@primitivedotdev/sdk 0.12.0 → 0.14.0

package/dist/openapi/openapi.generated.js

@@ -532,8 +532,8 @@ export const openapiDocument = {
         "/emails": {
             "get": {
                 "operationId": "listEmails",
-                "summary": "List emails",
-                "description": "Returns a paginated list of received emails. Supports filtering by\ndomain, status, date range, and free-text search across subject,\nsender, and recipient fields.\n",
+                "summary": "List inbound emails",
+                "description": "Returns a paginated list of INBOUND emails received at your\nverified domains. Outbound messages sent via /send-mail are not\nincluded; this endpoint is the inbox view, not a unified\nsend/receive history.\n\nSupports filtering by domain, status, date range, and free-text\nsearch across subject, sender, and recipient fields.\n",
                 "tags": [
                     "Emails"
                 ],
@@ -1522,6 +1522,53 @@ export const openapiDocument = {
                 }
             }
         },
+        "/send-permissions": {
+            "get": {
+                "operationId": "getSendPermissions",
+                "summary": "List send-permission rules",
+                "description": "Returns a flat list of rules describing every recipient the\ncaller may send to. Each rule has a `type`, a kind-specific\npayload, and a human-readable `description`. If any rule\nmatches the recipient, /send-mail will accept the send under\nthe recipient-scope check.\n\nThe endpoint is the answer to \"where can I send\" without\nexposing internal entitlement names. Agents that don't\nrecognize a `type` can still read the `description` prose\nand act on it.\n\nRule kinds, ordered broadest-first so an agent can stop\nscanning at the first match:\n\n  1. `any_recipient` (one entry, only when the org can send\n     anywhere): every other rule below it is redundant.\n  2. `managed_zone` (always emitted, one per Primitive-managed\n     zone): sends to any address at *.primitive.email or\n     *.email.works always succeed; no entitlement required.\n  3. `your_domain` (one per active verified outbound domain\n     owned by the org): sends to that domain are approved.\n  4. `address` (one per address that has authenticated\n     inbound mail to the org, capped at `meta.address_cap`):\n     sends to that exact address are approved.\n\nThe list is informational, not an authorization check.\n/send-mail remains the source of truth on whether an\nindividual send will succeed (it also enforces the\nfrom-address and the `send_mail` entitlement, which are\nnot recipient-scope concerns and are not represented here).\n",
+                "tags": [
+                    "Sending"
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Send-permission rules for the caller's org",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "allOf": [
+                                        {
+                                            "$ref": "#/components/schemas/SuccessEnvelope"
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "data": {
+                                                    "type": "array",
+                                                    "items": {
+                                                        "$ref": "#/components/schemas/SendPermissionRule"
+                                                    }
+                                                },
+                                                "meta": {
+                                                    "$ref": "#/components/schemas/SendPermissionsMeta"
+                                                }
+                                            },
+                                            "required": [
+                                                "data",
+                                                "meta"
+                                            ]
+                                        }
+                                    ]
+                                }
+                            }
+                        }
+                    },
+                    "401": {
+                        "$ref": "#/components/responses/Unauthorized"
+                    }
+                }
+            }
+        },
         "/send-mail": {
             "post": {
                 "operationId": "sendEmail",
@@ -1600,6 +1647,150 @@ export const openapiDocument = {
                     }
                 }
             }
+        },
+        "/sent-emails": {
+            "get": {
+                "operationId": "listSentEmails",
+                "summary": "List outbound sent emails",
+                "description": "Returns a paginated list of OUTBOUND emails the caller's\norg has sent via /send-mail (and /emails/{id}/reply, which\nforwards through /send-mail). Includes every recorded\nattempt, including gate-denied attempts that the agent\nnever called and rows still in `queued` state.\n\nFor inbound mail received at your verified domains, see\n/emails. There is no unified send/receive history endpoint;\nthe two surfaces are intentionally separate because the\nunderlying tables, statuses, and lifecycle differ.\n\nEmail bodies (`body_text`, `body_html`) are NOT included on\nlist rows so a 50-row page can't balloon into a multi-MB\nresponse when sends are near the 5MB body cap. Use\n/sent-emails/{id} to fetch a single row with bodies, or\ncross-reference by `client_idempotency_key` if the caller\nalready has the body locally.\n",
+                "tags": [
+                    "Sending"
+                ],
+                "parameters": [
+                    {
+                        "$ref": "#/components/parameters/Cursor"
+                    },
+                    {
+                        "$ref": "#/components/parameters/Limit"
+                    },
+                    {
+                        "name": "status",
+                        "in": "query",
+                        "schema": {
+                            "$ref": "#/components/schemas/SentEmailStatus"
+                        },
+                        "description": "Filter to rows in this status. Useful for polling\nqueued rows that haven't transitioned, auditing\ngate-denied attempts, or listing only successful\ndeliveries.\n"
+                    },
+                    {
+                        "name": "request_id",
+                        "in": "query",
+                        "schema": {
+                            "type": "string",
+                            "format": "uuid"
+                        },
+                        "description": "Filter to the row matching a specific server-issued\n`request_id`. The /send-mail response surfaces\n`request_id` on every send; this lookup lets the\ncaller find the historical row for a given live call\nwithout remembering its `id`.\n"
+                    },
+                    {
+                        "name": "idempotency_key",
+                        "in": "query",
+                        "schema": {
+                            "type": "string",
+                            "minLength": 1,
+                            "maxLength": 255
+                        },
+                        "description": "Filter to rows with the given `client_idempotency_key`.\nMultiple rows can share a key (a retry that hit the\nidempotent-replay path returns the same row, but a\nretry with a DIFFERENT canonical payload under the\nsame key is rejected by /send-mail before the row is\nwritten, so duplicates are bounded).\n"
+                    },
+                    {
+                        "name": "date_from",
+                        "in": "query",
+                        "schema": {
+                            "type": "string",
+                            "format": "date-time"
+                        },
+                        "description": "Inclusive lower bound on `created_at`."
+                    },
+                    {
+                        "name": "date_to",
+                        "in": "query",
+                        "schema": {
+                            "type": "string",
+                            "format": "date-time"
+                        },
+                        "description": "Inclusive upper bound on `created_at`."
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Page of sent-email summaries",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "allOf": [
+                                        {
+                                            "$ref": "#/components/schemas/ListEnvelope"
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "data": {
+                                                    "type": "array",
+                                                    "items": {
+                                                        "$ref": "#/components/schemas/SentEmailSummary"
+                                                    }
+                                                }
+                                            }
+                                        }
+                                    ]
+                                }
+                            }
+                        }
+                    },
+                    "400": {
+                        "$ref": "#/components/responses/ValidationError"
+                    },
+                    "401": {
+                        "$ref": "#/components/responses/Unauthorized"
+                    }
+                }
+            }
+        },
+        "/sent-emails/{id}": {
+            "get": {
+                "operationId": "getSentEmail",
+                "summary": "Get a sent email by id",
+                "description": "Returns the full sent-email record by id, including\n`body_text` and `body_html` (omitted from the listing\nendpoint to keep paginated responses small). Use this when\ndiagnosing a specific send, e.g. inspecting the receiver's\nSMTP response on a `bounced` row or pulling the gate\ndenial detail on a `gate_denied` row.\n",
+                "tags": [
+                    "Sending"
+                ],
+                "parameters": [
+                    {
+                        "$ref": "#/components/parameters/ResourceId"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Sent-email detail",
+                        "content": {
+                            "application/json": {
+                                "schema": {
+                                    "allOf": [
+                                        {
+                                            "$ref": "#/components/schemas/SuccessEnvelope"
+                                        },
+                                        {
+                                            "type": "object",
+                                            "properties": {
+                                                "data": {
+                                                    "$ref": "#/components/schemas/SentEmailDetail"
+                                                }
+                                            }
+                                        }
+                                    ]
+                                }
+                            }
+                        }
+                    },
+                    "400": {
+                        "$ref": "#/components/responses/ValidationError"
+                    },
+                    "401": {
+                        "$ref": "#/components/responses/Unauthorized"
+                    },
+                    "404": {
+                        "$ref": "#/components/responses/NotFound"
+                    }
+                }
+            }
         }
     },
     "components": {
@@ -2432,7 +2623,8 @@ export const openapiDocument = {
                         ]
                     },
                     "sender": {
-                        "type": "string"
+                        "type": "string",
+                        "description": "SMTP envelope sender (return-path) the inbound mail server\naccepted. For most legitimate mail this equals the bare\naddress in the From header; for mailing lists, bounce\nhandlers, and forwarders it is typically the bounce address\nrather than the human-visible sender.\n\nFor the parsed From-header value (with display name handling\nand a sender-fallback when the header is unparseable), GET\nthe email by id and use `from_email`.\n"
                     },
                     "recipient": {
                         "type": "string"
@@ -2523,7 +2715,8 @@ export const openapiDocument = {
                         "format": "uuid"
                     },
                     "sender": {
-                        "type": "string"
+                        "type": "string",
+                        "description": "SMTP envelope sender (return-path) the inbound mail server\naccepted. Same value as `smtp_mail_from`; both fields exist\nso protocol-aware tooling can use whichever name it expects.\n\nFor most legitimate mail this equals `from_email`; for\nmailing lists, bounce handlers, and forwarders it is\ntypically the bounce-handling address rather than the\nhuman-visible sender.\n\n**For the canonical \"who sent this email\" value, use\n`from_email`.**\n"
                     },
                     "recipient": {
                         "type": "string"
@@ -2645,7 +2838,8 @@ export const openapiDocument = {
                         "type": [
                             "string",
                             "null"
-                        ]
+                        ],
+                        "description": "SMTP envelope MAIL FROM (return-path), as accepted by the\ninbound mail server. Same value as `sender`; both fields\nexist so protocol-aware tooling can use whichever name it\nexpects.\n\nFor the canonical \"who sent this email\" value (display name\nstripped, From-header preferred), use `from_email`.\n"
                     },
                     "smtp_rcpt_to": {
                         "type": [
@@ -2660,7 +2854,8 @@ export const openapiDocument = {
                         "type": [
                             "string",
                             "null"
-                        ]
+                        ],
+                        "description": "Raw `From:` header from the message body, including any\ndisplay name (e.g. `\"Alice Example\" <alice@example.com>`).\nUse this when you need the display name for rendering.\n\nFor the bare email address (display name stripped), use\n`from_email`.\n"
                     },
                     "content_discarded_at": {
                         "type": [
@@ -2677,7 +2872,7 @@ export const openapiDocument = {
                     },
                     "from_email": {
                         "type": "string",
-                        "description": "Parsed from address (from_header or sender fallback)"
+                        "description": "Bare email address parsed from the `From:` header, with\ndisplay name stripped (e.g. `alice@example.com`). Falls\nback to `sender` (the SMTP envelope MAIL FROM) when the\n`From:` header cannot be parsed.\n\n**This is the canonical \"who sent this email\" field for\nmost use cases**, including comparing against allowlists,\nrouting replies, or displaying the sender to a user. Use\n`from_header` when you specifically need the display name,\nor `sender`/`smtp_mail_from` when you need the SMTP\nenvelope value (e.g. to follow a bounce).\n"
                     },
                     "to_email": {
                         "type": "string",
@@ -2816,10 +3011,12 @@ export const openapiDocument = {
             },
             "SentEmailStatus": {
                 "type": "string",
+                "description": "Lifecycle status of a sent_emails row. Possible values:\n\n  - `queued`: pre-call INSERT; the outbound agent has not\n    yet replied.\n  - `submitted_to_agent`: agent accepted; `queue_id` is set.\n  - `agent_failed`: agent rejected; `error_code` and\n    `error_message` carry the reason.\n  - `gate_denied`: a recipient-scope gate denied the send;\n    the agent was never called. The `gates` array carries\n    the denial detail. /send-mail returns 403 in this case\n    so callers see the denial synchronously; /sent-emails\n    additionally records the row for historical lookup,\n    which is when this status appears in a listing.\n  - `unknown`: terminal indeterminate; the on-box log\n    poller couldn't classify the receiver's response.\n  - `delivered` / `bounced` / `deferred` / `wait_timeout`:\n    terminal delivery outcomes (see DeliveryStatus).\n",
                 "enum": [
                     "queued",
                     "submitted_to_agent",
                     "agent_failed",
+                    "gate_denied",
                     "unknown",
                     "delivered",
                     "bounced",
@@ -2836,6 +3033,217 @@ export const openapiDocument = {
                     "wait_timeout"
                 ]
             },
+            "SentEmailSummary": {
+                "type": "object",
+                "description": "List-row projection of a sent-email record. Drops\n`body_text` and `body_html` to keep paginated responses\nsmall; fetch /sent-emails/{id} for the full record with\nbodies.\n",
+                "properties": {
+                    "id": {
+                        "type": "string",
+                        "format": "uuid"
+                    },
+                    "status": {
+                        "$ref": "#/components/schemas/SentEmailStatus"
+                    },
+                    "status_changed_at": {
+                        "type": "string",
+                        "format": "date-time",
+                        "description": "Timestamp of the most recent status transition.\nPolling clients should treat `status='queued'` AND\n`status_changed_at` older than 5 minutes as\n\"stuck-queued\" (the post-tx UPDATE failed and the\nactual delivery state is recoverable from on-box logs\nvia `queue_id` when populated, or `request_id`).\n"
+                    },
+                    "created_at": {
+                        "type": "string",
+                        "format": "date-time"
+                    },
+                    "updated_at": {
+                        "type": "string",
+                        "format": "date-time"
+                    },
+                    "client_idempotency_key": {
+                        "type": [
+                            "string",
+                            "null"
+                        ],
+                        "description": "Effective idempotency key used for this send. If the\ncaller passed the `Idempotency-Key` header, this is\nthat value; otherwise it's a server-derived hash of\nthe canonical request payload.\n"
+                    },
+                    "content_hash": {
+                        "type": "string",
+                        "description": "Stable hash of the canonical send payload."
+                    },
+                    "from_header": {
+                        "type": "string",
+                        "description": "Raw `From:` header as sent on the wire, including any\ndisplay name (e.g. `\"Acme Support\" <agent@acme.test>`).\n"
+                    },
+                    "from_address": {
+                        "type": "string",
+                        "description": "Bare email address parsed from `from_header`."
+                    },
+                    "to_header": {
+                        "type": "string",
+                        "description": "Raw `To:` header as sent on the wire, including any\ndisplay name.\n"
+                    },
+                    "to_address": {
+                        "type": "string",
+                        "description": "Bare email address parsed from `to_header`."
+                    },
+                    "subject": {
+                        "type": "string"
+                    },
+                    "body_size_bytes": {
+                        "type": "integer",
+                        "description": "Total UTF-8 byte length of `body_text` + `body_html`.\nSurfaced on the list endpoint so callers can see \"this\nrow has a 4MB body\" without fetching it.\n"
+                    },
+                    "content_discarded_at": {
+                        "type": [
+                            "string",
+                            "null"
+                        ],
+                        "format": "date-time",
+                        "description": "Timestamp at which the bodies were discarded by an\nentitlement-driven retention policy. Null when bodies\nare still present. The detail endpoint returns\nnull-valued `body_text`/`body_html` for discarded rows.\n"
+                    },
+                    "message_id": {
+                        "type": [
+                            "string",
+                            "null"
+                        ],
+                        "description": "Wire-level Message-ID assigned to the outbound message\n(RFC 5322). Null on rows that never reached signing\n(queued, gate_denied, agent_failed before signing).\n"
+                    },
+                    "in_reply_to": {
+                        "type": [
+                            "string",
+                            "null"
+                        ],
+                        "description": "Wire-level In-Reply-To header value, when this send\nwas a reply.\n"
+                    },
+                    "email_references": {
+                        "type": [
+                            "string",
+                            "null"
+                        ],
+                        "description": "Wire-level References header value, when this send\nwas a reply.\n"
+                    },
+                    "in_reply_to_email_id": {
+                        "type": [
+                            "string",
+                            "null"
+                        ],
+                        "format": "uuid",
+                        "description": "Reference to the inbound `emails.id` that this send\nreplied to, when known. Populated when the caller used\n/emails/{id}/reply or when /send-mail's `in_reply_to`\nmatched a stored inbound message_id in the same org.\n"
+                    },
+                    "queue_id": {
+                        "type": [
+                            "string",
+                            "null"
+                        ],
+                        "description": "Message identifier assigned by Primitive's outbound\nrelay once the agent accepts the message. Null on\nqueued, gate_denied, and agent_failed rows.\n"
+                    },
+                    "smtp_response_code": {
+                        "type": [
+                            "integer",
+                            "null"
+                        ],
+                        "description": "Receiver's 3-digit SMTP code (e.g. 250, 550, 451).\nPopulated on terminal delivery statuses; may be null\non a deferred where the agent never got an SMTP-level\nresponse (TCP refused, DNS failed, TLS handshake\nfailed). `smtp_response_text` still carries Postfix's\ndescriptive text in those cases.\n"
+                    },
+                    "smtp_response_text": {
+                        "type": [
+                            "string",
+                            "null"
+                        ],
+                        "description": "Free-form text portion of the receiver's SMTP\nresponse. The most useful debugging signal on a\n`bounced` or `deferred` row.\n"
+                    },
+                    "smtp_enhanced_status_code": {
+                        "type": [
+                            "string",
+                            "null"
+                        ],
+                        "description": "RFC 3463 enhanced status code (e.g. `5.1.1` for \"Bad\ndestination mailbox address\"). Distinct from\n`smtp_response_code`: the basic 3-digit code is coarse\n(550 = \"permanent failure\"), the enhanced code is\nfiner-grained.\n"
+                    },
+                    "dkim_selector": {
+                        "type": [
+                            "string",
+                            "null"
+                        ],
+                        "description": "DKIM selector used to sign the outbound message.\nPublic DNS data; useful for diagnosing why a downstream\nverifier rejected the signature.\n"
+                    },
+                    "dkim_domain": {
+                        "type": [
+                            "string",
+                            "null"
+                        ],
+                        "description": "DKIM signing domain."
+                    },
+                    "error_code": {
+                        "type": [
+                            "string",
+                            "null"
+                        ],
+                        "description": "Stable public error code on `agent_failed` rows. The\nagent's internal codes are remapped to a stable public\ntaxonomy (see `publicAgentError` in the server) so this\nfield is safe to branch on across agent versions.\n"
+                    },
+                    "error_message": {
+                        "type": [
+                            "string",
+                            "null"
+                        ],
+                        "description": "Free-form error message accompanying `error_code`."
+                    },
+                    "gates": {
+                        "type": [
+                            "array",
+                            "null"
+                        ],
+                        "items": {
+                            "$ref": "#/components/schemas/GateDenial"
+                        },
+                        "description": "Gate-denial detail on `gate_denied` rows. Mirrors the\nsynchronous /send-mail 403 contract so a caller's\nGateDenial handler is the same across live denies and\nhistorical lookups. Null on every other status.\n"
+                    },
+                    "request_id": {
+                        "type": [
+                            "string",
+                            "null"
+                        ],
+                        "description": "Server-issued request identifier from the original\n/send-mail call. Surfaced as the `X-Request-Id`\nresponse header on the live send and recorded here\nfor support escalation.\n"
+                    }
+                },
+                "required": [
+                    "id",
+                    "status",
+                    "status_changed_at",
+                    "created_at",
+                    "updated_at",
+                    "content_hash",
+                    "from_header",
+                    "from_address",
+                    "to_header",
+                    "to_address",
+                    "subject",
+                    "body_size_bytes"
+                ]
+            },
+            "SentEmailDetail": {
+                "description": "Full sent-email record, including `body_text` and\n`body_html`. Returned by /sent-emails/{id}.\n",
+                "allOf": [
+                    {
+                        "$ref": "#/components/schemas/SentEmailSummary"
+                    },
+                    {
+                        "type": "object",
+                        "properties": {
+                            "body_text": {
+                                "type": [
+                                    "string",
+                                    "null"
+                                ],
+                                "description": "Plain-text body sent on the wire. Null when the\nsend carried only an HTML body, or when bodies have\nbeen discarded post-send (`content_discarded_at`\nset).\n"
+                            },
+                            "body_html": {
+                                "type": [
+                                    "string",
+                                    "null"
+                                ],
+                                "description": "HTML body sent on the wire. Null when the send\ncarried only a plain-text body, or when bodies\nhave been discarded post-send.\n"
+                            }
+                        }
+                    }
+                ]
+            },
             "ReplyInput": {
                 "type": "object",
                 "additionalProperties": false,
@@ -2871,6 +3279,10 @@ export const openapiDocument = {
                     "status": {
                         "$ref": "#/components/schemas/SentEmailStatus"
                     },
+                    "from": {
+                        "type": "string",
+                        "description": "Bare from-address actually written on the wire. Echoed\non every success branch so callers can confirm what\nwent out, particularly useful for the /emails/{id}/reply\npath where `from` is server-derived from the inbound's\nrecipient when the caller doesn't override.\n\nFor sends where the caller passed a from-header that\nincluded a display name (e.g. `\"Acme Support\" <support@acme.test>`),\nthis field is the parsed bare address (`support@acme.test`).\nThe display name was sent on the wire intact; this field\njust makes the address easy to compare against allowlists.\n"
+                    },
                     "queue_id": {
                         "type": [
                             "string",
@@ -2926,6 +3338,7 @@ export const openapiDocument = {
                 "required": [
                     "id",
                     "status",
+                    "from",
                     "queue_id",
                     "accepted",
                     "rejected",
@@ -2935,6 +3348,156 @@ export const openapiDocument = {
                     "idempotent_replay"
                 ]
             },
+            "SendPermissionRule": {
+                "description": "One recipient-scope rule describing a destination the caller\nmay send to. Discriminated on `type`. Each rule carries a\nhuman-prose `description` field intended for display.\n\nRule kinds are stable within an SDK release. A response\ncontaining a `type` value not enumerated in this schema\nmeans the server is running a newer version than the SDK;\nupgrade the SDK to the release that matches the server's\nschema. Strict-parsing SDKs (Go, Python) will raise a\ndecode error in that case rather than silently dropping\nthe unknown rule, since silent drops would let an outbound\nagent reason from an incomplete view of its own permissions.\n",
+                "discriminator": {
+                    "propertyName": "type",
+                    "mapping": {
+                        "any_recipient": "#/components/schemas/SendPermissionAnyRecipient",
+                        "managed_zone": "#/components/schemas/SendPermissionManagedZone",
+                        "your_domain": "#/components/schemas/SendPermissionYourDomain",
+                        "address": "#/components/schemas/SendPermissionAddress"
+                    }
+                },
+                "oneOf": [
+                    {
+                        "$ref": "#/components/schemas/SendPermissionAnyRecipient"
+                    },
+                    {
+                        "$ref": "#/components/schemas/SendPermissionManagedZone"
+                    },
+                    {
+                        "$ref": "#/components/schemas/SendPermissionYourDomain"
+                    },
+                    {
+                        "$ref": "#/components/schemas/SendPermissionAddress"
+                    }
+                ]
+            },
+            "SendPermissionAnyRecipient": {
+                "type": "object",
+                "description": "The caller can send to any recipient. When this rule is\npresent, every other rule in the response is redundant.\n",
+                "properties": {
+                    "type": {
+                        "type": "string",
+                        "enum": [
+                            "any_recipient"
+                        ]
+                    },
+                    "description": {
+                        "type": "string",
+                        "description": "Human-prose summary of the rule."
+                    }
+                },
+                "required": [
+                    "type",
+                    "description"
+                ]
+            },
+            "SendPermissionManagedZone": {
+                "type": "object",
+                "description": "The caller can send to any address at the named\nPrimitive-managed zone. Always emitted (no entitlement\nrequired) because Primitive owns the zone and every mailbox\nbelongs to a Primitive customer by construction.\n",
+                "properties": {
+                    "type": {
+                        "type": "string",
+                        "enum": [
+                            "managed_zone"
+                        ]
+                    },
+                    "zone": {
+                        "type": "string",
+                        "description": "The managed apex domain. Sends are accepted to any\naddress at the apex itself or any subdomain (e.g.\n`alice@primitive.email` and `alice@acme.primitive.email`\nboth match the `primitive.email` zone rule).\n"
+                    },
+                    "description": {
+                        "type": "string",
+                        "description": "Human-prose summary of the rule."
+                    }
+                },
+                "required": [
+                    "type",
+                    "zone",
+                    "description"
+                ]
+            },
+            "SendPermissionYourDomain": {
+                "type": "object",
+                "description": "The caller can send to any address at one of their own\nverified outbound domains. Emitted once per active row in\nthe org's `domains` table.\n",
+                "properties": {
+                    "type": {
+                        "type": "string",
+                        "enum": [
+                            "your_domain"
+                        ]
+                    },
+                    "domain": {
+                        "type": "string",
+                        "description": "A verified outbound domain owned by the caller's org."
+                    },
+                    "description": {
+                        "type": "string",
+                        "description": "Human-prose summary of the rule."
+                    }
+                },
+                "required": [
+                    "type",
+                    "domain",
+                    "description"
+                ]
+            },
+            "SendPermissionAddress": {
+                "type": "object",
+                "description": "The caller can send to a specific address that has\nauthenticated inbound mail to the org. Emitted once per row\nin the org's `known_send_addresses` table, capped at\n`meta.address_cap`.\n",
+                "properties": {
+                    "type": {
+                        "type": "string",
+                        "enum": [
+                            "address"
+                        ]
+                    },
+                    "address": {
+                        "type": "string",
+                        "description": "The bare email address this rule grants sends to."
+                    },
+                    "last_received_at": {
+                        "type": "string",
+                        "format": "date-time",
+                        "description": "Most recent inbound email from this address that\nauthenticated successfully (DMARC pass + DKIM/SPF\nalignment). Updated on each new authenticated receipt.\n"
+                    },
+                    "received_count": {
+                        "type": "integer",
+                        "description": "Total number of authenticated inbound emails from this\naddress. Increments only when `last_received_at` advances.\n"
+                    },
+                    "description": {
+                        "type": "string",
+                        "description": "Human-prose summary of the rule."
+                    }
+                },
+                "required": [
+                    "type",
+                    "address",
+                    "last_received_at",
+                    "received_count",
+                    "description"
+                ]
+            },
+            "SendPermissionsMeta": {
+                "type": "object",
+                "description": "Response metadata for /send-permissions. The `address_cap`\nbounds the size of the `address` rule subset; orgs with more\nthan `address_cap` known addresses almost always also hold a\nbroader rule type (`any_recipient` or `your_domain`), so the\ncap is a response-size bound rather than a meaningful\nproduct limit.\n",
+                "properties": {
+                    "address_cap": {
+                        "type": "integer",
+                        "description": "Maximum number of `address` rules included in `data`."
+                    },
+                    "truncated": {
+                        "type": "boolean",
+                        "description": "True when the org has more than `address_cap` known\naddresses and the list was truncated. False when every\nknown address is represented or when the org holds no\naddress rules at all.\n"
+                    }
+                },
+                "required": [
+                    "address_cap",
+                    "truncated"
+                ]
+            },
             "Endpoint": {
                 "type": "object",
                 "properties": {