
+   * skipped. `true` also saves the Connections already synced; `false` keeps
+   * the Contacts saved so far. Without Automate it throws `TIER_REQUIRED`, and
+   * `get` omits the field. `save_connections_paused_reason` reads
+   * `"contact_limit_reached"` while your team holds its 100,000 Contacts.
+   *
    * Returns the account (as `get` returns it, without `quotas` and
    * `event_log`). After a location change its `connection_location` is re-read,
    * so it shows where the account really connects from now. A change that did
    * not land where asked throws `CONNECTION_LOCATION_UNAVAILABLE`, whose
-   * `connectionLocation` carries the actual location.
+   * `connectionLocation` carries the actual location. The account's time zone
+   * follows its connection location: there is no zone to set.
    *
    * @example
    * await curviate.accounts.update("acc_123", { external_id: "usr_42", metadata: { plan: "pro" } });
@@ -865,6 +1002,9 @@ var AccountsResource = class {
    * @example
    * const account = await curviate.accounts.update("acc_123", { country: "DE" });
    * console.log(account.connection_location?.country); // "DE"
+   *
+   * @example
+   * await curviate.accounts.update("acc_123", { save_connections_as_contacts: false });
    */
   update(accountId, body) {
     return this.ctx.request({
@@ -957,6 +1097,96 @@ var AccountsResource = class {
       path: apiPath`/v1/billing/seats/${seatId}/cancel/revert`
     });
   }
+  /**
+   * The account's own numbers, one snapshot per day, oldest first: 1st-degree
+   * `connections`, `followers`, `profile_viewers_90d`,
+   * `search_appearances_week`, `post_impressions_7d`, and `ssi` (Sales
+   * Navigator accounts only, else `null`). Read once a day inside the
+   * account's activity window and stored: this makes no LinkedIn call. `from`
+   * and `to` are the account's local days (default the last 90 days; at most
+   * 366 days across); a day with no snapshot has no item. One response holds
+   * the whole range (`cursor` is always `null`).
+   * `GET /v1/accounts/{account_id}/metrics`
+   *
+   * @example
+   * const { items } = await curviate.accounts.metrics("acc_123", { from: "2026-08-01", to: "2026-10-28" });
+   */
+  metrics(accountId, params) {
+    return this.ctx.request({
+      method: "GET",
+      path: apiPath`/v1/accounts/${accountId}/metrics`,
+      ...params !== void 0 ? { query: params } : {}
+    });
+  }
+  /**
+   * One account at a glance, with no LinkedIn call: `profile`, its daily
+   * `metrics` snapshot (`null` before the first one, or when you may not
+   * operate the account), `limits` (its three outreach rows now),
+   * `activity` (its latest 10 actions and their outcomes, metadata only), and
+   * its results in the window (`performance`, `daily`, its `motions`) as the
+   * team overview reads them scoped to it. `profile`, `metrics`, `limits` and
+   * `activity` do not follow the window. The window, `motion_id`, `origin`,
+   * `include`, `fields`, `sort`, `limit` and `compare` work as on
+   * `analytics.motions.list`; with none of `include` and `fields` the body is
+   * trimmed to a summary. `flags` includes `account_attention` and
+   * `limit_reached` for this account.
+   * `GET /v1/accounts/{account_id}/overview`
+   *
+   * @example
+   * const { performance, flags } = await curviate.accounts.overview("acc_123", { range: "30d" });
+   */
+  overview(accountId, params) {
+    return this.ctx.request({
+      method: "GET",
+      path: apiPath`/v1/accounts/${accountId}/overview`,
+      query: commaLists(params, "motion_id", "origin", "include", "fields", "sort")
+    });
+  }
+  /**
+   * Read an account's safety policy: every configurable field for every
+   * budget row, and where each value was inherited from. Also carries the
+   * derived `warm_up` (`enabled`, `dormant`, `state`, `factor`, `triggers`)
+   * and `activity_window` (the zone the hours are read in, from where the
+   * account connects). Limits are always enforced.
+   * `GET /v1/{account_id}/safety-policy`
+   *
+   * @example
+   * const { warm_up } = await curviate.accounts.getSafetyPolicy("acc_123");
+   */
+  getSafetyPolicy(accountId) {
+    return this.ctx.request({
+      method: "GET",
+      path: apiPath`/v1/${accountId}/safety-policy`
+    });
+  }
+  /**
+   * Update an account's safety policy. Send only the fields you are changing;
+   * `null` clears an override back to the Team or Curviate default. Limits are
+   * always enforced: to send more, raise the limit. Returns the policy as
+   * `getSafetyPolicy` reads it.
+   *
+   * `warm_up: { enabled }` turns the account's warm-up ramp on or off (default
+   * on; off skips the connect and quiet ramps, recovery after a LinkedIn
+   * restriction still applies). `active_hours` sets the account's own days and
+   * local hours; a row's own `activity_window_start` / `activity_window_end`
+   * win over it. Read-only fields (`activity_window`, a row's
+   * `effective_ceiling`, `over_default`, `warm_up_state` ...) are accepted and
+   * ignored, so a read document can be sent back unchanged. A time zone is not
+   * a setting: `timezone` and a row's `activity_window_timezone` other than
+   * `null` are `400 INVALID_REQUEST`; change the account's `country` or own
+   * `proxy` instead.
+   * `PATCH /v1/{account_id}/safety-policy`
+   *
+   * @example
+   * await curviate.accounts.updateSafetyPolicy("acc_123", { warm_up: { enabled: false } });
+   */
+  updateSafetyPolicy(accountId, body) {
+    return this.ctx.request({
+      method: "PATCH",
+      path: apiPath`/v1/${accountId}/safety-policy`,
+      body
+    });
+  }
 };
 
 // src/resources/auth.ts
@@ -973,7 +1203,36 @@ var AuthResource = class {
    * success (200 re-authenticated in place / 201 new), or a checkpoint
    * challenge (202) when LinkedIn requires verification; resolve it with
    * {@link solveCheckpoint} (code) or {@link pollCheckpoint} (mobile-app
-   * approval).
+   * approval, or `checking`: LinkedIn is checking the sign-in, nothing to
+   * answer, keep polling).
+   *
+   * **Checkpoints.** `challenge_type` may be `checking` (poll it, no action)
+   * or `phone_register` (LinkedIn wants a phone number: solve it with
+   * `(+CC)number`, then answer the code check that follows). On `otp` and
+   * `otp_or_mobile_app_approval`, `channel` says where LinkedIn sent the code
+   * (`email`, `sms`, `whatsapp`, or `null` when not known). `expires_at` is
+   * when Curviate stops accepting an answer; a chained checkpoint keeps the
+   * sign-in's original `expires_at`. After it, solve, poll, resend and request
+   * answer `409 CHECKPOINT_EXPIRED`: start the connection again.
+   *
+   * **Refusals.** A cookie connect LinkedIn rejects, for any reason, is
+   * `401 LINKEDIN_COOKIE_INVALID`. `403 LINKEDIN_SIGN_IN_REQUIRED`: LinkedIn
+   * wants the person to sign in on linkedin.com first; sign in there, then
+   * retry, or connect with cookies from a browser where it is signed in. An
+   * intent that times out before any checkpoint is
+   * `503 LINKEDIN_SERVICE_UNAVAILABLE`; the platform's account cap is
+   * `503 PLATFORM_ERROR` with `retryLikelyToSucceed: false`.
+   *
+   * `user_languages` (cookie connects only; a credentials connect ignores
+   * it): the language preferences of the browser the cookies came from, most
+   * preferred first, at most 5 BCP 47 tags (`en-US`), each at most 35
+   * characters.
+   *
+   * `recruiter_contract_id`: the Sales Navigator or Recruiter contract the
+   * account sends from, for a LinkedIn account that holds several. It is
+   * selected once the Account is connected; the answer then carries
+   * `contract_selected`, and `contract_selected: false` means connected, not
+   * selected (select it again with a reconnect).
    *
    * For `auth_method: "cookie"`, `user_agent` is **required**; connecting by
    * session cookie without one is rejected with `INVALID_REQUEST`. It stays
@@ -1021,7 +1280,14 @@ var AuthResource = class {
    * to keep the account's configured one. The account's `connection_location`
    * says where it connects from; when a connect re-attached an account you
    * already had and moved it, `connection_location.previous_country` names
-   * where it was.
+   * where it was. The account's time zone follows its connection location;
+   * `timezone` is deprecated and ignored.
+   *
+   * `warm_up: false` connects a NEW account with warm-up off (no connect ramp,
+   * no ramp after a quiet spell; recovery after a LinkedIn restriction still
+   * applies). Default `true`. Sent with `account_id` it is
+   * `400 INVALID_REQUEST`: change an existing account's switch on its safety
+   * policy instead.
    *
    * @example
    * const result = await curviate.auth.intent({
@@ -1040,12 +1306,21 @@ var AuthResource = class {
     });
   }
   /**
-   * Solve a checkpoint challenge by submitting an OTP / 2FA code (or the
-   * special value `TRY_ANOTHER_WAY` to switch challenge method).
+   * Solve a checkpoint challenge by submitting an OTP / 2FA code, a phone
+   * number for `phone_register` (`(+CC)number`; `code` accepts `( ) +`), or
+   * the special value `TRY_ANOTHER_WAY`.
+   *
+   * `TRY_ANOTHER_WAY` asks LinkedIn for another verification method and
+   * counts no attempt; the answer is the method LinkedIn offers instead (202),
+   * with the same `expires_at`. It is `400 INVALID_REQUEST` on
+   * `contract_selection`, `challenge_selection`, `phone_register` and
+   * `checking`.
    *
-   * Returns the connected account (201) or, when LinkedIn chains a second
+   * Returns the connected account (201, with `contract_selected` when
+   * `recruiter_contract_id` was sent) or, when LinkedIn chains a second
    * challenge (another checkpoint, 202); resolve that one with a further
-   * `solveCheckpoint` call for the same `accountId`.
+   * `solveCheckpoint` call for the same `accountId`. Past `expires_at` it is
+   * `409 CHECKPOINT_EXPIRED` (409 on every path now).
    *
    * @param accountId - the (provisional) `account_id` from the 202 response.
    * @param body - the verification `code`.
@@ -1091,11 +1366,14 @@ var AuthResource = class {
     });
   }
   /**
-   * Poll for mobile-app approval of a pending checkpoint challenge until it
-   * leaves `pending`.
+   * Poll an action-based checkpoint (`mobile_app_approval`,
+   * `otp_or_mobile_app_approval`, `checking`) until it leaves `pending`.
    *
-   * On `status: "expired"`, the response carries `challenge_type`
-   * (`"mobile_app_approval"`) and a human-readable `recovery_hint`.
+   * A transient error on Curviate's side answers `pending`: keep polling.
+   * Only a refusal answers `failed`, and a terminal refusal throws its own
+   * code. Past `expires_at` (also after the expiry sweep) the poll throws
+   * `409 CHECKPOINT_EXPIRED`; there is no `status: "expired"` answer. Start
+   * the connection again.
    *
    * @param accountId - the (provisional) `account_id` from the 202 response.
    */
@@ -1143,6 +1421,15 @@ var MessagingResource = class {
    * Company pages are reply-only and cannot start a conversation this way.
    * Reply to an existing one instead, with `sendMessage()` using a
    * `COMPANY_` chat id from `inboxes.listChats()`.
+   *
+   * When the Account already has a private
+   * conversation with this person that you may not read, this throws
+   * `CHAT_NOT_VISIBLE` (409) and sends nothing. Ask the person who connected
+   * the Account to reply, or to sync the full inbox. It is detected from what
+   * Curviate stored, so a thread older than 90 days that Curviate never
+   * touched is not detected. A person on the do-not-contact list throws
+   * `DO_NOT_CONTACT` (409). A send marks the chat read, and a disconnected
+   * Account throws `REAUTH_REQUIRED` (409).
    */
   startChat(body) {
     return this.ctx.request({
@@ -1169,6 +1456,10 @@ var MessagingResource = class {
   /**
    * Mark a chat read or unread. `PATCH /v1/{account_id}/chats/{chat_id}`
    * Body: `{read}`.
+   *
+   * `read: false` makes the Unibox chat's `marked_unread` read
+   * `{origin: "api", at}`. A later send through the API marks the chat read
+   * again. A disconnected Account throws `REAUTH_REQUIRED` (409).
    */
   markChatRead(chatId, body) {
     return this.ctx.request({
@@ -1188,6 +1479,18 @@ var MessagingResource = class {
    * first message rather than from the chat. Ordinary (non-InMail) messages
    * return `specifics: {}`.
    *
+   * A message the connected Account sent carries `origin`: `motion`, `unibox`,
+   * `api` (any API key or MCP grant) or `linkedin` (sent on LinkedIn itself).
+   * It is derived by Curviate, omitted when unknown, absent on a received
+   * message and never on a chat's `last_message`. `is_deleted` is `true` for a
+   * deleted message. For an API key or MCP grant, a message's `quoted` is
+   * omitted when the quoted message is from before the Motion chat's visible
+   * start, the same line the message list stops at.
+   *
+   * On a disconnected Account the page comes from Curviate's stored copy
+   * alone: `coverage.complete` is `false` when the stored history is not
+   * whole, and an attachment reads `unavailable: true`.
+   *
    * A CHAT READ CARRIES NO SUBJECT AT ALL, including on its embedded
    * `last_message`: the preview is deliberately narrower than a message read, so
    * that a chat read returns the same fields whether it was answered from
@@ -1222,6 +1525,13 @@ var MessagingResource = class {
    * `{ kind: "personal" }`. Never infer the acting identity from a
    * message's `sender` field, only from `sent_as`.
    *
+   *
+   * A person on the Team's do-not-contact list throws `DO_NOT_CONTACT` (409);
+   * nothing is sent.
+   *
+   * Marks the chat read (its `unread` turns `false`, `marked_unread` clears,
+   * and `chat.updated` reports it). A disconnected Account throws
+   * `REAUTH_REQUIRED` (409); nothing is sent.
    * @example
    * const acc = curviate.account("acc_YOUR_ACCOUNT_ID");
    * const result = await acc.messaging.sendMessage("COMPANY_83734124_2-YTQ3ODU3Njgt", {
@@ -1294,7 +1604,18 @@ var MessagingResource = class {
       path: apiPath`/v1/{account_id}/chats/${chatId}/messages/${messageId}/attachments/${attachmentId}`
     });
   }
-  /** Send an InMail. `POST /v1/{account_id}/messages/inmail` */
+  /**
+   * Send an InMail. `POST /v1/{account_id}/messages/inmail`
+   *
+   * When the Account already has a private
+   * conversation with this person that you may not read, this throws
+   * `CHAT_NOT_VISIBLE` (409) and sends nothing. Ask the person who connected
+   * the Account to reply, or to sync the full inbox. It is detected from what
+   * Curviate stored, so a thread older than 90 days that Curviate never
+   * touched is not detected. A person on the do-not-contact list throws
+   * `DO_NOT_CONTACT` (409). A send marks the chat read, and a disconnected
+   * Account throws `REAUTH_REQUIRED` (409).
+   */
   sendInMail(body) {
     return this.ctx.request({
       method: "POST",
@@ -1399,6 +1720,9 @@ var UsersResource = class {
    * Follow a user (bodyless). `POST /v1/{account_id}/users/{user_id}/follow`
    * If the target's profile is private, sends a connect request instead and
    * returns `connect_request_sent`.
+   *
+   * A person on the Team's do-not-contact list throws `DO_NOT_CONTACT` (409);
+   * nothing is sent.
    */
   follow(userId) {
     return this.ctx.request({
@@ -1434,6 +1758,9 @@ var UsersResource = class {
    * `POST /v1/{account_id}/users/{user_id}/endorse-skill`
    * Body key is `endorsement_id` (was `skill_endorsement_id` on `profiles.endorse`).
    * Obtain it from `GET /v1/{account_id}/users/{user_id}?linkedin_sections=linkedin_skills`.
+   *
+   * A person on the Team's do-not-contact list throws `DO_NOT_CONTACT` (409);
+   * nothing is sent.
    */
   endorseSkill(userId, body) {
     return this.ctx.request({
@@ -1449,7 +1776,12 @@ var InvitesResource = class {
   constructor(ctx) {
     this.ctx = ctx;
   }
-  /** Send a connect-request. `POST /v1/{account_id}/invites` */
+  /**
+   * Send a connect-request. `POST /v1/{account_id}/invites`
+   *
+   * A person on the Team's do-not-contact list throws `DO_NOT_CONTACT` (409);
+   * nothing is sent.
+   */
   send(body) {
     return this.ctx.request({
       method: "POST",
@@ -1745,7 +2077,12 @@ var PostsResource = class {
       ...params ? { query: params } : {}
     });
   }
-  /** React to a post. `POST /v1/{account_id}/posts/{post_id}/reactions` */
+  /**
+   * React to a post. `POST /v1/{account_id}/posts/{post_id}/reactions`
+   *
+   * A person on the Team's do-not-contact list throws `DO_NOT_CONTACT` (409);
+   * nothing is sent.
+   */
   react(postId, body) {
     return this.ctx.request({
       method: "POST",
@@ -1851,6 +2188,9 @@ var CommentsResource = class {
    * Publish a comment on a post. `POST /v1/{account_id}/posts/{post_id}/comments`
    * Was `posts.comment`. Attachments (at most one) travel as a base64
    * object, never `FormData`.
+   *
+   * A person on the Team's do-not-contact list throws `DO_NOT_CONTACT` (409);
+   * nothing is sent.
    */
   create(postId, body) {
     return this.ctx.request({
@@ -1884,6 +2224,9 @@ var CommentsResource = class {
    * Reply to a comment. Shares its path with `edit`; POST creates a reply
    * under the target comment, PATCH edits the target comment's own text.
    * `POST /v1/{account_id}/posts/{post_id}/comments/{comment_id}`
+   *
+   * A person on the Team's do-not-contact list throws `DO_NOT_CONTACT` (409);
+   * nothing is sent.
    */
   reply(postId, commentId, body) {
     return this.ctx.request({
@@ -1916,6 +2259,9 @@ var CommentsResource = class {
   }
   /**
    * React to a comment. `POST /v1/{account_id}/posts/{post_id}/comments/{comment_id}/reactions`
+   *
+   * A person on the Team's do-not-contact list throws `DO_NOT_CONTACT` (409);
+   * nothing is sent.
    */
   addReaction(postId, commentId, body) {
     return this.ctx.request({
@@ -2344,6 +2690,9 @@ var ConnectRequestsResource = class {
    * A reconnect that signs in to a different LinkedIn account fails with
    * `LINKEDIN_ACCOUNT_MISMATCH` and leaves the account unchanged.
    *
+   * `warm_up: false` connects the new account with warm-up off (default
+   * `true`); with `account_id` it is `400 INVALID_REQUEST`.
+   *
    * @example
    * const req = await curviate.connectRequests.create();
    * console.log(`Open this link to connect your LinkedIn account: ${req.url}`);
@@ -2392,11 +2741,23 @@ var TeamsResource = class {
     this.ctx = ctx;
   }
   /**
-   * List the teams you belong to, with your role in each.
+   * List the teams you belong to, with your role in each. `is_current` marks
+   * the team this credential acts in; `logo_url` is the team's public PNG or
+   * `null`. Pages with an opaque `cursor` until it is `null`.
+   *
+   * `include: "counts"` adds to each row `tier` (or the Tier of a seat lent to
+   * it; `null` with no subscription), `trial: { days_left }` while a trial is
+   * all the team has, `accounts` and `active_motions` (what you would read in
+   * that team), and `seats: { used, total, lent_out, lent_in }` on rows where
+   * you are an Owner. Which rows get counts depends on the credential: a
+   * dashboard session and an All-Teams key get them on every row; a Team API
+   * key, or a token for one Team, only on its own row (the other rows come
+   * back without them).
    * `GET /v1/teams`
    *
    * @example
    * const { items } = await curviate.teams.list();
+   * const withCounts = await curviate.teams.list({ include: "counts" });
    */
   list(params) {
     return this.ctx.request({
@@ -2406,8 +2767,27 @@ var TeamsResource = class {
     });
   }
   /**
-   * The team this credential acts in: its name, your role, and the Owner who
-   * receives invoices.
+   * Create a team with you as its Owner and the Owner who receives its
+   * invoices. It has no subscription and no seat yet. Any role may call it,
+   * and two identical calls create two teams. The result is the
+   * {@link TeamsResource.list} item shape plus `next_step`, which depends on
+   * the credential: an All-Teams key gets `{ team_header }`, the header line
+   * to send (`X-Curviate-Team: <team_id>`, usable at once; with this SDK pass
+   * the `team_id` to `curviate.withTeam(team_id)`); any other credential gets
+   * `{ command, url }` (the CLI command that sets up a key in the new team,
+   * and the dashboard page with your teams).
+   * `POST /v1/teams`
+   *
+   * @example
+   * const { team_id, next_step } = await curviate.teams.create({ name: "Agency client A" });
+   * if (next_step?.command) console.log(next_step.command); // set up a key for the new team
+   */
+  create(body) {
+    return this.ctx.request({ method: "POST", path: "/v1/teams", body });
+  }
+  /**
+   * The team this credential acts in: its name, your role, its `logo_url`, and
+   * the Owner who receives invoices.
    * `GET /v1/teams/current`
    *
    * @example
@@ -2417,8 +2797,9 @@ var TeamsResource = class {
     return this.ctx.request({ method: "GET", path: "/v1/teams/current" });
   }
   /**
-   * Rename the current team, or set `billing_owner_user_id` (an Owner of this
-   * team, whose email receives invoices). Owners only.
+   * Rename the current team (Owners and Managers), or set
+   * `billing_owner_user_id` (an Owner of this team, whose email receives
+   * invoices; Owners only).
    * `PATCH /v1/teams/current`
    *
    * @example
@@ -2432,7 +2813,37 @@ var TeamsResource = class {
     });
   }
   /**
-   * List the current team's members and their roles.
+   * Set the current team's logo from a PNG of at most 1 MB. The file's own
+   * bytes are checked, whatever its content type: a file that is not a PNG
+   * throws `UNSUPPORTED_MEDIA_TYPE` (415) and a larger one `PAYLOAD_TOO_LARGE`
+   * (413). Replaces the previous logo and resolves with the team, whose
+   * `logo_url` is the new public PNG URL. Owners and Managers.
+   * `PUT /v1/teams/current/logo`
+   *
+   * @example
+   * await curviate.teams.setLogo(await fs.promises.readFile("logo.png"));
+   */
+  setLogo(png) {
+    return this.ctx.request({
+      method: "PUT",
+      path: "/v1/teams/current/logo",
+      rawBody: { data: png, contentType: "image/png" }
+    });
+  }
+  /**
+   * Remove the current team's logo; the team resolves with `logo_url: null`.
+   * Owners and Managers.
+   * `DELETE /v1/teams/current/logo`
+   *
+   * @example
+   * await curviate.teams.removeLogo();
+   */
+  removeLogo() {
+    return this.ctx.request({ method: "DELETE", path: "/v1/teams/current/logo" });
+  }
+  /**
+   * List the current team's members and their roles. A member's `name` is
+   * their name, else their email (`null` only when neither is known).
    * `GET /v1/teams/current/members`
    *
    * @example
@@ -2463,7 +2874,7 @@ var TeamsResource = class {
     });
   }
   /**
-   * Remove a member (Owners only), or pass `"me"` to leave the team yourself.
+   * Remove a member (an Owner removes anyone, a Manager removes Members), or pass `"me"` to leave the team yourself.
    * Their API key and connectors for this team stop working at once. Same
    * refusals as {@link TeamsResource.updateMember}.
    * `DELETE /v1/teams/current/members/{user_id}`
@@ -2481,7 +2892,8 @@ var TeamsResource = class {
    * Invite 1 to 20 people by email, each with a role (`member` by default).
    * Each gets a link valid for 7 days. All or nothing: if any row is refused
    * (`ALREADY_MEMBER`, `INVITE_ALREADY_PENDING`, `INVITE_LIMIT_REACHED`),
-   * nothing is created or sent and the error names the row. Owners only.
+   * nothing is created or sent and the error names the row. Owners and Managers
+   * (a Manager invites Members only).
    * `POST /v1/teams/current/invites`
    *
    * @example
@@ -2495,7 +2907,7 @@ var TeamsResource = class {
     });
   }
   /**
-   * List the current team's invites, optionally by `status`.
+   * List the current team's invites, optionally by `status`. Owners and Managers.
    * `GET /v1/teams/current/invites`
    *
    * @example
@@ -2510,7 +2922,8 @@ var TeamsResource = class {
   }
   /**
    * Re-send a pending or expired invite; its link is valid for 7 more days.
-   * An accepted or revoked one is refused with `INVITE_NOT_PENDING`.
+   * An accepted or revoked one is refused with `INVITE_NOT_PENDING`. Owners,
+   * and Managers for Member invites.
    * `POST /v1/teams/current/invites/{invite_id}/resend`
    *
    * @example
@@ -2523,7 +2936,8 @@ var TeamsResource = class {
     });
   }
   /**
-   * Revoke an invite; its link stops working.
+   * Revoke an invite; its link stops working. Owners, and Managers for Member
+   * invites.
    * `DELETE /v1/teams/current/invites/{invite_id}`
    *
    * @example
@@ -2537,17 +2951,6 @@ var TeamsResource = class {
   }
 };
 
-// src/internal/query.ts
-function commaLists(params, ...keys) {
-  if (params === void 0) return void 0;
-  const out = { ...params };
-  for (const k of keys) {
-    const v = out[k];
-    if (Array.isArray(v)) out[k] = v.length ? v.join(",") : void 0;
-  }
-  return out;
-}
-
 // src/resources/contacts.ts
 var ContactImportsResource = class {
   constructor(ctx) {
@@ -2632,23 +3035,33 @@ var ContactsResource = class {
     this.imports = new ContactImportsResource(ctx);
   }
   /**
-   * List Contacts, newest first (`order: "asc"` for oldest). Filters combine:
-   * `list_id`, `tag` (comma list, any of them), `import_id`, `linkedin_url`,
+   * List Contacts, newest first (`order: "asc"` for oldest). Filters combine
+   * with AND: `list_id` (up to 20 Contact lists, as an array or a comma list:
+   * Contacts in any of them, or in every one with `list_match: "all"`; one id
+   * is one list), `not_list_id` (Contacts in none of those lists), `has_email`
+   * (`true`: only Contacts with an email address, `false`: only those
+   * without), `tag` (comma list, any of them), `import_id`, `linkedin_url`,
    * `q` (substring over names, headline, job title, company, email,
    * location), `enrichment_status`, `connected`, `account_id` (Connections of
-   * that account), `motion_id` + `enrollment_status` (any of the statuses
-   * given). Pages with an opaque
-   * `cursor` until it is `null`.
+   * that account, or of any of up to 50, as an array or a comma list), `motion_id` + `enrollment_status` (any of the statuses
+   * given). A list id that is not your team's throws `RESOURCE_NOT_FOUND`
+   * naming the key. Pages with an opaque `cursor` until it is `null`.
+   * `include_total: true` adds `total` to the page, the number of Contacts the
+   * filters match (with `limit: 1` it is the count before a bulk call or a new
+   * list); it is left out unless asked for.
    * `GET /v1/contacts`
    *
    * @example
    * const { items, cursor } = await curviate.contacts.list({ tag: "warm", limit: 100 });
+   *
+   * @example
+   * const { total } = await curviate.contacts.list({ list_id: ["cl_1", "cl_2"], list_match: "all", has_email: true, include_total: true, limit: 1 });
    */
   list(params) {
     return this.ctx.request({
       method: "GET",
       path: "/v1/contacts",
-      query: commaLists(params, "enrollment_status")
+      query: commaLists(params, "enrollment_status", "list_id", "not_list_id", "account_id")
     });
   }
   /**
@@ -2721,12 +3134,22 @@ var ContactsResource = class {
     });
   }
   /**
-   * Delete up to 1,000 Contacts. Ids that are not your team's come back in
-   * `not_found`. Owners and Managers only.
+   * Delete up to 1,000 Contacts by `contact_ids`, or every Contact a `filter`
+   * matches (up to 10,000). Send exactly one of the two. `filter` takes the
+   * {@link ContactsResource.list} filters as JSON, comma lists as arrays
+   * (`list_id`, `not_list_id`, `list_match`, `has_email`, `tag`, ...); a
+   * filter matching more than 10,000 Contacts throws `INVALID_REQUEST`
+   * naming the count and deletes nothing, so count first with
+   * `list({ ...filter, include_total: true, limit: 1 })`. Ids that are not your
+   * team's come back in `not_found` (always empty with a filter). Owners and
+   * Managers only.
    * `POST /v1/contacts/delete`
    *
    * @example
    * const { deleted, not_found } = await curviate.contacts.deleteMany({ contact_ids: ["con_1", "con_2"] });
+   *
+   * @example
+   * await curviate.contacts.deleteMany({ filter: { list_id: ["cl_1"], has_email: false } });
    */
   deleteMany(body) {
     return this.ctx.request({
@@ -2738,13 +3161,17 @@ var ContactsResource = class {
   /**
    * Add or remove Tags and list memberships on up to 1,000 Contacts at once:
    * `add_tags`, `remove_tags`, `add_list_id` or `add_list_name` (created if
-   * new), `remove_list_id`.
+   * new), `remove_list_id`. Name the Contacts with exactly one of
+   * `contact_ids` or `filter`: every Contact the {@link ContactsResource.list}
+   * filters match (comma lists as arrays), up to 10,000. A filter over the
+   * cap throws `INVALID_REQUEST` naming the count and changes nothing.
    * `POST /v1/contacts/update`
    *
    * Needs Automate: a Team below that Tier is refused with `TIER_REQUIRED`.
    *
    * @example
    * await curviate.contacts.updateMany({ contact_ids: ["con_1", "con_2"], add_tags: ["vip"], add_list_name: "Q4" });
+   * await curviate.contacts.updateMany({ filter: { tag: ["warm"], has_email: true }, add_list_name: "Warm with email" });
    */
   updateMany(body) {
     return this.ctx.request({
@@ -2778,7 +3205,7 @@ var ContactsResource = class {
     return this.ctx.request({
       method: "GET",
       path: "/v1/contacts/export",
-      query: commaLists(params, "enrollment_status")
+      query: commaLists(params, "enrollment_status", "list_id", "not_list_id", "account_id")
     });
   }
 };
@@ -2789,13 +3216,20 @@ var ContactListsResource = class {
     this.ctx = ctx;
   }
   /**
-   * Create an empty Contact list.
+   * Create a static Contact list: empty, or with `from`, a filter as in
+   * `contacts.updateMany({ filter })`, holding every Contact it matches right
+   * now (up to 10,000; more throws `INVALID_REQUEST` naming the count and
+   * creates nothing). `from.list_id` of two lists combines them (a Contact in
+   * both counts once), `list_match: "all"` keeps those in both and
+   * `not_list_id` leaves some out. The lists named in `from` are not changed,
+   * and `contact_count` is how many Contacts matched.
    * `POST /v1/contact-lists`
    *
    * Needs Automate: a Team below that Tier is refused with `TIER_REQUIRED`.
    *
    * @example
    * const list = await curviate.contactLists.create({ name: "Q4 webinar" });
+   * const both = await curviate.contactLists.create({ name: "Both", from: { list_id: ["cl_1", "cl_2"], list_match: "all" } });
    */
   create(body) {
     return this.ctx.request({
@@ -2922,7 +3356,7 @@ var TagsResource = class {
 
 // src/sequence/order.ts
 var DOC = ["$schema", "on_reply", "steps"];
-var STEP = ["id", "do", "wait", "until", "if", "emit", "tag", "timeout", "variants", "with", "event", "then", "else", "next", "note"];
+var STEP = ["id", "do", "wait", "until", "if", "emit", "tag", "timeout", "save", "save_to_contact", "variants", "with", "event", "then", "else", "next", "note"];
 var WITH = ["post", "newer_than", "reaction", "subject", "text", "note", "note_fallback", "fallback", "withdraw_after"];
 var VARIANT = ["id", "subject", "text"];
 var FALLBACK = ["subject", "text"];
@@ -2957,7 +3391,7 @@ var schema_v1_default = {
   $schema: "https://json-schema.org/draft/2020-12/schema",
   $id: "https://docs.curviate.com/schemas/sequence/v1.json",
   title: "Sequence document v1",
-  description: 'A Motion\'s Sequence: a flat steps array run from the first step, ending explicitly in "end". Served documents use this key order: $schema, on_reply, steps; in a step id, the kind key, timeout, variants, with, event, then, else, next, note; in with post, newer_than, reaction, subject, text, note, note_fallback, fallback, withdraw_after; in a variant id, subject, text. A text holds at most 50 variables. Variables: `{{first_name}}` (any standard Contact field), `{{my_first_name}}`, `{{my_last_name}}`, `{{my_full_name}}` (the sending Account), any other `{{<key>}}` is the custom field `contact.extra.<key>`; the long forms `{{contact.<field>}}`, `{{contact.extra.<key>}}` and `{{account.<name>}}` stay valid. Delays are about their duration: every wait and until timeout gets a small random spread that only ever adds time.',
+  description: 'A Motion\'s Sequence: a flat steps array run from the first step, ending explicitly in "end". Served documents use this key order: $schema, on_reply, steps; in a step id, the kind key, timeout, save, save_to_contact, variants, with, event, then, else, next, note; in with post, newer_than, reaction, subject, text, note, note_fallback, fallback, withdraw_after; in a variant id, subject, text. A text holds at most 50 variables. Variables: `{{first_name}}` (any standard Contact field), `{{my_first_name}}`, `{{my_last_name}}`, `{{my_full_name}}` (the sending Account), any other `{{<key>}}` is the custom field `contact.extra.<key>`; the long forms `{{contact.<field>}}`, `{{contact.extra.<key>}}` and `{{account.<name>}}` stay valid; `{{enrollment.<name>}}` is a value a save of this Sequence writes. Delays are about their duration: every wait and until timeout gets a small random spread that only ever adds time.',
   type: "object",
   additionalProperties: false,
   required: [
@@ -2972,7 +3406,7 @@ var schema_v1_default = {
     on_reply: {
       type: "string",
       pattern: "^(end|[a-z][a-z0-9_]{0,39})$",
-      description: "Where a reply interrupts to. Used only while stop_on_engagement is false."
+      description: "Where a reply interrupts to."
     },
     steps: {
       type: "array",
@@ -3700,6 +4134,52 @@ var schema_v1_default = {
                 pattern: "^[1-9][0-9]*(m|h|d)$",
                 description: "Give up waiting after about this long (1h to 180d; a small random spread is added, never subtracted)."
               },
+              save: {
+                type: "object",
+                minProperties: 1,
+                maxProperties: 20,
+                propertyNames: {
+                  pattern: "^[a-z][a-z0-9_]{0,63}$",
+                  not: {
+                    const: "id"
+                  }
+                },
+                additionalProperties: {
+                  type: "string",
+                  minLength: 1,
+                  maxLength: 256,
+                  description: 'A field path into the incoming payload: dots, items[0] and ["a.b"].'
+                },
+                description: "until event.<name> only: Enrollment values saved from the incoming event, name to path (at most 20). Read them as {{enrollment.<name>}} and if enrollment.<name>; they end with the Enrollment."
+              },
+              save_to_contact: {
+                type: "object",
+                minProperties: 1,
+                maxProperties: 20,
+                propertyNames: {
+                  pattern: "^(email|[A-Za-z0-9_]{1,64})$",
+                  not: {
+                    enum: [
+                      "full_name",
+                      "first_name",
+                      "last_name",
+                      "headline",
+                      "job_title",
+                      "company",
+                      "location",
+                      "linkedin_url",
+                      "about"
+                    ]
+                  }
+                },
+                additionalProperties: {
+                  type: "string",
+                  minLength: 1,
+                  maxLength: 256,
+                  description: 'A field path into the incoming payload: dots, items[0] and ["a.b"].'
+                },
+                description: "until event.<name> only: Contact custom fields (contact.extra.<key>) saved from the incoming event, key to path (at most 20); email fills only an empty email."
+              },
               then: {
                 type: "string",
                 pattern: "^(end|[a-z][a-z0-9_]{0,39})$",
@@ -4325,12 +4805,73 @@ var schema_v1_default = {
                           },
                           exists: {
                             type: "boolean"
+                          },
+                          gte: {
+                            type: "number"
+                          },
+                          lte: {
+                            type: "number"
                           }
                         },
-                        description: "Exactly one operator. Strings compare trimmed, case-insensitive."
+                        description: "Exactly one operator. Strings compare trimmed, case-insensitive; gte and lte compare a number, or text that reads as one."
                       }
                     }
                   },
+                  {
+                    type: "object",
+                    minProperties: 1,
+                    maxProperties: 1,
+                    additionalProperties: false,
+                    patternProperties: {
+                      "^enrollment\\.(?!id$)[a-z][a-z0-9_]{0,63}$": {
+                        type: "object",
+                        minProperties: 1,
+                        maxProperties: 1,
+                        additionalProperties: false,
+                        properties: {
+                          eq: {
+                            type: [
+                              "string",
+                              "number",
+                              "boolean"
+                            ]
+                          },
+                          neq: {
+                            type: [
+                              "string",
+                              "number",
+                              "boolean"
+                            ]
+                          },
+                          in: {
+                            type: "array",
+                            minItems: 1,
+                            items: {
+                              type: [
+                                "string",
+                                "number",
+                                "boolean"
+                              ]
+                            }
+                          },
+                          contains: {
+                            type: "string"
+                          },
+                          exists: {
+                            type: "boolean"
+                          },
+                          gte: {
+                            type: "number"
+                          },
+                          lte: {
+                            type: "number"
+                          }
+                        },
+                        description: "Exactly one operator. Strings compare trimmed, case-insensitive; gte and lte compare a number, or text that reads as one."
+                      }
+                    },
+                    description: "if only: an Enrollment value a save of this Sequence writes. Unset is false, except exists:false."
+                  },
                   {
                     type: "object",
                     additionalProperties: false,
@@ -4956,12 +5497,73 @@ var schema_v1_default = {
                                   },
                                   exists: {
                                     type: "boolean"
+                                  },
+                                  gte: {
+                                    type: "number"
+                                  },
+                                  lte: {
+                                    type: "number"
                                   }
                                 },
-                                description: "Exactly one operator. Strings compare trimmed, case-insensitive."
+                                description: "Exactly one operator. Strings compare trimmed, case-insensitive; gte and lte compare a number, or text that reads as one."
                               }
                             }
                           },
+                          {
+                            type: "object",
+                            minProperties: 1,
+                            maxProperties: 1,
+                            additionalProperties: false,
+                            patternProperties: {
+                              "^enrollment\\.(?!id$)[a-z][a-z0-9_]{0,63}$": {
+                                type: "object",
+                                minProperties: 1,
+                                maxProperties: 1,
+                                additionalProperties: false,
+                                properties: {
+                                  eq: {
+                                    type: [
+                                      "string",
+                                      "number",
+                                      "boolean"
+                                    ]
+                                  },
+                                  neq: {
+                                    type: [
+                                      "string",
+                                      "number",
+                                      "boolean"
+                                    ]
+                                  },
+                                  in: {
+                                    type: "array",
+                                    minItems: 1,
+                                    items: {
+                                      type: [
+                                        "string",
+                                        "number",
+                                        "boolean"
+                                      ]
+                                    }
+                                  },
+                                  contains: {
+                                    type: "string"
+                                  },
+                                  exists: {
+                                    type: "boolean"
+                                  },
+                                  gte: {
+                                    type: "number"
+                                  },
+                                  lte: {
+                                    type: "number"
+                                  }
+                                },
+                                description: "Exactly one operator. Strings compare trimmed, case-insensitive; gte and lte compare a number, or text that reads as one."
+                              }
+                            },
+                            description: "if only: an Enrollment value a save of this Sequence writes. Unset is false, except exists:false."
+                          },
                           {
                             type: "object",
                             additionalProperties: false,
@@ -5026,7 +5628,7 @@ var schema_v1_default = {
               emit: {
                 type: "string",
                 pattern: "^[a-z][a-z0-9_.]{0,63}$",
-                description: "Legacy: a custom event name. New documents put event on the step that matters."
+                description: "Send event: the custom event name this step sends (motion.custom_event)."
               },
               next: {
                 type: "string",
@@ -5094,16 +5696,86 @@ function deepFreeze(value) {
 }
 var SEQUENCE_SCHEMA_V1 = deepFreeze(schema_v1_default);
 
-// src/sequence/constants.ts
+// src/shared/sequence/limits.ts
+var SEQUENCE_SCHEMA_URL2 = "https://docs.curviate.com/schemas/sequence/v1.json";
+var MAX_STEPS = 100;
+var MIN_VARIANTS = 2;
+var MAX_VARIANTS = 2;
+var DEPRECATED_ACCEPTED_UNTIL = "2027-01-19";
+var MAX_VARIANTS_DEPRECATED = 5;
+var MAX_SEQUENCE_BYTES = 256 * 1024;
+var MAX_STEP_NOTE_CHARS = 500;
+var MAX_TAG_CHARS = 64;
+var MAX_PREDICATE_DEPTH = 10;
+var MAX_VARIABLE_REFS_PER_TEXT = 50;
+var MAX_QUOTED_TOKEN_CHARS = 64;
+var ID_PATTERN = "^[a-z][a-z0-9_]{0,39}$";
+var EVENT_NAME_PATTERN = "^[a-z][a-z0-9_.]{0,63}$";
+var EXTRA_KEY_PATTERN = "^[A-Za-z0-9_]{1,64}$";
+var SAVE_NAME_PATTERN = "^[a-z][a-z0-9_]{0,63}$";
+var MAX_SAVE_ENTRIES = 20;
+var DURATION_PATTERN = "^[1-9][0-9]*(m|h|d)$";
+var TAG_PATTERN = "^[^,;]*[^,;\\s][^,;]*$";
 var END = "end";
+var M = 1;
 var H = 60;
-var D = 24 * H;
+var D = 24 * 60;
 var DURATION_BOUNDS = {
-  wait: { min: 1, max: 365 * D, label: "1m and 365d", example: "1d" },
+  wait: { min: 1 * M, max: 365 * D, label: "1m and 365d", example: "1d" },
   timeout: { min: 1 * H, max: 180 * D, label: "1h and 180d", example: "21d" },
   withdraw_after: { min: 14 * D, max: 180 * D, label: "14d and 180d", example: "21d" },
   newer_than: { min: 1 * H, max: 365 * D, label: "1h and 365d", example: "30d" }
 };
+var STEP_KINDS = ["do", "wait", "until", "if", "emit", "tag"];
+var ACTIONS = [
+  "profile.view",
+  "profile.follow",
+  "profile.unfollow",
+  "invite.send",
+  "invite.withdraw",
+  "message.send",
+  "inmail.send",
+  "post.react",
+  "post.comment",
+  "skill.endorse"
+];
+var ACTION_PARAMS = {
+  "profile.view": [],
+  "profile.follow": [],
+  "profile.unfollow": [],
+  "invite.send": ["note", "note_fallback", "withdraw_after"],
+  "invite.withdraw": [],
+  "message.send": ["text", "fallback"],
+  "inmail.send": ["subject", "text", "fallback"],
+  "post.react": ["post", "newer_than", "reaction"],
+  "post.comment": ["post", "newer_than", "text", "fallback"],
+  "skill.endorse": []
+};
+var MESSAGING_ACTIONS = ["invite.send", "message.send", "inmail.send", "post.comment"];
+var REACTIONS = ["like", "celebrate", "support", "love", "insightful", "funny"];
+var EVENTS = ["invite.accepted", "message.replied", "message.read"];
+var STANDARD_FIELDS = [
+  "full_name",
+  "first_name",
+  "last_name",
+  "headline",
+  "job_title",
+  "company",
+  "email",
+  "location",
+  "linkedin_url",
+  "about"
+];
+var NAME_FIELDS = ["full_name", "first_name", "last_name"];
+var ACCOUNT_FIELDS = ["first_name", "last_name", "full_name"];
+var BOOLEAN_PREDICATES = [
+  "contact.connected",
+  "contact.open_profile",
+  "contact.premium",
+  "contact.has_photo"
+];
+var FIELD_OPERATORS = ["eq", "neq", "in", "contains", "exists"];
+var NUMBER_OPERATORS = ["gte", "lte"];
 var TEXT_LIMITS = {
   message: 8e3,
   invite_note: 300,
@@ -5111,22 +5783,104 @@ var TEXT_LIMITS = {
   inmail_text: 1900,
   comment: 1250
 };
-var MAX_SEQUENCE_BYTES = 256 * 1024;
-var MAX_PREDICATE_DEPTH = 10;
-var MAX_VARIABLE_REFS_PER_TEXT = 50;
-var MAX_QUOTED_TOKEN_CHARS = 64;
-var ACCOUNT_FIELDS = ["first_name", "last_name", "full_name"];
-var NAME_FIELDS = ["full_name", "first_name", "last_name"];
-var MOTION_KEY_PATTERN = "^[a-z][a-z0-9_]{0,39}$";
-var MAX_VARIANTS = 2;
-var DEPRECATED_ACCEPTED_UNTIL = "2027-01-19";
+var STEP_KEYS = {
+  do: ["id", "do", "with", "variants", "event", "next", "else", "note"],
+  wait: ["id", "wait", "next", "note"],
+  until: ["id", "until", "timeout", "save", "save_to_contact", "then", "else", "note"],
+  if: ["id", "if", "then", "else", "note"],
+  emit: ["id", "emit", "next", "note"],
+  tag: ["id", "tag", "event", "next", "note"]
+};
 var SHORT_VARIABLE_PATTERN = "^[a-z][a-z0-9_]{0,63}$";
+var SHORT_RE = new RegExp(SHORT_VARIABLE_PATTERN);
 var MY_FIELDS = ["my_first_name", "my_last_name", "my_full_name"];
+function longVariable(inner) {
+  if (inner.includes("."))
+    return inner;
+  if (!SHORT_RE.test(inner))
+    return null;
+  if (MY_FIELDS.includes(inner))
+    return `account.${inner.slice(3)}`;
+  if (inner.startsWith("my_"))
+    return null;
+  if (STANDARD_FIELDS.includes(inner))
+    return `contact.${inner}`;
+  return `contact.extra.${inner}`;
+}
+var isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var fallbackKeyword = (action) => action === "invite.send" ? "drop" : action === "post.comment" ? "skip" : null;
 
-// src/sequence/rules.ts
-var SEQUENCE_RULES_DOCS_URL = "https://docs.curviate.com/reference/sequence-rules";
-var HINTS = {
-  R1: () => "Keep only $schema, on_reply and steps at the top level; $schema, when present, is https://docs.curviate.com/schemas/sequence/v1.json.",
+// src/shared/sequence/paths.ts
+function durationMinutes(v) {
+  const m = typeof v === "string" ? /^([1-9][0-9]*)(m|h|d)$/.exec(v) : null;
+  if (!m)
+    return 0;
+  return Number(m[1]) * { m: 1, h: 60, d: 1440 }[m[2]];
+}
+
+// src/shared/field-paths.ts
+var PATH_MAX = 256;
+var PLAIN = /^[A-Za-z0-9_$-]+$/;
+function parsePath(input) {
+  const s = input.trim();
+  const out = [];
+  let i = 0;
+  const key = () => {
+    const m = /^[A-Za-z0-9_$-]+/.exec(s.slice(i));
+    if (!m)
+      return false;
+    out.push(m[0]);
+    i += m[0].length;
+    return true;
+  };
+  if (s === "" || s[0] !== "[" && !key())
+    return null;
+  while (i < s.length) {
+    if (s[i] === ".") {
+      i += 1;
+      if (!key())
+        return null;
+    } else if (s[i] === "[") {
+      const idx = /^\[(\d{1,6})\]/.exec(s.slice(i));
+      const str = /^\[("(?:[^"\\]|\\.)*")\]/.exec(s.slice(i));
+      if (idx) {
+        out.push(Number(idx[1]));
+        i += idx[0].length;
+      } else if (str) {
+        try {
+          out.push(JSON.parse(str[1]));
+        } catch {
+          return null;
+        }
+        i += str[0].length;
+      } else
+        return null;
+    } else
+      return null;
+  }
+  return out;
+}
+function formatPath(segs) {
+  return segs.map((g, n) => typeof g === "number" ? `[${g}]` : PLAIN.test(g) ? n === 0 ? g : `.${g}` : `[${JSON.stringify(g)}]`).join("");
+}
+function normalizePath(input) {
+  const segs = parsePath(input);
+  if (segs === null)
+    return null;
+  const p = formatPath(segs);
+  return p.length > PATH_MAX ? null : p;
+}
+
+// src/shared/sequence/references.ts
+function awaitedEventName(until) {
+  const m = typeof until === "string" ? /^(?:event|signal)\.(.+)$/s.exec(until) : null;
+  return m ? m[1] : null;
+}
+
+// src/shared/sequence/rules.ts
+var SEQUENCE_RULES_DOCS_URL = "https://docs.curviate.com/reference/sequence-rules";
+var HINTS = {
+  R1: () => "Keep only $schema, on_reply and steps at the top level; $schema, when present, is https://docs.curviate.com/schemas/sequence/v1.json.",
   R2: () => "Keep the document to 1 to 100 steps and 256 KiB; split a longer flow into two Motions.",
   R3: () => "Give each step a unique id: lowercase letters, digits and _, starting with a letter, at most 40 characters, not end.",
   R4: () => "Give the step exactly one of do, wait, until, if, emit or tag.",
@@ -5145,203 +5899,124 @@ var HINTS = {
   R17: () => "Remove the part after | and add a variable-free fallback on the step instead.",
   R18: () => "Write a variable with double braces, like {{first_name}}, or remove the braces.",
   R19: () => 'Add a variable-free fallback: with.fallback, with.note_fallback (or "drop") on an invitation, "skip" on a comment.',
-  R20: () => "Use a Contact variable in the comment, for example a custom field {{comment}} your agent writes per Contact.",
+  R20: () => "Use a Contact variable in the comment, for example a custom field {{comment}} your AI writes per Contact.",
   R21: () => "Set withdraw_after between 14d and 180d, for example 21d.",
   R22: () => "Shorten the text to the limit (variables are not counted) or use fewer variables.",
   R23: () => "Give the step exactly 2 variants (A/B) with ids unique in the document, or one text in with.",
   R24: () => "Name the event with lowercase letters, digits, _ and ., starting with a letter, like reply.received; a Tag is 1 to 64 characters without , or ;.",
+  R25: () => "Put save and save_to_contact on an until event.<name> step, 1 to 20 entries each: save names are lowercase (not id), save_to_contact keys are custom fields or email.",
+  R26: () => 'Write the path with dots, items[0] and ["a.b"], like lead.score, at most 256 characters.',
+  R27: (t) => t ? `Use ${t}.` : "Save the value with save on an until event.<name> step first; a save_to_contact key reads as {{contact.extra.<key>}}.",
+  R28: () => 'Use gte or lte with a number, like {"gte": 50}, on enrollment.<key> or contact.extra.<key>.',
+  R29: () => "Save a field inside the object or list, or compare that value with eq, neq or exists instead.",
   W1: () => "If the merge is intended, keep it; otherwise give the jumping step its own continuation.",
+  W2: () => "Add a sending Account with Sales Navigator or Recruiter, or remove the InMail step.",
+  W3: () => 'Set note_fallback to "drop" so invitations go on without a note once the noted ones are used up.',
+  W4: () => "Wait for message.replied instead, or add a sending Account that does not use Recruiter.",
   W5: () => "Remove the follow step: the invitation already follows the person.",
   W6: () => "Send an invitation on this path before waiting for its acceptance.",
   W7: () => "Write the comment per Contact, for example in a custom field {{comment}}.",
   W8: () => "Keep the link for a later message.",
   W9: () => "Motion variables are deprecated: write the text in place, or use a custom field.",
+  W10: () => "Retired: never emitted. The Sequence's on_reply decides what a reply does.",
   W11: (t) => `Did you mean ${t}?`,
   W12: () => "Send a message on this path before checking whether it was seen.",
-  W13: (t) => `Use ${t} instead.`
+  W13: (t) => `Use ${t} instead.`,
+  W14: () => "Use the value in a message or an if step, or remove it from save if no webhook template sends it.",
+  W16: (t) => `Use ${t} to read the saved value.`
 };
+var SEQUENCE_RULE_CODES = Object.keys(HINTS);
 function ruleHelp(code, token = "") {
   const hint = HINTS[code];
-  if (!hint) throw new Error(`no hint for ${code}`);
+  if (!hint)
+    throw new Error(`no hint for ${code}`);
   return { hint: hint(token), docs_url: `${SEQUENCE_RULES_DOCS_URL}#${code.toLowerCase()}` };
 }
-
-// src/sequence/vocab.ts
-var SUPPORTED_KEYWORDS = /* @__PURE__ */ new Set([
-  "$id",
-  "$schema",
-  "additionalProperties",
-  "anyOf",
-  "const",
-  "default",
-  "description",
-  "enum",
-  "items",
-  "maxItems",
-  "maxLength",
-  "maxProperties",
-  "minItems",
-  "minLength",
-  "minProperties",
-  "minimum",
-  "oneOf",
-  "pattern",
-  "patternProperties",
-  "properties",
-  "required",
-  "title",
-  "type"
-]);
-var MAPS = /* @__PURE__ */ new Set(["properties", "patternProperties"]);
-function schemaKeywords(schema) {
-  const out = /* @__PURE__ */ new Set();
-  const visit = (node) => {
-    if (Array.isArray(node)) return node.forEach(visit);
-    if (!isObject(node)) return;
-    for (const [k, v] of Object.entries(node)) {
-      out.add(k);
-      if (MAPS.has(k) && isObject(v)) Object.values(v).forEach(visit);
-      else if (k !== "enum" && k !== "const" && k !== "default" && k !== "required") visit(v);
-    }
-  };
-  visit(schema);
-  return out;
-}
-function assertKeywords(schema) {
-  const unknown = [...schemaKeywords(schema)].filter((k) => !SUPPORTED_KEYWORDS.has(k));
-  if (unknown.length) throw new Error(`Sequence schema uses unsupported JSON Schema keyword(s): ${unknown.join(", ")}`);
-}
-var isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-var obj = (v, at) => {
-  if (!isObject(v)) throw new Error(`Sequence schema: expected an object at ${at}`);
-  return v;
-};
-var arr = (v, at) => {
-  if (!Array.isArray(v)) throw new Error(`Sequence schema: expected an array at ${at}`);
-  return v;
-};
-var num = (v, at) => {
-  if (typeof v !== "number") throw new Error(`Sequence schema: expected a number at ${at}`);
-  return v;
+var PROBLEMS = {
+  R1: { sentence: "The document has a top-level key the API does not take.", short: "Unknown key" },
+  R2: { sentence: "The Sequence has too many steps or is too large.", short: "Too long" },
+  R3: { sentence: "A step has a missing or repeated id.", short: "Needs an id" },
+  R4: { sentence: "This step is not exactly one kind of step.", short: "Needs setup: pick a kind" },
+  R5: { sentence: "This step has a setting its kind does not take.", short: "Unknown setting" },
+  R6: { sentence: "This step leads to a step that does not exist.", short: "Leads nowhere" },
+  R7: { sentence: "Choose where this step goes on its \u2713 branch.", short: "Needs setup: the \u2713 branch" },
+  R8: { sentence: "These steps loop back on themselves.", short: "Loops back" },
+  R9: { sentence: "Nothing leads to this step.", short: "Not reached" },
+  R10: { sentence: "This path runs off the end.", short: "Needs an ending" },
+  R11: { sentence: "When they reply leads to a step that does not exist.", short: "Leads nowhere" },
+  R12: { sentence: "The delay or timeout is out of range.", short: "Needs setup: a duration" },
+  R13: { sentence: "A setting of this step is missing or not valid.", short: "Needs setup" },
+  R14: { sentence: "Choose what to wait for and for how long.", short: "Needs setup: what to wait for" },
+  R15: { sentence: "The condition is not one Curviate can check.", short: "Needs setup: the condition" },
+  R16: { sentence: "A variable is not one Curviate knows.", short: "Unknown variable" },
+  R17: { sentence: "A variable carries a default or a filter; use a fallback instead.", short: "Variable with a default" },
+  R18: { sentence: "Single braces are not a variable.", short: "Single-brace placeholder" },
+  R19: { sentence: "Add a fallback for Contacts missing a field.", short: "Needs a fallback" },
+  R20: { sentence: "A comment must use a Contact variable.", short: "Needs a Contact variable" },
+  R21: { sentence: "Withdraw after must be between 14 and 180 days.", short: "Needs setup: withdraw after" },
+  R22: { sentence: "The text is over its limit.", short: "Text too long" },
+  R23: { sentence: "A/B needs exactly two variants.", short: "Needs setup: variants" },
+  R24: { sentence: "The event or Tag name is not valid.", short: "Needs setup: a valid name" },
+  R25: { sentence: "Saved values belong on a wait for an incoming event, at most 20.", short: "Needs setup: saved values" },
+  R26: { sentence: "A field path is not valid.", short: "Needs setup: a field path" },
+  R27: { sentence: "This uses a value no step saves.", short: "Value not saved" },
+  R28: { sentence: "At least and at most compare numbers on saved values and custom fields.", short: "Needs setup: a number" },
+  R29: { sentence: "The incoming sample has no plain value at this field.", short: "Not a plain value" },
+  W1: { sentence: "Two paths merge here.", short: "Merge point" },
+  W2: { sentence: "InMail needs a sending Account with Sales Navigator or Recruiter.", short: "No InMail Account" },
+  W3: { sentence: "Basic Accounts send only a few invitation notes a month.", short: "Few notes on Basic" },
+  W4: { sentence: "Read receipts are not available on Recruiter.", short: "No read receipts" },
+  W5: { sentence: "The invitation already follows the person.", short: "Follows twice" },
+  W6: { sentence: "This waits for acceptance with no invitation before it.", short: "No invitation before" },
+  W7: { sentence: "The comment is personalised by name only.", short: "Name-only comment" },
+  W8: { sentence: "A link in the first message gets fewer replies.", short: "Link in first message" },
+  W9: { sentence: "Motion variables are deprecated.", short: "Motion variable" },
+  W10: { sentence: "Retired: no longer reported.", short: "Retired" },
+  W11: { sentence: "A custom field looks like a typo.", short: "Possible typo" },
+  W12: { sentence: "This checks for a seen message before any message is sent.", short: "Nothing seen yet" },
+  W13: { sentence: "This form is deprecated.", short: "Deprecated form" },
+  W14: { sentence: "A saved value is never used.", short: "Unused value" },
+  W16: { sentence: "This reads a Contact field, not the saved value.", short: "Contact field, not the value" }
 };
-var str = (v, at) => {
-  if (typeof v !== "string") throw new Error(`Sequence schema: expected a string at ${at}`);
-  return v;
-};
-var after = (pattern, prefix) => {
-  if (!pattern.startsWith(prefix)) throw new Error(`Sequence schema: pattern ${pattern} does not start with ${prefix}`);
-  return "^" + pattern.slice(prefix.length);
-};
-function vocabulary(schema) {
-  assertKeywords(schema);
-  const root = obj(schema, "$");
-  const props = obj(root["properties"], "properties");
-  const steps = obj(props["steps"], "properties.steps");
-  const alts = arr(obj(steps["items"], "steps.items")["oneOf"], "steps.items.oneOf").map((a, i) => obj(a, `steps.items.oneOf[${i}]`));
-  const propsOf = (a) => obj(a["properties"], "step.properties");
-  const withProps = (a) => obj(obj(propsOf(a)["with"], "with")["properties"], "with.properties");
-  const doAlts = alts.filter((a) => isObject(propsOf(a)["do"]));
-  const kindOf = (a) => {
-    const req = arr(a["required"], "step.required");
-    return str(req[1], "step.required[1]");
-  };
-  const stepKinds = [...new Set(alts.map(kindOf))];
-  const stepKeys = {};
-  for (const a of alts) {
-    const k = kindOf(a);
-    stepKeys[k] = [.../* @__PURE__ */ new Set([...stepKeys[k] ?? [], ...Object.keys(propsOf(a))])];
-  }
-  const actions = [];
-  const actionParams = {};
-  const messagingActions = [];
-  let variants;
-  for (const a of doAlts) {
-    const p = propsOf(a);
-    const action = str(obj(p["do"], "do")["const"], "do.const");
-    actions.push(action);
-    actionParams[action] = Object.keys(withProps(a));
-    if (isObject(p["variants"])) {
-      messagingActions.push(action);
-      variants ?? (variants = p["variants"]);
-    }
-  }
-  if (!variants) throw new Error("Sequence schema: no action takes variants");
-  const byKind = (k) => propsOf(alts.find((a) => kindOf(a) === k) ?? {});
-  const stepId = obj(propsOf(alts[0])["id"], "id");
-  const until = arr(obj(byKind("until")["until"], "until")["anyOf"], "until.anyOf").map((x) => obj(x, "until.anyOf[]"));
-  const tag = obj(byKind("tag")["tag"], "tag");
-  const reacting = doAlts.find((a) => "reaction" in withProps(a));
-  if (!reacting) throw new Error("Sequence schema: no action takes a reaction");
-  const reactWith = withProps(reacting);
-  const preds = arr(obj(byKind("if")["if"], "if")["oneOf"], "if.oneOf").map((x) => obj(x, "if.oneOf[]"));
-  const singleKey = (p) => {
-    const req = p["required"];
-    return Array.isArray(req) && req.length === 1 && typeof req[0] === "string" ? req[0] : null;
-  };
-  const booleanPredicates = preds.filter((p) => {
-    const k = singleKey(p);
-    return k !== null && k.startsWith("contact.") && obj(propsOf(p)[k], k)["type"] === "boolean";
-  }).map((p) => singleKey(p));
-  const fields = preds.find((p) => singleKey(p) === null && isObject(p["properties"]) && Object.keys(propsOf(p)).length > 1);
-  if (!fields) throw new Error("Sequence schema: no standard-field predicate");
-  const standardFields = Object.keys(propsOf(fields)).map((k) => k.slice("contact.".length));
-  const operand = obj(Object.values(propsOf(fields))[0], "field operand");
-  const extra = preds.find((p) => isObject(p["patternProperties"]));
-  if (!extra) throw new Error("Sequence schema: no contact.extra predicate");
-  const extraKey = Object.keys(obj(extra["patternProperties"], "patternProperties"))[0];
-  const degree = obj(preds.find((p) => singleKey(p) === "contact.degree")["properties"], "degree")["contact.degree"];
-  const degreeEq = obj(obj(arr(obj(degree, "degree")["oneOf"], "degree.oneOf")[0], "degree.eq")["properties"], "degree.eq.properties")["eq"];
-  const connections = obj(propsOf(preds.find((p) => singleKey(p) === "contact.connections_gte"))["contact.connections_gte"], "connections_gte");
-  return {
-    schemaUrl: str(root["$id"], "$id"),
-    minSteps: num(steps["minItems"], "steps.minItems"),
-    maxSteps: num(steps["maxItems"], "steps.maxItems"),
-    stepKinds,
-    stepKeys,
-    actions,
-    actionParams,
-    messagingActions,
-    minVariants: num(variants["minItems"], "variants.minItems"),
-    maxVariants: num(variants["maxItems"], "variants.maxItems"),
-    idPattern: after(str(stepId["pattern"], "id.pattern"), "^(?!end$)"),
-    maxNoteChars: num(obj(propsOf(alts[0])["note"], "note")["maxLength"], "note.maxLength"),
-    durationPattern: str(obj(byKind("wait")["wait"], "wait")["pattern"], "wait.pattern"),
-    events: arr(until[0]["enum"], "until.enum").map((e) => str(e, "until.enum[]")),
-    eventNamePattern: after(str(until[1]["pattern"], "until.pattern"), "^(event|signal)\\."),
-    emitPattern: str(obj(byKind("emit")["emit"], "emit")["pattern"], "emit.pattern"),
-    tagPattern: str(tag["pattern"], "tag.pattern"),
-    maxTagChars: num(tag["maxLength"], "tag.maxLength"),
-    reactions: arr(obj(reactWith["reaction"], "reaction")["enum"], "reaction.enum").map((e) => str(e, "reaction.enum[]")),
-    post: str(obj(reactWith["post"], "post")["const"], "post.const"),
-    booleanPredicates,
-    standardFields,
-    fieldOperators: Object.keys(obj(operand["properties"], "operand.properties")),
-    extraKeyPattern: after(extraKey, "^contact\\.extra\\."),
-    degrees: arr(obj(degreeEq, "degree.eq")["enum"], "degree.enum"),
-    connectionsMin: num(connections["minimum"], "connections_gte.minimum")
-  };
-}
+var SEQUENCE_PROBLEM_CODES = Object.keys(PROBLEMS);
 
-// src/sequence/validate.ts
-var issue = (ctx, i) => ctx.issues.push(i);
-var warning = (ctx, i) => ctx.warnings.push(i);
+// src/shared/sequence/validate.ts
+function lintSequence(doc) {
+  return run(doc, { kind: "lint" });
+}
 function jsonPointer(...tokens) {
   return tokens.map((t) => "/" + String(t).replace(/~/g, "~0").replace(/\//g, "~1")).join("");
 }
-function entry(code, path, pointer, rule, token) {
-  return { path, rule, code, message: rule, pointer, ...ruleHelp(code, token) };
+function sequenceEntry(code, path, pointer, rule, token, candidates) {
+  return {
+    path,
+    rule,
+    code,
+    message: rule,
+    pointer,
+    ...ruleHelp(code, token),
+    severity: code.startsWith("W") ? "warning" : "error",
+    ...candidates?.length ? { candidates } : {}
+  };
 }
-function entries(issues) {
-  return issues.sort((a, b) => a.order - b.order).map((i) => entry(i.code, i.path, i.pointer, i.rule, i.token));
+function sequenceSizeError(bytes) {
+  return sequenceEntry("R2", "$", "", `the document is ${bytes} bytes; the limit is ${MAX_SEQUENCE_BYTES}, UTF-8 compact JSON`);
 }
 var UNTIL = `; accepted until ${DEPRECATED_ACCEPTED_UNTIL}`;
+var ID_RE = new RegExp(ID_PATTERN);
+var DURATION_RE = new RegExp(DURATION_PATTERN);
+var EVENT_RE = new RegExp(EVENT_NAME_PATTERN);
+var EXTRA_KEY_RE = new RegExp(EXTRA_KEY_PATTERN);
+var TAG_RE = new RegExp(TAG_PATTERN);
+var SAVE_NAME_RE = new RegExp(SAVE_NAME_PATTERN);
 var VARIABLE_RE = /\{\{([^{}]*)\}\}/g;
 var SINGLE_BRACE_RE = /\{[A-Za-z_][A-Za-z0-9_.]*\}/g;
+var KIND_LIST = STEP_KINDS.join(", ");
 function keysOf(o) {
   return Object.keys(o).filter((k) => o[k] !== void 0);
 }
 function has(o, k) {
-  return Object.prototype.hasOwnProperty.call(o, k) && o[k] !== void 0;
+  return Object.hasOwn(o, k) && o[k] !== void 0;
 }
 function quote(token) {
   return [...token].slice(0, MAX_QUOTED_TOKEN_CHARS).join("");
@@ -5358,31 +6033,32 @@ function deeperThan(v, max) {
   for (let depth = 1; level.length; depth++) {
     const next = [];
     for (const x of level) {
-      if (typeof x === "object" && x !== null) for (const child of Object.values(x)) next.push(child);
+      if (typeof x === "object" && x !== null)
+        for (const child of Object.values(x))
+          next.push(child);
     }
-    if (!next.length) return false;
-    if (depth > max) return true;
+    if (!next.length)
+      return false;
+    if (depth > max)
+      return true;
     level = next;
   }
   return false;
 }
-function durationMinutes(v) {
-  const m = /^([1-9][0-9]*)(m|h|d)$/.exec(v);
-  if (!m) return 0;
-  return Number(m[1]) * { m: 1, h: 60, d: 1440 }[m[2]];
-}
 function durationRule(bounds) {
   return `must be a duration between ${bounds.label}: a number then m, h or d, like 30d`;
 }
 var durationHint = (bounds) => `${bounds.label}, for example ${bounds.example}`;
-function durationOk(ctx, v, bounds) {
-  if (typeof v !== "string" || !ctx.re.duration.test(v)) return false;
+function durationOk(v, bounds) {
+  if (typeof v !== "string" || !DURATION_RE.test(v))
+    return false;
   const m = durationMinutes(v);
   return m >= bounds.min && m <= bounds.max;
 }
-function tagOk(ctx, v) {
-  return typeof v === "string" && [...v].length <= ctx.v.maxTagChars && ctx.re.tag.test(v);
+function tagOk(v) {
+  return typeof v === "string" && [...v].length <= MAX_TAG_CHARS && TAG_RE.test(v);
 }
+var TAG_RULE = "a Tag name is 1 to 64 characters, without , or ;";
 function variablesIn(text) {
   return [...text.matchAll(VARIABLE_RE)].map((m) => ({ token: m[0], inner: m[1].trim() }));
 }
@@ -5392,44 +6068,34 @@ function hasVariable(text) {
 function staticLength(text) {
   return [...text.replace(VARIABLE_RE, "")].length;
 }
-function longVariable(ctx, inner) {
-  if (inner.includes(".")) return inner;
-  if (!ctx.re.short.test(inner)) return null;
-  if (MY_FIELDS.includes(inner)) return `account.${inner.slice(3)}`;
-  if (inner.startsWith("my_")) return null;
-  if (ctx.v.standardFields.includes(inner)) return `contact.${inner}`;
-  return `contact.extra.${inner}`;
-}
-function isKnownVariable(ctx, inner) {
-  const long = longVariable(ctx, inner);
-  if (long === null) return false;
-  if (long.startsWith("contact.extra.")) return ctx.re.extraKey.test(long.slice("contact.extra.".length));
-  if (long.startsWith("contact.")) return ctx.v.standardFields.includes(long.slice(8));
-  if (long.startsWith("account.")) return ACCOUNT_FIELDS.includes(long.slice(8));
-  return false;
-}
 function distance(a, b, cap) {
-  if (Math.abs(a.length - b.length) > cap) return cap + 1;
+  if (Math.abs(a.length - b.length) > cap)
+    return cap + 1;
   let prev = Array.from({ length: b.length + 1 }, (_, j) => j);
   for (let i = 1; i <= a.length; i++) {
     const cur = [i];
-    for (let j = 1; j <= b.length; j++) cur[j] = Math.min(prev[j] + 1, cur[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+    for (let j = 1; j <= b.length; j++)
+      cur[j] = Math.min(prev[j] + 1, cur[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
     prev = cur;
   }
   return prev[b.length];
 }
-function likelyTypoOf(ctx, key) {
+var NEAR_NAMES = [...STANDARD_FIELDS, ...MY_FIELDS];
+function likelyTypoOf(key) {
   let best = null;
   let bestD = 3;
-  for (const n of [...ctx.v.standardFields, ...MY_FIELDS]) {
+  for (const n of NEAR_NAMES) {
     const d = distance(key, n, 2);
-    if (d < bestD) [best, bestD] = [n, d];
+    if (d < bestD)
+      [best, bestD] = [n, d];
   }
   return best;
 }
+var issue = (ctx, i) => ctx.issues.push(i);
+var warning = (ctx, i) => ctx.warnings.push(i);
 function checkText(ctx, order, path, pointer, parent, value, limit) {
   if (typeof value !== "string" || value.trim() === "") {
-    issue(ctx, { order, code: "R13", path, pointer: value === void 0 ? parent : pointer, rule: "must be non-empty text" });
+    issue(ctx, { order, code: "R13", path, pointer: typeof value === "undefined" ? parent : pointer, rule: "must be non-empty text" });
     return null;
   }
   const at = { order, path, pointer };
@@ -5442,22 +6108,31 @@ function checkText(ctx, order, path, pointer, parent, value, limit) {
       issue(ctx, { ...at, code: "R17", rule: "variable defaults are not supported; add a fallback" });
       continue;
     }
-    if (v.inner.startsWith("motion.") && ctx.re.motion.test(v.inner.slice(7))) {
-      const key = v.inner.slice(7);
+    const motion = /^motion\.([a-z][a-z0-9_]{0,39})$/.exec(v.inner);
+    if (motion) {
       warning(ctx, {
         ...at,
         code: "W13",
         rule: `${quote(v.token)}: Motion variables were removed${UNTIL}; write the text in place or use a custom field`,
-        token: `text in place or a custom field such as {{${key}}}`
+        token: `text in place or a custom field such as {{${motion[1]}}}`
       });
-      warning(ctx, { ...at, code: "W9", rule: `${quote(v.token)} is checked against settings.variables by the server only` });
+      if (ctx.mode.kind === "lint") {
+        warning(ctx, { ...at, code: "W9", rule: `${quote(v.token)} is checked against settings.variables by the server only` });
+      } else if (!Object.hasOwn(ctx.mode.variables, motion[1])) {
+        issue(ctx, { ...at, code: "R16", rule: `${quote(v.token)} is not defined in settings.variables` });
+      }
+      continue;
+    }
+    const ev = /^enrollment\.(.*)$/s.exec(v.inner);
+    if (ev) {
+      enrollmentRef(ctx, at, quote(v.token), ev[1], (k) => `{{${k}}}`);
       continue;
     }
     if (!v.inner.includes(".") && v.inner.startsWith("my_") && !MY_FIELDS.includes(v.inner)) {
       issue(ctx, { ...at, code: "R16", rule: `${quote(v.token)}: the my_ prefix is reserved for my_first_name, my_last_name and my_full_name` });
       continue;
     }
-    if (!isKnownVariable(ctx, v.inner)) {
+    if (!isKnownVariable(v.inner)) {
       issue(ctx, {
         ...at,
         code: "R16",
@@ -5465,9 +6140,15 @@ function checkText(ctx, order, path, pointer, parent, value, limit) {
       });
       continue;
     }
-    if (!v.inner.includes(".") && longVariable(ctx, v.inner).startsWith("contact.extra.")) {
-      const near = likelyTypoOf(ctx, v.inner);
-      if (near !== null) warning(ctx, { ...at, code: "W11", rule: `${quote(v.token)} is read as a custom field; did you mean ${near}?`, token: near });
+    const long = longVariable(v.inner);
+    if (!v.inner.includes(".") && long.startsWith("contact.extra.") && ctx.values.saved.has(v.inner)) {
+      const want = `{{enrollment.${v.inner}}}`;
+      warning(ctx, { ...at, code: "W16", rule: `${quote(v.token)} is read as a Contact field; did you mean ${want}?`, token: want, candidates: [want] });
+    }
+    if (!v.inner.includes(".") && long.startsWith("contact.extra.")) {
+      const near = likelyTypoOf(v.inner);
+      if (near !== null)
+        warning(ctx, { ...at, code: "W11", rule: `${quote(v.token)} is read as a custom field; did you mean ${near}?`, token: near });
     }
   }
   const rest = value.replace(VARIABLE_RE, " ");
@@ -5479,11 +6160,37 @@ function checkText(ctx, order, path, pointer, parent, value, limit) {
     }
   }
   const len = staticLength(value);
-  if (len > limit) issue(ctx, { ...at, code: "R22", rule: `${len} characters; the limit is ${limit}, variables not counted` });
+  if (len > limit) {
+    issue(ctx, { ...at, code: "R22", rule: `${len} characters; the limit is ${limit}, variables not counted` });
+  }
   return value;
 }
+function enrollmentRef(ctx, at, shown, key, form) {
+  if (key === "id") {
+    issue(ctx, { ...at, code: "R27", rule: `${shown}: enrollment.id is reserved`, token: "{{enrollment_id}}", candidates: ["{{enrollment_id}}"] });
+    return;
+  }
+  ctx.values.used.add(key);
+  if (ctx.values.saved.has(key))
+    return;
+  const candidates = ctx.values.toContact.has(key) ? [form(`contact.extra.${key}`)] : [...ctx.values.saved.keys()].filter((n) => distance(key, n, 2) <= 2).map((n) => form(`enrollment.${n}`));
+  issue(ctx, { ...at, code: "R27", rule: `${shown}: no save of this Sequence writes ${quote(key)}`, ...candidates.length ? { token: candidates[0], candidates } : {} });
+}
+function isKnownVariable(inner) {
+  const long = longVariable(inner);
+  if (long === null)
+    return false;
+  if (long.startsWith("contact.extra."))
+    return EXTRA_KEY_RE.test(long.slice("contact.extra.".length));
+  if (long.startsWith("contact."))
+    return STANDARD_FIELDS.includes(long.slice(8));
+  if (long.startsWith("account."))
+    return ACCOUNT_FIELDS.includes(long.slice(8));
+  return false;
+}
 function checkFallbackText(ctx, order, path, pointer, parent, value, limit, keyword) {
-  if (keyword !== void 0 && value === keyword) return;
+  if (keyword !== void 0 && value === keyword)
+    return;
   const at = { order, code: "R19", path, pointer };
   if (typeof value !== "string") {
     issue(ctx, { ...at, pointer: value === void 0 ? parent : pointer, rule: keyword ? `must be text or "${keyword}"` : "must be text" });
@@ -5499,82 +6206,39 @@ function checkFallbackText(ctx, order, path, pointer, parent, value, limit, keyw
   }
   checkText(ctx, order, path, pointer, parent, value, limit);
 }
-function createValidator(v) {
-  const re = {
-    id: new RegExp(v.idPattern),
-    duration: new RegExp(v.durationPattern),
-    emit: new RegExp(v.emitPattern),
-    event: new RegExp(v.eventNamePattern),
-    extraKey: new RegExp(v.extraKeyPattern),
-    tag: new RegExp(v.tagPattern),
-    motion: new RegExp(MOTION_KEY_PATTERN),
-    short: new RegExp(SHORT_VARIABLE_PATTERN)
-  };
-  return (doc) => run(doc, { v, re, issues: [], warnings: [] });
-}
-function validateSequence(value) {
-  const out = verdict(value);
-  return { errors: out.errors.slice(0, MAX_ERRORS_LISTED), warnings: out.warnings };
-}
-function verdict(value) {
-  shipped ?? (shipped = createValidator(vocabulary(SEQUENCE_SCHEMA_V1)));
-  return shipped(value);
-}
-var shipped;
-var UNSTORABLE_RULE = "must be well-formed Unicode and must not contain a NUL (\\u0000) character";
-var MAX_ERRORS_LISTED = 100;
-var UNSTORABLE_RE = /\u0000|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
-function firstUnstorable(doc) {
-  const stack = [["value", doc, ""]];
-  while (stack.length) {
-    const [kind, value, path] = stack.pop();
-    if (kind === "key") {
-      if (UNSTORABLE_RE.test(value)) return path ? `${path} key` : "$ key";
-    } else if (typeof value === "string") {
-      if (UNSTORABLE_RE.test(value)) return path || "$";
-    } else if (Array.isArray(value)) {
-      for (let i = value.length - 1; i >= 0; i--) stack.push(["value", value[i], `${path}[${i}]`]);
-    } else if (typeof value === "object" && value !== null) {
-      const entries2 = Object.entries(value);
-      for (let i = entries2.length - 1; i >= 0; i--) {
-        const [k, v] = entries2[i];
-        stack.push(["value", v, path ? `${path}.${k}` : k], ["key", k, path]);
-      }
-    }
-  }
-  return null;
-}
-function run(doc, ctx) {
-  const bad = firstUnstorable(doc);
-  if (bad !== null) return { errors: [{ path: bad, rule: UNSTORABLE_RULE }], warnings: [] };
-  const size = compactBytes(doc);
-  if (size > MAX_SEQUENCE_BYTES) {
-    return { errors: [entry("R2", "$", "", `the document is ${size} bytes; the limit is ${MAX_SEQUENCE_BYTES}, UTF-8 compact JSON`)], warnings: [] };
-  }
-  return rules(doc, ctx);
+function entries(issues) {
+  return issues.sort((a, b) => a.order - b.order).map((i) => sequenceEntry(i.code, i.path, i.pointer, i.rule, i.token, i.candidates));
 }
-function rules(doc, ctx) {
-  const { v } = ctx;
+function run(doc, mode) {
+  const ctx = { mode, issues: [], warnings: [], values: { saved: /* @__PURE__ */ new Map(), toContact: /* @__PURE__ */ new Set(), used: /* @__PURE__ */ new Set() } };
   const DOC2 = -1;
-  if (!isObject(doc)) return { errors: [entry("R1", "$", "", "a Sequence document is a JSON object")], warnings: [] };
+  if (!isObject(doc)) {
+    return { errors: [sequenceEntry("R1", "$", "", "a Sequence document is a JSON object")], warnings: [] };
+  }
   for (const k of keysOf(doc)) {
     if (k !== "$schema" && k !== "on_reply" && k !== "steps") {
       issue(ctx, { order: DOC2, code: "R1", path: quote(k), pointer: jsonPointer(k), rule: "unknown key; a Sequence document holds only $schema, on_reply and steps" });
     }
   }
-  if (has(doc, "$schema") && doc["$schema"] !== v.schemaUrl) {
-    issue(ctx, { order: DOC2, code: "R1", path: "$schema", pointer: "/$schema", rule: `must be ${v.schemaUrl}` });
+  if (has(doc, "$schema") && doc["$schema"] !== SEQUENCE_SCHEMA_URL2) {
+    issue(ctx, { order: DOC2, code: "R1", path: "$schema", pointer: "/$schema", rule: `must be ${SEQUENCE_SCHEMA_URL2}` });
+  }
+  const bytes = compactBytes(doc);
+  if (bytes > MAX_SEQUENCE_BYTES) {
+    const e = sequenceSizeError(bytes);
+    issue(ctx, { order: DOC2, code: e.code, path: e.path, pointer: e.pointer, rule: e.rule });
   }
   const rawSteps = doc["steps"];
   const stepsArr = Array.isArray(rawSteps) ? rawSteps : [];
-  if (!Array.isArray(rawSteps) || rawSteps.length < v.minSteps) {
-    issue(ctx, { order: DOC2, code: "R2", path: "steps", pointer: has(doc, "steps") ? "/steps" : "", rule: `required: an array of ${v.minSteps} to ${v.maxSteps} steps` });
-  } else if (rawSteps.length > v.maxSteps) {
-    issue(ctx, { order: DOC2, code: "R2", path: "steps", pointer: "/steps", rule: `${rawSteps.length} steps; the limit is ${v.maxSteps}` });
+  ctx.values = valuesOf(stepsArr);
+  if (!Array.isArray(rawSteps) || rawSteps.length === 0) {
+    issue(ctx, { order: DOC2, code: "R2", path: "steps", pointer: has(doc, "steps") ? "/steps" : "", rule: `required: an array of 1 to ${MAX_STEPS} steps` });
+  } else if (rawSteps.length > MAX_STEPS) {
+    issue(ctx, { order: DOC2, code: "R2", path: "steps", pointer: "/steps", rule: `${rawSteps.length} steps; the limit is ${MAX_STEPS}` });
   }
   const infos = [];
   const firstIndex = /* @__PURE__ */ new Map();
-  let structural = !Array.isArray(rawSteps) || rawSteps.length < v.minSteps || rawSteps.length > v.maxSteps;
+  let structural = !Array.isArray(rawSteps) || rawSteps.length === 0 || rawSteps.length > MAX_STEPS;
   stepsArr.forEach((raw, index) => {
     const ptr = jsonPointer("steps", index);
     const info = { index, prefix: `steps[${index}]`, ptr, id: null, kind: null, raw: null };
@@ -5588,10 +6252,10 @@ function rules(doc, ctx) {
     const id = raw["id"];
     const idAt = { order: index, code: "R3", path: `${info.prefix}.id`, pointer: `${ptr}/id` };
     if (!has(raw, "id")) {
-      issue(ctx, { ...idAt, pointer: ptr, rule: `required: matching ${v.idPattern}` });
+      issue(ctx, { ...idAt, pointer: ptr, rule: `required: matching ${ID_PATTERN}` });
       structural = true;
-    } else if (typeof id !== "string" || !ctx.re.id.test(id)) {
-      issue(ctx, { ...idAt, rule: `must match ${v.idPattern}` });
+    } else if (typeof id !== "string" || !ID_RE.test(id)) {
+      issue(ctx, { ...idAt, rule: `must match ${ID_PATTERN}` });
       structural = true;
     } else if (id === END) {
       issue(ctx, { ...idAt, rule: '"end" is reserved' });
@@ -5604,14 +6268,14 @@ function rules(doc, ctx) {
       info.id = id;
       info.prefix = id;
     }
-    const kinds = v.stepKinds.filter((k) => has(raw, k));
+    const kinds = STEP_KINDS.filter((k) => has(raw, k));
     if (kinds.length !== 1) {
       issue(ctx, {
         order: index,
         code: "R4",
         path: info.prefix,
         pointer: ptr,
-        rule: kinds.length === 0 ? `a step needs exactly one of ${v.stepKinds.join(", ")}` : `a step has exactly one kind; found ${kinds.join(", ")}`
+        rule: kinds.length === 0 ? `a step needs exactly one of ${KIND_LIST}` : `a step has exactly one kind; found ${kinds.join(", ")}`
       });
       structural = true;
       return;
@@ -5633,11 +6297,16 @@ function rules(doc, ctx) {
   }
   const usedIds = new Set(firstIndex.keys());
   for (const info of infos) {
-    if (!info.raw || !info.kind) continue;
+    if (!info.raw || !info.kind)
+      continue;
     const { raw, kind, index: order, prefix: p, ptr } = info;
-    const keys = v.stepKeys[kind] ?? [];
     for (const k of keysOf(raw)) {
-      if (keys.includes(k)) continue;
+      if (STEP_KEYS[kind].includes(k))
+        continue;
+      if (k === "save" || k === "save_to_contact") {
+        issue(ctx, { order, code: "R25", path: `${p}.${k}`, pointer: `${ptr}/${k}`, rule: `${k} is allowed only on an until event.<name> step` });
+        continue;
+      }
       issue(ctx, {
         order,
         code: "R5",
@@ -5648,14 +6317,14 @@ function rules(doc, ctx) {
     }
     if (has(raw, "note")) {
       const n = raw["note"];
-      if (typeof n !== "string" || [...n].length > v.maxNoteChars) {
-        issue(ctx, { order, code: "R22", path: `${p}.note`, pointer: `${ptr}/note`, rule: `must be text of at most ${v.maxNoteChars} characters` });
+      if (typeof n !== "string" || [...n].length > MAX_STEP_NOTE_CHARS) {
+        issue(ctx, { order, code: "R22", path: `${p}.note`, pointer: `${ptr}/note`, rule: `must be text of at most ${MAX_STEP_NOTE_CHARS} characters` });
       }
     }
-    if (has(raw, "event") && keys.includes("event")) {
+    if (has(raw, "event") && STEP_KEYS[kind].includes("event")) {
       const e = raw["event"];
-      if (typeof e !== "string" || !ctx.re.event.test(e)) {
-        issue(ctx, { order, code: "R24", path: `${p}.event`, pointer: `${ptr}/event`, rule: `must match ${v.eventNamePattern}, like invite_sent` });
+      if (typeof e !== "string" || !EVENT_RE.test(e)) {
+        issue(ctx, { order, code: "R24", path: `${p}.event`, pointer: `${ptr}/event`, rule: `must match ${EVENT_NAME_PATTERN}, like invite_sent` });
       }
     }
     switch (kind) {
@@ -5663,7 +6332,7 @@ function rules(doc, ctx) {
         checkDo(ctx, order, p, ptr, raw, usedIds);
         break;
       case "wait":
-        if (!durationOk(ctx, raw["wait"], DURATION_BOUNDS.wait)) {
+        if (!durationOk(raw["wait"], DURATION_BOUNDS.wait)) {
           issue(ctx, { order, code: "R12", path: `${p}.wait`, pointer: `${ptr}/wait`, rule: durationRule(DURATION_BOUNDS.wait), token: durationHint(DURATION_BOUNDS.wait) });
         }
         break;
@@ -5671,17 +6340,18 @@ function rules(doc, ctx) {
         checkUntil(ctx, order, p, ptr, raw);
         break;
       case "if":
-        checkPredicate(ctx, raw["if"], `${p}.if`, `${ptr}/if`, order);
+        checkPredicate(raw["if"], `${p}.if`, `${ptr}/if`, false, ctx.issues, order, false, ctx);
         break;
       case "emit": {
         const e = raw["emit"];
-        if (typeof e !== "string" || !ctx.re.emit.test(e)) {
-          issue(ctx, { order, code: "R24", path: `${p}.emit`, pointer: `${ptr}/emit`, rule: `must match ${v.emitPattern}, like reply.received` });
+        if (typeof e !== "string" || !EVENT_RE.test(e)) {
+          issue(ctx, { order, code: "R24", path: `${p}.emit`, pointer: `${ptr}/emit`, rule: `must match ${EVENT_NAME_PATTERN}, like reply.received` });
         }
         break;
       }
       case "tag":
-        if (!tagOk(ctx, raw["tag"])) issue(ctx, { order, code: "R24", path: `${p}.tag`, pointer: `${ptr}/tag`, rule: "a Tag name is 1 to 64 characters, without , or ;" });
+        if (!tagOk(raw["tag"]))
+          issue(ctx, { order, code: "R24", path: `${p}.tag`, pointer: `${ptr}/tag`, rule: TAG_RULE });
         break;
     }
     if ((kind === "until" || kind === "if") && !has(raw, "then")) {
@@ -5689,7 +6359,8 @@ function rules(doc, ctx) {
       structural = true;
     }
     for (const f of ["then", "else", "next"]) {
-      if (!has(raw, f) || !keys.includes(f)) continue;
+      if (!has(raw, f) || !STEP_KEYS[kind].includes(f))
+        continue;
       const t = raw[f];
       const at = { order, code: "R6", path: `${p}.${f}`, pointer: `${ptr}/${f}` };
       if (typeof t !== "string") {
@@ -5701,7 +6372,24 @@ function rules(doc, ctx) {
       }
     }
   }
-  if (!structural) graph(ctx, infos, firstIndex, onReply);
+  for (const info of infos) {
+    const save = info.kind === "until" && awaitedEventName(info.raw["until"]) !== null ? info.raw["save"] : void 0;
+    if (!isObject(save))
+      continue;
+    for (const name of keysOf(save)) {
+      if (ctx.values.used.has(name) || name === "id" || !SAVE_NAME_RE.test(name))
+        continue;
+      warning(ctx, {
+        order: info.index,
+        code: "W14",
+        path: `${info.prefix}.save.${quote(name)}`,
+        pointer: `${info.ptr}/save${jsonPointer(name)}`,
+        rule: `${quote(name)} is saved but nothing in this Sequence reads it; a webhook template may still send it`
+      });
+    }
+  }
+  if (!structural)
+    graph(ctx, infos, firstIndex, onReply);
   return { errors: entries(ctx.issues), warnings: entries(ctx.warnings) };
 }
 function checkUntil(ctx, order, p, ptr, raw) {
@@ -5710,17 +6398,21 @@ function checkUntil(ctx, order, p, ptr, raw) {
   const custom = typeof ev === "string" ? /^(event|signal)\.(.*)$/s.exec(ev) : null;
   if (custom) {
     const [, ns, name] = custom;
-    if (!ctx.re.event.test(name)) {
-      issue(ctx, { ...at, rule: `an event name must match ${ctx.v.eventNamePattern}` });
+    if (!EVENT_RE.test(name)) {
+      issue(ctx, { ...at, rule: `an event name must match ${EVENT_NAME_PATTERN}` });
     } else if (ns === "signal") {
       warning(ctx, { ...at, code: "W13", rule: `until signal.${quote(name)} is now until event.${quote(name)}${UNTIL}`, token: `event.${quote(name)}` });
     }
-  } else if (!ctx.v.events.includes(ev)) {
-    issue(ctx, { ...at, rule: `unknown event; use ${ctx.v.events.join(", ")} or event.<name>` });
+  } else if (!EVENTS.includes(ev)) {
+    issue(ctx, { ...at, rule: "unknown event; use invite.accepted, message.replied, message.read or event.<name>" });
+  }
+  for (const key of ["save", "save_to_contact"]) {
+    if (has(raw, key))
+      checkSave(ctx, order, p, ptr, raw, key, custom && EVENT_RE.test(custom[2]) ? custom[2] : null);
   }
   if (!has(raw, "timeout")) {
     issue(ctx, { order, code: "R14", path: `${p}.timeout`, pointer: ptr, rule: "required on an until step" });
-  } else if (!durationOk(ctx, raw["timeout"], DURATION_BOUNDS.timeout)) {
+  } else if (!durationOk(raw["timeout"], DURATION_BOUNDS.timeout)) {
     issue(ctx, {
       order,
       code: "R12",
@@ -5731,20 +6423,75 @@ function checkUntil(ctx, order, p, ptr, raw) {
     });
   }
 }
-function limitOf(a, field) {
-  if (a === "message.send") return TEXT_LIMITS.message;
-  if (a === "post.comment") return TEXT_LIMITS.comment;
-  if (a === "invite.send") return TEXT_LIMITS.invite_note;
-  return field === "subject" ? TEXT_LIMITS.inmail_subject : TEXT_LIMITS.inmail_text;
+var SAVE_CONTACT_FIELDS = STANDARD_FIELDS.filter((f) => f !== "email");
+function checkSave(ctx, order, p, ptr, raw, key, event) {
+  const v = raw[key];
+  const at = { order, path: `${p}.${key}`, pointer: `${ptr}/${key}` };
+  if (event === null) {
+    issue(ctx, { ...at, code: "R25", rule: `${key} is allowed only on an until event.<name> step` });
+    return;
+  }
+  if (!isObject(v) || keysOf(v).length === 0) {
+    issue(ctx, { ...at, code: "R25", rule: `must be an object of 1 to ${MAX_SAVE_ENTRIES} entries` });
+    return;
+  }
+  const names = keysOf(v);
+  if (names.length > MAX_SAVE_ENTRIES)
+    issue(ctx, { ...at, code: "R25", rule: `${names.length} entries; the limit is ${MAX_SAVE_ENTRIES}` });
+  for (const name of names) {
+    const e = { order, path: `${at.path}.${quote(name)}`, pointer: `${at.pointer}${jsonPointer(name)}` };
+    if (key === "save") {
+      if (name === "id")
+        issue(ctx, { ...e, code: "R25", rule: '"id" is reserved; enrollment_id is always sent' });
+      else if (!SAVE_NAME_RE.test(name))
+        issue(ctx, { ...e, code: "R25", rule: `a value name must match ${SAVE_NAME_PATTERN}` });
+    } else if (SAVE_CONTACT_FIELDS.includes(name)) {
+      issue(ctx, { ...e, code: "R25", rule: `${name} is a standard Contact field; only email can be saved to one` });
+    } else if (name !== "email" && !EXTRA_KEY_RE.test(name)) {
+      issue(ctx, { ...e, code: "R25", rule: `a custom field key must match ${EXTRA_KEY_PATTERN}, or be email` });
+    }
+    const path = typeof v[name] === "string" ? normalizePath(v[name]) : null;
+    if (path === null) {
+      issue(ctx, { ...e, code: "R26", rule: 'not a field path; use dots, items[0] and ["a.b"], at most 256 characters, like lead.score' });
+      continue;
+    }
+    const type = sampleType(ctx, event, path);
+    if (type === "object" || type === "array") {
+      issue(ctx, { ...e, code: "R29", rule: `${quote(path)} is an ${type} in the sample of event ${event}; save a field inside it` });
+    }
+  }
+}
+function sampleType(ctx, event, path) {
+  if (ctx.mode.kind !== "server")
+    return null;
+  return ctx.mode.shapes[event]?.find((f) => f.path === path)?.type ?? null;
+}
+function valuesOf(steps) {
+  const out = { saved: /* @__PURE__ */ new Map(), toContact: /* @__PURE__ */ new Set(), used: /* @__PURE__ */ new Set() };
+  for (const s of steps) {
+    if (!isObject(s))
+      continue;
+    const m = typeof s["until"] === "string" ? /^(?:event|signal)\.(.+)$/s.exec(s["until"]) : null;
+    if (isObject(s["save"])) {
+      for (const [name, raw] of Object.entries(s["save"])) {
+        const path = typeof raw === "string" ? normalizePath(raw) : null;
+        out.saved.set(name, [...out.saved.get(name) ?? [], ...m && path ? [{ event: m[1], path }] : []]);
+      }
+    }
+    if (isObject(s["save_to_contact"]))
+      for (const k of Object.keys(s["save_to_contact"]))
+        out.toContact.add(k);
+  }
+  return out;
 }
 function checkDo(ctx, order, p, ptr, raw, usedIds) {
-  const { v } = ctx;
-  const a = raw["do"];
-  if (typeof a !== "string" || !v.actions.includes(a)) {
-    issue(ctx, { order, code: "R13", path: `${p}.do`, pointer: `${ptr}/do`, rule: `unknown action; use ${v.actions.join(", ")}` });
+  const action = raw["do"];
+  if (!ACTIONS.includes(action)) {
+    issue(ctx, { order, code: "R13", path: `${p}.do`, pointer: `${ptr}/do`, rule: `unknown action; use ${ACTIONS.join(", ")}` });
     return;
   }
-  const params = v.actionParams[a] ?? [];
+  const a = action;
+  const params = ACTION_PARAMS[a];
   const wp = `${ptr}/with`;
   const withParent = isObject(raw["with"]) ? wp : ptr;
   let w = {};
@@ -5766,14 +6513,16 @@ function checkDo(ctx, order, p, ptr, raw, usedIds) {
       }
     }
   }
-  const messaging = v.messagingActions.includes(a);
+  const messaging = MESSAGING_ACTIONS.includes(a);
   const hasVariants = has(raw, "variants");
   const vptr = `${ptr}/variants`;
-  if (hasVariants && !messaging) issue(ctx, { order, code: "R23", path: `${p}.variants`, pointer: vptr, rule: "variants are allowed on messaging steps only" });
-  if (has(w, "post") && params.includes("post") && w["post"] !== v.post) {
-    issue(ctx, { order, code: "R13", path: `${p}.with.post`, pointer: `${wp}/post`, rule: `only "${v.post}" is supported` });
+  if (hasVariants && !messaging) {
+    issue(ctx, { order, code: "R23", path: `${p}.variants`, pointer: vptr, rule: "variants are allowed on messaging steps only" });
   }
-  if (has(w, "newer_than") && params.includes("newer_than") && !durationOk(ctx, w["newer_than"], DURATION_BOUNDS.newer_than)) {
+  if (has(w, "post") && params.includes("post") && w["post"] !== "latest") {
+    issue(ctx, { order, code: "R13", path: `${p}.with.post`, pointer: `${wp}/post`, rule: 'only "latest" is supported' });
+  }
+  if (has(w, "newer_than") && params.includes("newer_than") && !durationOk(w["newer_than"], DURATION_BOUNDS.newer_than)) {
     issue(ctx, {
       order,
       code: "R12",
@@ -5783,25 +6532,27 @@ function checkDo(ctx, order, p, ptr, raw, usedIds) {
       token: durationHint(DURATION_BOUNDS.newer_than)
     });
   }
-  if (has(w, "reaction") && params.includes("reaction") && !v.reactions.includes(w["reaction"])) {
-    issue(ctx, { order, code: "R13", path: `${p}.with.reaction`, pointer: `${wp}/reaction`, rule: `must be one of ${v.reactions.join(", ")}` });
+  if (has(w, "reaction") && params.includes("reaction") && !REACTIONS.includes(w["reaction"])) {
+    issue(ctx, { order, code: "R13", path: `${p}.with.reaction`, pointer: `${wp}/reaction`, rule: `must be one of ${REACTIONS.join(", ")}` });
   }
-  if (has(w, "withdraw_after") && params.includes("withdraw_after") && !durationOk(ctx, w["withdraw_after"], DURATION_BOUNDS.withdraw_after)) {
+  if (has(w, "withdraw_after") && params.includes("withdraw_after") && !durationOk(w["withdraw_after"], DURATION_BOUNDS.withdraw_after)) {
     issue(ctx, { order, code: "R21", path: `${p}.with.withdraw_after`, pointer: `${wp}/withdraw_after`, rule: durationRule(DURATION_BOUNDS.withdraw_after) });
   }
-  if (!messaging) return;
+  if (!messaging)
+    return;
   const textKeys = a === "inmail.send" ? ["subject", "text"] : ["text"];
   const withTextKeys = a === "invite.send" ? ["note"] : textKeys;
   const variants = hasVariants ? raw["variants"] : void 0;
   if (hasVariants && withTextKeys.some((k) => has(w, k) && w[k] !== null)) {
     issue(ctx, { order, code: "R23", path: `${p}.variants`, pointer: vptr, rule: `use either variants or with.${withTextKeys.join(" and with.")}, not both` });
   }
+  const limitOf = (field) => a === "message.send" ? TEXT_LIMITS.message : a === "post.comment" ? TEXT_LIMITS.comment : a === "invite.send" ? TEXT_LIMITS.invite_note : field === "subject" ? TEXT_LIMITS.inmail_subject : TEXT_LIMITS.inmail_text;
   const texts = [];
   if (hasVariants) {
     const n = Array.isArray(variants) ? variants.length : null;
-    if (n !== null && n > MAX_VARIANTS && n <= v.maxVariants) {
+    if (n !== null && n > MAX_VARIANTS && n <= MAX_VARIANTS_DEPRECATED) {
       warning(ctx, { order, code: "W13", path: `${p}.variants`, pointer: vptr, rule: `${n} variants; A/B takes exactly ${MAX_VARIANTS}${UNTIL}`, token: `${MAX_VARIANTS} variants` });
-    } else if (n === null || n < v.minVariants || n > MAX_VARIANTS) {
+    } else if (n === null || n < MIN_VARIANTS || n > MAX_VARIANTS) {
       issue(ctx, {
         order,
         code: "R23",
@@ -5810,17 +6561,17 @@ function checkDo(ctx, order, p, ptr, raw, usedIds) {
         rule: `needs exactly ${MAX_VARIANTS} variants (A/B)${n === null ? "" : `; found ${n}`}`
       });
     }
-    (Array.isArray(variants) ? variants : []).forEach((variant, j) => {
+    (Array.isArray(variants) ? variants : []).forEach((v, j) => {
       let vp = `${p}.variants[${j}]`;
       const vptrJ = `${vptr}/${j}`;
-      if (!isObject(variant)) {
+      if (!isObject(v)) {
         issue(ctx, { order, code: "R23", path: vp, pointer: vptrJ, rule: "a variant is a JSON object" });
         return;
       }
-      const vid = variant["id"];
-      const idAt = { order, code: "R23", path: `${vp}.id`, pointer: has(variant, "id") ? `${vptrJ}/id` : vptrJ };
-      if (typeof vid !== "string" || !ctx.re.id.test(vid)) {
-        issue(ctx, { ...idAt, rule: `must match ${v.idPattern}` });
+      const vid = v["id"];
+      const idAt = { order, code: "R23", path: `${vp}.id`, pointer: has(v, "id") ? `${vptrJ}/id` : vptrJ };
+      if (typeof vid !== "string" || !ID_RE.test(vid)) {
+        issue(ctx, { ...idAt, rule: `must match ${ID_PATTERN}` });
       } else if (vid === END) {
         issue(ctx, { ...idAt, rule: '"end" is reserved' });
       } else if (usedIds.has(vid)) {
@@ -5829,14 +6580,15 @@ function checkDo(ctx, order, p, ptr, raw, usedIds) {
         usedIds.add(vid);
         vp = `${p}.variants.${vid}`;
       }
-      for (const k of keysOf(variant)) {
+      for (const k of keysOf(v)) {
         if (k !== "id" && !textKeys.includes(k)) {
           issue(ctx, { order, code: "R23", path: `${vp}.${quote(k)}`, pointer: `${vptrJ}${jsonPointer(k)}`, rule: `unknown key; a variant holds id and ${textKeys.join(" and ")}` });
         }
       }
       for (const field of textKeys) {
-        const value = checkText(ctx, order, `${vp}.${field}`, `${vptrJ}/${field}`, vptrJ, variant[field], limitOf(a, field));
-        if (value !== null) texts.push({ path: `${vp}.${field}`, pointer: `${vptrJ}/${field}`, value });
+        const value = checkText(ctx, order, `${vp}.${field}`, `${vptrJ}/${field}`, vptrJ, v[field], limitOf(field));
+        if (value !== null)
+          texts.push({ path: `${vp}.${field}`, pointer: `${vptrJ}/${field}`, field, value });
       }
     });
   } else {
@@ -5844,20 +6596,22 @@ function checkDo(ctx, order, p, ptr, raw, usedIds) {
       const fp = `${wp}/${field}`;
       if (a === "invite.send") {
         if (has(w, "note") && w["note"] !== null) {
-          const value = checkText(ctx, order, `${p}.with.note`, fp, withParent, w["note"], limitOf(a, field));
-          if (value !== null) texts.push({ path: `${p}.with.note`, pointer: fp, value });
+          const value = checkText(ctx, order, `${p}.with.note`, fp, withParent, w["note"], limitOf(field));
+          if (value !== null)
+            texts.push({ path: `${p}.with.note`, pointer: fp, field, value });
         }
       } else if (!has(w, field)) {
         issue(ctx, { order, code: "R13", path: `${p}.with.${field}`, pointer: withParent, rule: "required, or use variants" });
       } else {
-        const value = checkText(ctx, order, `${p}.with.${field}`, fp, withParent, w[field], limitOf(a, field));
-        if (value !== null) texts.push({ path: `${p}.with.${field}`, pointer: fp, value });
+        const value = checkText(ctx, order, `${p}.with.${field}`, fp, withParent, w[field], limitOf(field));
+        if (value !== null)
+          texts.push({ path: `${p}.with.${field}`, pointer: fp, field, value });
       }
     }
   }
   if (a === "post.comment") {
     for (const t of texts) {
-      const contactVars = variablesIn(t.value).filter((x) => isKnownVariable(ctx, x.inner)).map((x) => longVariable(ctx, x.inner)).filter((l) => l.startsWith("contact."));
+      const contactVars = variablesIn(t.value).filter((v) => isKnownVariable(v.inner)).map((v) => longVariable(v.inner)).filter((l) => l.startsWith("contact."));
       if (contactVars.length === 0) {
         issue(ctx, { order, code: "R20", path: t.path, pointer: t.pointer, rule: "a comment must use a contact variable, such as {{contact.extra.comment}}" });
       } else if (contactVars.every((l) => NAME_FIELDS.includes(l.slice(8)))) {
@@ -5874,8 +6628,11 @@ function checkDo(ctx, order, p, ptr, raw, usedIds) {
   const usesVariable = texts.some((t) => hasVariable(t.value));
   if (a === "invite.send") {
     const fp = `${p}.with.note_fallback`;
-    if (has(w, "note_fallback")) checkFallbackText(ctx, order, fp, `${wp}/note_fallback`, withParent, w["note_fallback"], TEXT_LIMITS.invite_note, "drop");
-    else if (usesVariable) issue(ctx, { order, code: "R19", path: fp, pointer: withParent, rule: 'required because the note uses a variable: text, or "drop"' });
+    if (has(w, "note_fallback")) {
+      checkFallbackText(ctx, order, fp, `${wp}/note_fallback`, withParent, w["note_fallback"], TEXT_LIMITS.invite_note, fallbackKeyword(a) ?? void 0);
+    } else if (usesVariable) {
+      issue(ctx, { order, code: "R19", path: fp, pointer: withParent, rule: 'required because the note uses a variable: text, or "drop"' });
+    }
   } else if (a === "inmail.send") {
     const fp = `${p}.with.fallback`;
     const fptr = `${wp}/fallback`;
@@ -5898,14 +6655,16 @@ function checkDo(ctx, order, p, ptr, raw, usedIds) {
   } else {
     const fp = `${p}.with.fallback`;
     const comment = a === "post.comment";
-    if (has(w, "fallback")) checkFallbackText(ctx, order, fp, `${wp}/fallback`, withParent, w["fallback"], limitOf(a, "text"), comment ? "skip" : void 0);
-    else if (comment) issue(ctx, { order, code: "R19", path: fp, pointer: withParent, rule: 'required on a comment: text, or "skip"' });
-    else if (usesVariable) issue(ctx, { order, code: "R19", path: fp, pointer: withParent, rule: "required because the text uses a variable" });
+    if (has(w, "fallback"))
+      checkFallbackText(ctx, order, fp, `${wp}/fallback`, withParent, w["fallback"], limitOf("text"), fallbackKeyword(a) ?? void 0);
+    else if (comment)
+      issue(ctx, { order, code: "R19", path: fp, pointer: withParent, rule: 'required on a comment: text, or "skip"' });
+    else if (usesVariable)
+      issue(ctx, { order, code: "R19", path: fp, pointer: withParent, rule: "required because the text uses a variable" });
   }
 }
-function checkPredicate(ctx, pred, path, pointer, order, nested = false) {
-  const { v } = ctx;
-  const push = (rule) => issue(ctx, { order, code: "R15", path, pointer, rule });
+function checkPredicate(pred, path, pointer, inWhere, out, order = 0, nested = false, ctx) {
+  const push = (rule, code = "R15") => out.push({ order, code, path, pointer, rule });
   if (!nested && deeperThan(pred, MAX_PREDICATE_DEPTH)) {
     push(`a predicate nests at most ${MAX_PREDICATE_DEPTH} levels`);
     return;
@@ -5915,63 +6674,101 @@ function checkPredicate(ctx, pred, path, pointer, order, nested = false) {
     return;
   }
   const key = keysOf(pred)[0];
-  const val = pred[key];
+  const v = pred[key];
   if (key === "not") {
-    if (nested) push("not cannot wrap another not");
-    else checkPredicate(ctx, val, `${path}.not`, `${pointer}/not`, order, true);
+    if (nested)
+      push("not cannot wrap another not");
+    else
+      checkPredicate(v, `${path}.not`, `${pointer}/not`, inWhere, out, order, true, ctx);
     return;
   }
   if (key.startsWith("account.")) {
-    if (key !== "account.premium") push(`unknown predicate ${quote(key)}`);
-    else if (typeof val !== "boolean") push("account.premium takes true or false");
+    if (inWhere)
+      push("account.* predicates are not allowed in where");
+    else if (key !== "account.premium")
+      push(`unknown predicate ${quote(key)}`);
+    else if (typeof v !== "boolean")
+      push("account.premium takes true or false");
     return;
   }
   if (key.startsWith("message.")) {
-    if (key !== "message.seen") push(`unknown predicate ${quote(key)}`);
-    else if (typeof val !== "boolean") push("message.seen takes true or false");
+    if (inWhere)
+      push("message.* predicates are not allowed in where");
+    else if (key !== "message.seen")
+      push(`unknown predicate ${quote(key)}`);
+    else if (typeof v !== "boolean")
+      push("message.seen takes true or false");
     return;
   }
-  if (v.booleanPredicates.includes(key)) {
-    if (typeof val !== "boolean") push(`${key} takes true or false`);
+  if (BOOLEAN_PREDICATES.includes(key)) {
+    if (typeof v !== "boolean")
+      push(`${key} takes true or false`);
     return;
   }
   switch (key) {
     case "contact.degree": {
-      const deg = (n) => v.degrees.includes(n);
-      const ok2 = isObject(val) && keysOf(val).length === 1 && (has(val, "eq") && deg(val["eq"]) || has(val, "in") && Array.isArray(val["in"]) && val["in"].length > 0 && val["in"].every(deg));
-      if (!ok2) push('contact.degree takes {"eq": n} or {"in": [n, ...]}, n being 1, 2 or 3');
+      const deg = (n) => n === 1 || n === 2 || n === 3;
+      const ok2 = isObject(v) && keysOf(v).length === 1 && (has(v, "eq") && deg(v["eq"]) || has(v, "in") && Array.isArray(v["in"]) && v["in"].length > 0 && v["in"].every(deg));
+      if (!ok2)
+        push('contact.degree takes {"eq": n} or {"in": [n, ...]}, n being 1, 2 or 3');
       return;
     }
     case "contact.connections_gte":
-      if (!Number.isInteger(val) || val < v.connectionsMin) push("contact.connections_gte takes an integer of 0 or more");
+      if (!Number.isInteger(v) || v < 0)
+        push("contact.connections_gte takes an integer of 0 or more");
       return;
     case "contact.posted_within":
-      if (typeof val !== "string" || !ctx.re.duration.test(val)) push("contact.posted_within takes a duration like 14d");
+      if (typeof v !== "string" || !DURATION_RE.test(v))
+        push("contact.posted_within takes a duration like 14d");
       return;
     case "contact.tag":
-      if (!tagOk(ctx, val)) push("contact.tag takes a Tag name of 1 to 64 characters, without , or ;");
+      if (!tagOk(v))
+        push("contact.tag takes a Tag name of 1 to 64 characters, without , or ;");
       return;
   }
-  const field = key.startsWith("contact.extra.") ? ctx.re.extraKey.test(key.slice(14)) : key.startsWith("contact.") && v.standardFields.includes(key.slice(8));
+  const enrollmentKey = key.startsWith("enrollment.") ? key.slice("enrollment.".length) : null;
+  if (enrollmentKey !== null && inWhere) {
+    push("enrollment.* predicates are not allowed in where");
+    return;
+  }
+  const field = enrollmentKey !== null ? true : key.startsWith("contact.extra.") ? EXTRA_KEY_RE.test(key.slice(14)) : key.startsWith("contact.") && STANDARD_FIELDS.includes(key.slice(8));
   if (!field) {
     push(`unknown predicate ${quote(key)}`);
     return;
   }
   const scalar = (x) => typeof x === "string" || typeof x === "number" || typeof x === "boolean";
-  const op = isObject(val) && keysOf(val).length === 1 ? keysOf(val)[0] : null;
-  const operand = op === null ? void 0 : val[op];
-  const ok = op !== null && v.fieldOperators.includes(op) && (op === "eq" || op === "neq" ? scalar(operand) : op === "in" ? Array.isArray(operand) && operand.length > 0 && operand.every(scalar) : op === "contains" ? typeof operand === "string" : typeof operand === "boolean");
+  const op = isObject(v) && keysOf(v).length === 1 ? keysOf(v)[0] : null;
+  const operand = op === null ? void 0 : v[op];
+  if (enrollmentKey !== null && ctx)
+    enrollmentRef(ctx, { order, path, pointer }, quote(key), enrollmentKey, (k) => k);
+  if (op !== null && NUMBER_OPERATORS.includes(op)) {
+    if (enrollmentKey === null && !key.startsWith("contact.extra."))
+      push(`${op} compares numbers on enrollment.<key> and contact.extra.<key> only`, "R28");
+    else if (typeof operand !== "number" || !Number.isFinite(operand))
+      push(`${op} takes a number, like {"${op}": 50}`, "R28");
+    else if (enrollmentKey !== null && ctx) {
+      for (const sv of ctx.values.saved.get(enrollmentKey) ?? []) {
+        const type = sampleType(ctx, sv.event, sv.path);
+        if (type === "boolean" || type === "object" || type === "array") {
+          push(`${quote(key)} is saved from ${quote(sv.path)}, a ${type} in the sample of event ${sv.event}; ${op} compares numbers`, "R29");
+          break;
+        }
+      }
+    }
+    return;
+  }
+  const ok = op !== null && FIELD_OPERATORS.includes(op) && (op === "eq" || op === "neq" ? scalar(operand) : op === "in" ? Array.isArray(operand) && operand.length > 0 && operand.every(scalar) : op === "contains" ? typeof operand === "string" : typeof operand === "boolean");
   if (!ok) {
     push(`${quote(key)} takes exactly one of {"eq": v}, {"neq": v}, {"in": [v, ...]}, {"contains": "text"}, {"exists": true or false}`);
   }
 }
 function graph(ctx, infos, ids, onReply) {
   const n = infos.length;
-  const resolve = (t) => t === END ? END : ids.get(t);
+  const resolve2 = (t) => t === END ? END : ids.get(t);
   const ft = (i) => i + 1 < n ? i + 1 : "off";
   const edges = infos.map((info, i) => {
     const raw = info.raw;
-    const explicit = (f) => ({ field: f, to: resolve(raw[f]), fallThrough: false });
+    const explicit = (f) => ({ field: f, to: resolve2(raw[f]), fallThrough: false });
     const implicit = (f) => ({ field: f, to: ft(i), fallThrough: true });
     const pick = (f) => has(raw, f) ? explicit(f) : implicit(f);
     switch (info.kind) {
@@ -6004,12 +6801,17 @@ function graph(ctx, infos, ids, onReply) {
   const queue = [...roots];
   while (queue.length) {
     const i = queue.shift();
-    if (seen.has(i)) continue;
+    if (seen.has(i))
+      continue;
     seen.add(i);
-    for (const e of edges[i]) if (typeof e.to === "number") queue.push(e.to);
+    for (const e of edges[i])
+      if (typeof e.to === "number")
+        queue.push(e.to);
   }
   infos.forEach((info, i) => {
-    if (!seen.has(i)) graphIssues.push({ order: i, code: "R9", path: info.prefix, pointer: info.ptr, rule: "unreachable: no path leads here from the first step or from on_reply" });
+    if (!seen.has(i)) {
+      graphIssues.push({ order: i, code: "R9", path: info.prefix, pointer: info.ptr, rule: "unreachable: no path leads here from the first step or from on_reply" });
+    }
   });
   const state = new Array(n).fill(0);
   const stack = [];
@@ -6017,10 +6819,13 @@ function graph(ctx, infos, ids, onReply) {
     state[i] = 1;
     stack.push(i);
     for (const e of edges[i]) {
-      if (typeof e.to !== "number") continue;
+      if (typeof e.to !== "number")
+        continue;
       if (state[e.to] === 1) {
         const rule = `cycle: ${[...stack.slice(stack.indexOf(e.to)), e.to].map((k) => infos[k].prefix).join(" -> ")}`;
-        if (!graphIssues.some((x) => x.rule === rule)) graphIssues.push({ order: i, code: "R8", path: `${infos[i].prefix}.${e.field}`, pointer: exitPtr(i, e), rule });
+        if (!graphIssues.some((x) => x.rule === rule)) {
+          graphIssues.push({ order: i, code: "R8", path: `${infos[i].prefix}.${e.field}`, pointer: exitPtr(i, e), rule });
+        }
       } else if (state[e.to] === 0) {
         dfs(e.to);
       }
@@ -6028,9 +6833,12 @@ function graph(ctx, infos, ids, onReply) {
     stack.pop();
     state[i] = 2;
   };
-  for (const r of roots) if (state[r] === 0) dfs(r);
+  for (const r of roots)
+    if (state[r] === 0)
+      dfs(r);
   ctx.issues.push(...graphIssues);
-  if (graphIssues.length) return;
+  if (graphIssues.length)
+    return;
   const preds = infos.map(() => []);
   edges.forEach((es, i) => es.forEach((e) => typeof e.to === "number" && preds[e.to].push({ from: i, edge: e })));
   const action = (i) => infos[i].raw["do"];
@@ -6053,20 +6861,32 @@ function graph(ctx, infos, ids, onReply) {
   const withoutInvite = new Array(n).fill(false);
   const withoutMessage = new Array(n).fill(false);
   const fromFirst = new Set(topo(n, edges, [0]));
-  for (const r of roots) if (r === 0 || !fromFirst.has(r)) withoutInvite[r] = withoutMessage[r] = true;
+  for (const r of roots)
+    if (r === 0 || !fromFirst.has(r))
+      withoutInvite[r] = withoutMessage[r] = true;
   for (const i of order) {
     for (const { from, edge } of preds[i]) {
       const invited = action(from) === "invite.send" && edge.field === "next";
-      if (afterInvite[from] || invited) afterInvite[i] = true;
-      if (withoutInvite[from] && !invited) withoutInvite[i] = true;
+      if (afterInvite[from] || invited)
+        afterInvite[i] = true;
+      if (withoutInvite[from] && !invited)
+        withoutInvite[i] = true;
       const messaged = (action(from) === "message.send" || action(from) === "inmail.send") && edge.field === "next";
-      if (withoutMessage[from] && !messaged) withoutMessage[i] = true;
+      if (withoutMessage[from] && !messaged)
+        withoutMessage[i] = true;
     }
   }
   infos.forEach((info, i) => {
-    if (!seen.has(i)) return;
+    if (!seen.has(i))
+      return;
     if (action(i) === "profile.follow" && afterInvite[i]) {
-      warning(ctx, { order: i, code: "W5", path: `${info.prefix}.do`, pointer: `${info.ptr}/do`, rule: "profile.follow after invite.send on the same path; an invitation already follows" });
+      warning(ctx, {
+        order: i,
+        code: "W5",
+        path: `${info.prefix}.do`,
+        pointer: `${info.ptr}/do`,
+        rule: "profile.follow after invite.send on the same path; an invitation already follows"
+      });
     }
     const cond = info.raw["if"];
     const seenPred = isObject(cond) && (has(cond, "message.seen") || isObject(cond["not"]) && has(cond["not"], "message.seen"));
@@ -6085,23 +6905,29 @@ function graph(ctx, infos, ids, onReply) {
   });
   const flagged = /* @__PURE__ */ new Set();
   infos.forEach((info, i) => {
-    if (info.raw["until"] !== "invite.accepted") return;
+    if (info.raw["until"] !== "invite.accepted")
+      return;
     const start = edges[i][0].to;
     const visited = /* @__PURE__ */ new Set();
     const q = typeof start === "number" ? [start] : [];
     while (q.length) {
       const k = q.shift();
-      if (visited.has(k)) continue;
+      if (visited.has(k))
+        continue;
       visited.add(k);
       if (action(k) === "message.send") {
         if (!flagged.has(k)) {
           flagged.add(k);
           const link = messageTexts(infos[k]).find((t) => t.value.includes("http"));
-          if (link) warning(ctx, { order: k, code: "W8", path: link.path, pointer: link.pointer, rule: "a link in the first message after the invitation is accepted" });
+          if (link) {
+            warning(ctx, { order: k, code: "W8", path: link.path, pointer: link.pointer, rule: "a link in the first message after the invitation is accepted" });
+          }
         }
         continue;
       }
-      for (const e of edges[k]) if (typeof e.to === "number") q.push(e.to);
+      for (const e of edges[k])
+        if (typeof e.to === "number")
+          q.push(e.to);
     }
   });
 }
@@ -6110,30 +6936,78 @@ function messageTexts(info) {
   const w = isObject(raw["with"]) ? raw["with"] : {};
   const out = [];
   if (Array.isArray(raw["variants"])) {
-    raw["variants"].forEach((variant, j) => {
-      if (isObject(variant) && typeof variant["text"] === "string") {
-        const id = typeof variant["id"] === "string" ? `variants.${variant["id"]}` : `variants[${j}]`;
-        out.push({ path: `${info.prefix}.${id}.text`, pointer: `${info.ptr}/variants/${j}/text`, value: variant["text"] });
+    raw["variants"].forEach((v, j) => {
+      if (isObject(v) && typeof v["text"] === "string") {
+        const id = typeof v["id"] === "string" ? `variants.${v["id"]}` : `variants[${j}]`;
+        out.push({ path: `${info.prefix}.${id}.text`, pointer: `${info.ptr}/variants/${j}/text`, value: v["text"] });
       }
     });
   }
-  if (typeof w["text"] === "string") out.push({ path: `${info.prefix}.with.text`, pointer: `${info.ptr}/with/text`, value: w["text"] });
-  if (typeof w["fallback"] === "string") out.push({ path: `${info.prefix}.with.fallback`, pointer: `${info.ptr}/with/fallback`, value: w["fallback"] });
+  if (typeof w["text"] === "string")
+    out.push({ path: `${info.prefix}.with.text`, pointer: `${info.ptr}/with/text`, value: w["text"] });
+  if (typeof w["fallback"] === "string")
+    out.push({ path: `${info.prefix}.with.fallback`, pointer: `${info.ptr}/with/fallback`, value: w["fallback"] });
   return out;
 }
 function topo(n, edges, roots) {
   const out = [];
   const done = new Array(n).fill(false);
   const visit = (i) => {
-    if (done[i]) return;
+    if (done[i])
+      return;
     done[i] = true;
-    for (const e of edges[i]) if (typeof e.to === "number") visit(e.to);
+    for (const e of edges[i])
+      if (typeof e.to === "number")
+        visit(e.to);
     out.push(i);
   };
   roots.forEach(visit);
   return out.reverse();
 }
 
+// src/sequence/validate.ts
+function validateSequence(value) {
+  const out = verdict(value);
+  return { errors: out.errors.slice(0, MAX_ERRORS_LISTED), warnings: out.warnings };
+}
+function verdict(value) {
+  const bad = firstUnstorable(value);
+  if (bad !== null) return { errors: [{ path: bad, rule: UNSTORABLE_RULE }], warnings: [] };
+  const size = compactBytes2(value);
+  if (size > MAX_SEQUENCE_BYTES) return { errors: [sequenceSizeError(size)], warnings: [] };
+  return lintSequence(value);
+}
+function compactBytes2(v) {
+  try {
+    return new TextEncoder().encode(JSON.stringify(v)).length;
+  } catch {
+    return 0;
+  }
+}
+var UNSTORABLE_RULE = "must be well-formed Unicode and must not contain a NUL (\\u0000) character";
+var MAX_ERRORS_LISTED = 100;
+var UNSTORABLE_RE = /\u0000|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+function firstUnstorable(doc) {
+  const stack = [["value", doc, ""]];
+  while (stack.length) {
+    const [kind, value, path] = stack.pop();
+    if (kind === "key") {
+      if (UNSTORABLE_RE.test(value)) return path ? `${path} key` : "$ key";
+    } else if (typeof value === "string") {
+      if (UNSTORABLE_RE.test(value)) return path || "$";
+    } else if (Array.isArray(value)) {
+      for (let i = value.length - 1; i >= 0; i--) stack.push(["value", value[i], `${path}[${i}]`]);
+    } else if (typeof value === "object" && value !== null) {
+      const entries2 = Object.entries(value);
+      for (let i = entries2.length - 1; i >= 0; i--) {
+        const [k, v] = entries2[i];
+        stack.push(["value", v, path ? `${path}.${k}` : k], ["key", k, path]);
+      }
+    }
+  }
+  return null;
+}
+
 // src/sequence/builder.ts
 var refuse = (errors) => errors[0].rule === UNSTORABLE_RULE ? new CurviateError({
   code: "INVALID_REQUEST",
@@ -6296,6 +7170,16 @@ var MotionsResource = class {
    *
    * Needs Automate: a Team below that Tier is refused with `TIER_REQUIRED`.
    *
+   * Days and hours in `schedule` are read in each sending account's own time
+   * zone. `schedule.timezone` and `settings.stop_on_engagement` are retired:
+   * accepted with warning W13 until 2027-01-25, never stored or returned
+   * (`stop_on_engagement: true` with an acting reply route is a 400).
+   * `settings.acceptance_floor` defaults to `null` (off). With
+   * `settings.accounts_per_contact` above 1 (Several mode) the settings gain
+   * `on_reply_elsewhere` (`stop` or `continue`), `withdraw_on_reply_elsewhere`
+   * and `account_gap` (`1d` to `30d`), served only in that mode;
+   * `accounts_per_contact` is locked once the Motion has started.
+   *
    * @example
    * const motion = await curviate.motions.create({
    *   name: "Q4 webinar follow-up",
@@ -6308,14 +7192,17 @@ var MotionsResource = class {
     return this.ctx.request({ method: "POST", path: "/v1/motions", body: withDocument(body) });
   }
   /**
-   * List Motions, most recently updated first. `status` (any of them; default
-   * all but `archived`), `account_id`, `q` (name substring). Items carry no
+   * List Motions. `status` (any of them; default all but `archived`),
+   * `account_id` (one or several accounts as a comma list, up to 50: Motions
+   * sending from any of them), `q` (name substring), `sort`: `updated`
+   * (default, latest edit first) or `activity` (latest step record first,
+   * else `updated_at`). Items carry `last_activity_at` (or `null`) but no
    * `sequence`: read it with `get`. Pages with an opaque `cursor` until it is
-   * `null`.
+   * `null`; a cursor belongs to its sort.
    * `GET /v1/motions`
    *
    * @example
-   * const { items } = await curviate.motions.list({ status: ["active", "paused"] });
+   * const { items } = await curviate.motions.list({ status: ["active", "paused"], account_id: "acc_1,acc_2", sort: "activity" });
    */
   list(params) {
     return this.ctx.request({ method: "GET", path: "/v1/motions", query: commaLists(params, "status") });
@@ -6417,6 +7304,13 @@ var MotionsResource = class {
    * Sequence, rendered messages for `sample` Contacts (1 to 20, default 5) or
    * the `contact_ids` you name (up to 20, not with `sample`), and the budget
    * projection. A read: never reaches LinkedIn, spends nothing.
+   *
+   * `projection.audience` is `{ total, skipped, to_enroll }`, `skipped`
+   * counted per reason (`do_not_contact`, `excluded`, `other_motion`,
+   * `known_chat`, `filtered`; a Contact counts under the first that applies);
+   * `projection.contacts` equals `to_enroll`. In
+   * Several mode `accounts[].contacts` counts Enrollments, not people, and
+   * `projection.fits_before_end_at` is counted per account zone.
    * `GET /v1/motions/{id}/preview`
    *
    * @example
@@ -6482,15 +7376,20 @@ var EnrollmentsResource = class {
   }
   /**
    * List Enrollments, newest first. Filters: `motion_id`, `contact_id`,
-   * `account_id`, `status` (any of them), `step_id` (at that Step now),
-   * `version`; by Step outcome: `done_step` with `outcome` (how that Step
+   * `account_id` (one or several as a comma list, up to 50), `status` (any of
+   * them), `step_id` (at any of these Steps now, up to 10), `version`; by Step outcome: `done_step` with `outcome` (how that Step
    * ended), `reason` (catalogue codes, any of them), `variant_id`,
    * `relationship_at_enrollment` (any of them). Pages with an opaque `cursor`
    * until it is `null`.
    * `GET /v1/enrollments`
    *
+   * A finished Enrollment's `finish_reason` may be `engaged_elsewhere`: the
+   * Contact replied to, or was messaged from, another account of the Motion
+   * (Several mode).
+   *
    * @example
    * const { items } = await curviate.enrollments.list({ motion_id: "mot_123", done_step: "opener", outcome: "failed" });
+   * const atEither = await curviate.enrollments.list({ motion_id: "mot_123", step_id: ["opener", "bump"] });
    */
   list(params) {
     return this.ctx.request({
@@ -6501,7 +7400,12 @@ var EnrollmentsResource = class {
   }
   /**
    * One Enrollment with its `history` of Steps (metadata only, no rendered
-   * text).
+   * text). `history` reaches back 12 months, plus the entries `retry` reads
+   * at any age; `history_truncated: true` says older entries are not listed.
+   * The Enrollment's state has no such limit. `values` are what the
+   * Sequence's `save` maps took from an incoming event (name to value; read
+   * them as `{{enrollment.<name>}}` and `if enrollment.<name>`); they are
+   * empty once it finishes, and after a resume.
    * `GET /v1/enrollments/{id}`
    *
    * @example
@@ -6511,8 +7415,8 @@ var EnrollmentsResource = class {
     return this.ctx.request({ method: "GET", path: apiPath`/v1/enrollments/${enrollmentId}` });
   }
   /**
-   * Stop a `pending`, `active` or `paused` Enrollment (`finished`,
-   * `stopped`); else `ENROLLMENT_NOT_ACTIVE`.
+   * Stop a `queued`, `active` or `paused` Enrollment (it ends `finished`,
+   * `finish_reason: "stopped"`); else `ENROLLMENT_NOT_ACTIVE`.
    * `POST /v1/enrollments/{id}/stop`
    *
    * @example
@@ -6522,7 +7426,7 @@ var EnrollmentsResource = class {
     return this.ctx.request({ method: "POST", path: apiPath`/v1/enrollments/${enrollmentId}/stop` });
   }
   /**
-   * Hold one `pending`, `active` or `paused` Enrollment until you `resume` it
+   * Hold one `queued`, `active` or `paused` Enrollment until you `resume` it
    * (`waiting.kind: "paused_by_user"`); its waits freeze. A Step being sent
    * right now is `STEP_IN_FLIGHT`: retry in a minute. Works on every plan.
    * `POST /v1/enrollments/{id}/pause`
@@ -6687,6 +7591,15 @@ var NetworkConnectionsResource = class {
    * characters), `include_removed` (Connections that left), `limit` (up to
    * 1,000). `await` it for one page; `for await` it for every Connection
    * across pages.
+   *
+   * By default an item is one account and one person (`object: "connection"`),
+   * so someone connected to three of your accounts appears three times.
+   * `group: "person"` lists one item per person (`object: "connection_person"`)
+   * with `accounts`, each of your accounts they are connected to, and `contact`,
+   * their Contact summary (`id`, `list_count`, up to 10 `lists`; `null` when
+   * they are not a Contact); `account_id` then picks which people are
+   * listed. `include_total: true` (only with `group: "person"`) adds `total`,
+   * the number of people that match across all pages. Branch on `object`.
    * `GET /v1/network/connections`
    *
    * @example
@@ -6720,16 +7633,24 @@ var NetworkResource = class {
   /**
    * Start a full re-read of one account's Connections, paced and inside the
    * account's activity window (hours to days for a large network). Once per
-   * account per 24 hours; follow it with `syncStatus`.
+   * account per 24 hours; follow it with `syncStatus`. With an `account_id` it
+   * resolves with that account's answer (`object: "network_resync"`). With no
+   * argument (or no `account_id`) it is Resync all: every account you can
+   * operate that can start one now, one after another in a random order, each
+   * 20 to 90 seconds after the previous; it resolves with
+   * `object: "network_resync_list"`, one item per account with its `status`
+   * (`queued`, `cooldown`, `in_progress` or `paused`: answers, not errors) and
+   * `starts_at`. Branch on `object`.
    * `POST /v1/network/resync`
    *
    * Needs Automate: a Team below that Tier is refused with `TIER_REQUIRED`.
    *
    * @example
    * await curviate.network.resync({ account_id: "acc_123" });
+   * const all = await curviate.network.resync(); // Resync all
    */
   resync(body) {
-    return this.ctx.request({ method: "POST", path: "/v1/network/resync", body });
+    return this.ctx.request({ method: "POST", path: "/v1/network/resync", body: body ?? {} });
   }
 };
 
@@ -6740,9 +7661,20 @@ var UniboxAccountsResource = class {
   }
   /**
    * For every account you can operate: whether its whole inbox is copied into
-   * the Unibox, and how far the chat-list sync is.
+   * the Unibox, and how far the chat-list sync is. A disconnected account is
+   * listed too (`account_status: "disconnected"`), read-only.
    * `GET /v1/unibox/accounts`
    *
+   * Read `sync` before trusting an empty Unibox: `off` and `pending` mean
+   * nothing was listed yet. `sync.next_run_at` is when the next read of the
+   * account happens: once the first listing is `complete`, the next poll
+   * (every 5 to 10 minutes while the Unibox is open in the dashboard,
+   * otherwise 30 to 60, slower at weekends, inside the account's active hours
+   * only); while `paused`, when the pause ends; `null` when none can be
+   * scheduled or full-inbox sync is off. An account without full-inbox sync
+   * that still has Motion chats is polled for them, yet reads `off` with
+   * `next_run_at: null`.
+   *
    * @example
    * const { items } = await curviate.unibox.accounts.list();
    */
@@ -6774,12 +7706,26 @@ var UniboxResource = class {
   /**
    * List the chats of every account you can operate in one inbox, newest
    * activity first. Filters: `account_ids`, `motion_ids`, `tags` (several
-   * each), `unread`, `last_message_from`, `type`, `q` (3+ characters).
-   * `await` it for one page; `for await` it for every chat across pages.
+   * each), `person`, `unread`, `last_message_from`, `type`, `q` (3+
+   * characters). `await` it for one page; `for await` it for every chat
+   * across pages.
    * `GET /v1/unibox/chats`
    *
+   * `person` is one Contact id (`con_...`) or LinkedIn id (`ACo...`), not a
+   * list; an unknown id matches nothing. `motion_ids` also takes `"none"`:
+   * the chats no Motion links, alone or beside Motion ids. `include_total:
+   * true` adds `total` to the page, the chats that match the filters (not
+   * the page); without it the body has no `total`.
+   *
+   * A chat of a disconnected account is listed (`account_status:
+   * "disconnected"`), read-only. `unread` is LinkedIn's state for the
+   * account, the same for every viewer. `marked_unread` is `{origin, at}`
+   * (`origin`: `unibox`, `api` or `linkedin`) when the chat was made unread
+   * without a newer message from the other person, else `null`.
+   *
    * @example
    * for await (const chat of curviate.unibox.list({ unread: true })) console.log(chat.chat_id);
+   * const { total } = await curviate.unibox.list({ person: "con_123", motion_ids: ["none"], include_total: true });
    */
   list(params) {
     return pageable(
@@ -6811,9 +7757,18 @@ var UniboxResource = class {
   /**
    * Queue a re-read of the newest chats (up to 100) of each account with
    * full-inbox sync on, or of `account_ids`. Runs within minutes. Once per
-   * account per 5 minutes; a repeat answers `cooldown` with `next_allowed_at`.
+   * account per 2 minutes; a repeat answers `cooldown` with `next_allowed_at`.
    * `POST /v1/unibox/refresh`
    *
+   * It covers every account the poll covers: full-inbox sync on, or Motion
+   * chats or Motion outreach without it (only those chats are kept). An
+   * account's `status` is `queued`, `cooldown`, `paused` (it runs when the
+   * pause ends) or `not_synced`, which means none of those apply (or the
+   * first full listing is still running), so there is nothing to refresh.
+   * `next_allowed_at` is when the next manual refresh is allowed (while
+   * `paused`, when the pause ends, `null` if unknown). A disconnected account
+   * named here is ignored and claims no cooldown.
+   *
    * Needs Automate: a Team below that Tier is refused with `TIER_REQUIRED`.
    *
    * @example
@@ -6858,27 +7813,57 @@ var AnalyticsMotionsResource = class {
     this.ctx = ctx;
   }
   /**
-   * Results of your Motions in total, per Motion and per account:
-   * Enrollments by state, invitations, messages, replies, engagement and a
-   * daily series.
+   * Results of your Motions and direct actions (API, CLI, MCP, Unibox) in
+   * total, per Motion and per account: Enrollments by state right now (the
+   * window does not apply), invitations and acceptance, messages and reply,
+   * InMails and InMail reply (never mixed with messages), replies, engagement,
+   * a daily series. Each Contact counts once per Account and source. Rates are
+   * outcomes so far (`maturing` is the part sent under 7 days ago;
+   * `low_sample` under 30); `compare: "previous_period"` adds `previous` and
+   * `delta` to every rate. `origin` filters by source: `motion`, `unibox`,
+   * `api`, or `direct` (unibox and api).
+   *
+   * Grammar: `include` picks sections (`performance`, `daily`, `motions`,
+   * `accounts`, `flags`), `fields` keeps dotted paths (`motions.reply.rate`),
+   * `sort` and `limit` order and cut the Motion and account lists (`-key`
+   * is descending), and `flags` says what to read next. Give any of these
+   * without `include` and the body is the summary: `performance`, the top 5
+   * by sent, `flags`. Give none and you still get the full body, with a
+   * `Deprecation` header: it becomes the summary later.
+   *
+   * Window: `from` and `to` reach back up to 3650 days (more is a `400` naming
+   * `from`). Beyond 12 months you get daily counts only:
+   * `window.counts_only_through` is the last day read from the daily counts
+   * (`null` when the whole window has full detail), and
+   * `window.paths_through` says `paths` covers only the days after it, so past
+   * it `paths` does not add up to the totals.
    * `GET /v1/analytics/motions`
    *
    * @example
    * const { totals, motions } = await curviate.analytics.motions.list({ from: "2026-10-01", to: "2026-10-31" });
+   *
+   * @example
+   * const summary = await curviate.analytics.motions.list({ range: "30d", compare: "previous_period", origin: ["motion", "unibox"] });
    */
   list(params) {
-    return this.ctx.request({ method: "GET", path: "/v1/analytics/motions", query: params });
+    return this.ctx.request({ method: "GET", path: "/v1/analytics/motions", query: commaLists(params, "account_id", "motion_id", "origin", "include", "fields", "sort") });
   }
   /**
    * One Motion's results with a row per step and per variant (document
-   * order, never ranked); `version` picks a Sequence version.
+   * order, never ranked); `version` picks a Sequence version. The window,
+   * `origin`, `include`, `fields`, `sort`, `limit` and `compare` work as on
+   * {@link AnalyticsMotionsResource.list}; here the summary is `performance`,
+   * `accounts` and `flags`, and `steps`, `variants` and `paths` come with
+   * `include`. `paths` splits the Motion by the Contact's relationship to the
+   * account when the Enrollment started (provisional); it covers only the
+   * days after `window.paths_through`.
    * `GET /v1/analytics/motions/{motion_id}`
    *
    * @example
    * const { steps } = await curviate.analytics.motions.get("mot_123");
    */
   get(motionId, params) {
-    return this.ctx.request({ method: "GET", path: apiPath`/v1/analytics/motions/${motionId}`, query: params });
+    return this.ctx.request({ method: "GET", path: apiPath`/v1/analytics/motions/${motionId}`, query: commaLists(params, "account_id", "origin", "include", "fields", "sort") });
   }
 };
 var AnalyticsEventsResource = class {
@@ -6887,10 +7872,16 @@ var AnalyticsEventsResource = class {
   }
   /**
    * Recent Motion events, newest first: steps executed, skipped or failed,
-   * invitations accepted and replies. Filters: `account_id`, `motion_id`,
-   * `kind` (several). Keyset paging: events recorded after your first page
+   * invitations accepted and replies, plus the direct actions (Unibox, API).
+   * Filters: `account_id`, `motion_id`, `contact_id`, `kind` and `origin`
+   * (several). `origin` is `motion`, `unibox`, `api` or `direct` (an alias
+   * for `unibox` and `api`). `contact_id` (`con_...`) keeps one person's
+   * events, their Enrollments' and the direct actions with them; an unknown
+   * id, another team's, or one merged into another Contact throws
+   * `RESOURCE_NOT_FOUND` (404). Keyset paging: events recorded after your first page
    * never shift later pages. `await` it for one page; `for await` it for
-   * every event across pages.
+   * every event across pages. A direct action's `person_name` names the
+   * person (they may not be a Contact); `null` for a Motion event.
    * `GET /v1/analytics/events`
    *
    * @example
@@ -6898,7 +7889,7 @@ var AnalyticsEventsResource = class {
    */
   list(params) {
     return pageable(
-      (p) => this.ctx.request({ method: "GET", path: "/v1/analytics/events", query: commaLists(p, "kind") }),
+      (p) => this.ctx.request({ method: "GET", path: "/v1/analytics/events", query: commaLists(p, "kind", "origin") }),
       params
     );
   }
@@ -6919,7 +7910,346 @@ var AnalyticsResource = class {
    * const { types } = await curviate.analytics.activity({ account_id: "acc_123" });
    */
   activity(params) {
-    return this.ctx.request({ method: "GET", path: "/v1/analytics/activity", query: params });
+    return this.ctx.request({ method: "GET", path: "/v1/analytics/activity", query: commaLists(params, "account_id") });
+  }
+  /**
+   * The Analytics tables as one download, now, any size and no row limit,
+   * never message text: `table` picks `daily`, `accounts`, `motions` and
+   * `enrollments` (default all; several come as one ZIP), `format` is `csv`
+   * (default; UTF-8 with a BOM, formula-guarded), `json` or `ndjson` (one
+   * table only), under the overview's filters (window, `account_id`,
+   * `motion_id`, `origin`). Resolves with the file's bytes. Owners and
+   * Managers. For a file to fetch later, `exports.create`.
+   * `GET /v1/analytics/export`
+   *
+   * @example
+   * const csv = await curviate.analytics.export({ table: "daily", range: "90d" });
+   */
+  async export(params) {
+    return this.ctx.request({ bytes: true, method: "GET", path: "/v1/analytics/export", query: commaLists(params, "account_id", "motion_id", "origin", "table") });
+  }
+};
+
+// src/resources/billing.ts
+var BillingSeatsResource = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  /**
+   * Move an unused paid seat of this Team to another of your Teams, at no
+   * charge; it stays on this Team's invoice at its Tier. `seat_id` picks the
+   * seat, or leave it out to lend the oldest unused one; each call lends one
+   * more seat. Trial, occupied, unconfirmed, cancelling and already-lent seats
+   * cannot move (`SEAT_NOT_FOUND`). The borrowing Team connects an Account
+   * into it and the seat counts against that Team's rate limit, not this
+   * one's. While it is lent, a connect naming it or a cancel of it throws
+   * `SEAT_LENT`: move it back first. Only the Owner who pays for both Teams
+   * can lend (`INSUFFICIENT_ROLE`). Resolves with the lent `seat_id` and the
+   * `team_id` it went to.
+   * `POST /v1/billing/seats/lend`
+   *
+   * @example
+   * const { seat_id } = await curviate.billing.seats.lend({ team_id: "tnt_456" });
+   */
+  lend(body) {
+    return this.ctx.request({ method: "POST", path: "/v1/billing/seats/lend", body });
+  }
+  /**
+   * End a seat loan while no Account uses the seat. Call it from either Team:
+   * with the lending Team's seat id, or with the lent seat's id in the Team
+   * that received it. A seat an Account still uses throws `SEAT_NOT_EMPTY`:
+   * disconnect the Account first. The Owner who pays for either Team can move
+   * it back.
+   * `POST /v1/billing/seats/{seat_id}/return`
+   *
+   * @example
+   * await curviate.billing.seats.return("seat_123");
+   */
+  return(seatId) {
+    return this.ctx.request({ method: "POST", path: apiPath`/v1/billing/seats/${seatId}/return` });
+  }
+};
+var BillingInvoicesResource = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  /**
+   * The Team's issued invoices, newest first, with number, `total`,
+   * `currency`, `status` (`paid`, `open`, `failed` or `void`) and service
+   * period. Draft invoices are never listed and an invoice carries no link:
+   * download its PDF by `number`. `limit` is 1 to 100 (default 20). `await` it
+   * for one page; `for await` it for every invoice across pages. Owners only
+   * (`INSUFFICIENT_ROLE`); `BILLING_PORTAL_UNAVAILABLE` (503) means retry.
+   * `GET /v1/billing/invoices`
+   *
+   * @example
+   * for await (const invoice of curviate.billing.invoices.list()) console.log(invoice.number, invoice.status);
+   */
+  list(params) {
+    return pageable(
+      (p) => this.ctx.request({ method: "GET", path: "/v1/billing/invoices", ...p ? { query: p } : {} }),
+      params
+    );
+  }
+  /**
+   * One invoice as PDF bytes, by its `number` from {@link BillingInvoicesResource.list}.
+   * An unknown number throws `RESOURCE_NOT_FOUND`. Owners only.
+   * `GET /v1/billing/invoices/{number}/pdf`
+   *
+   * @example
+   * const pdf = await curviate.billing.invoices.pdf("INV-0042");
+   * await fs.promises.writeFile("INV-0042.pdf", Buffer.from(pdf));
+   */
+  pdf(number) {
+    return this.ctx.request({ method: "GET", path: apiPath`/v1/billing/invoices/${number}/pdf` });
+  }
+};
+var BillingResource = class {
+  constructor(ctx) {
+    this.seats = new BillingSeatsResource(ctx);
+    this.invoices = new BillingInvoicesResource(ctx);
+  }
+};
+
+// src/resources/do-not-contact.ts
+var DoNotContactResource = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  /**
+   * The Team's do-not-contact list, newest first. `q` matches the Contact's
+   * name. `await` it for one page; `for await` it for every entry across
+   * pages.
+   * `GET /v1/do-not-contact`
+   *
+   * @example
+   * for await (const entry of curviate.doNotContact.list({ q: "ana" })) console.log(entry.id, entry.reason);
+   */
+  list(params) {
+    return pageable(
+      (p) => this.ctx.request({ method: "GET", path: "/v1/do-not-contact", ...p ? { query: p } : {} }),
+      params
+    );
+  }
+  /**
+   * One entry. `reason` is one of `asked_to_stop`, `existing_customer`,
+   * `competitor`, `partner`, `employee`, `other`, or `null`.
+   * `GET /v1/do-not-contact/{id}`
+   *
+   * @example
+   * const entry = await curviate.doNotContact.get("dnc_123");
+   */
+  get(id) {
+    return this.ctx.request({ method: "GET", path: apiPath`/v1/do-not-contact/${id}` });
+  }
+  /**
+   * Add one person by `contact_id` or `linkedin_url` (someone who is not a
+   * Contact yet becomes one first, from stored data only), with an optional
+   * `reason`. A person already on the list resolves with their existing entry,
+   * unchanged. Any team member may add. There is no bulk route: loop. Needs
+   * Automate: a Team below that Tier is refused with `TIER_REQUIRED`.
+   * `POST /v1/do-not-contact`
+   *
+   * @example
+   * const entry = await curviate.doNotContact.add({ linkedin_url: "https://www.linkedin.com/in/ana/", reason: "asked_to_stop" });
+   */
+  add(body) {
+    return this.ctx.request({ method: "POST", path: "/v1/do-not-contact", body });
+  }
+  /**
+   * Set the entry's `reason` from the fixed list; `null` clears it. Needs
+   * Automate: a Team below that Tier is refused with `TIER_REQUIRED`.
+   * `PATCH /v1/do-not-contact/{id}`
+   *
+   * @example
+   * await curviate.doNotContact.update("dnc_123", { reason: "existing_customer" });
+   */
+  update(id, body) {
+    return this.ctx.request({ method: "PATCH", path: apiPath`/v1/do-not-contact/${id}`, body });
+  }
+  /**
+   * Remove the entry (bodyless, 204): Motions and writes may reach the person
+   * again. Owners and Managers only (`INSUFFICIENT_ROLE`).
+   * `DELETE /v1/do-not-contact/{id}`
+   *
+   * @example
+   * await curviate.doNotContact.remove("dnc_123");
+   */
+  async remove(id) {
+    await this.ctx.request({ method: "DELETE", path: apiPath`/v1/do-not-contact/${id}` });
+  }
+};
+
+// src/resources/incoming-events.ts
+var IncomingEventsResource = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  /**
+   * Create an incoming event, switched off, waiting for its sample. Exactly
+   * one of `event_name` (fixed) and `event_name_field` (a path in the post).
+   * The result's `url` is the only time it is shown in full.
+   * `POST /v1/incoming-events`
+   *
+   * @example
+   * const { id, url } = await curviate.incomingEvents.create({ event_name: "reply_received", match: { email: "lead.email" } });
+   */
+  create(body) {
+    return this.ctx.request({ method: "POST", path: "/v1/incoming-events", body });
+  }
+  /**
+   * The Team's incoming events (`url` masked); `event` keeps one event name.
+   * `await` it for one page; `for await` it for every one across pages.
+   * `GET /v1/incoming-events`
+   */
+  list(params) {
+    return pageable(
+      (p) => this.ctx.request({ method: "GET", path: "/v1/incoming-events", ...p ? { query: p } : {} }),
+      params
+    );
+  }
+  /**
+   * One incoming event, `url` masked; `shape` is the captured sample as paths
+   * and types only.
+   * `GET /v1/incoming-events/{id}`
+   */
+  get(id) {
+    return this.ctx.request({ method: "GET", path: apiPath`/v1/incoming-events/${id}` });
+  }
+  /**
+   * Change it; `enabled: true` switches it on once the sample is in. In
+   * `match` and `required_header`, `null` removes an entry.
+   * `PATCH /v1/incoming-events/{id}`
+   *
+   * @example
+   * await curviate.incomingEvents.update("inc_123", { enabled: true });
+   */
+  update(id, body) {
+    return this.ctx.request({ method: "PATCH", path: apiPath`/v1/incoming-events/${id}`, body });
+  }
+  /**
+   * Delete it: its URL answers `410 INCOMING_URL_RETIRED` from then on.
+   * `DELETE /v1/incoming-events/{id}`
+   */
+  async delete(id) {
+    await this.ctx.request({ method: "DELETE", path: apiPath`/v1/incoming-events/${id}` });
+  }
+  /**
+   * Issue a new URL, in full in this result only. The old one keeps working
+   * for 24 hours (`previous_url_valid_until`), then answers `410
+   * INCOMING_URL_RETIRED`. Only the creator.
+   * `POST /v1/incoming-events/{id}/rotate`
+   */
+  rotate(id) {
+    return this.ctx.request({ method: "POST", path: apiPath`/v1/incoming-events/${id}/rotate` });
+  }
+  /**
+   * The next post replaces the sample (paths and types only) and, when
+   * switched on, still moves Enrollments. Only the creator.
+   * `POST /v1/incoming-events/{id}/capture`
+   */
+  capture(id) {
+    return this.ctx.request({ method: "POST", path: apiPath`/v1/incoming-events/${id}/capture` });
+  }
+  /**
+   * The last 20 posts and what each did (`outcome`; accept values you do not
+   * know), kept 30 days. Metadata only, never a value from the post.
+   * `GET /v1/incoming-events/{id}/arrivals`
+   */
+  arrivals(id) {
+    return this.ctx.request({ method: "GET", path: apiPath`/v1/incoming-events/${id}/arrivals` });
+  }
+};
+
+// src/resources/tenant.ts
+var TenantBetaResource = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  /**
+   * The persisted decision only, not the effective consent of a given call:
+   * the `X-Curviate-Beta` header overrides it per request, either way. Every
+   * member may read.
+   * `GET /v1/tenant/beta`
+   *
+   * @example
+   * const { beta_enabled } = await curviate.tenant.beta.get();
+   */
+  get() {
+    return this.ctx.request({ method: "GET", path: "/v1/tenant/beta" });
+  }
+  /**
+   * Persist the consent for every account of the Team. Off: beta-gated
+   * operations refuse `BETA_NOT_ENABLED` again from the next call. Owners
+   * only (`INSUFFICIENT_ROLE`).
+   * `PATCH /v1/tenant/beta`
+   *
+   * @example
+   * await curviate.tenant.beta.set({ beta_enabled: true });
+   */
+  set(body) {
+    return this.ctx.request({ method: "PATCH", path: "/v1/tenant/beta", body });
+  }
+};
+var TenantResource = class {
+  constructor(ctx) {
+    this.beta = new TenantBetaResource(ctx);
+  }
+};
+
+// src/resources/exports.ts
+var ExportsResource = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  /**
+   * Start an export; it runs in the background and this resolves at once with
+   * `status: "queued"`. `entity` is what to export (`analytics`,
+   * `motion_activity`, `account_activity` or `account_metrics`), `format`
+   * `csv`, `json` or `ndjson` (one table only), `tables` picks the Analytics
+   * tables (`daily`, `accounts`, `motions`, `enrollments`; several make one
+   * ZIP), `filters` are the Analytics overview's filters (default: the last
+   * 30 days). Your team has one export at a time: a second is refused with
+   * `EXPORT_IN_PROGRESS`, and `details.export_id` names the running one (it
+   * may be a teammate's, which `get` answers 404). An Owner or Manager only.
+   * `POST /v1/exports`
+   *
+   * Not retry-safe: a retry starts a second export once the first finishes.
+   *
+   * @example
+   * const exp = await curviate.exports.create({ entity: "analytics", format: "csv", tables: ["daily"], filters: { range: "90d" } });
+   */
+  create(body) {
+    return this.ctx.request({ method: "POST", path: "/v1/exports", body });
+  }
+  /**
+   * One export of yours and its `status`: `queued`, `running`, `ready`
+   * (download it), `failed` (read `error`: `EXPORT_TOO_LARGE` means narrow the
+   * filters or tables), `expired` (24 hours after `ready_at`, the file is
+   * deleted) or `removed` (a Contact was deleted, which removes the Team's
+   * exports that hold Contacts). Accept statuses you do not know. There is no
+   * link to the file.
+   * `GET /v1/exports/{export_id}`
+   *
+   * @example
+   * const { status } = await curviate.exports.get("exp_123");
+   */
+  get(exportId) {
+    return this.ctx.request({ method: "GET", path: apiPath`/v1/exports/${exportId}` });
+  }
+  /**
+   * Download a ready export's file as bytes (CSV with a BOM, JSON, NDJSON, or
+   * a ZIP when several tables were asked). A queued, running or failed export
+   * throws `EXPORT_NOT_READY`, an expired one `EXPORT_EXPIRED` and one removed
+   * by a Contact delete `EXPORT_REMOVED` (run it again).
+   * `GET /v1/exports/{export_id}/file`
+   *
+   * @example
+   * const bytes = await curviate.exports.download("exp_123");
+   * await fs.promises.writeFile("export.csv", Buffer.from(bytes));
+   */
+  async download(exportId) {
+    return this.ctx.request({ bytes: true, method: "GET", path: apiPath`/v1/exports/${exportId}/file` });
   }
 };
 
@@ -6980,6 +8310,14 @@ var SalesNavigatorResource = class {
    * base64-encoded file bytes, always sent as JSON, never multipart.
    * `POST /v1/{account_id}/sales-navigator/chats`
    *
+   * When the Account already has a private
+   * conversation with this person that you may not read, this throws
+   * `CHAT_NOT_VISIBLE` (409) and sends nothing. Ask the person who connected
+   * the Account to reply, or to sync the full inbox. It is detected from what
+   * Curviate stored, so a thread older than 90 days that Curviate never
+   * touched is not detected. A person on the do-not-contact list throws
+   * `DO_NOT_CONTACT` (409).
+   *
    * @beta Beta operation. See the namespace note above: while beta-gated it
    * refuses `BETA_NOT_ENABLED` (403) until a human enables beta in Settings,
    * or the request carries the `X-Curviate-Beta` header.
@@ -7170,6 +8508,14 @@ var RecruiterResource = class {
    * are REQUIRED; optional attachments ride the body as base64-encoded
    * objects (no multipart). `POST /v1/{account_id}/recruiter/chats`
    *
+   * When the Account already has a private
+   * conversation with this person that you may not read, this throws
+   * `CHAT_NOT_VISIBLE` (409) and sends nothing. Ask the person who connected
+   * the Account to reply, or to sync the full inbox. It is detected from what
+   * Curviate stored, so a thread older than 90 days that Curviate never
+   * touched is not detected. A person on the do-not-contact list throws
+   * `DO_NOT_CONTACT` (409).
+   *
    * @beta Beta operation. See the namespace note above: while beta-gated it
    * refuses `BETA_NOT_ENABLED` (403) until a human enables beta in Settings,
    * or the request carries the `X-Curviate-Beta` header.
@@ -7789,6 +9135,9 @@ var CompaniesResource = class {
    * the whole request rejects with a 404, not a partial result.
    * Re-inviting an already-invited member is a safe no-op, the same
    * invitation id, never a duplicate.
+   *
+   * A person on the Team's do-not-contact list throws `DO_NOT_CONTACT` (409);
+   * nothing is sent.
    */
   followInvite(identifier, body) {
     return this.ctx.request({
@@ -7919,9 +9268,50 @@ var CompaniesResource = class {
 };
 
 // src/resources/webhooks.ts
+var WebhookDeliveriesResource = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  /**
+   * The webhook's deliveries of the last 30 days, newest first: one item per
+   * delivery (one event rendered once), attempts counted. `failed: true` keeps
+   * those that ended `failed` or `not_retried`. No body is kept. An item's `id`
+   * is the same value as the delivered body's `id`. `await` it for one page;
+   * `for await` it for every delivery across pages.
+   * `GET /v1/webhooks/{id}/deliveries`
+   *
+   * @example
+   * for await (const d of curviate.webhooks.deliveries.list("wh_123", { failed: true })) console.log(d.id, d.status);
+   */
+  list(webhookId, params) {
+    return pageable(
+      (p) => this.ctx.request({
+        method: "GET",
+        path: apiPath`/v1/webhooks/${webhookId}/deliveries`,
+        ...p ? { query: p } : {}
+      }),
+      params
+    );
+  }
+  /**
+   * One delivery: status, reason, attempts, the receiver's latest code and
+   * timing, and `redeliverable_until`.
+   * `GET /v1/webhooks/{id}/deliveries/{delivery_id}`
+   *
+   * @example
+   * const d = await curviate.webhooks.deliveries.get("wh_123", "wdl_456");
+   */
+  get(webhookId, deliveryId) {
+    return this.ctx.request({
+      method: "GET",
+      path: apiPath`/v1/webhooks/${webhookId}/deliveries/${deliveryId}`
+    });
+  }
+};
 var WebhooksResource = class {
   constructor(ctx) {
     this.ctx = ctx;
+    this.deliveries = new WebhookDeliveriesResource(ctx);
   }
   /**
    * Register a new webhook endpoint to receive real-time events.
@@ -7933,6 +9323,13 @@ var WebhooksResource = class {
    * account of the workspace (reads then return `account_ids: null`). An
    * explicit `[]` is rejected.
    *
+   * `body_template` (a JSON text with `{{variables}}` in its strings) replaces
+   * the standard payload; check it offline first with
+   * `validateWebhookTemplate`. A template that fails is refused with
+   * `WEBHOOK_TEMPLATE_INVALID` (every finding with `line` and `col`); its
+   * warnings come back in `warnings`. `custom_event_names` narrows
+   * `motion.custom_event` to those names (`null`: every one).
+   *
    * @example
    * await curviate.webhooks.create({ source: "account_status", request_url: "https://example.com/hooks" });
    */
@@ -7970,6 +9367,8 @@ var WebhooksResource = class {
    * Return a single webhook owned by the calling tenant.
    * `GET /v1/webhooks/{id}`
    * The plaintext secret is never present on a read, only `secret_prefix`.
+   * `request_url` reads masked (`https://host/•••`). `disabled_reason`,
+   * `failing_since` and `last_delivery_status_code` say how it is delivering.
    */
   get(id) {
     return this.ctx.request({
@@ -7981,7 +9380,15 @@ var WebhooksResource = class {
    * Update a webhook in place. `source` is immutable.
    * `PATCH /v1/webhooks/{id}`
    * `account_ids: null` switches an `account_status` webhook to every current
-   * and future account.
+   * and future account. Sending back the masked `request_url` you read keeps
+   * the stored URL. A `headers` entry with a key and no value keeps that
+   * header's stored value; a new key needs a value. Setting `body_template`
+   * lints it (`WEBHOOK_TEMPLATE_INVALID` on an error; warnings in the result's
+   * `warnings`). Never rotates the secret: use {@link rotateSecret}.
+   *
+   * @example
+   * // keep the stored Authorization value, replace the rest
+   * await curviate.webhooks.update("wh_123", { headers: [{ key: "Authorization" }, { key: "X-Env", value: "prod" }] });
    */
   update(id, body) {
     return this.ctx.request({
@@ -8000,6 +9407,77 @@ var WebhooksResource = class {
       path: apiPath`/v1/webhooks/${id}`
     });
   }
+  /**
+   * The variables a body template of this source may use, each with its
+   * scope, type and an example from the synthetic sample. On `motion` it also
+   * lists every Enrollment value your Team's current Sequences save
+   * (`{{enrollment.<key>}}`), with `saved_by`.
+   * `GET /v1/webhooks/variables`
+   *
+   * @example
+   * const { variables } = await curviate.webhooks.variables({ source: "motion" });
+   */
+  variables(params) {
+    return this.ctx.request({
+      method: "GET",
+      path: "/v1/webhooks/variables",
+      query: params
+    });
+  }
+  /**
+   * Queue a synthetic delivery to confirm your endpoint receives and verifies
+   * deliveries: one signed attempt with `Curviate-Test: true`, never changing
+   * the webhook's health. `event` picks the subscribed event it stands for
+   * (default: the first); the delivered `event` is always `webhook.test`, with
+   * `data.test_event` the one you picked. Read the attempt with
+   * `deliveries.get(id, delivery_id)`.
+   * `POST /v1/webhooks/{id}/test`
+   *
+   * @example
+   * const { delivery_id } = await curviate.webhooks.test("wh_123", { event: "enrollment.finished" });
+   */
+  test(id, body) {
+    return this.ctx.request({
+      method: "POST",
+      path: apiPath`/v1/webhooks/${id}/test`,
+      body: body ?? {}
+    });
+  }
+  /**
+   * Send a delivery's original request again, byte for byte (never
+   * re-rendered), freshly signed, as one attempt with no retries. Works until
+   * `redeliverable_until` (receipt + 24 h) on an enabled webhook; a success
+   * cancels its pending retries. Refusals: `NOTHING_TO_REDELIVER` (never
+   * sent), `REDELIVERY_EXPIRED`, `WEBHOOK_DISABLED`, `DELIVERY_IN_FLIGHT`
+   * (retry shortly).
+   * `POST /v1/webhooks/{id}/deliveries/{delivery_id}/redeliver`
+   *
+   * @example
+   * await curviate.webhooks.redeliver("wh_123", "wdl_456");
+   */
+  redeliver(id, deliveryId) {
+    return this.ctx.request({
+      method: "POST",
+      path: apiPath`/v1/webhooks/${id}/deliveries/${deliveryId}/redeliver`
+    });
+  }
+  /**
+   * Issue a new signing secret, returned once: store it now. For 24 hours
+   * (`previous_valid_until`) every delivery carries both signatures
+   * (`v1=<new>,v1=<old>`) and `constructEvent` accepts either secret, so
+   * deploy the new one inside that window. A second rotation before then
+   * drops the oldest secret at once. Only the webhook's creator may rotate.
+   * `POST /v1/webhooks/{id}/rotate-secret`
+   *
+   * @example
+   * const { secret, previous_valid_until } = await curviate.webhooks.rotateSecret("wh_123");
+   */
+  rotateSecret(id) {
+    return this.ctx.request({
+      method: "POST",
+      path: apiPath`/v1/webhooks/${id}/rotate-secret`
+    });
+  }
 };
 
 // src/resources/drafts.ts
@@ -8189,7 +9667,12 @@ function buildRootNamespaces(ctx) {
     tier: new TierResource(ctx),
     network: new NetworkResource(ctx),
     unibox: new UniboxResource(ctx),
-    analytics: new AnalyticsResource(ctx)
+    analytics: new AnalyticsResource(ctx),
+    billing: new BillingResource(ctx),
+    doNotContact: new DoNotContactResource(ctx),
+    exports: new ExportsResource(ctx),
+    incomingEvents: new IncomingEventsResource(ctx),
+    tenant: new TenantResource(ctx)
   };
 }
 function buildAccountScopedNamespaces(ctx) {
@@ -8208,7 +9691,7 @@ function buildAccountScopedNamespaces(ctx) {
 }
 
 // src/client.ts
-var Curviate = class {
+var Curviate = class _Curviate {
   constructor(config) {
     this.config = resolveConfig(config);
     const ctx = createContext(this.config);
@@ -8229,6 +9712,11 @@ var Curviate = class {
     this.network = ns.network;
     this.unibox = ns.unibox;
     this.analytics = ns.analytics;
+    this.billing = ns.billing;
+    this.doNotContact = ns.doNotContact;
+    this.exports = ns.exports;
+    this.incomingEvents = ns.incomingEvents;
+    this.tenant = ns.tenant;
   }
   /**
    * Return an account-scoped accessor that fixes `account_id` on every call,
@@ -8252,6 +9740,25 @@ var Curviate = class {
     const ctx = createContext(this.config, accountId);
     return buildAccountScopedNamespaces(ctx);
   }
+  /**
+   * The same client acting in another Team: every call made through the
+   * returned client sends `X-Curviate-Team: <team>`, overriding the `team`
+   * client option. Use it per call with a key that works in all of your
+   * Teams, which a Team-level operation otherwise refuses with
+   * `TEAM_REQUIRED`. A Team key accepts only its own Team
+   * (`TEAM_ACCESS_DENIED`). No network call; `team` is checked as in the
+   * constructor.
+   *
+   * @param team - a Team id (`tnt_...`); `curviate.teams.list()` lists yours.
+   *
+   * @example
+   * for (const team of (await curviate.teams.list()).items) {
+   *   const { items } = await curviate.withTeam(team.id).motions.list({ status: ["active"] });
+   * }
+   */
+  withTeam(team) {
+    return new _Curviate({ ...this.config, team });
+  }
   /**
    * Transparent cursor-pagination iterator.
    *
@@ -8335,16 +9842,16 @@ var WebhookSignatureError = class _WebhookSignatureError extends Error {
 function parseHeader(header) {
   const parts = header.split(",");
   let tStr;
-  let v1;
+  const v1 = [];
   for (const part of parts) {
     const eq = part.indexOf("=");
     if (eq === -1) continue;
     const key = part.slice(0, eq).trim();
     const val = part.slice(eq + 1).trim();
     if (key === "t") tStr = val;
-    else if (key === "v1") v1 = val;
+    else if (key === "v1") v1.push(val);
   }
-  if (tStr === void 0 || v1 === void 0) {
+  if (tStr === void 0 || v1.length === 0) {
     throw new WebhookSignatureError(
       "malformed_header",
       'Webhook signature header must contain both "t=<timestamp>" and "v1=<hmac>".'
@@ -8399,20 +9906,29 @@ async function hmacWebCrypto(secret, payload) {
   return bytesToHex(new Uint8Array(sig));
 }
 function verifyAndParse(computedHex, v1, timestamp, bodyStr, replayWindowSecs) {
-  let providedBytes;
-  try {
-    providedBytes = hexToBytes(v1);
-  } catch {
+  const computedBytes = hexToBytes(computedHex);
+  let matched = false;
+  let validHex = false;
+  for (const candidate of v1) {
+    let providedBytes;
+    try {
+      providedBytes = hexToBytes(candidate);
+    } catch {
+      continue;
+    }
+    validHex = true;
+    if (constantTimeEqual(computedBytes, providedBytes)) matched = true;
+  }
+  if (!validHex) {
     throw new WebhookSignatureError(
       "invalid_signature",
       "Webhook signature v1 value is not valid hex."
     );
   }
-  const computedBytes = hexToBytes(computedHex);
-  if (!constantTimeEqual(computedBytes, providedBytes)) {
+  if (!matched) {
     throw new WebhookSignatureError(
       "invalid_signature",
-      "Webhook signature does not match. Verify your signing secret."
+      "Webhook signature does not match any v1. Verify your signing secret."
     );
   }
   const nowSecs = Date.now() / 1e3;
@@ -8457,6 +9973,343 @@ async function constructEvent(rawBody, signatureHeader, secret, opts) {
   const computedHex = await hmacWebCrypto(secret, hmacPayload);
   return verifyAndParse(computedHex, v1, timestamp, bodyStr, replayWindowSecs);
 }
+
+// src/shared/webhook-template.ts
+var MAX_TEMPLATE_BYTES = 16384;
+var MAX_TEMPLATE_REFERENCES = 200;
+var BODY_TEMPLATES_DOCS_URL = "https://docs.curviate.com/reference/webhooks/body-templates";
+var RULES = {
+  T1: { title: "Empty template", hint: () => "Send null for the standard payload, or write the JSON body your tool expects." },
+  T2: {
+    title: "Not valid JSON",
+    hint: (t) => t ? `Remove the trailing comma before ${t}.` : "Write the template as JSON: double-quoted keys and strings, commas between members, nothing after the last value."
+  },
+  T3: { title: "Variable never closed", hint: () => "Close the variable with }}, like {{contact.email}}." },
+  T4: { title: "Variable outside a string", hint: (t) => `Put the variable inside a JSON string: "${t}" keeps the value's type.` },
+  T5: { title: "Variable in a key", hint: (t) => `Use a fixed key and put the variable in the value, like ${t}.` },
+  T6: { title: "Unknown variable", hint: (t) => t ? `Use ${t}.` : "Use a variable this source carries: GET /v1/webhooks/variables?source=<source> lists them." },
+  T7: { title: "enrollment.id is reserved", hint: () => "Use {{enrollment_id}} for the Enrollment's id." },
+  T8: { title: "No defaults or filters", hint: () => "Remove the part after |: a template has no defaults or filters, and a missing value drops its key." },
+  T9: { title: "Single-brace placeholder", hint: (t) => `Write the variable with double braces, like ${t}.` },
+  T10: { title: "Template size", hint: () => `Keep the template to ${MAX_TEMPLATE_BYTES.toLocaleString("en-US")} bytes and ${MAX_TEMPLATE_REFERENCES} variables.` },
+  TW1: { title: "Enrollment value no Sequence saves", hint: (t) => `Save ${t} with save on an until event.<name> step of a Sequence; until one does, it is always missing.` }
+};
+var WEBHOOK_TEMPLATE_RULE_CODES = Object.keys(RULES);
+var SCOPES_BY_SOURCE = {
+  motion: ["event", "account", "contact", "motion", "enrollment"],
+  messaging: ["event", "account", "contact", "motion"],
+  user: ["event", "account", "contact", "motion"],
+  account_status: ["event", "account"],
+  post: ["event", "account"]
+};
+var ACCOUNT_PARTS = ["first_name", "last_name", "full_name"];
+var EXTRA_KEY = /^[A-Za-z0-9_]{1,64}$/;
+var VALUE_KEY = /^[a-z][a-z0-9_]{0,63}$/;
+var FIXED = [
+  ["event", "event"],
+  ["occurred_at", "event"],
+  ...ACCOUNT_PARTS.map((p) => [`account.${p}`, "account"]),
+  ...STANDARD_FIELDS.map((f) => [`contact.${f}`, "contact"]),
+  ["motion.id", "motion"],
+  ["motion.name", "motion"],
+  ["enrollment_id", "motion"],
+  ["step_id", "enrollment"]
+];
+var SCOPE_OF = new Map(FIXED);
+var SHORT = new Map([...STANDARD_FIELDS.map((f) => [f, `contact.${f}`]), ...ACCOUNT_PARTS.map((p) => [`my_${p}`, `account.${p}`])]);
+function resolve(inner) {
+  const raw = inner.trim();
+  if (raw.includes("|"))
+    return { ok: false, code: "T8", rule: `{{${raw.slice(0, raw.indexOf("|")).trim()} | \u2026}} carries a default or a filter` };
+  const name = SHORT.get(raw) ?? raw;
+  if (name === "enrollment.id")
+    return { ok: false, code: "T7", rule: "{{enrollment.id}} is reserved", token: "{{enrollment_id}}", candidates: ["{{enrollment_id}}"] };
+  const fixed = SCOPE_OF.get(name);
+  if (fixed)
+    return { ok: true, name, scope: fixed };
+  if (name.startsWith("contact.extra.") && EXTRA_KEY.test(name.slice(14)))
+    return { ok: true, name, scope: "contact" };
+  if (name.startsWith("enrollment.") && VALUE_KEY.test(name.slice(11)))
+    return { ok: true, name, scope: "enrollment" };
+  return { ok: false, code: "T6", rule: `unknown variable {{${raw}}}` };
+}
+var scopeOk = (source, r) => (SCOPES_BY_SOURCE[source] ?? []).includes(r.scope);
+function candidatesFor(source, raw) {
+  const known = [...FIXED.filter(([n, s]) => scopeOk(source, { name: n, scope: s })).map(([n]) => n), ...[...SHORT].filter(([, l]) => scopeOk(source, { name: l, scope: SCOPE_OF.get(l) })).map(([s]) => s)];
+  return known.map((n) => [n, distance(raw, n, 3)]).filter(([, d]) => d <= 3).sort((a, b) => a[1] - b[1] || (a[0] < b[0] ? -1 : 1)).slice(0, 3).map(([n]) => `{{${n}}}`);
+}
+var LITERAL = /-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null/y;
+var STRUCTURAL = /* @__PURE__ */ new Set(["{", "}", "[", "]", ":", ",", '"']);
+var what = (c) => c === void 0 ? "the end of the template" : STRUCTURAL.has(c) ? `'${c}'` : "a character that starts no JSON value";
+function scan(src) {
+  const out = { strings: [], bare: [], error: null };
+  const fail = (at, rule, code = "T2", token) => (out.error = { at, code, rule, ...token ? { token } : {} }, out);
+  const stack = [];
+  let i = 0;
+  let expect = "value";
+  let opened = false;
+  let comma = false;
+  const ws = () => {
+    while (i < src.length && (src[i] === " " || src[i] === "	" || src[i] === "\n" || src[i] === "\r"))
+      i++;
+  };
+  const string = () => {
+    let j = i + 1;
+    while (j < src.length) {
+      const c = src.charCodeAt(j);
+      if (c === 34)
+        return j + 1;
+      if (c === 92) {
+        const e = src[j + 1];
+        if (e === "u" ? !/^[0-9a-fA-F]{4}$/.test(src.slice(j + 2, j + 6)) : e === void 0 || !'"\\/bfnrt'.includes(e))
+          return `invalid escape in a string at line ${lineCol(src, j).line}`;
+        j += e === "u" ? 6 : 2;
+        continue;
+      }
+      if (c < 32)
+        return "a control character (a raw line break or tab) inside a string; write it as \\n or \\t";
+      j++;
+    }
+    return "a string is never closed";
+  };
+  for (; ; ) {
+    ws();
+    const c = src[i];
+    if (expect === "next") {
+      const closer = stack.at(-1);
+      if (closer === void 0)
+        return i < src.length ? fail(i, `unexpected ${what(c)} after the JSON value`) : out;
+      if (c === ",") {
+        i++;
+        comma = true;
+        expect = closer === "}" ? "key" : "value";
+      } else if (c === closer) {
+        stack.pop();
+        i++;
+      } else
+        return fail(i, `expected ',' or '${closer}', found ${what(c)}`);
+      continue;
+    }
+    if (opened && c === stack.at(-1)) {
+      stack.pop();
+      i++;
+      opened = false;
+      expect = "next";
+      continue;
+    }
+    if (comma && (c === "}" || c === "]"))
+      return fail(i, `trailing comma before '${c}'`, "T2", `'${c}'`);
+    opened = comma = false;
+    if (c === void 0)
+      return fail(i, "the template ends where a value is expected");
+    if (expect === "key") {
+      if (c !== '"')
+        return fail(i, `expected a double-quoted key, found ${what(c)}`);
+      const end = string();
+      if (typeof end === "string")
+        return fail(i, end);
+      out.strings.push({ start: i, end, key: true });
+      i = end;
+      ws();
+      if (src[i] !== ":")
+        return fail(i, `expected ':' after a key, found ${what(src[i])}`);
+      i++;
+      expect = "value";
+      continue;
+    }
+    if (c === "{" && src[i + 1] === "{") {
+      const close = src.indexOf("}}", i + 2);
+      if (close < 0)
+        return fail(i, "{{ is never closed", "T3");
+      out.bare.push({ start: i, end: close + 2 });
+      i = close + 2;
+      expect = "next";
+    } else if (c === "{" || c === "[") {
+      stack.push(c === "{" ? "}" : "]");
+      i++;
+      opened = true;
+      expect = c === "{" ? "key" : "value";
+    } else if (c === '"') {
+      const end = string();
+      if (typeof end === "string")
+        return fail(i, end);
+      out.strings.push({ start: i, end, key: false });
+      i = end;
+      expect = "next";
+    } else {
+      LITERAL.lastIndex = i;
+      const m = LITERAL.exec(src);
+      if (!m)
+        return fail(i, `unexpected ${what(c)}`);
+      i += m[0].length;
+      expect = "next";
+    }
+  }
+}
+function lineCol(src, at) {
+  let line = 1;
+  let start = 0;
+  for (let k = src.indexOf("\n"); k !== -1 && k < at; k = src.indexOf("\n", k + 1)) {
+    line++;
+    start = k + 1;
+  }
+  return { line, col: at - start + 1 };
+}
+function lintWebhookTemplate(template, opts) {
+  const found = [];
+  const finish = () => {
+    const all = found.map((f, n) => ({ f, n })).sort((a, b) => a.f.at - b.f.at || a.n - b.n).map(({ f }) => entry(template, f));
+    return { errors: all.filter((e) => e.severity === "error"), warnings: all.filter((e) => e.severity === "warning") };
+  };
+  if (template.trim() === "") {
+    found.push({ at: 0, code: "T1", rule: "the template is empty; send null for the standard payload" });
+    return finish();
+  }
+  const bytes = new TextEncoder().encode(template).length;
+  if (bytes > MAX_TEMPLATE_BYTES) {
+    found.push({ at: 0, code: "T10", rule: `the template is ${bytes} bytes; the limit is ${MAX_TEMPLATE_BYTES}` });
+    return finish();
+  }
+  const s = scan(template);
+  let refs = 0;
+  const counted = (at) => {
+    refs += 1;
+    if (refs === MAX_TEMPLATE_REFERENCES + 1)
+      found.push({ at, code: "T10", rule: `the template has more than ${MAX_TEMPLATE_REFERENCES} variables` });
+  };
+  const judge = (at, inner) => {
+    const r = resolve(inner);
+    if (!r.ok) {
+      const raw = inner.trim();
+      const dotless = r.code === "T6" && !raw.includes(".") && /^[A-Za-z0-9_]+$/.test(raw);
+      const extra = dotless && (SCOPES_BY_SOURCE[opts.source] ?? []).includes("contact") ? `{{contact.extra.${raw}}}` : void 0;
+      const near = r.code === "T6" ? candidatesFor(opts.source, raw) : r.candidates ?? [];
+      const candidates = extra ? [extra, ...near.filter((c) => c !== extra)] : near;
+      found.push({ at, code: r.code, rule: r.rule, ...r.token ?? extra ?? candidates[0] ? { token: r.token ?? extra ?? candidates[0] } : {}, ...candidates.length ? { candidates } : {} });
+      return;
+    }
+    if (!scopeOk(opts.source, r)) {
+      found.push({ at, code: "T6", rule: `{{${inner.trim()}}} is not carried by ${opts.source} events` });
+      return;
+    }
+    const key = r.name.startsWith("enrollment.") ? r.name.slice(11) : null;
+    if (key !== null && opts.saved && !opts.saved.has(key))
+      found.push({ at, code: "TW1", rule: `{{${r.name}}}: no current Sequence of this Team saves ${key}`, token: key });
+  };
+  for (const str of s.strings) {
+    const raw = template.slice(str.start + 1, str.end - 1);
+    const base = str.start + 1;
+    for (let from = 0; ; ) {
+      const k = raw.indexOf("{{", from);
+      if (k < 0)
+        break;
+      if (raw[k - 1] === "\\" && raw[k - 2] === "\\") {
+        from = k + 2;
+        continue;
+      }
+      const close = raw.indexOf("}}", k + 2);
+      if (close < 0) {
+        found.push({ at: base + k, code: "T3", rule: "{{ is never closed" });
+        break;
+      }
+      const inner = raw.slice(k + 2, close);
+      counted(base + k);
+      if (str.key) {
+        const leaf = (resolve(inner).ok ? SHORT.get(inner.trim()) ?? inner.trim() : inner.trim()).split(".").pop() || "value";
+        found.push({ at: base + k, code: "T5", rule: `{{${inner.trim()}}} is in an object key`, token: `"${leaf}": "{{${inner.trim()}}}"` });
+      } else
+        judge(base + k, inner);
+      from = close + 2;
+    }
+    if (!str.key) {
+      for (const m of raw.matchAll(/\{([A-Za-z_][A-Za-z0-9_.]*)\}/g)) {
+        const k = m.index;
+        if (raw[k - 1] === "{" || raw[k + m[0].length] === "}")
+          continue;
+        found.push({ at: base + k, code: "T9", rule: `{${m[1]}} is a single-brace placeholder`, token: `{{${m[1]}}}` });
+      }
+    }
+  }
+  for (const b of s.bare) {
+    const inner = template.slice(b.start + 2, b.end - 2).trim();
+    counted(b.start);
+    found.push({ at: b.start, code: "T4", rule: `{{${inner}}} is outside a JSON string`, token: `{{${inner}}}` });
+  }
+  if (s.error)
+    found.push({ at: s.error.at, code: s.error.code, rule: s.error.code === "T3" ? s.error.rule : `not valid JSON: ${s.error.rule}`, ...s.error.token ? { token: s.error.token } : {} });
+  return finish();
+}
+function entry(src, f) {
+  const { line, col } = lineCol(src, f.at);
+  return {
+    path: "body_template",
+    rule: f.rule,
+    code: f.code,
+    message: f.rule,
+    pointer: "/body_template",
+    line,
+    col,
+    hint: RULES[f.code].hint(f.token ?? ""),
+    docs_url: `${BODY_TEMPLATES_DOCS_URL}#${f.code.toLowerCase()}`,
+    severity: f.code === "TW1" ? "warning" : "error",
+    ...f.candidates?.length ? { candidates: f.candidates } : {}
+  };
+}
+var isObj2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var own = (o, k) => isObj2(o) && Object.hasOwn(o, k) ? o[k] : void 0;
+function valueOf(name, ctx) {
+  const [ns, a, ...rest] = name.split(".");
+  let v;
+  if (a === void 0)
+    v = own(ctx, ns);
+  else if (ns === "contact" && a === "extra")
+    v = own(own(ctx.contact, "extra"), rest.join("."));
+  else if (rest.length === 0)
+    v = own(ns === "contact" ? ctx.contact : ns === "account" ? ctx.account : ns === "motion" ? ctx.motion : ns === "enrollment" ? ctx.enrollment : void 0, a);
+  if (typeof v === "string")
+    return v.trim() === "" ? void 0 : v;
+  if (typeof v === "number")
+    return Number.isFinite(v) ? v : void 0;
+  return typeof v === "boolean" ? v : void 0;
+}
+var DROP = /* @__PURE__ */ Symbol("drop");
+var WHOLE = /^\{\{([^{}]*)\}\}$/;
+function renderWebhookTemplate(template, ctx) {
+  const look = (inner) => {
+    const r = resolve(inner);
+    return r.ok ? valueOf(r.name, ctx) : void 0;
+  };
+  const sub = (v) => {
+    if (typeof v === "string") {
+      const whole = WHOLE.exec(v);
+      if (whole)
+        return look(whole[1]) ?? DROP;
+      return v.replace(/\\\{\{|\{\{([^{}]*)\}\}/g, (m, inner) => inner === void 0 ? "{{" : String(look(inner) ?? ""));
+    }
+    if (Array.isArray(v))
+      return v.map(sub).filter((x) => x !== DROP);
+    if (isObj2(v)) {
+      const o = {};
+      for (const [k, x] of Object.entries(v)) {
+        const r = sub(x);
+        if (r !== DROP)
+          o[k] = r;
+      }
+      return o;
+    }
+    return v;
+  };
+  const out = sub(JSON.parse(template));
+  return JSON.stringify(out === DROP ? null : out);
+}
+
+// src/templates.ts
+function validateWebhookTemplate(template, opts) {
+  return lintWebhookTemplate(template, { source: opts.source });
+}
+function renderWebhookTemplate2(template, context) {
+  return renderWebhookTemplate(template, context);
+}
 export {
   Curviate,
   CurviateError,
@@ -8468,6 +10321,8 @@ export {
   constructEvent,
   isCurviateError,
   newStepId,
+  renderWebhookTemplate2 as renderWebhookTemplate,
   step,
-  validateSequence
+  validateSequence,
+  validateWebhookTemplate
 };