@extrovert.dev/sdk 0.1.0-pre.4 → 0.1.0-pre.6

package/README.md

@@ -30,7 +30,7 @@ for a stable release:
 npm install @extrovert.dev/sdk@next
 ```
 
-Pin `@extrovert.dev/sdk@0.1.0-pre.4` when a dogfood test needs a reproducible contract snapshot.
+Pin `@extrovert.dev/sdk@0.1.0-pre.6` when a dogfood test needs a reproducible contract snapshot.
 Requires Node 18+ for global `fetch` and Web Crypto.
 
 ## Build and use from source
@@ -419,6 +419,7 @@ A key carries a subset of these capability scopes (`whoami().scopes`):
 | ----------------- | ---------------------------------------------------------------------- |
 | `mailbox:create`  | Create inboxes.                                                        |
 | `mailbox:read`    | Read inboxes, messages, threads.                                       |
+| `mailbox:credentials` | Export raw IMAP/SMTP credentials on paid plans; never implied by read. |
 | `mailbox:send`    | Send / reply / forward.                                                |
 | `mailbox:quota`   | Change an inbox's effective daily recipient cap (opt-in).              |
 | `mailbox:delete`  | Delete inboxes.                                                        |
@@ -442,7 +443,7 @@ a wire protocol (there is no `/v1/contract` endpoint).
 ```ts
 import { CONTRACT_VERSION, CONTRACT_MANIFEST } from "@extrovert.dev/sdk";
 
-CONTRACT_VERSION;            // "0.1.0-pre.4" — provisional, pre-1.0; pin it
+CONTRACT_VERSION;            // "0.1.0-pre.6" — provisional, pre-1.0; pin it
 CONTRACT_MANIFEST.stability; // "provisional"
 CONTRACT_MANIFEST.core_shapes; // ["ReviewIntent","ReviewFeedback","DiffJson","Rule","ReviewEvent"]
 ```
@@ -463,7 +464,7 @@ page and the agent skills (`extrovert-send-email`, `extrovert-writing-rules`).
 The Review-Loop shapes are an **open, documented contract — versioned *with* this SDK** (not a wire
 protocol; there is no `/v1/contract` endpoint). Three guarantees:
 
-- **One version, everywhere.** `CONTRACT_VERSION` is **`0.1.0-pre.4`**, reconciled across the SDK package
+- **One version, everywhere.** `CONTRACT_VERSION` is **`0.1.0-pre.6`**, reconciled across the SDK package
   version, the MCP server, and the OpenAPI `info.version`. Pin it; pin `CONTRACT_MANIFEST` for the
   exact shape set you built against.
 - **Named, documented types.** The five canonical shapes — `ReviewIntent`, `ReviewFeedback`,
@@ -494,7 +495,7 @@ EXTROVERT_API_BASE_URL=mock npx tsx examples/wait-for-otp.ts
 
 ## Status
 
-> **Note.** This source SDK tracks the `/v1` contract at `CONTRACT_VERSION` `0.1.0-pre.4` — a
+> **Note.** This source SDK tracks the `/v1` contract at `CONTRACT_VERSION` `0.1.0-pre.6` — a
 > deliberate **prerelease**, pre-1.0, expect additive change. The offline `mock` transport models the
 > live server closely enough to reproduce a 422 `intent_required` and a queued review, so build and
 > test against it before you have a key. Install from the `next` tag until a stable release is cut.

package/dist/index.cjs

@@ -268,7 +268,7 @@ var CURRENT_API_VERSION = "2026-06-23";
 var API_VERSION_HEADER = "Extrovert-Version";
 
 // src/http.ts
-var SDK_VERSION = "0.1.0-pre.4";
+var SDK_VERSION = "0.1.0-pre.6";
 function buildUrl(baseUrl, path, query) {
   const base = baseUrl.endsWith("/") ? baseUrl.slice(0, -1) : baseUrl;
   const rel = path.startsWith("/") ? path : `/${path}`;
@@ -625,6 +625,23 @@ function decodeMockCursor(cursor) {
     return 0;
   }
 }
+function mailboxQuickstart(address) {
+  return {
+    inbox: address,
+    list_mail: {
+      tool: "read_messages",
+      arguments: { inbox: address, limit: 20, unread_only: false }
+    },
+    read_message: {
+      tool: "get_message",
+      arguments: { id: "<message_id from read_messages>", format: "text", variant: "extracted" }
+    },
+    wait_for_mail: {
+      tool: "wait_for_email",
+      arguments: { inbox: address, since_now: true }
+    }
+  };
+}
 var SHARED_SUBDOMAIN = "smtp.extrovert.dev";
 var MOCK_ORG_ID = "org_mock";
 var MOCK_PROJECT_ID = "prj_mock";
@@ -935,14 +952,14 @@ var MockBackend = class {
     const customerId = existing?.customerId ?? `cus_pn_signup_${rid("c").slice(2)}`;
     const agentId = existing?.agentId ?? rid("agt");
     const address = existing?.address ?? `${req.username ?? randomHandle()}@smtp.extrovert.dev`;
-    const otp = String(Math.floor(1e5 + Math.random() * 9e5));
+    const otp = "492013";
     this.state.signupByEmail.set(email, { customerId, agentId, address, otp, verified: false });
     return {
       customer_id: customerId,
       agent_id: agentId,
       agent_key: `pk_agent_${agentId.slice(4)}_${rid("sk").slice(3)}`,
       key_prefix: `pk_agent_${agentId.slice(4, 8)}`,
-      scopes: ["mailbox:read"],
+      scopes: ["signup:verify"],
       address,
       verified: false,
       otp_sent_to: email,
@@ -960,8 +977,10 @@ var MockBackend = class {
           agent_key: `pk_agent_${s.agentId.slice(4)}_${rid("sk").slice(3)}`,
           key_prefix: `pk_agent_${s.agentId.slice(4, 8)}`,
           scopes: ["mailbox:create", "mailbox:read", "mailbox:send"],
+          address: s.address,
           verified: true,
-          message: "Verified. Use the new agent_key (full scopes)."
+          message: "Verified. The inbox is ready; use read_messages, then get_message with a returned message id.",
+          mailbox_quickstart: mailboxQuickstart(s.address)
         };
       }
     }
@@ -1971,7 +1990,15 @@ var MockBackend = class {
       category = active.filter((r) => r.scope === "category" && r.category_id === params.category_id).sort(byRank);
     }
     const items = [...category, ...general];
-    return { items, total: items.length };
+    return {
+      items,
+      total: items.length,
+      house_style_version: 1,
+      category_rules_version: params.category_id ? 1 : 0,
+      rule_high_water: params.category_id ? 1 : 0,
+      composition_token: params.scope ? void 0 : `cmp_fixture_${params.category_id ?? "general"}`,
+      composition_token_expires_at: params.scope ? void 0 : new Date(Date.now() + 6e5).toISOString()
+    };
   }
   /** Save / edit a rule (mock) — append-only by supersession (D11). */
   saveRule(req) {
@@ -3579,7 +3606,13 @@ var HttpTransport = class {
     });
   }
   saveRule(req, signal) {
-    return this.call({ method: "PUT", path: "/v1/rules", body: req, signal });
+    return this.call({
+      method: "PUT",
+      path: "/v1/rules",
+      body: withoutIdempotencyKey(req),
+      idempotencyKey: req.idempotency_key,
+      signal
+    });
   }
   promoteRule(ruleId, toScope, signal) {
     return this.call({
@@ -4976,6 +5009,8 @@ var ExtrovertClient = class _ExtrovertClient {
    * + a first inbox and returns a LIMITED-scope (read-only) agent key; a one-time
    * code is emailed to `human_email`. Call {@link verify} with the code to unlock
    * full scopes. Idempotent on `human_email`: re-calling rotates the key + resends.
+   * When free signup is paused, this throws an `ApiError` with status 403 and
+   * code `signup_disabled` without creating account state.
    */
   signUp(req, signal) {
     return this.transport.signUp(req, signal);
@@ -4983,6 +5018,10 @@ var ExtrovertClient = class _ExtrovertClient {
   /**
    * Confirm the emailed signup code and receive a NEW full-scope agent key (shown
    * once). Must be called with the limited key from {@link signUp} as the bearer.
+   * The result repeats the ready inbox address and includes MCP-first list/read/wait
+   * calls; SDK callers can pass `address` directly to `inboxes` and `messages`.
+   * Pending verification is also fail-closed with 403 `signup_disabled` while
+   * free signup is paused.
    */
   verify(req, signal) {
     return this.transport.verify(req, signal);
@@ -5150,7 +5189,7 @@ async function signWebhook(secret, body, timestampSeconds) {
 }
 
 // src/contract.ts
-var CONTRACT_VERSION = "0.1.0-pre.4";
+var CONTRACT_VERSION = "0.1.0-pre.6";
 var CONTRACT_MANIFEST = {
   name: "extrovert.review-loop",
   version: CONTRACT_VERSION,