@primitivedotdev/sdk 1.29.0 → 1.31.0

package/dist/{operations.generated-Dra-xGtu.js → operations.generated-CJVEZJJ2.js}

@@ -112,6 +112,10 @@ const openapiDocument = {
 		{
 			"name": "Registries",
 			"description": "The Agent Registry: ownable directories of agents, addressable by a\nregistry-scoped handle. A registry's publish policy (owner_only, request,\nor open) decides whether a publish lists immediately or pends owner\napproval. An agent is defined once with a globally unique,\nreachability-verified address, then published into any registry under a\nhandle. Discovery reads (list, resolve, get) are public for public\nregistries; managing a registry and moderating requests use the owner's\nAPI key.\n"
+		},
+		{
+			"name": "Contacts",
+			"description": "Organization contacts and per-address agent preferences."
 		}
 	],
 	"paths": {
@@ -1080,7 +1084,7 @@ const openapiDocument = {
 		"/emails/search": { "get": {
 			"operationId": "searchEmails",
 			"summary": "Search inbound emails",
-			"description": "Searches inbound emails with structured filters and optional\nfull-text matching across parsed email fields. This endpoint is\noptimized for filtered inbox views and CLI polling workflows:\ncallers that only need new accepted mail can pass\n`sort=received_at_asc`, `snippet=false`, `include_facets=false`,\nand a `date_from` timestamp.\n\n`q`, `subject`, and `body` use the same English full-text index\nas the web inbox search. Structured filters such as `from`, `to`,\n`domain_id`, status, attachment presence, and spam score bounds\nare combined with the text query.\n",
+			"description": "Searches inbound emails with structured filters and optional\nfull-text matching across parsed email fields. This endpoint is\noptimized for filtered inbox views and CLI polling workflows:\ncallers that only need new accepted mail can pass\n`sort=received_at_asc`, `snippet=false`, `include_facets=false`,\nand a `date_from` timestamp.\n\n`q`, `subject`, and `body` use the same English full-text index\nas the web inbox search. Structured filters such as `from`, `to`,\n`domain_id`, status, attachment presence, and spam score bounds\nare combined with the text query.\n\nConnected-agent credentials search only mail received by their own\naddress. This applies to results, totals, facets, and every page;\nsearch filters cannot widen the credential's scope. When\n`reply_to_sent_email_id` is supplied, its parent send must belong\nto the connected address in the same organization. An unavailable\nparent returns 404. Sender filters are not authentication proof;\ninspect the email detail's authentication evidence before trusting it.\n",
 			"tags": ["Emails"],
 			"parameters": [
 				{
@@ -1253,6 +1257,7 @@ const openapiDocument = {
 				},
 				"400": { "$ref": "#/components/responses/ValidationError" },
 				"401": { "$ref": "#/components/responses/Unauthorized" },
+				"404": { "$ref": "#/components/responses/NotFound" },
 				"504": {
 					"description": "Search query timed out",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
@@ -4258,62 +4263,25 @@ const openapiDocument = {
 					"404": { "$ref": "#/components/responses/NotFound" }
 				}
 			}
-		}
-	},
-	"components": {
-		"securitySchemes": {
-			"BearerAuth": {
-				"type": "http",
-				"scheme": "bearer",
-				"description": "API key with `prim_` prefix: `Authorization: Bearer prim_<key>`"
-			},
-			"DownloadToken": {
-				"type": "apiKey",
-				"in": "query",
-				"name": "token",
-				"description": "Signed download token provided in webhook payloads"
-			}
 		},
-		"parameters": {
-			"AttachmentPartIndex": {
-				"name": "part_index",
-				"in": "path",
-				"required": true,
-				"description": "The attachment metadata `part_index`, not its offset in the attachments array",
-				"schema": {
-					"type": "integer",
-					"format": "int32",
-					"minimum": 0,
-					"maximum": 2147483647
-				}
-			},
-			"ResourceId": {
-				"name": "id",
-				"in": "path",
-				"required": true,
+		"/contacts": { "get": {
+			"operationId": "listContacts",
+			"summary": "list Contacts",
+			"tags": ["Contacts"],
+			"security": [{ "BearerAuth": [] }],
+			"description": "Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.",
+			"parameters": [{
+				"name": "cursor",
+				"in": "query",
 				"schema": {
 					"type": "string",
-					"format": "uuid"
+					"format": "email",
+					"maxLength": 254,
+					"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
 				},
-				"description": "Resource UUID"
-			},
-			"IdempotencyKey": {
-				"name": "idempotency-key",
-				"in": "header",
 				"required": false,
-				"schema": {
-					"type": "string",
-					"maxLength": 255
-				},
-				"description": "Optional idempotency key. Retrying a request with the same key returns\nthe original result instead of repeating the side effect (for\n`createEmailChallenge`, re-sending the email).\n"
-			},
-			"Cursor": {
-				"name": "cursor",
-				"in": "query",
-				"schema": { "type": "string" },
-				"description": "Pagination cursor from a previous response's `meta.cursor` field.\nFormat: `{ISO-datetime}|{id}`\n"
-			},
-			"Limit": {
+				"description": "cursor for contacts."
+			}, {
 				"name": "limit",
 				"in": "query",
 				"schema": {
@@ -4322,126 +4290,1834 @@ const openapiDocument = {
 					"maximum": 100,
 					"default": 50
 				},
-				"description": "Number of results per page"
-			},
-			"MemoryKeyQuery": {
-				"name": "key",
-				"in": "query",
-				"required": true,
-				"description": "Memory key. Must be at most 512 UTF-8 bytes.",
-				"schema": {
-					"type": "string",
-					"minLength": 1,
-					"maxLength": 512
-				}
-			},
-			"MemoryScopeQueryType": {
-				"name": "scope_type",
-				"in": "query",
-				"required": false,
-				"description": "Explicit scope type. Omit to use automatic scope resolution. Pass\n`function` with `scope_id=<function-id>`, or `org` with no `scope_id`.\n",
-				"schema": {
-					"type": "string",
-					"enum": ["org", "function"]
-				}
-			},
-			"MemoryScopeId": {
-				"name": "scope_id",
-				"in": "query",
 				"required": false,
-				"description": "Function id UUID when `scope_type=function`. Not valid with\n`scope_type=org`.\n",
-				"schema": {
-					"type": "string",
-					"format": "uuid"
-				}
-			}
-		},
-		"responses": {
-			"AttachmentPart": {
-				"description": "Original attachment bytes; never a JSON envelope or a base64 string",
-				"content": { "application/octet-stream": { "schema": {
-					"type": "string",
-					"format": "binary"
-				} } },
-				"headers": {
-					"X-Content-SHA256": {
-						"description": "SHA-256 hex digest of the original bytes",
-						"schema": {
-							"type": "string",
-							"pattern": "^[a-fA-F0-9]{64}$"
+				"description": "limit for contacts."
+			}],
+			"responses": {
+				"200": {
+					"description": "Success",
+					"content": { "application/json": { "schema": { "allOf": [{
+						"type": "object",
+						"properties": { "success": {
+							"type": "boolean",
+							"const": true
+						} },
+						"required": [
+							"success",
+							"data",
+							"meta"
+						]
+					}, {
+						"type": "object",
+						"properties": {
+							"data": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"additionalProperties": false,
+									"properties": {
+										"address": {
+											"type": "string",
+											"format": "email",
+											"maxLength": 254,
+											"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+										},
+										"display_name": {
+											"type": ["string", "null"],
+											"maxLength": 200
+										},
+										"version": {
+											"type": "string",
+											"format": "uuid",
+											"description": "Opaque CAS token. Changes on mutations and cannot be reused after deletion/recreation."
+										},
+										"created_at": {
+											"type": "string",
+											"format": "date-time"
+										},
+										"updated_at": {
+											"type": "string",
+											"format": "date-time"
+										}
+									},
+									"required": [
+										"address",
+										"display_name",
+										"version",
+										"created_at",
+										"updated_at"
+									]
+								}
+							},
+							"meta": {
+								"type": "object",
+								"required": ["cursor"],
+								"properties": {
+									"limit": { "type": "integer" },
+									"cursor": { "type": ["string", "null"] }
+								}
+							}
 						}
-					},
-					"Content-Disposition": {
-						"description": "Safe attachment disposition with a sanitized filename",
-						"schema": { "type": "string" }
-					},
-					"Cache-Control": {
-						"description": "Attachment responses are private and must not be stored by caches",
-						"schema": {
-							"type": "string",
-							"example": "private, no-store"
+					}] } } },
+					"headers": {
+						"ratelimit-limit": {
+							"description": "Maximum number of requests allowed in the current window.",
+							"schema": {
+								"type": "integer",
+								"minimum": 1,
+								"example": 120
+							}
+						},
+						"ratelimit-remaining": {
+							"description": "Remaining requests in the current window.",
+							"schema": {
+								"type": "integer",
+								"minimum": 0,
+								"example": 118
+							}
+						},
+						"ratelimit-reset": {
+							"description": "Unix timestamp (seconds) when the current window resets.",
+							"schema": {
+								"type": "integer",
+								"example": 1700000060
+							}
+						},
+						"ratelimit-policy": {
+							"description": "Rate-limit policy in `limit;w=seconds` format, e.g. `120;w=60`.",
+							"schema": {
+								"type": "string",
+								"example": "120;w=60"
+							}
+						},
+						"Cache-Control": {
+							"schema": {
+								"type": "string",
+								"const": "no-store"
+							},
+							"description": "Always fresh policy metadata."
 						}
 					}
-				}
-			},
-			"PullContentGone": {
-				"description": "Queued content is no longer available",
-				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-			},
-			"RequestCanceled": {
-				"description": "Request was canceled",
-				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-			},
-			"PullUnavailable": {
-				"description": "Local receiving is unavailable",
-				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-			},
-			"Unauthorized": {
-				"description": "Invalid or missing API key",
-				"content": { "application/json": {
-					"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-					"example": {
-						"success": false,
-						"error": {
-							"code": "unauthorized",
-							"message": "Invalid or missing API key"
+				},
+				"400": {
+					"description": "Invalid request parameters",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "validation_error",
+								"message": "Invalid domain format"
+							}
 						}
-					}
-				} }
-			},
-			"Forbidden": {
-				"description": "Authenticated caller lacks permission for the operation",
-				"content": { "application/json": {
-					"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-					"example": {
-						"success": false,
-						"error": {
-							"code": "forbidden",
-							"message": "Insufficient permissions"
+					} }
+				},
+				"401": {
+					"description": "Invalid or missing API key",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
+							}
 						}
-					}
-				} }
-			},
-			"NotFound": {
-				"description": "Resource not found",
-				"content": { "application/json": {
-					"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-					"example": {
-						"success": false,
-						"error": {
-							"code": "not_found",
-							"message": "Resource not found"
+					} }
+				},
+				"403": {
+					"description": "Authenticated caller lacks permission for the operation",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "forbidden",
+								"message": "Insufficient permissions"
+							}
 						}
-					}
-				} }
-			},
-			"ValidationError": {
-				"description": "Invalid request parameters",
-				"content": { "application/json": {
-					"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-					"example": {
-						"success": false,
-						"error": {
+					} }
+				},
+				"404": {
+					"description": "Resource not found",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "not_found",
+								"message": "Resource not found"
+							}
+						}
+					} }
+				},
+				"409": {
+					"description": "contact_conflict: write precondition did not match.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"429": {
+					"description": "Rate limit exceeded",
+					"headers": { "Retry-After": {
+						"schema": { "type": "integer" },
+						"description": "Seconds to wait before retrying"
+					} },
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				}
+			}
+		} },
+		"/contacts/{address}": {
+			"get": {
+				"operationId": "getContact",
+				"summary": "get Contact",
+				"tags": ["Contacts"],
+				"security": [{ "BearerAuth": [] }],
+				"description": "Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.",
+				"parameters": [{
+					"name": "address",
+					"in": "path",
+					"schema": {
+						"type": "string",
+						"format": "email",
+						"maxLength": 254,
+						"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+					},
+					"required": true,
+					"description": "address for contacts."
+				}],
+				"responses": {
+					"200": {
+						"description": "Success",
+						"content": { "application/json": { "schema": { "allOf": [{
+							"type": "object",
+							"properties": { "success": {
+								"type": "boolean",
+								"const": true
+							} },
+							"required": ["success", "data"]
+						}, {
+							"type": "object",
+							"properties": { "data": {
+								"type": "object",
+								"additionalProperties": false,
+								"properties": {
+									"address": {
+										"type": "string",
+										"format": "email",
+										"maxLength": 254,
+										"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+									},
+									"display_name": {
+										"type": ["string", "null"],
+										"maxLength": 200
+									},
+									"version": {
+										"type": "string",
+										"format": "uuid",
+										"description": "Opaque CAS token. Changes on mutations and cannot be reused after deletion/recreation."
+									},
+									"created_at": {
+										"type": "string",
+										"format": "date-time"
+									},
+									"updated_at": {
+										"type": "string",
+										"format": "date-time"
+									}
+								},
+								"required": [
+									"address",
+									"display_name",
+									"version",
+									"created_at",
+									"updated_at"
+								]
+							} }
+						}] } } },
+						"headers": {
+							"ratelimit-limit": {
+								"description": "Maximum number of requests allowed in the current window.",
+								"schema": {
+									"type": "integer",
+									"minimum": 1,
+									"example": 120
+								}
+							},
+							"ratelimit-remaining": {
+								"description": "Remaining requests in the current window.",
+								"schema": {
+									"type": "integer",
+									"minimum": 0,
+									"example": 118
+								}
+							},
+							"ratelimit-reset": {
+								"description": "Unix timestamp (seconds) when the current window resets.",
+								"schema": {
+									"type": "integer",
+									"example": 1700000060
+								}
+							},
+							"ratelimit-policy": {
+								"description": "Rate-limit policy in `limit;w=seconds` format, e.g. `120;w=60`.",
+								"schema": {
+									"type": "string",
+									"example": "120;w=60"
+								}
+							},
+							"Cache-Control": {
+								"schema": {
+									"type": "string",
+									"const": "no-store"
+								},
+								"description": "Always fresh policy metadata."
+							}
+						}
+					},
+					"400": {
+						"description": "Invalid request parameters",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "validation_error",
+									"message": "Invalid domain format"
+								}
+							}
+						} }
+					},
+					"401": {
+						"description": "Invalid or missing API key",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "unauthorized",
+									"message": "Invalid or missing API key"
+								}
+							}
+						} }
+					},
+					"403": {
+						"description": "Authenticated caller lacks permission for the operation",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "forbidden",
+									"message": "Insufficient permissions"
+								}
+							}
+						} }
+					},
+					"404": {
+						"description": "Resource not found",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "not_found",
+									"message": "Resource not found"
+								}
+							}
+						} }
+					},
+					"409": {
+						"description": "contact_conflict: write precondition did not match.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"429": {
+						"description": "Rate limit exceeded",
+						"headers": { "Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						} },
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "rate_limit_exceeded",
+									"message": "Rate limit exceeded"
+								}
+							}
+						} }
+					}
+				}
+			},
+			"put": {
+				"operationId": "putContact",
+				"summary": "put Contact",
+				"tags": ["Contacts"],
+				"security": [{ "BearerAuth": [] }],
+				"description": "Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.",
+				"parameters": [{
+					"name": "address",
+					"in": "path",
+					"schema": {
+						"type": "string",
+						"format": "email",
+						"maxLength": 254,
+						"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+					},
+					"required": true,
+					"description": "address for contacts."
+				}],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "oneOf": [{
+						"type": "object",
+						"additionalProperties": false,
+						"properties": {
+							"display_name": {
+								"type": ["string", "null"],
+								"maxLength": 200
+							},
+							"if_absent": {
+								"type": "boolean",
+								"const": true
+							}
+						},
+						"required": ["if_absent"]
+					}, {
+						"type": "object",
+						"additionalProperties": false,
+						"properties": {
+							"display_name": {
+								"type": ["string", "null"],
+								"maxLength": 200
+							},
+							"if_version": {
+								"type": "string",
+								"format": "uuid",
+								"description": "Opaque CAS token. Changes on mutations and cannot be reused after deletion/recreation."
+							}
+						},
+						"required": ["if_version"]
+					}] } } }
+				},
+				"responses": {
+					"200": {
+						"description": "Success",
+						"content": { "application/json": { "schema": { "allOf": [{
+							"type": "object",
+							"properties": { "success": {
+								"type": "boolean",
+								"const": true
+							} },
+							"required": ["success", "data"]
+						}, {
+							"type": "object",
+							"properties": { "data": {
+								"type": "object",
+								"additionalProperties": false,
+								"properties": {
+									"address": {
+										"type": "string",
+										"format": "email",
+										"maxLength": 254,
+										"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+									},
+									"display_name": {
+										"type": ["string", "null"],
+										"maxLength": 200
+									},
+									"version": {
+										"type": "string",
+										"format": "uuid",
+										"description": "Opaque CAS token. Changes on mutations and cannot be reused after deletion/recreation."
+									},
+									"created_at": {
+										"type": "string",
+										"format": "date-time"
+									},
+									"updated_at": {
+										"type": "string",
+										"format": "date-time"
+									}
+								},
+								"required": [
+									"address",
+									"display_name",
+									"version",
+									"created_at",
+									"updated_at"
+								]
+							} }
+						}] } } },
+						"headers": {
+							"ratelimit-limit": {
+								"description": "Maximum number of requests allowed in the current window.",
+								"schema": {
+									"type": "integer",
+									"minimum": 1,
+									"example": 120
+								}
+							},
+							"ratelimit-remaining": {
+								"description": "Remaining requests in the current window.",
+								"schema": {
+									"type": "integer",
+									"minimum": 0,
+									"example": 118
+								}
+							},
+							"ratelimit-reset": {
+								"description": "Unix timestamp (seconds) when the current window resets.",
+								"schema": {
+									"type": "integer",
+									"example": 1700000060
+								}
+							},
+							"ratelimit-policy": {
+								"description": "Rate-limit policy in `limit;w=seconds` format, e.g. `120;w=60`.",
+								"schema": {
+									"type": "string",
+									"example": "120;w=60"
+								}
+							},
+							"Cache-Control": {
+								"schema": {
+									"type": "string",
+									"const": "no-store"
+								},
+								"description": "Always fresh policy metadata."
+							}
+						}
+					},
+					"400": {
+						"description": "Invalid request parameters",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "validation_error",
+									"message": "Invalid domain format"
+								}
+							}
+						} }
+					},
+					"401": {
+						"description": "Invalid or missing API key",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "unauthorized",
+									"message": "Invalid or missing API key"
+								}
+							}
+						} }
+					},
+					"403": {
+						"description": "Authenticated caller lacks permission for the operation",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "forbidden",
+									"message": "Insufficient permissions"
+								}
+							}
+						} }
+					},
+					"404": {
+						"description": "Resource not found",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "not_found",
+									"message": "Resource not found"
+								}
+							}
+						} }
+					},
+					"409": {
+						"description": "contact_conflict: write precondition did not match.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"429": {
+						"description": "Rate limit exceeded",
+						"headers": { "Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						} },
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "rate_limit_exceeded",
+									"message": "Rate limit exceeded"
+								}
+							}
+						} }
+					}
+				}
+			},
+			"delete": {
+				"operationId": "deleteContact",
+				"summary": "delete Contact",
+				"tags": ["Contacts"],
+				"security": [{ "BearerAuth": [] }],
+				"description": "Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.",
+				"parameters": [{
+					"name": "address",
+					"in": "path",
+					"schema": {
+						"type": "string",
+						"format": "email",
+						"maxLength": 254,
+						"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+					},
+					"required": true,
+					"description": "address for contacts."
+				}, {
+					"name": "if_version",
+					"in": "query",
+					"schema": {
+						"type": "string",
+						"format": "uuid",
+						"description": "Opaque CAS token. Changes on mutations and cannot be reused after deletion/recreation."
+					},
+					"required": true,
+					"description": "if_version for contacts."
+				}],
+				"responses": {
+					"200": {
+						"description": "Success",
+						"content": { "application/json": { "schema": { "allOf": [{
+							"type": "object",
+							"properties": { "success": {
+								"type": "boolean",
+								"const": true
+							} },
+							"required": ["success", "data"]
+						}, {
+							"type": "object",
+							"properties": { "data": {
+								"type": "object",
+								"additionalProperties": false,
+								"properties": { "deleted": { "type": "boolean" } },
+								"required": ["deleted"]
+							} }
+						}] } } },
+						"headers": {
+							"ratelimit-limit": {
+								"description": "Maximum number of requests allowed in the current window.",
+								"schema": {
+									"type": "integer",
+									"minimum": 1,
+									"example": 120
+								}
+							},
+							"ratelimit-remaining": {
+								"description": "Remaining requests in the current window.",
+								"schema": {
+									"type": "integer",
+									"minimum": 0,
+									"example": 118
+								}
+							},
+							"ratelimit-reset": {
+								"description": "Unix timestamp (seconds) when the current window resets.",
+								"schema": {
+									"type": "integer",
+									"example": 1700000060
+								}
+							},
+							"ratelimit-policy": {
+								"description": "Rate-limit policy in `limit;w=seconds` format, e.g. `120;w=60`.",
+								"schema": {
+									"type": "string",
+									"example": "120;w=60"
+								}
+							},
+							"Cache-Control": {
+								"schema": {
+									"type": "string",
+									"const": "no-store"
+								},
+								"description": "Always fresh policy metadata."
+							}
+						}
+					},
+					"400": {
+						"description": "Invalid request parameters",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "validation_error",
+									"message": "Invalid domain format"
+								}
+							}
+						} }
+					},
+					"401": {
+						"description": "Invalid or missing API key",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "unauthorized",
+									"message": "Invalid or missing API key"
+								}
+							}
+						} }
+					},
+					"403": {
+						"description": "Authenticated caller lacks permission for the operation",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "forbidden",
+									"message": "Insufficient permissions"
+								}
+							}
+						} }
+					},
+					"404": {
+						"description": "Resource not found",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "not_found",
+									"message": "Resource not found"
+								}
+							}
+						} }
+					},
+					"409": {
+						"description": "contact_conflict: write precondition did not match.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"429": {
+						"description": "Rate limit exceeded",
+						"headers": { "Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						} },
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "rate_limit_exceeded",
+									"message": "Rate limit exceeded"
+								}
+							}
+						} }
+					}
+				}
+			}
+		},
+		"/agent-contacts/{agent_address}": { "get": {
+			"operationId": "listAgentContacts",
+			"summary": "list Agent Contacts",
+			"tags": ["Contacts"],
+			"security": [{ "BearerAuth": [] }],
+			"description": "Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.",
+			"parameters": [
+				{
+					"name": "agent_address",
+					"in": "path",
+					"schema": {
+						"type": "string",
+						"format": "email",
+						"maxLength": 254,
+						"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+					},
+					"required": true,
+					"description": "agent_address for contacts."
+				},
+				{
+					"name": "cursor",
+					"in": "query",
+					"schema": {
+						"type": "string",
+						"format": "email",
+						"maxLength": 254,
+						"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+					},
+					"required": false,
+					"description": "cursor for contacts."
+				},
+				{
+					"name": "limit",
+					"in": "query",
+					"schema": {
+						"type": "integer",
+						"minimum": 1,
+						"maximum": 100,
+						"default": 50
+					},
+					"required": false,
+					"description": "limit for contacts."
+				}
+			],
+			"responses": {
+				"200": {
+					"description": "Success",
+					"content": { "application/json": { "schema": { "allOf": [{
+						"type": "object",
+						"properties": { "success": {
+							"type": "boolean",
+							"const": true
+						} },
+						"required": [
+							"success",
+							"data",
+							"meta"
+						]
+					}, {
+						"type": "object",
+						"properties": {
+							"data": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"additionalProperties": false,
+									"properties": {
+										"agent_address": {
+											"type": "string",
+											"format": "email",
+											"maxLength": 254,
+											"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+										},
+										"contact_address": {
+											"type": "string",
+											"format": "email",
+											"maxLength": 254,
+											"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+										},
+										"purpose": {
+											"type": ["string", "null"],
+											"maxLength": 2e3
+										},
+										"notify": { "type": "boolean" },
+										"notify_since": {
+											"type": ["string", "null"],
+											"format": "date-time"
+										},
+										"notification_generation": {
+											"type": ["string", "null"],
+											"format": "uuid"
+										},
+										"version": {
+											"type": "string",
+											"format": "uuid",
+											"description": "Opaque CAS token. Changes on mutations and cannot be reused after deletion/recreation."
+										},
+										"created_at": {
+											"type": "string",
+											"format": "date-time"
+										},
+										"updated_at": {
+											"type": "string",
+											"format": "date-time"
+										}
+									},
+									"required": [
+										"agent_address",
+										"contact_address",
+										"purpose",
+										"notify",
+										"notify_since",
+										"notification_generation",
+										"version",
+										"created_at",
+										"updated_at"
+									]
+								}
+							},
+							"meta": {
+								"type": "object",
+								"required": ["cursor"],
+								"properties": {
+									"limit": { "type": "integer" },
+									"cursor": { "type": ["string", "null"] }
+								}
+							}
+						}
+					}] } } },
+					"headers": {
+						"ratelimit-limit": {
+							"description": "Maximum number of requests allowed in the current window.",
+							"schema": {
+								"type": "integer",
+								"minimum": 1,
+								"example": 120
+							}
+						},
+						"ratelimit-remaining": {
+							"description": "Remaining requests in the current window.",
+							"schema": {
+								"type": "integer",
+								"minimum": 0,
+								"example": 118
+							}
+						},
+						"ratelimit-reset": {
+							"description": "Unix timestamp (seconds) when the current window resets.",
+							"schema": {
+								"type": "integer",
+								"example": 1700000060
+							}
+						},
+						"ratelimit-policy": {
+							"description": "Rate-limit policy in `limit;w=seconds` format, e.g. `120;w=60`.",
+							"schema": {
+								"type": "string",
+								"example": "120;w=60"
+							}
+						},
+						"Cache-Control": {
+							"schema": {
+								"type": "string",
+								"const": "no-store"
+							},
+							"description": "Always fresh policy metadata."
+						}
+					}
+				},
+				"400": {
+					"description": "Invalid request parameters",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "validation_error",
+								"message": "Invalid domain format"
+							}
+						}
+					} }
+				},
+				"401": {
+					"description": "Invalid or missing API key",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
+							}
+						}
+					} }
+				},
+				"403": {
+					"description": "Authenticated caller lacks permission for the operation",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "forbidden",
+								"message": "Insufficient permissions"
+							}
+						}
+					} }
+				},
+				"404": {
+					"description": "Resource not found",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "not_found",
+								"message": "Resource not found"
+							}
+						}
+					} }
+				},
+				"409": {
+					"description": "contact_conflict: write precondition did not match.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"429": {
+					"description": "Rate limit exceeded",
+					"headers": { "Retry-After": {
+						"schema": { "type": "integer" },
+						"description": "Seconds to wait before retrying"
+					} },
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				}
+			}
+		} },
+		"/agent-contacts/{agent_address}/{contact_address}": {
+			"put": {
+				"operationId": "putAgentContact",
+				"summary": "put Agent Contact",
+				"tags": ["Contacts"],
+				"security": [{ "BearerAuth": [] }],
+				"description": "Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.",
+				"parameters": [{
+					"name": "agent_address",
+					"in": "path",
+					"schema": {
+						"type": "string",
+						"format": "email",
+						"maxLength": 254,
+						"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+					},
+					"required": true,
+					"description": "agent_address for contacts."
+				}, {
+					"name": "contact_address",
+					"in": "path",
+					"schema": {
+						"type": "string",
+						"format": "email",
+						"maxLength": 254,
+						"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+					},
+					"required": true,
+					"description": "contact_address for contacts."
+				}],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "oneOf": [{
+						"type": "object",
+						"additionalProperties": false,
+						"properties": {
+							"purpose": {
+								"type": ["string", "null"],
+								"maxLength": 2e3
+							},
+							"notify": { "type": "boolean" },
+							"if_absent": {
+								"type": "boolean",
+								"const": true
+							}
+						},
+						"required": ["if_absent"]
+					}, {
+						"type": "object",
+						"additionalProperties": false,
+						"properties": {
+							"purpose": {
+								"type": ["string", "null"],
+								"maxLength": 2e3
+							},
+							"notify": { "type": "boolean" },
+							"if_version": {
+								"type": "string",
+								"format": "uuid",
+								"description": "Opaque CAS token. Changes on mutations and cannot be reused after deletion/recreation."
+							}
+						},
+						"required": ["if_version"]
+					}] } } }
+				},
+				"responses": {
+					"200": {
+						"description": "Success",
+						"content": { "application/json": { "schema": { "allOf": [{
+							"type": "object",
+							"properties": { "success": {
+								"type": "boolean",
+								"const": true
+							} },
+							"required": ["success", "data"]
+						}, {
+							"type": "object",
+							"properties": { "data": {
+								"type": "object",
+								"additionalProperties": false,
+								"properties": {
+									"agent_address": {
+										"type": "string",
+										"format": "email",
+										"maxLength": 254,
+										"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+									},
+									"contact_address": {
+										"type": "string",
+										"format": "email",
+										"maxLength": 254,
+										"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+									},
+									"purpose": {
+										"type": ["string", "null"],
+										"maxLength": 2e3
+									},
+									"notify": { "type": "boolean" },
+									"notify_since": {
+										"type": ["string", "null"],
+										"format": "date-time"
+									},
+									"notification_generation": {
+										"type": ["string", "null"],
+										"format": "uuid"
+									},
+									"version": {
+										"type": "string",
+										"format": "uuid",
+										"description": "Opaque CAS token. Changes on mutations and cannot be reused after deletion/recreation."
+									},
+									"created_at": {
+										"type": "string",
+										"format": "date-time"
+									},
+									"updated_at": {
+										"type": "string",
+										"format": "date-time"
+									}
+								},
+								"required": [
+									"agent_address",
+									"contact_address",
+									"purpose",
+									"notify",
+									"notify_since",
+									"notification_generation",
+									"version",
+									"created_at",
+									"updated_at"
+								]
+							} }
+						}] } } },
+						"headers": {
+							"ratelimit-limit": {
+								"description": "Maximum number of requests allowed in the current window.",
+								"schema": {
+									"type": "integer",
+									"minimum": 1,
+									"example": 120
+								}
+							},
+							"ratelimit-remaining": {
+								"description": "Remaining requests in the current window.",
+								"schema": {
+									"type": "integer",
+									"minimum": 0,
+									"example": 118
+								}
+							},
+							"ratelimit-reset": {
+								"description": "Unix timestamp (seconds) when the current window resets.",
+								"schema": {
+									"type": "integer",
+									"example": 1700000060
+								}
+							},
+							"ratelimit-policy": {
+								"description": "Rate-limit policy in `limit;w=seconds` format, e.g. `120;w=60`.",
+								"schema": {
+									"type": "string",
+									"example": "120;w=60"
+								}
+							},
+							"Cache-Control": {
+								"schema": {
+									"type": "string",
+									"const": "no-store"
+								},
+								"description": "Always fresh policy metadata."
+							}
+						}
+					},
+					"400": {
+						"description": "Invalid request parameters",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "validation_error",
+									"message": "Invalid domain format"
+								}
+							}
+						} }
+					},
+					"401": {
+						"description": "Invalid or missing API key",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "unauthorized",
+									"message": "Invalid or missing API key"
+								}
+							}
+						} }
+					},
+					"403": {
+						"description": "Authenticated caller lacks permission for the operation",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "forbidden",
+									"message": "Insufficient permissions"
+								}
+							}
+						} }
+					},
+					"404": {
+						"description": "Resource not found",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "not_found",
+									"message": "Resource not found"
+								}
+							}
+						} }
+					},
+					"409": {
+						"description": "contact_conflict: write precondition did not match.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"429": {
+						"description": "Rate limit exceeded",
+						"headers": { "Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						} },
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "rate_limit_exceeded",
+									"message": "Rate limit exceeded"
+								}
+							}
+						} }
+					}
+				}
+			},
+			"delete": {
+				"operationId": "deleteAgentContact",
+				"summary": "delete Agent Contact",
+				"tags": ["Contacts"],
+				"security": [{ "BearerAuth": [] }],
+				"description": "Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.",
+				"parameters": [
+					{
+						"name": "agent_address",
+						"in": "path",
+						"schema": {
+							"type": "string",
+							"format": "email",
+							"maxLength": 254,
+							"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+						},
+						"required": true,
+						"description": "agent_address for contacts."
+					},
+					{
+						"name": "contact_address",
+						"in": "path",
+						"schema": {
+							"type": "string",
+							"format": "email",
+							"maxLength": 254,
+							"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+						},
+						"required": true,
+						"description": "contact_address for contacts."
+					},
+					{
+						"name": "if_version",
+						"in": "query",
+						"schema": {
+							"type": "string",
+							"format": "uuid",
+							"description": "Opaque CAS token. Changes on mutations and cannot be reused after deletion/recreation."
+						},
+						"required": true,
+						"description": "if_version for contacts."
+					}
+				],
+				"responses": {
+					"200": {
+						"description": "Success",
+						"content": { "application/json": { "schema": { "allOf": [{
+							"type": "object",
+							"properties": { "success": {
+								"type": "boolean",
+								"const": true
+							} },
+							"required": ["success", "data"]
+						}, {
+							"type": "object",
+							"properties": { "data": {
+								"type": "object",
+								"additionalProperties": false,
+								"properties": { "deleted": { "type": "boolean" } },
+								"required": ["deleted"]
+							} }
+						}] } } },
+						"headers": {
+							"ratelimit-limit": {
+								"description": "Maximum number of requests allowed in the current window.",
+								"schema": {
+									"type": "integer",
+									"minimum": 1,
+									"example": 120
+								}
+							},
+							"ratelimit-remaining": {
+								"description": "Remaining requests in the current window.",
+								"schema": {
+									"type": "integer",
+									"minimum": 0,
+									"example": 118
+								}
+							},
+							"ratelimit-reset": {
+								"description": "Unix timestamp (seconds) when the current window resets.",
+								"schema": {
+									"type": "integer",
+									"example": 1700000060
+								}
+							},
+							"ratelimit-policy": {
+								"description": "Rate-limit policy in `limit;w=seconds` format, e.g. `120;w=60`.",
+								"schema": {
+									"type": "string",
+									"example": "120;w=60"
+								}
+							},
+							"Cache-Control": {
+								"schema": {
+									"type": "string",
+									"const": "no-store"
+								},
+								"description": "Always fresh policy metadata."
+							}
+						}
+					},
+					"400": {
+						"description": "Invalid request parameters",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "validation_error",
+									"message": "Invalid domain format"
+								}
+							}
+						} }
+					},
+					"401": {
+						"description": "Invalid or missing API key",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "unauthorized",
+									"message": "Invalid or missing API key"
+								}
+							}
+						} }
+					},
+					"403": {
+						"description": "Authenticated caller lacks permission for the operation",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "forbidden",
+									"message": "Insufficient permissions"
+								}
+							}
+						} }
+					},
+					"404": {
+						"description": "Resource not found",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "not_found",
+									"message": "Resource not found"
+								}
+							}
+						} }
+					},
+					"409": {
+						"description": "contact_conflict: write precondition did not match.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"429": {
+						"description": "Rate limit exceeded",
+						"headers": { "Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						} },
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "rate_limit_exceeded",
+									"message": "Rate limit exceeded"
+								}
+							}
+						} }
+					}
+				}
+			}
+		},
+		"/agent-connections/claim": { "post": {
+			"operationId": "claimAgentConnection",
+			"tags": ["Agent Connections"],
+			"summary": "claim Agent Connection",
+			"description": "Address-bound external runtime pairing. Management operations require an organization owner or admin session or OAuth token; members and organization API keys cannot manage connections. Claim is authorized only by its one-use invitation. Connected means a real challenge was received and a reply sent by the current bound credential was received back. Invitations expire after 15 minutes. Reconnection preserves the address and revokes previous credentials. Status responses contain no credentials. Runtime credentials allow only address-scoped mail operations, organization note reads and own-address note writes. The credential is returned once. If the claim response is lost or the outcome is unknown, request a fresh owner invitation instead of retrying the consumed invitation.",
+			"security": [],
+			"parameters": [{
+				"name": "Idempotency-Key",
+				"in": "header",
+				"required": false,
+				"description": "This header does not enable credential replay for this one-use claim. If the response is lost or the outcome is unknown, request a fresh owner invitation. Do not assume that retrying the same key or payload can recover the returned credential.",
+				"schema": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 255
+				}
+			}],
+			"responses": {
+				"200": {
+					"description": "Success",
+					"headers": { "Cache-Control": {
+						"description": "Credentials and status must not be cached.",
+						"schema": {
+							"type": "string",
+							"const": "no-store"
+						}
+					} },
+					"content": { "application/json": { "schema": {
+						"type": "object",
+						"required": ["success", "data"],
+						"properties": {
+							"success": {
+								"const": true,
+								"type": "boolean"
+							},
+							"data": {
+								"$schema": "https://json-schema.org/draft/2020-12/schema",
+								"type": "object",
+								"properties": {
+									"connection": {
+										"type": "object",
+										"properties": {
+											"address": {
+												"type": "string",
+												"format": "email",
+												"pattern": "^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"name": {
+												"type": "string",
+												"minLength": 1,
+												"maxLength": 80
+											},
+											"owner_address": {
+												"type": "string",
+												"format": "email",
+												"pattern": "^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+											},
+											"status": {
+												"type": "string",
+												"enum": [
+													"pending",
+													"claimed",
+													"connected",
+													"revoked"
+												]
+											},
+											"created_at": {
+												"type": "string",
+												"format": "date-time",
+												"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
+											},
+											"updated_at": {
+												"type": "string",
+												"format": "date-time",
+												"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
+											},
+											"claimed_at": { "anyOf": [{
+												"type": "string",
+												"format": "date-time",
+												"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
+											}, { "type": "null" }] },
+											"verified_at": { "anyOf": [{
+												"type": "string",
+												"format": "date-time",
+												"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
+											}, { "type": "null" }] },
+											"last_seen_at": { "anyOf": [{
+												"type": "string",
+												"format": "date-time",
+												"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
+											}, { "type": "null" }] }
+										},
+										"required": [
+											"address",
+											"name",
+											"owner_address",
+											"status",
+											"created_at",
+											"updated_at",
+											"claimed_at",
+											"verified_at",
+											"last_seen_at"
+										],
+										"additionalProperties": false
+									},
+									"org_id": {
+										"type": "string",
+										"pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
+									},
+									"owner_address": {
+										"type": "string",
+										"format": "email",
+										"pattern": "^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+									},
+									"api_key": { "type": "string" },
+									"api_base_url": {
+										"type": "string",
+										"format": "uri"
+									}
+								},
+								"required": [
+									"connection",
+									"org_id",
+									"owner_address",
+									"api_key",
+									"api_base_url"
+								],
+								"additionalProperties": false
+							}
+						}
+					} } }
+				},
+				"400": {
+					"description": "Invalid request parameters",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "validation_error",
+								"message": "Invalid domain format"
+							}
+						}
+					} }
+				},
+				"401": {
+					"description": "Invalid or missing API key",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
+							}
+						}
+					} }
+				},
+				"403": {
+					"description": "Authenticated caller lacks permission for the operation",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "forbidden",
+								"message": "Insufficient permissions"
+							}
+						}
+					} }
+				},
+				"404": {
+					"description": "Resource not found",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "not_found",
+								"message": "Resource not found"
+							}
+						}
+					} }
+				},
+				"409": {
+					"description": "The request conflicts with the current state of the resource",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "conflict",
+								"message": "settlement already in progress"
+							}
+						}
+					} }
+				},
+				"429": {
+					"description": "Rate limit exceeded",
+					"headers": { "Retry-After": {
+						"schema": { "type": "integer" },
+						"description": "Seconds to wait before retrying"
+					} },
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				}
+			},
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": {
+					"$schema": "https://json-schema.org/draft/2020-12/schema",
+					"type": "object",
+					"properties": { "token": {
+						"type": "string",
+						"minLength": 32,
+						"maxLength": 256
+					} },
+					"required": ["token"],
+					"additionalProperties": false
+				} } }
+			}
+		} }
+	},
+	"components": {
+		"securitySchemes": {
+			"BearerAuth": {
+				"type": "http",
+				"scheme": "bearer",
+				"description": "API key with `prim_` prefix: `Authorization: Bearer prim_<key>`"
+			},
+			"DownloadToken": {
+				"type": "apiKey",
+				"in": "query",
+				"name": "token",
+				"description": "Signed download token provided in webhook payloads"
+			}
+		},
+		"parameters": {
+			"AttachmentPartIndex": {
+				"name": "part_index",
+				"in": "path",
+				"required": true,
+				"description": "The attachment metadata `part_index`, not its offset in the attachments array",
+				"schema": {
+					"type": "integer",
+					"format": "int32",
+					"minimum": 0,
+					"maximum": 2147483647
+				}
+			},
+			"ResourceId": {
+				"name": "id",
+				"in": "path",
+				"required": true,
+				"schema": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"description": "Resource UUID"
+			},
+			"IdempotencyKey": {
+				"name": "idempotency-key",
+				"in": "header",
+				"required": false,
+				"schema": {
+					"type": "string",
+					"maxLength": 255
+				},
+				"description": "Optional idempotency key. Retrying a request with the same key returns\nthe original result instead of repeating the side effect (for\n`createEmailChallenge`, re-sending the email).\n"
+			},
+			"Cursor": {
+				"name": "cursor",
+				"in": "query",
+				"schema": { "type": "string" },
+				"description": "Pagination cursor from a previous response's `meta.cursor` field.\nFormat: `{ISO-datetime}|{id}`\n"
+			},
+			"Limit": {
+				"name": "limit",
+				"in": "query",
+				"schema": {
+					"type": "integer",
+					"minimum": 1,
+					"maximum": 100,
+					"default": 50
+				},
+				"description": "Number of results per page"
+			},
+			"MemoryKeyQuery": {
+				"name": "key",
+				"in": "query",
+				"required": true,
+				"description": "Memory key. Must be at most 512 UTF-8 bytes.",
+				"schema": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 512
+				}
+			},
+			"MemoryScopeQueryType": {
+				"name": "scope_type",
+				"in": "query",
+				"required": false,
+				"description": "Explicit scope type. Omit to use automatic scope resolution. Pass\n`function` with `scope_id=<function-id>`, or `org` with no `scope_id`.\n",
+				"schema": {
+					"type": "string",
+					"enum": ["org", "function"]
+				}
+			},
+			"MemoryScopeId": {
+				"name": "scope_id",
+				"in": "query",
+				"required": false,
+				"description": "Function id UUID when `scope_type=function`. Not valid with\n`scope_type=org`.\n",
+				"schema": {
+					"type": "string",
+					"format": "uuid"
+				}
+			}
+		},
+		"responses": {
+			"AttachmentPart": {
+				"description": "Original attachment bytes; never a JSON envelope or a base64 string",
+				"content": { "application/octet-stream": { "schema": {
+					"type": "string",
+					"format": "binary"
+				} } },
+				"headers": {
+					"X-Content-SHA256": {
+						"description": "SHA-256 hex digest of the original bytes",
+						"schema": {
+							"type": "string",
+							"pattern": "^[a-fA-F0-9]{64}$"
+						}
+					},
+					"Content-Disposition": {
+						"description": "Safe attachment disposition with a sanitized filename",
+						"schema": { "type": "string" }
+					},
+					"Cache-Control": {
+						"description": "Attachment responses are private and must not be stored by caches",
+						"schema": {
+							"type": "string",
+							"example": "private, no-store"
+						}
+					}
+				}
+			},
+			"PullContentGone": {
+				"description": "Queued content is no longer available",
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+			},
+			"RequestCanceled": {
+				"description": "Request was canceled",
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+			},
+			"PullUnavailable": {
+				"description": "Local receiving is unavailable",
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+			},
+			"Unauthorized": {
+				"description": "Invalid or missing API key",
+				"content": { "application/json": {
+					"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+					"example": {
+						"success": false,
+						"error": {
+							"code": "unauthorized",
+							"message": "Invalid or missing API key"
+						}
+					}
+				} }
+			},
+			"Forbidden": {
+				"description": "Authenticated caller lacks permission for the operation",
+				"content": { "application/json": {
+					"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+					"example": {
+						"success": false,
+						"error": {
+							"code": "forbidden",
+							"message": "Insufficient permissions"
+						}
+					}
+				} }
+			},
+			"NotFound": {
+				"description": "Resource not found",
+				"content": { "application/json": {
+					"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+					"example": {
+						"success": false,
+						"error": {
+							"code": "not_found",
+							"message": "Resource not found"
+						}
+					}
+				} }
+			},
+			"ValidationError": {
+				"description": "Invalid request parameters",
+				"content": { "application/json": {
+					"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+					"example": {
+						"success": false,
+						"error": {
 							"code": "validation_error",
 							"message": "Invalid domain format"
 						}
@@ -5472,7 +7148,15 @@ const openapiDocument = {
 									"credit_code_not_eligible",
 									"credit_code_balance_cap",
 									"rate_limited",
-									"service_unavailable"
+									"service_unavailable",
+									"connection_domain_unavailable",
+									"connection_address_unavailable",
+									"connection_owner_address_invalid",
+									"connection_invitation_unavailable",
+									"agent_connection_scope_forbidden",
+									"address_note_conflict",
+									"address_not_controlled",
+									"contact_conflict"
 								]
 							},
 							"message": { "type": "string" },
@@ -11790,15 +13474,228 @@ const operationManifest = [
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
-		"command": "get-account",
-		"description": null,
+		"command": "get-account",
+		"description": null,
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getAccount",
+		"path": "/account",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"email": { "type": "string" },
+				"plan": { "type": "string" },
+				"limits": {
+					"type": "object",
+					"description": "Plan-derived quota limits for an account.",
+					"properties": {
+						"storage_mb": { "type": "number" },
+						"send_per_hour": { "type": "number" },
+						"send_per_day": { "type": "number" },
+						"api_per_minute": { "type": "number" },
+						"webhooks_max_global": { "type": ["number", "null"] },
+						"webhooks_per_domain": { "type": "boolean" },
+						"filters_per_domain": { "type": "boolean" },
+						"spam_thresholds_per_domain": { "type": "boolean" }
+					},
+					"required": [
+						"storage_mb",
+						"send_per_hour",
+						"send_per_day",
+						"api_per_minute",
+						"webhooks_max_global",
+						"webhooks_per_domain",
+						"filters_per_domain",
+						"spam_thresholds_per_domain"
+					]
+				},
+				"entitlements": {
+					"type": "array",
+					"items": { "type": "string" },
+					"description": "Granted org entitlement keys (sorted). A headless caller reads its\ncapabilities here — e.g. an emailless agent seeing only\n[\"send_mail\", \"send_to_known_addresses\"] knows it is reply-only.\n"
+				},
+				"managed_inbox_address": {
+					"type": ["string", "null"],
+					"description": "The managed inbox FQDN to reply as, or null if the org has no managed inbox."
+				},
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"onboarding_completed": { "type": "boolean" },
+				"onboarding_step": { "type": ["string", "null"] },
+				"stripe_subscription_status": { "type": ["string", "null"] },
+				"subscription_current_period_end": {
+					"type": ["string", "null"],
+					"format": "date-time"
+				},
+				"subscription_cancel_at_period_end": { "type": ["boolean", "null"] },
+				"spam_threshold": {
+					"type": ["number", "null"],
+					"minimum": 0,
+					"maximum": 15
+				},
+				"discard_content_on_webhook_confirmed": { "type": "boolean" },
+				"webhook_secret_rotated_at": {
+					"type": ["string", "null"],
+					"format": "date-time"
+				}
+			},
+			"required": [
+				"id",
+				"email",
+				"plan",
+				"limits",
+				"entitlements",
+				"managed_inbox_address",
+				"created_at",
+				"discard_content_on_webhook_confirmed"
+			]
+		},
+		"sdkName": "getAccount",
+		"summary": "Get account info",
+		"tag": "Account",
+		"tagCommand": "account"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-storage-stats",
+		"description": null,
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getStorageStats",
+		"path": "/account/storage",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"used_bytes": {
+					"type": "integer",
+					"description": "Total storage used in bytes"
+				},
+				"used_kb": {
+					"type": "number",
+					"description": "Total storage used in kilobytes (1 decimal)"
+				},
+				"used_mb": {
+					"type": "number",
+					"description": "Total storage used in megabytes (2 decimals)"
+				},
+				"quota_mb": {
+					"type": "number",
+					"description": "Storage quota in megabytes (based on plan)"
+				},
+				"percentage": {
+					"type": "number",
+					"description": "Percentage of quota used (1 decimal)"
+				},
+				"emails_count": {
+					"type": "integer",
+					"description": "Number of stored emails"
+				}
+			},
+			"required": [
+				"used_bytes",
+				"used_kb",
+				"used_mb",
+				"quota_mb",
+				"percentage",
+				"emails_count"
+			]
+		},
+		"sdkName": "getStorageStats",
+		"summary": "Get storage usage",
+		"tag": "Account",
+		"tagCommand": "account"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-webhook-secret",
+		"description": "Returns the webhook signing secret for your account. If no\nsecret exists yet, one is generated automatically on first\naccess.\n\nSigning is account-scoped, not per-endpoint. Every webhook\ndelivery from any of your registered endpoints is signed\nwith this single secret. Rotate via\n`POST /account/webhook-secret/rotate`.\n\n**Secret format**: the returned string looks base64-shaped\n(e.g. `XNHBBW8VqoBjRfNs1tkZj11jTk...`) but is NOT base64.\nUse it AS-IS as a UTF-8 string when computing HMAC over a\ndelivery body. Base64-decoding before HMAC will silently\nproduce mismatched signatures.\n\nSee the API-level \"Webhook signing\" section for the full\nwire format (header name, signed string shape, hash algo,\ntolerance) including a language-agnostic verification\nrecipe.\n",
 		"hasJsonBody": false,
 		"method": "GET",
-		"operationId": "getAccount",
-		"path": "/account",
+		"operationId": "getWebhookSecret",
+		"path": "/account/webhook-secret",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": { "secret": {
+				"type": "string",
+				"description": "The webhook signing secret value"
+			} },
+			"required": ["secret"]
+		},
+		"sdkName": "getWebhookSecret",
+		"summary": "Get webhook signing secret",
+		"tag": "Account",
+		"tagCommand": "account"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "rotate-webhook-secret",
+		"description": "Generates a new webhook signing secret, replacing the current one.\nRate limited to once per 60 minutes.\n",
+		"hasJsonBody": false,
+		"method": "POST",
+		"operationId": "rotateWebhookSecret",
+		"path": "/account/webhook-secret/rotate",
 		"pathParams": [],
 		"queryParams": [],
 		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": { "secret": {
+				"type": "string",
+				"description": "The webhook signing secret value"
+			} },
+			"required": ["secret"]
+		},
+		"sdkName": "rotateWebhookSecret",
+		"summary": "Rotate webhook signing secret",
+		"tag": "Account",
+		"tagCommand": "account"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "update-account",
+		"description": null,
+		"hasJsonBody": true,
+		"method": "PATCH",
+		"operationId": "updateAccount",
+		"path": "/account",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": {
+				"spam_threshold": {
+					"type": ["number", "null"],
+					"minimum": 0,
+					"maximum": 15,
+					"description": "Global spam score threshold (0-15). Emails scoring above this are rejected. Set to null to disable."
+				},
+				"discard_content_on_webhook_confirmed": {
+					"type": "boolean",
+					"description": "Whether to discard email content after the webhook endpoint confirms receipt."
+				}
+			},
+			"minProperties": 1
+		},
 		"responseSchema": {
 			"type": "object",
 			"properties": {
@@ -11808,6 +13705,73 @@ const operationManifest = [
 				},
 				"email": { "type": "string" },
 				"plan": { "type": "string" },
+				"spam_threshold": {
+					"type": ["number", "null"],
+					"minimum": 0,
+					"maximum": 15
+				},
+				"discard_content_on_webhook_confirmed": { "type": "boolean" }
+			},
+			"required": [
+				"id",
+				"email",
+				"plan",
+				"discard_content_on_webhook_confirmed"
+			]
+		},
+		"sdkName": "updateAccount",
+		"summary": "Update account settings",
+		"tag": "Account",
+		"tagCommand": "account"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "create-agent-account",
+		"description": "Creates an emailless agent account without authentication and returns a\none-time API key (prefixed `prim_`) plus a provisioned managed inbox.\nThe account is on the `agent` plan: reply-only (it can send only to\naddresses that have already sent it authenticated mail) with tight send\nlimits. Use the returned `api_key` as a Bearer token on later calls. The\naccount can be upgraded to a full developer account by confirming an\nemail through the claim flow. This endpoint does not require an API key.\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "createAgentAccount",
+		"path": "/agent/accounts",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": {
+				"terms_accepted": {
+					"type": "boolean",
+					"enum": [true],
+					"description": "Must be true to accept the Terms of Service and Privacy Policy."
+				},
+				"device_name": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 80,
+					"description": "Optional label for the device or agent creating the account."
+				}
+			},
+			"required": ["terms_accepted"]
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"api_key": {
+					"type": "string",
+					"description": "One-time API key (prefixed `prim_`). Shown once; store it securely."
+				},
+				"org_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"address": {
+					"type": ["string", "null"],
+					"description": "Provisioned managed inbox FQDN, or null if the inbox publish was deferred."
+				},
+				"plan": {
+					"type": "string",
+					"enum": ["agent"]
+				},
 				"limits": {
 					"type": "object",
 					"description": "Plan-derived quota limits for an account.",
@@ -11832,261 +13796,286 @@ const operationManifest = [
 						"spam_thresholds_per_domain"
 					]
 				},
-				"entitlements": {
-					"type": "array",
-					"items": { "type": "string" },
-					"description": "Granted org entitlement keys (sorted). A headless caller reads its\ncapabilities here — e.g. an emailless agent seeing only\n[\"send_mail\", \"send_to_known_addresses\"] knows it is reply-only.\n"
-				},
-				"managed_inbox_address": {
-					"type": ["string", "null"],
-					"description": "The managed inbox FQDN to reply as, or null if the org has no managed inbox."
-				},
-				"created_at": {
-					"type": "string",
-					"format": "date-time"
-				},
-				"onboarding_completed": { "type": "boolean" },
-				"onboarding_step": { "type": ["string", "null"] },
-				"stripe_subscription_status": { "type": ["string", "null"] },
-				"subscription_current_period_end": {
-					"type": ["string", "null"],
-					"format": "date-time"
-				},
-				"subscription_cancel_at_period_end": { "type": ["boolean", "null"] },
-				"spam_threshold": {
-					"type": ["number", "null"],
-					"minimum": 0,
-					"maximum": 15
-				},
-				"discard_content_on_webhook_confirmed": { "type": "boolean" },
-				"webhook_secret_rotated_at": {
-					"type": ["string", "null"],
-					"format": "date-time"
+				"upgrade": {
+					"type": "object",
+					"description": "In-band pointer to the upgrade path for an agent account.",
+					"properties": {
+						"plan": {
+							"type": "string",
+							"enum": ["developer"]
+						},
+						"description": { "type": "string" },
+						"claim_path": { "type": "string" }
+					},
+					"required": [
+						"plan",
+						"description",
+						"claim_path"
+					]
 				}
 			},
 			"required": [
-				"id",
-				"email",
+				"api_key",
+				"org_id",
+				"address",
 				"plan",
 				"limits",
-				"entitlements",
-				"managed_inbox_address",
-				"created_at",
-				"discard_content_on_webhook_confirmed"
+				"upgrade"
 			]
 		},
-		"sdkName": "getAccount",
-		"summary": "Get account info",
-		"tag": "Account",
-		"tagCommand": "account"
+		"sdkName": "createAgentAccount",
+		"summary": "Create an emailless agent account",
+		"tag": "Agent",
+		"tagCommand": "agent"
 	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
-		"command": "get-storage-stats",
-		"description": null,
-		"hasJsonBody": false,
-		"method": "GET",
-		"operationId": "getStorageStats",
-		"path": "/account/storage",
+		"command": "create-agent-claim-link",
+		"description": "Mints an opaque, single-use link an agent can hand to a human to\ncomplete the email-confirmation upgrade in a browser. Authenticated by\nthe agent's own API key. `claim_url` is null when the API host cannot\nresolve a web origin to build the link.\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "createAgentClaimLink",
+		"path": "/agent/claim/link",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "No fields; an empty object is accepted.",
+			"properties": {}
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"claim_token": { "type": "string" },
+				"claim_url": {
+					"type": ["string", "null"],
+					"description": "Browser URL to hand to a human, or null if no web origin is configured."
+				},
+				"expires_in_seconds": { "type": "integer" }
+			},
+			"required": [
+				"claim_token",
+				"claim_url",
+				"expires_in_seconds"
+			]
+		},
+		"sdkName": "createAgentClaimLink",
+		"summary": "Create a browser claim link",
+		"tag": "Agent",
+		"tagCommand": "agent"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "resend-agent-signup-verification",
+		"description": "Sends a new email verification code for a pending agent signup session.\nThis endpoint does not require an API key.\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "resendAgentSignupVerification",
+		"path": "/agent/signup/resend",
 		"pathParams": [],
 		"queryParams": [],
-		"requestSchema": null,
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": { "signup_token": {
+				"type": "string",
+				"minLength": 1
+			} },
+			"required": ["signup_token"]
+		},
 		"responseSchema": {
 			"type": "object",
 			"properties": {
-				"used_bytes": {
-					"type": "integer",
-					"description": "Total storage used in bytes"
-				},
-				"used_kb": {
-					"type": "number",
-					"description": "Total storage used in kilobytes (1 decimal)"
-				},
-				"used_mb": {
-					"type": "number",
-					"description": "Total storage used in megabytes (2 decimals)"
+				"email": {
+					"type": "string",
+					"format": "email"
 				},
-				"quota_mb": {
-					"type": "number",
-					"description": "Storage quota in megabytes (based on plan)"
+				"expires_in": {
+					"type": "integer",
+					"description": "Seconds until the pending signup expires"
 				},
-				"percentage": {
-					"type": "number",
-					"description": "Percentage of quota used (1 decimal)"
+				"resend_after": {
+					"type": "integer",
+					"description": "Minimum seconds before requesting another verification email"
 				},
-				"emails_count": {
+				"verification_code_length": {
 					"type": "integer",
-					"description": "Number of stored emails"
+					"description": "Number of digits in the emailed verification code"
 				}
 			},
 			"required": [
-				"used_bytes",
-				"used_kb",
-				"used_mb",
-				"quota_mb",
-				"percentage",
-				"emails_count"
+				"email",
+				"expires_in",
+				"resend_after",
+				"verification_code_length"
 			]
 		},
-		"sdkName": "getStorageStats",
-		"summary": "Get storage usage",
-		"tag": "Account",
-		"tagCommand": "account"
+		"sdkName": "resendAgentSignupVerification",
+		"summary": "Resend agent signup verification code",
+		"tag": "Agent",
+		"tagCommand": "agent"
 	},
 	{
 		"binaryResponse": false,
-		"bodyRequired": false,
-		"command": "get-webhook-secret",
-		"description": "Returns the webhook signing secret for your account. If no\nsecret exists yet, one is generated automatically on first\naccess.\n\nSigning is account-scoped, not per-endpoint. Every webhook\ndelivery from any of your registered endpoints is signed\nwith this single secret. Rotate via\n`POST /account/webhook-secret/rotate`.\n\n**Secret format**: the returned string looks base64-shaped\n(e.g. `XNHBBW8VqoBjRfNs1tkZj11jTk...`) but is NOT base64.\nUse it AS-IS as a UTF-8 string when computing HMAC over a\ndelivery body. Base64-decoding before HMAC will silently\nproduce mismatched signatures.\n\nSee the API-level \"Webhook signing\" section for the full\nwire format (header name, signed string shape, hash algo,\ntolerance) including a language-agnostic verification\nrecipe.\n",
-		"hasJsonBody": false,
-		"method": "GET",
-		"operationId": "getWebhookSecret",
-		"path": "/account/webhook-secret",
+		"bodyRequired": true,
+		"command": "start-agent-claim",
+		"description": "Begins upgrading an emailless `agent` account into a full `developer`\naccount by confirming an email address. Authenticated by the agent's own\nAPI key (the org is taken from the credential). Sends a verification\ncode to the supplied email and returns the claim session id plus resend\ntiming. Submit the code to `/agent/claim/verify` to complete the\nupgrade. Confirming an email that already belongs to a Primitive account\nis rejected.\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "startAgentClaim",
+		"path": "/agent/claim/start",
 		"pathParams": [],
 		"queryParams": [],
-		"requestSchema": null,
-		"responseSchema": {
+		"requestSchema": {
 			"type": "object",
-			"properties": { "secret": {
+			"additionalProperties": false,
+			"properties": { "email": {
 				"type": "string",
-				"description": "The webhook signing secret value"
+				"format": "email",
+				"maxLength": 254,
+				"description": "Email to confirm. Must not already belong to a Primitive account."
 			} },
-			"required": ["secret"]
+			"required": ["email"]
 		},
-		"sdkName": "getWebhookSecret",
-		"summary": "Get webhook signing secret",
-		"tag": "Account",
-		"tagCommand": "account"
-	},
-	{
-		"binaryResponse": false,
-		"bodyRequired": false,
-		"command": "rotate-webhook-secret",
-		"description": "Generates a new webhook signing secret, replacing the current one.\nRate limited to once per 60 minutes.\n",
-		"hasJsonBody": false,
-		"method": "POST",
-		"operationId": "rotateWebhookSecret",
-		"path": "/account/webhook-secret/rotate",
-		"pathParams": [],
-		"queryParams": [],
-		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
-			"properties": { "secret": {
-				"type": "string",
-				"description": "The webhook signing secret value"
-			} },
-			"required": ["secret"]
+			"properties": {
+				"claim_session_id": { "type": "string" },
+				"resend_after_seconds": { "type": "integer" },
+				"expires_in_seconds": { "type": "integer" }
+			},
+			"required": [
+				"claim_session_id",
+				"resend_after_seconds",
+				"expires_in_seconds"
+			]
 		},
-		"sdkName": "rotateWebhookSecret",
-		"summary": "Rotate webhook signing secret",
-		"tag": "Account",
-		"tagCommand": "account"
+		"sdkName": "startAgentClaim",
+		"summary": "Start an agent account email claim",
+		"tag": "Agent",
+		"tagCommand": "agent"
 	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": true,
-		"command": "update-account",
-		"description": null,
+		"command": "start-agent-signup",
+		"description": "Starts an agent-native signup session. `signup_code` is optional;\nomit it to sign up without one. The API creates a pending signup\nsession, sends an email verification code, and returns an opaque\nsignup token used by the resend and verify steps. This endpoint\ndoes not require an API key.\n",
 		"hasJsonBody": true,
-		"method": "PATCH",
-		"operationId": "updateAccount",
-		"path": "/account",
+		"method": "POST",
+		"operationId": "startAgentSignup",
+		"path": "/agent/signup/start",
 		"pathParams": [],
 		"queryParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
 			"properties": {
-				"spam_threshold": {
-					"type": ["number", "null"],
-					"minimum": 0,
-					"maximum": 15,
-					"description": "Global spam score threshold (0-15). Emails scoring above this are rejected. Set to null to disable."
+				"email": {
+					"type": "string",
+					"format": "email",
+					"maxLength": 254
 				},
-				"discard_content_on_webhook_confirmed": {
+				"signup_code": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 128,
+					"description": "Optional signup code. Omit if you do not have one."
+				},
+				"terms_accepted": {
 					"type": "boolean",
-					"description": "Whether to discard email content after the webhook endpoint confirms receipt."
+					"const": true,
+					"description": "Must be true to confirm acceptance of Primitive's Terms of Service and Privacy Policy"
+				},
+				"device_name": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 80,
+					"description": "Human-readable device name used for the created agent OAuth session"
+				},
+				"metadata": {
+					"type": "object",
+					"additionalProperties": true,
+					"description": "Optional client metadata stored with the signup session; serialized JSON must be 2048 bytes or fewer"
 				}
 			},
-			"minProperties": 1
+			"required": ["email", "terms_accepted"]
 		},
 		"responseSchema": {
 			"type": "object",
 			"properties": {
-				"id": {
+				"signup_token": {
 					"type": "string",
-					"format": "uuid"
+					"description": "Opaque token used to verify or resend the pending agent signup"
 				},
-				"email": { "type": "string" },
-				"plan": { "type": "string" },
-				"spam_threshold": {
-					"type": ["number", "null"],
-					"minimum": 0,
-					"maximum": 15
+				"email": {
+					"type": "string",
+					"format": "email"
 				},
-				"discard_content_on_webhook_confirmed": { "type": "boolean" }
+				"expires_in": {
+					"type": "integer",
+					"description": "Seconds until the pending signup expires"
+				},
+				"resend_after": {
+					"type": "integer",
+					"description": "Minimum seconds before requesting another verification email"
+				},
+				"verification_code_length": {
+					"type": "integer",
+					"description": "Number of digits in the emailed verification code"
+				}
 			},
 			"required": [
-				"id",
+				"signup_token",
 				"email",
-				"plan",
-				"discard_content_on_webhook_confirmed"
+				"expires_in",
+				"resend_after",
+				"verification_code_length"
 			]
 		},
-		"sdkName": "updateAccount",
-		"summary": "Update account settings",
-		"tag": "Account",
-		"tagCommand": "account"
+		"sdkName": "startAgentSignup",
+		"summary": "Start agent account signup",
+		"tag": "Agent",
+		"tagCommand": "agent"
 	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": true,
-		"command": "create-agent-account",
-		"description": "Creates an emailless agent account without authentication and returns a\none-time API key (prefixed `prim_`) plus a provisioned managed inbox.\nThe account is on the `agent` plan: reply-only (it can send only to\naddresses that have already sent it authenticated mail) with tight send\nlimits. Use the returned `api_key` as a Bearer token on later calls. The\naccount can be upgraded to a full developer account by confirming an\nemail through the claim flow. This endpoint does not require an API key.\n",
+		"command": "verify-agent-claim",
+		"description": "Confirms the verification code emailed by `/agent/claim/start` and\nupgrades the account to the `developer` plan. The org id, API key, and\nmanaged inbox all carry over; the send cap lifts. Authenticated by the\nagent's own API key.\n",
 		"hasJsonBody": true,
 		"method": "POST",
-		"operationId": "createAgentAccount",
-		"path": "/agent/accounts",
+		"operationId": "verifyAgentClaim",
+		"path": "/agent/claim/verify",
 		"pathParams": [],
 		"queryParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
-			"properties": {
-				"terms_accepted": {
-					"type": "boolean",
-					"enum": [true],
-					"description": "Must be true to accept the Terms of Service and Privacy Policy."
-				},
-				"device_name": {
-					"type": "string",
-					"minLength": 1,
-					"maxLength": 80,
-					"description": "Optional label for the device or agent creating the account."
-				}
-			},
-			"required": ["terms_accepted"]
+			"properties": { "verification_code": {
+				"type": "string",
+				"minLength": 1,
+				"maxLength": 32,
+				"description": "The verification code emailed by the claim start step."
+			} },
+			"required": ["verification_code"]
 		},
 		"responseSchema": {
 			"type": "object",
 			"properties": {
-				"api_key": {
-					"type": "string",
-					"description": "One-time API key (prefixed `prim_`). Shown once; store it securely."
-				},
 				"org_id": {
 					"type": "string",
-					"format": "uuid"
-				},
-				"address": {
-					"type": ["string", "null"],
-					"description": "Provisioned managed inbox FQDN, or null if the inbox publish was deferred."
+					"format": "uuid"
 				},
 				"plan": {
 					"type": "string",
-					"enum": ["agent"]
+					"enum": ["developer"]
+				},
+				"email": {
+					"type": "string",
+					"format": "email"
 				},
 				"limits": {
 					"type": "object",
@@ -12111,545 +14100,675 @@ const operationManifest = [
 						"filters_per_domain",
 						"spam_thresholds_per_domain"
 					]
-				},
-				"upgrade": {
-					"type": "object",
-					"description": "In-band pointer to the upgrade path for an agent account.",
-					"properties": {
-						"plan": {
-							"type": "string",
-							"enum": ["developer"]
-						},
-						"description": { "type": "string" },
-						"claim_path": { "type": "string" }
-					},
-					"required": [
-						"plan",
-						"description",
-						"claim_path"
-					]
 				}
 			},
 			"required": [
-				"api_key",
 				"org_id",
-				"address",
 				"plan",
-				"limits",
-				"upgrade"
+				"email",
+				"limits"
 			]
 		},
-		"sdkName": "createAgentAccount",
-		"summary": "Create an emailless agent account",
+		"sdkName": "verifyAgentClaim",
+		"summary": "Verify an agent account email claim",
 		"tag": "Agent",
 		"tagCommand": "agent"
 	},
 	{
 		"binaryResponse": false,
-		"bodyRequired": false,
-		"command": "create-agent-claim-link",
-		"description": "Mints an opaque, single-use link an agent can hand to a human to\ncomplete the email-confirmation upgrade in a browser. Authenticated by\nthe agent's own API key. `claim_url` is null when the API host cannot\nresolve a web origin to build the link.\n",
+		"bodyRequired": true,
+		"command": "verify-agent-signup",
+		"description": "Verifies the email code for an agent signup session and creates\nthe account when needed. When the session was started with a\n`signup_code`, the reserved code is redeemed; sessions started\nwithout a code skip the redemption step. An org-scoped OAuth\nsession for CLI authentication is minted and the raw tokens are\nreturned exactly once. For existing users, the optional `org_id`\nselects which accessible workspace should receive the new\nsession (no signup-code redemption is performed for existing\nusers regardless of how the session was started).\n",
 		"hasJsonBody": true,
 		"method": "POST",
-		"operationId": "createAgentClaimLink",
-		"path": "/agent/claim/link",
+		"operationId": "verifyAgentSignup",
+		"path": "/agent/signup/verify",
 		"pathParams": [],
 		"queryParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
-			"description": "No fields; an empty object is accepted.",
-			"properties": {}
+			"properties": {
+				"signup_token": {
+					"type": "string",
+					"minLength": 1
+				},
+				"verification_code": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 32
+				},
+				"org_id": {
+					"type": "string",
+					"format": "uuid",
+					"description": "Optional workspace id to target when the verified email already belongs to multiple workspaces"
+				}
+			},
+			"required": ["signup_token", "verification_code"]
 		},
 		"responseSchema": {
 			"type": "object",
 			"properties": {
-				"claim_token": { "type": "string" },
-				"claim_url": {
-					"type": ["string", "null"],
-					"description": "Browser URL to hand to a human, or null if no web origin is configured."
+				"api_key": {
+					"type": "string",
+					"description": "Legacy alias for access_token. New CLI builds should persist access_token and refresh_token."
 				},
-				"expires_in_seconds": { "type": "integer" }
+				"key_id": {
+					"type": "string",
+					"format": "uuid",
+					"description": "Legacy alias for oauth_grant_id"
+				},
+				"key_prefix": {
+					"type": "string",
+					"description": "Legacy display prefix derived from access_token"
+				},
+				"access_token": {
+					"type": "string",
+					"description": "OAuth access token for CLI API authentication"
+				},
+				"refresh_token": {
+					"type": "string",
+					"description": "OAuth refresh token used by the CLI to renew access"
+				},
+				"token_type": {
+					"type": "string",
+					"enum": ["Bearer"]
+				},
+				"expires_in": {
+					"type": "integer",
+					"description": "Seconds until access_token expires"
+				},
+				"auth_method": {
+					"type": "string",
+					"enum": ["oauth"]
+				},
+				"oauth_grant_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"oauth_client_id": { "type": "string" },
+				"org_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"org_name": { "type": ["string", "null"] },
+				"orgs": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"name": { "type": ["string", "null"] }
+						},
+						"required": ["id", "name"]
+					},
+					"description": "Workspaces available to the verified email. The minted session targets `org_id`."
+				}
 			},
 			"required": [
-				"claim_token",
-				"claim_url",
-				"expires_in_seconds"
+				"api_key",
+				"key_id",
+				"key_prefix",
+				"access_token",
+				"refresh_token",
+				"token_type",
+				"expires_in",
+				"auth_method",
+				"oauth_grant_id",
+				"oauth_client_id",
+				"org_id",
+				"org_name",
+				"orgs"
 			]
 		},
-		"sdkName": "createAgentClaimLink",
-		"summary": "Create a browser claim link",
+		"sdkName": "verifyAgentSignup",
+		"summary": "Verify agent signup and create OAuth tokens",
 		"tag": "Agent",
 		"tagCommand": "agent"
 	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": true,
-		"command": "resend-agent-signup-verification",
-		"description": "Sends a new email verification code for a pending agent signup session.\nThis endpoint does not require an API key.\n",
+		"command": "claim-agent-connection",
+		"description": "Address-bound external runtime pairing. Management operations require an organization owner or admin session or OAuth token; members and organization API keys cannot manage connections. Claim is authorized only by its one-use invitation. Connected means a real challenge was received and a reply sent by the current bound credential was received back. Invitations expire after 15 minutes. Reconnection preserves the address and revokes previous credentials. Status responses contain no credentials. Runtime credentials allow only address-scoped mail operations, organization note reads and own-address note writes. The credential is returned once. If the claim response is lost or the outcome is unknown, request a fresh owner invitation instead of retrying the consumed invitation.",
 		"hasJsonBody": true,
 		"method": "POST",
-		"operationId": "resendAgentSignupVerification",
-		"path": "/agent/signup/resend",
+		"operationId": "claimAgentConnection",
+		"path": "/agent-connections/claim",
 		"pathParams": [],
 		"queryParams": [],
 		"requestSchema": {
+			"$schema": "https://json-schema.org/draft/2020-12/schema",
 			"type": "object",
-			"additionalProperties": false,
-			"properties": { "signup_token": {
+			"properties": { "token": {
 				"type": "string",
-				"minLength": 1
+				"minLength": 32,
+				"maxLength": 256
 			} },
-			"required": ["signup_token"]
+			"required": ["token"],
+			"additionalProperties": false
 		},
 		"responseSchema": {
 			"type": "object",
+			"required": ["success", "data"],
 			"properties": {
-				"email": {
-					"type": "string",
-					"format": "email"
-				},
-				"expires_in": {
-					"type": "integer",
-					"description": "Seconds until the pending signup expires"
+				"success": {
+					"const": true,
+					"type": "boolean"
 				},
-				"resend_after": {
-					"type": "integer",
-					"description": "Minimum seconds before requesting another verification email"
+				"data": {
+					"$schema": "https://json-schema.org/draft/2020-12/schema",
+					"type": "object",
+					"properties": {
+						"connection": {
+							"type": "object",
+							"properties": {
+								"address": {
+									"type": "string",
+									"format": "email",
+									"pattern": "^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+								},
+								"name": {
+									"type": "string",
+									"minLength": 1,
+									"maxLength": 80
+								},
+								"owner_address": {
+									"type": "string",
+									"format": "email",
+									"pattern": "^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+								},
+								"status": {
+									"type": "string",
+									"enum": [
+										"pending",
+										"claimed",
+										"connected",
+										"revoked"
+									]
+								},
+								"created_at": {
+									"type": "string",
+									"format": "date-time",
+									"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
+								},
+								"updated_at": {
+									"type": "string",
+									"format": "date-time",
+									"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
+								},
+								"claimed_at": { "anyOf": [{
+									"type": "string",
+									"format": "date-time",
+									"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
+								}, { "type": "null" }] },
+								"verified_at": { "anyOf": [{
+									"type": "string",
+									"format": "date-time",
+									"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
+								}, { "type": "null" }] },
+								"last_seen_at": { "anyOf": [{
+									"type": "string",
+									"format": "date-time",
+									"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
+								}, { "type": "null" }] }
+							},
+							"required": [
+								"address",
+								"name",
+								"owner_address",
+								"status",
+								"created_at",
+								"updated_at",
+								"claimed_at",
+								"verified_at",
+								"last_seen_at"
+							],
+							"additionalProperties": false
+						},
+						"org_id": {
+							"type": "string",
+							"pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
+						},
+						"owner_address": {
+							"type": "string",
+							"format": "email",
+							"pattern": "^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$"
+						},
+						"api_key": { "type": "string" },
+						"api_base_url": {
+							"type": "string",
+							"format": "uri"
+						}
+					},
+					"required": [
+						"connection",
+						"org_id",
+						"owner_address",
+						"api_key",
+						"api_base_url"
+					],
+					"additionalProperties": false
+				}
+			}
+		},
+		"sdkName": "claimAgentConnection",
+		"summary": "claim Agent Connection",
+		"tag": "Agent Connections",
+		"tagCommand": "agent-connections"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "remove-agent-connection",
+		"description": "Permanently removes a revoked connection record. Requires an organization\nowner or admin session or OAuth token; organization API keys are denied.\nDisconnect first using DELETE /agent-connections/{address}. An active\nconnection returns 409 connection_not_revoked. Missing or already removed\nrecords return 404. Mail, address notes, domains and external runtimes are\npreserved. The same address can be paired again with a new invitation;\nold credentials and invitations remain invalid.\n",
+		"hasJsonBody": false,
+		"method": "POST",
+		"operationId": "removeAgentConnection",
+		"path": "/agent-connections/{address}/remove",
+		"pathParams": [{
+			"description": "The email address identifying the revoked connection.",
+			"enum": null,
+			"name": "address",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"required": ["success", "data"],
+			"properties": {
+				"success": {
+					"type": "boolean",
+					"const": true
 				},
-				"verification_code_length": {
-					"type": "integer",
-					"description": "Number of digits in the emailed verification code"
+				"data": {
+					"type": "object",
+					"required": ["deleted"],
+					"properties": { "deleted": {
+						"type": "boolean",
+						"const": true
+					} }
 				}
-			},
-			"required": [
-				"email",
-				"expires_in",
-				"resend_after",
-				"verification_code_length"
-			]
+			}
 		},
-		"sdkName": "resendAgentSignupVerification",
-		"summary": "Resend agent signup verification code",
-		"tag": "Agent",
-		"tagCommand": "agent"
+		"sdkName": "removeAgentConnection",
+		"summary": "Remove a revoked agent connection",
+		"tag": "Agent Connections",
+		"tagCommand": "agent-connections"
 	},
 	{
 		"binaryResponse": false,
-		"bodyRequired": true,
-		"command": "start-agent-claim",
-		"description": "Begins upgrading an emailless `agent` account into a full `developer`\naccount by confirming an email address. Authenticated by the agent's own\nAPI key (the org is taken from the credential). Sends a verification\ncode to the supplied email and returns the claim session id plus resend\ntiming. Submit the code to `/agent/claim/verify` to complete the\nupgrade. Confirming an email that already belongs to a Primitive account\nis rejected.\n",
+		"bodyRequired": false,
+		"command": "cli-logout",
+		"description": "Revokes the OAuth grant used to authenticate the request. API-key\nauthenticated legacy logout requests succeed without deleting server API\nkeys so old local CLI state can be cleared safely.\n",
 		"hasJsonBody": true,
 		"method": "POST",
-		"operationId": "startAgentClaim",
-		"path": "/agent/claim/start",
+		"operationId": "cliLogout",
+		"path": "/cli/logout",
 		"pathParams": [],
 		"queryParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
-			"properties": { "email": {
+			"properties": { "key_id": {
 				"type": "string",
-				"format": "email",
-				"maxLength": 254,
-				"description": "Email to confirm. Must not already belong to a Primitive account."
-			} },
-			"required": ["email"]
+				"format": "uuid",
+				"description": "Optional id guard; when provided it must match the authenticated OAuth grant id or API key id"
+			} }
 		},
 		"responseSchema": {
 			"type": "object",
 			"properties": {
-				"claim_session_id": { "type": "string" },
-				"resend_after_seconds": { "type": "integer" },
-				"expires_in_seconds": { "type": "integer" }
+				"revoked": {
+					"type": "boolean",
+					"description": "True when an OAuth grant was revoked. False for API-key-authenticated legacy logout, which only clears local CLI state."
+				},
+				"key_id": {
+					"type": "string",
+					"format": "uuid",
+					"description": "API key id for API-key-authenticated legacy logout"
+				},
+				"oauth_grant_id": {
+					"type": "string",
+					"format": "uuid",
+					"description": "OAuth grant id revoked by OAuth-authenticated logout"
+				}
 			},
-			"required": [
-				"claim_session_id",
-				"resend_after_seconds",
-				"expires_in_seconds"
-			]
+			"required": ["revoked"]
 		},
-		"sdkName": "startAgentClaim",
-		"summary": "Start an agent account email claim",
-		"tag": "Agent",
-		"tagCommand": "agent"
+		"sdkName": "cliLogout",
+		"summary": "Revoke the current CLI OAuth session",
+		"tag": "CLI",
+		"tagCommand": "cli"
 	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": true,
-		"command": "start-agent-signup",
-		"description": "Starts an agent-native signup session. `signup_code` is optional;\nomit it to sign up without one. The API creates a pending signup\nsession, sends an email verification code, and returns an opaque\nsignup token used by the resend and verify steps. This endpoint\ndoes not require an API key.\n",
+		"command": "poll-cli-login",
+		"description": "Polls a CLI login session until the browser approval either succeeds,\nis denied, expires, or is polled too quickly. The OAuth token set is\ncreated only after approval and is returned exactly once.\n",
 		"hasJsonBody": true,
 		"method": "POST",
-		"operationId": "startAgentSignup",
-		"path": "/agent/signup/start",
+		"operationId": "pollCliLogin",
+		"path": "/cli/login/poll",
 		"pathParams": [],
 		"queryParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
+			"properties": { "device_code": {
+				"type": "string",
+				"minLength": 1
+			} },
+			"required": ["device_code"]
+		},
+		"responseSchema": {
+			"type": "object",
 			"properties": {
-				"email": {
+				"api_key": {
 					"type": "string",
-					"format": "email",
-					"maxLength": 254
+					"description": "Legacy alias for access_token. New CLI builds should persist access_token and refresh_token."
 				},
-				"signup_code": {
+				"key_id": {
 					"type": "string",
-					"minLength": 1,
-					"maxLength": 128,
-					"description": "Optional signup code. Omit if you do not have one."
+					"format": "uuid",
+					"description": "Legacy alias for oauth_grant_id"
 				},
-				"terms_accepted": {
-					"type": "boolean",
-					"const": true,
-					"description": "Must be true to confirm acceptance of Primitive's Terms of Service and Privacy Policy"
+				"key_prefix": {
+					"type": "string",
+					"description": "Legacy display prefix derived from access_token"
 				},
-				"device_name": {
+				"access_token": {
 					"type": "string",
-					"minLength": 1,
-					"maxLength": 80,
-					"description": "Human-readable device name used for the created agent OAuth session"
+					"description": "OAuth access token for CLI API authentication"
 				},
-				"metadata": {
-					"type": "object",
-					"additionalProperties": true,
-					"description": "Optional client metadata stored with the signup session; serialized JSON must be 2048 bytes or fewer"
-				}
-			},
-			"required": ["email", "terms_accepted"]
-		},
-		"responseSchema": {
-			"type": "object",
-			"properties": {
-				"signup_token": {
+				"refresh_token": {
 					"type": "string",
-					"description": "Opaque token used to verify or resend the pending agent signup"
+					"description": "OAuth refresh token used by the CLI to renew access"
 				},
-				"email": {
+				"token_type": {
 					"type": "string",
-					"format": "email"
+					"enum": ["Bearer"]
 				},
 				"expires_in": {
 					"type": "integer",
-					"description": "Seconds until the pending signup expires"
+					"description": "Seconds until access_token expires"
 				},
-				"resend_after": {
-					"type": "integer",
-					"description": "Minimum seconds before requesting another verification email"
+				"auth_method": {
+					"type": "string",
+					"enum": ["oauth"]
 				},
-				"verification_code_length": {
-					"type": "integer",
-					"description": "Number of digits in the emailed verification code"
-				}
+				"oauth_grant_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"oauth_client_id": { "type": "string" },
+				"org_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"org_name": { "type": ["string", "null"] }
 			},
 			"required": [
-				"signup_token",
-				"email",
+				"api_key",
+				"key_id",
+				"key_prefix",
+				"access_token",
+				"refresh_token",
+				"token_type",
 				"expires_in",
-				"resend_after",
-				"verification_code_length"
+				"auth_method",
+				"oauth_grant_id",
+				"oauth_client_id",
+				"org_id",
+				"org_name"
 			]
 		},
-		"sdkName": "startAgentSignup",
-		"summary": "Start agent account signup",
-		"tag": "Agent",
-		"tagCommand": "agent"
+		"sdkName": "pollCliLogin",
+		"summary": "Poll CLI browser login",
+		"tag": "CLI",
+		"tagCommand": "cli"
 	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": true,
-		"command": "verify-agent-claim",
-		"description": "Confirms the verification code emailed by `/agent/claim/start` and\nupgrades the account to the `developer` plan. The org id, API key, and\nmanaged inbox all carry over; the send cap lifts. Authenticated by the\nagent's own API key.\n",
+		"command": "resend-cli-signup-verification",
+		"description": "Sends a new email verification code for a pending CLI signup session.\nThis endpoint does not require an API key.\n",
 		"hasJsonBody": true,
 		"method": "POST",
-		"operationId": "verifyAgentClaim",
-		"path": "/agent/claim/verify",
+		"operationId": "resendCliSignupVerification",
+		"path": "/cli/signup/resend",
 		"pathParams": [],
 		"queryParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
-			"properties": { "verification_code": {
+			"properties": { "signup_token": {
 				"type": "string",
-				"minLength": 1,
-				"maxLength": 32,
-				"description": "The verification code emailed by the claim start step."
+				"minLength": 1
 			} },
-			"required": ["verification_code"]
+			"required": ["signup_token"]
 		},
 		"responseSchema": {
 			"type": "object",
 			"properties": {
-				"org_id": {
-					"type": "string",
-					"format": "uuid"
-				},
-				"plan": {
-					"type": "string",
-					"enum": ["developer"]
-				},
 				"email": {
 					"type": "string",
 					"format": "email"
 				},
-				"limits": {
-					"type": "object",
-					"description": "Plan-derived quota limits for an account.",
-					"properties": {
-						"storage_mb": { "type": "number" },
-						"send_per_hour": { "type": "number" },
-						"send_per_day": { "type": "number" },
-						"api_per_minute": { "type": "number" },
-						"webhooks_max_global": { "type": ["number", "null"] },
-						"webhooks_per_domain": { "type": "boolean" },
-						"filters_per_domain": { "type": "boolean" },
-						"spam_thresholds_per_domain": { "type": "boolean" }
-					},
-					"required": [
-						"storage_mb",
-						"send_per_hour",
-						"send_per_day",
-						"api_per_minute",
-						"webhooks_max_global",
-						"webhooks_per_domain",
-						"filters_per_domain",
-						"spam_thresholds_per_domain"
-					]
+				"expires_in": {
+					"type": "integer",
+					"description": "Seconds until the pending signup expires"
+				},
+				"resend_after": {
+					"type": "integer",
+					"description": "Minimum seconds before requesting another verification email"
+				},
+				"verification_code_length": {
+					"type": "integer",
+					"description": "Number of digits in the emailed verification code"
 				}
 			},
 			"required": [
-				"org_id",
-				"plan",
 				"email",
-				"limits"
+				"expires_in",
+				"resend_after",
+				"verification_code_length"
 			]
 		},
-		"sdkName": "verifyAgentClaim",
-		"summary": "Verify an agent account email claim",
-		"tag": "Agent",
-		"tagCommand": "agent"
+		"sdkName": "resendCliSignupVerification",
+		"summary": "Resend CLI signup verification code",
+		"tag": "CLI",
+		"tagCommand": "cli"
 	},
 	{
 		"binaryResponse": false,
-		"bodyRequired": true,
-		"command": "verify-agent-signup",
-		"description": "Verifies the email code for an agent signup session and creates\nthe account when needed. When the session was started with a\n`signup_code`, the reserved code is redeemed; sessions started\nwithout a code skip the redemption step. An org-scoped OAuth\nsession for CLI authentication is minted and the raw tokens are\nreturned exactly once. For existing users, the optional `org_id`\nselects which accessible workspace should receive the new\nsession (no signup-code redemption is performed for existing\nusers regardless of how the session was started).\n",
+		"bodyRequired": false,
+		"command": "start-cli-login",
+		"description": "Starts a browser-assisted CLI login session. The response includes a\ndevice code for polling and a user code that the user approves in the\nbrowser. This endpoint does not require an API key.\n",
 		"hasJsonBody": true,
-		"method": "POST",
-		"operationId": "verifyAgentSignup",
-		"path": "/agent/signup/verify",
+		"method": "POST",
+		"operationId": "startCliLogin",
+		"path": "/cli/login/start",
 		"pathParams": [],
 		"queryParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
 			"properties": {
-				"signup_token": {
-					"type": "string",
-					"minLength": 1
-				},
-				"verification_code": {
+				"device_name": {
 					"type": "string",
 					"minLength": 1,
-					"maxLength": 32
+					"maxLength": 80,
+					"description": "Human-readable device name shown during browser approval"
 				},
-				"org_id": {
-					"type": "string",
-					"format": "uuid",
-					"description": "Optional workspace id to target when the verified email already belongs to multiple workspaces"
+				"metadata": {
+					"type": "object",
+					"additionalProperties": true,
+					"description": "Optional client metadata stored with the login session; serialized JSON must be 2048 bytes or fewer"
 				}
-			},
-			"required": ["signup_token", "verification_code"]
+			}
 		},
 		"responseSchema": {
 			"type": "object",
 			"properties": {
-				"api_key": {
-					"type": "string",
-					"description": "Legacy alias for access_token. New CLI builds should persist access_token and refresh_token."
-				},
-				"key_id": {
-					"type": "string",
-					"format": "uuid",
-					"description": "Legacy alias for oauth_grant_id"
-				},
-				"key_prefix": {
+				"device_code": {
 					"type": "string",
-					"description": "Legacy display prefix derived from access_token"
+					"description": "Opaque code used by the CLI to poll for approval"
 				},
-				"access_token": {
+				"user_code": {
 					"type": "string",
-					"description": "OAuth access token for CLI API authentication"
+					"pattern": "^[BCDFGHJKLMNPQRSTVWXZ]{4}-[BCDFGHJKLMNPQRSTVWXZ]{4}$",
+					"description": "Short code the user confirms in the browser"
 				},
-				"refresh_token": {
+				"verification_uri": {
 					"type": "string",
-					"description": "OAuth refresh token used by the CLI to renew access"
+					"description": "Browser URL where the user approves the login"
 				},
-				"token_type": {
+				"verification_uri_complete": {
 					"type": "string",
-					"enum": ["Bearer"]
+					"description": "Browser URL with the user code prefilled"
 				},
 				"expires_in": {
 					"type": "integer",
-					"description": "Seconds until access_token expires"
-				},
-				"auth_method": {
-					"type": "string",
-					"enum": ["oauth"]
-				},
-				"oauth_grant_id": {
-					"type": "string",
-					"format": "uuid"
-				},
-				"oauth_client_id": { "type": "string" },
-				"org_id": {
-					"type": "string",
-					"format": "uuid"
+					"description": "Seconds until the login session expires"
 				},
-				"org_name": { "type": ["string", "null"] },
-				"orgs": {
-					"type": "array",
-					"items": {
-						"type": "object",
-						"properties": {
-							"id": {
-								"type": "string",
-								"format": "uuid"
-							},
-							"name": { "type": ["string", "null"] }
-						},
-						"required": ["id", "name"]
-					},
-					"description": "Workspaces available to the verified email. The minted session targets `org_id`."
+				"interval": {
+					"type": "integer",
+					"description": "Minimum seconds between poll requests"
 				}
 			},
 			"required": [
-				"api_key",
-				"key_id",
-				"key_prefix",
-				"access_token",
-				"refresh_token",
-				"token_type",
+				"device_code",
+				"user_code",
+				"verification_uri",
+				"verification_uri_complete",
 				"expires_in",
-				"auth_method",
-				"oauth_grant_id",
-				"oauth_client_id",
-				"org_id",
-				"org_name",
-				"orgs"
+				"interval"
 			]
 		},
-		"sdkName": "verifyAgentSignup",
-		"summary": "Verify agent signup and create OAuth tokens",
-		"tag": "Agent",
-		"tagCommand": "agent"
+		"sdkName": "startCliLogin",
+		"summary": "Start CLI browser login",
+		"tag": "CLI",
+		"tagCommand": "cli"
 	},
 	{
 		"binaryResponse": false,
-		"bodyRequired": false,
-		"command": "remove-agent-connection",
-		"description": "Permanently removes a revoked connection record. Requires an organization\nowner or admin session or OAuth token; organization API keys are denied.\nDisconnect first using DELETE /agent-connections/{address}. An active\nconnection returns 409 connection_not_revoked. Missing or already removed\nrecords return 404. Mail, address notes, domains and external runtimes are\npreserved. The same address can be paired again with a new invitation;\nold credentials and invitations remain invalid.\n",
-		"hasJsonBody": false,
+		"bodyRequired": true,
+		"command": "start-cli-signup",
+		"description": "Starts a terminal-native CLI signup. `signup_code` is optional;\nomit it to sign up without one. The API creates a pending signup\nsession, sends an email verification code, and returns an opaque\nsignup token used by the resend and verify steps. This endpoint\ndoes not require an API key.\n",
+		"hasJsonBody": true,
 		"method": "POST",
-		"operationId": "removeAgentConnection",
-		"path": "/agent-connections/{address}/remove",
-		"pathParams": [{
-			"description": "The email address identifying the revoked connection.",
-			"enum": null,
-			"name": "address",
-			"required": true,
-			"type": "string"
-		}],
+		"operationId": "startCliSignup",
+		"path": "/cli/signup/start",
+		"pathParams": [],
 		"queryParams": [],
-		"requestSchema": null,
-		"responseSchema": {
+		"requestSchema": {
 			"type": "object",
-			"required": ["success", "data"],
+			"additionalProperties": false,
 			"properties": {
-				"success": {
+				"email": {
+					"type": "string",
+					"format": "email",
+					"maxLength": 254
+				},
+				"signup_code": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 128,
+					"description": "Optional signup code. Omit if you do not have one."
+				},
+				"terms_accepted": {
 					"type": "boolean",
-					"const": true
+					"const": true,
+					"description": "Must be true to confirm acceptance of Primitive's Terms of Service and Privacy Policy"
 				},
-				"data": {
+				"device_name": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 80,
+					"description": "Human-readable device name used for the created CLI OAuth grant"
+				},
+				"metadata": {
 					"type": "object",
-					"required": ["deleted"],
-					"properties": { "deleted": {
-						"type": "boolean",
-						"const": true
-					} }
+					"additionalProperties": true,
+					"description": "Optional client metadata stored with the signup session; serialized JSON must be 2048 bytes or fewer"
 				}
-			}
-		},
-		"sdkName": "removeAgentConnection",
-		"summary": "Remove a revoked agent connection",
-		"tag": "Agent Connections",
-		"tagCommand": "agent-connections"
-	},
-	{
-		"binaryResponse": false,
-		"bodyRequired": false,
-		"command": "cli-logout",
-		"description": "Revokes the OAuth grant used to authenticate the request. API-key\nauthenticated legacy logout requests succeed without deleting server API\nkeys so old local CLI state can be cleared safely.\n",
-		"hasJsonBody": true,
-		"method": "POST",
-		"operationId": "cliLogout",
-		"path": "/cli/logout",
-		"pathParams": [],
-		"queryParams": [],
-		"requestSchema": {
-			"type": "object",
-			"additionalProperties": false,
-			"properties": { "key_id": {
-				"type": "string",
-				"format": "uuid",
-				"description": "Optional id guard; when provided it must match the authenticated OAuth grant id or API key id"
-			} }
+			},
+			"required": ["email", "terms_accepted"]
 		},
 		"responseSchema": {
 			"type": "object",
 			"properties": {
-				"revoked": {
-					"type": "boolean",
-					"description": "True when an OAuth grant was revoked. False for API-key-authenticated legacy logout, which only clears local CLI state."
-				},
-				"key_id": {
+				"signup_token": {
 					"type": "string",
-					"format": "uuid",
-					"description": "API key id for API-key-authenticated legacy logout"
+					"description": "Opaque token used to verify or resend the pending CLI signup"
 				},
-				"oauth_grant_id": {
+				"email": {
 					"type": "string",
-					"format": "uuid",
-					"description": "OAuth grant id revoked by OAuth-authenticated logout"
+					"format": "email"
+				},
+				"expires_in": {
+					"type": "integer",
+					"description": "Seconds until the pending signup expires"
+				},
+				"resend_after": {
+					"type": "integer",
+					"description": "Minimum seconds before requesting another verification email"
+				},
+				"verification_code_length": {
+					"type": "integer",
+					"description": "Number of digits in the emailed verification code"
 				}
 			},
-			"required": ["revoked"]
+			"required": [
+				"signup_token",
+				"email",
+				"expires_in",
+				"resend_after",
+				"verification_code_length"
+			]
 		},
-		"sdkName": "cliLogout",
-		"summary": "Revoke the current CLI OAuth session",
+		"sdkName": "startCliSignup",
+		"summary": "Start CLI account signup",
 		"tag": "CLI",
 		"tagCommand": "cli"
 	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": true,
-		"command": "poll-cli-login",
-		"description": "Polls a CLI login session until the browser approval either succeeds,\nis denied, expires, or is polled too quickly. The OAuth token set is\ncreated only after approval and is returned exactly once.\n",
+		"command": "verify-cli-signup",
+		"description": "Verifies the email code for a CLI signup session and creates the\naccount. When the session was started with a `signup_code`, the\nreserved code is redeemed; sessions started without a code skip\nthe redemption step. Either way an org-scoped OAuth CLI session\nis created and the token set is returned exactly once. This\nendpoint does not require an API key.\n",
 		"hasJsonBody": true,
 		"method": "POST",
-		"operationId": "pollCliLogin",
-		"path": "/cli/login/poll",
+		"operationId": "verifyCliSignup",
+		"path": "/cli/signup/verify",
 		"pathParams": [],
 		"queryParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
-			"properties": { "device_code": {
-				"type": "string",
-				"minLength": 1
-			} },
-			"required": ["device_code"]
+			"properties": {
+				"signup_token": {
+					"type": "string",
+					"minLength": 1
+				},
+				"verification_code": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 32
+				},
+				"password": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 1024
+				}
+			},
+			"required": ["signup_token", "verification_code"]
 		},
 		"responseSchema": {
 			"type": "object",
@@ -12713,314 +14832,515 @@ const operationManifest = [
 				"org_name"
 			]
 		},
-		"sdkName": "pollCliLogin",
-		"summary": "Poll CLI browser login",
+		"sdkName": "verifyCliSignup",
+		"summary": "Verify CLI signup and create OAuth session",
 		"tag": "CLI",
 		"tagCommand": "cli"
 	},
 	{
 		"binaryResponse": false,
-		"bodyRequired": true,
-		"command": "resend-cli-signup-verification",
-		"description": "Sends a new email verification code for a pending CLI signup session.\nThis endpoint does not require an API key.\n",
-		"hasJsonBody": true,
-		"method": "POST",
-		"operationId": "resendCliSignupVerification",
-		"path": "/cli/signup/resend",
-		"pathParams": [],
-		"queryParams": [],
-		"requestSchema": {
+		"bodyRequired": false,
+		"command": "delete-agent-contact",
+		"description": "Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.",
+		"hasJsonBody": false,
+		"method": "DELETE",
+		"operationId": "deleteAgentContact",
+		"path": "/agent-contacts/{agent_address}/{contact_address}",
+		"pathParams": [{
+			"description": "agent_address for contacts.",
+			"enum": null,
+			"name": "agent_address",
+			"required": true,
+			"type": "string"
+		}, {
+			"description": "contact_address for contacts.",
+			"enum": null,
+			"name": "contact_address",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [{
+			"description": "if_version for contacts.",
+			"enum": null,
+			"name": "if_version",
+			"required": true,
+			"type": "string"
+		}],
+		"requestSchema": null,
+		"responseSchema": {
 			"type": "object",
 			"additionalProperties": false,
-			"properties": { "signup_token": {
-				"type": "string",
-				"minLength": 1
-			} },
-			"required": ["signup_token"]
+			"properties": { "deleted": { "type": "boolean" } },
+			"required": ["deleted"]
 		},
+		"sdkName": "deleteAgentContact",
+		"summary": "delete Agent Contact",
+		"tag": "Contacts",
+		"tagCommand": "contacts"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "delete-contact",
+		"description": "Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.",
+		"hasJsonBody": false,
+		"method": "DELETE",
+		"operationId": "deleteContact",
+		"path": "/contacts/{address}",
+		"pathParams": [{
+			"description": "address for contacts.",
+			"enum": null,
+			"name": "address",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [{
+			"description": "if_version for contacts.",
+			"enum": null,
+			"name": "if_version",
+			"required": true,
+			"type": "string"
+		}],
+		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
-			"properties": {
-				"email": {
-					"type": "string",
-					"format": "email"
-				},
-				"expires_in": {
-					"type": "integer",
-					"description": "Seconds until the pending signup expires"
-				},
-				"resend_after": {
-					"type": "integer",
-					"description": "Minimum seconds before requesting another verification email"
-				},
-				"verification_code_length": {
-					"type": "integer",
-					"description": "Number of digits in the emailed verification code"
-				}
-			},
-			"required": [
-				"email",
-				"expires_in",
-				"resend_after",
-				"verification_code_length"
-			]
+			"additionalProperties": false,
+			"properties": { "deleted": { "type": "boolean" } },
+			"required": ["deleted"]
 		},
-		"sdkName": "resendCliSignupVerification",
-		"summary": "Resend CLI signup verification code",
-		"tag": "CLI",
-		"tagCommand": "cli"
+		"sdkName": "deleteContact",
+		"summary": "delete Contact",
+		"tag": "Contacts",
+		"tagCommand": "contacts"
 	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
-		"command": "start-cli-login",
-		"description": "Starts a browser-assisted CLI login session. The response includes a\ndevice code for polling and a user code that the user approves in the\nbrowser. This endpoint does not require an API key.\n",
-		"hasJsonBody": true,
-		"method": "POST",
-		"operationId": "startCliLogin",
-		"path": "/cli/login/start",
-		"pathParams": [],
+		"command": "get-contact",
+		"description": "Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getContact",
+		"path": "/contacts/{address}",
+		"pathParams": [{
+			"description": "address for contacts.",
+			"enum": null,
+			"name": "address",
+			"required": true,
+			"type": "string"
+		}],
 		"queryParams": [],
-		"requestSchema": {
+		"requestSchema": null,
+		"responseSchema": {
 			"type": "object",
 			"additionalProperties": false,
 			"properties": {
-				"device_name": {
+				"address": {
 					"type": "string",
-					"minLength": 1,
-					"maxLength": 80,
-					"description": "Human-readable device name shown during browser approval"
+					"format": "email",
+					"maxLength": 254,
+					"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
 				},
-				"metadata": {
-					"type": "object",
-					"additionalProperties": true,
-					"description": "Optional client metadata stored with the login session; serialized JSON must be 2048 bytes or fewer"
-				}
-			}
-		},
-		"responseSchema": {
-			"type": "object",
-			"properties": {
-				"device_code": {
-					"type": "string",
-					"description": "Opaque code used by the CLI to poll for approval"
+				"display_name": {
+					"type": ["string", "null"],
+					"maxLength": 200
 				},
-				"user_code": {
+				"version": {
 					"type": "string",
-					"pattern": "^[BCDFGHJKLMNPQRSTVWXZ]{4}-[BCDFGHJKLMNPQRSTVWXZ]{4}$",
-					"description": "Short code the user confirms in the browser"
+					"format": "uuid",
+					"description": "Opaque CAS token. Changes on mutations and cannot be reused after deletion/recreation."
 				},
-				"verification_uri": {
+				"created_at": {
 					"type": "string",
-					"description": "Browser URL where the user approves the login"
+					"format": "date-time"
 				},
-				"verification_uri_complete": {
+				"updated_at": {
 					"type": "string",
-					"description": "Browser URL with the user code prefilled"
+					"format": "date-time"
+				}
+			},
+			"required": [
+				"address",
+				"display_name",
+				"version",
+				"created_at",
+				"updated_at"
+			]
+		},
+		"sdkName": "getContact",
+		"summary": "get Contact",
+		"tag": "Contacts",
+		"tagCommand": "contacts"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-agent-contacts",
+		"description": "Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listAgentContacts",
+		"path": "/agent-contacts/{agent_address}",
+		"pathParams": [{
+			"description": "agent_address for contacts.",
+			"enum": null,
+			"name": "agent_address",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [{
+			"description": "cursor for contacts.",
+			"enum": null,
+			"name": "cursor",
+			"required": false,
+			"type": "string"
+		}, {
+			"default": 50,
+			"description": "limit for contacts.",
+			"enum": null,
+			"maximum": 100,
+			"minimum": 1,
+			"name": "limit",
+			"required": false,
+			"type": "integer"
+		}],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"agent_address": {
+						"type": "string",
+						"format": "email",
+						"maxLength": 254,
+						"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+					},
+					"contact_address": {
+						"type": "string",
+						"format": "email",
+						"maxLength": 254,
+						"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+					},
+					"purpose": {
+						"type": ["string", "null"],
+						"maxLength": 2e3
+					},
+					"notify": { "type": "boolean" },
+					"notify_since": {
+						"type": ["string", "null"],
+						"format": "date-time"
+					},
+					"notification_generation": {
+						"type": ["string", "null"],
+						"format": "uuid"
+					},
+					"version": {
+						"type": "string",
+						"format": "uuid",
+						"description": "Opaque CAS token. Changes on mutations and cannot be reused after deletion/recreation."
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"updated_at": {
+						"type": "string",
+						"format": "date-time"
+					}
 				},
-				"expires_in": {
-					"type": "integer",
-					"description": "Seconds until the login session expires"
+				"required": [
+					"agent_address",
+					"contact_address",
+					"purpose",
+					"notify",
+					"notify_since",
+					"notification_generation",
+					"version",
+					"created_at",
+					"updated_at"
+				]
+			}
+		},
+		"sdkName": "listAgentContacts",
+		"summary": "list Agent Contacts",
+		"tag": "Contacts",
+		"tagCommand": "contacts"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-contacts",
+		"description": "Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listContacts",
+		"path": "/contacts",
+		"pathParams": [],
+		"queryParams": [{
+			"description": "cursor for contacts.",
+			"enum": null,
+			"name": "cursor",
+			"required": false,
+			"type": "string"
+		}, {
+			"default": 50,
+			"description": "limit for contacts.",
+			"enum": null,
+			"maximum": 100,
+			"minimum": 1,
+			"name": "limit",
+			"required": false,
+			"type": "integer"
+		}],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"address": {
+						"type": "string",
+						"format": "email",
+						"maxLength": 254,
+						"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
+					},
+					"display_name": {
+						"type": ["string", "null"],
+						"maxLength": 200
+					},
+					"version": {
+						"type": "string",
+						"format": "uuid",
+						"description": "Opaque CAS token. Changes on mutations and cannot be reused after deletion/recreation."
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"updated_at": {
+						"type": "string",
+						"format": "date-time"
+					}
 				},
-				"interval": {
-					"type": "integer",
-					"description": "Minimum seconds between poll requests"
-				}
-			},
-			"required": [
-				"device_code",
-				"user_code",
-				"verification_uri",
-				"verification_uri_complete",
-				"expires_in",
-				"interval"
-			]
+				"required": [
+					"address",
+					"display_name",
+					"version",
+					"created_at",
+					"updated_at"
+				]
+			}
 		},
-		"sdkName": "startCliLogin",
-		"summary": "Start CLI browser login",
-		"tag": "CLI",
-		"tagCommand": "cli"
+		"sdkName": "listContacts",
+		"summary": "list Contacts",
+		"tag": "Contacts",
+		"tagCommand": "contacts"
 	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": true,
-		"command": "start-cli-signup",
-		"description": "Starts a terminal-native CLI signup. `signup_code` is optional;\nomit it to sign up without one. The API creates a pending signup\nsession, sends an email verification code, and returns an opaque\nsignup token used by the resend and verify steps. This endpoint\ndoes not require an API key.\n",
+		"command": "put-agent-contact",
+		"description": "Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.",
 		"hasJsonBody": true,
-		"method": "POST",
-		"operationId": "startCliSignup",
-		"path": "/cli/signup/start",
-		"pathParams": [],
+		"method": "PUT",
+		"operationId": "putAgentContact",
+		"path": "/agent-contacts/{agent_address}/{contact_address}",
+		"pathParams": [{
+			"description": "agent_address for contacts.",
+			"enum": null,
+			"name": "agent_address",
+			"required": true,
+			"type": "string"
+		}, {
+			"description": "contact_address for contacts.",
+			"enum": null,
+			"name": "contact_address",
+			"required": true,
+			"type": "string"
+		}],
 		"queryParams": [],
-		"requestSchema": {
+		"requestSchema": { "oneOf": [{
 			"type": "object",
 			"additionalProperties": false,
 			"properties": {
-				"email": {
-					"type": "string",
-					"format": "email",
-					"maxLength": 254
-				},
-				"signup_code": {
-					"type": "string",
-					"minLength": 1,
-					"maxLength": 128,
-					"description": "Optional signup code. Omit if you do not have one."
+				"purpose": {
+					"type": ["string", "null"],
+					"maxLength": 2e3
 				},
-				"terms_accepted": {
+				"notify": { "type": "boolean" },
+				"if_absent": {
 					"type": "boolean",
-					"const": true,
-					"description": "Must be true to confirm acceptance of Primitive's Terms of Service and Privacy Policy"
+					"const": true
+				}
+			},
+			"required": ["if_absent"]
+		}, {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": {
+				"purpose": {
+					"type": ["string", "null"],
+					"maxLength": 2e3
 				},
-				"device_name": {
+				"notify": { "type": "boolean" },
+				"if_version": {
 					"type": "string",
-					"minLength": 1,
-					"maxLength": 80,
-					"description": "Human-readable device name used for the created CLI OAuth grant"
-				},
-				"metadata": {
-					"type": "object",
-					"additionalProperties": true,
-					"description": "Optional client metadata stored with the signup session; serialized JSON must be 2048 bytes or fewer"
+					"format": "uuid",
+					"description": "Opaque CAS token. Changes on mutations and cannot be reused after deletion/recreation."
 				}
 			},
-			"required": ["email", "terms_accepted"]
-		},
+			"required": ["if_version"]
+		}] },
 		"responseSchema": {
 			"type": "object",
+			"additionalProperties": false,
 			"properties": {
-				"signup_token": {
+				"agent_address": {
 					"type": "string",
-					"description": "Opaque token used to verify or resend the pending CLI signup"
+					"format": "email",
+					"maxLength": 254,
+					"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
 				},
-				"email": {
+				"contact_address": {
 					"type": "string",
-					"format": "email"
+					"format": "email",
+					"maxLength": 254,
+					"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
 				},
-				"expires_in": {
-					"type": "integer",
-					"description": "Seconds until the pending signup expires"
+				"purpose": {
+					"type": ["string", "null"],
+					"maxLength": 2e3
 				},
-				"resend_after": {
-					"type": "integer",
-					"description": "Minimum seconds before requesting another verification email"
+				"notify": { "type": "boolean" },
+				"notify_since": {
+					"type": ["string", "null"],
+					"format": "date-time"
 				},
-				"verification_code_length": {
-					"type": "integer",
-					"description": "Number of digits in the emailed verification code"
+				"notification_generation": {
+					"type": ["string", "null"],
+					"format": "uuid"
+				},
+				"version": {
+					"type": "string",
+					"format": "uuid",
+					"description": "Opaque CAS token. Changes on mutations and cannot be reused after deletion/recreation."
+				},
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"updated_at": {
+					"type": "string",
+					"format": "date-time"
 				}
 			},
 			"required": [
-				"signup_token",
-				"email",
-				"expires_in",
-				"resend_after",
-				"verification_code_length"
+				"agent_address",
+				"contact_address",
+				"purpose",
+				"notify",
+				"notify_since",
+				"notification_generation",
+				"version",
+				"created_at",
+				"updated_at"
 			]
 		},
-		"sdkName": "startCliSignup",
-		"summary": "Start CLI account signup",
-		"tag": "CLI",
-		"tagCommand": "cli"
+		"sdkName": "putAgentContact",
+		"summary": "put Agent Contact",
+		"tag": "Contacts",
+		"tagCommand": "contacts"
 	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": true,
-		"command": "verify-cli-signup",
-		"description": "Verifies the email code for a CLI signup session and creates the\naccount. When the session was started with a `signup_code`, the\nreserved code is redeemed; sessions started without a code skip\nthe redemption step. Either way an org-scoped OAuth CLI session\nis created and the token set is returned exactly once. This\nendpoint does not require an API key.\n",
+		"command": "put-contact",
+		"description": "Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.",
 		"hasJsonBody": true,
-		"method": "POST",
-		"operationId": "verifyCliSignup",
-		"path": "/cli/signup/verify",
-		"pathParams": [],
+		"method": "PUT",
+		"operationId": "putContact",
+		"path": "/contacts/{address}",
+		"pathParams": [{
+			"description": "address for contacts.",
+			"enum": null,
+			"name": "address",
+			"required": true,
+			"type": "string"
+		}],
 		"queryParams": [],
-		"requestSchema": {
+		"requestSchema": { "oneOf": [{
 			"type": "object",
 			"additionalProperties": false,
 			"properties": {
-				"signup_token": {
-					"type": "string",
-					"minLength": 1
-				},
-				"verification_code": {
-					"type": "string",
-					"minLength": 1,
-					"maxLength": 32
+				"display_name": {
+					"type": ["string", "null"],
+					"maxLength": 200
 				},
-				"password": {
-					"type": "string",
-					"minLength": 1,
-					"maxLength": 1024
+				"if_absent": {
+					"type": "boolean",
+					"const": true
 				}
 			},
-			"required": ["signup_token", "verification_code"]
-		},
-		"responseSchema": {
+			"required": ["if_absent"]
+		}, {
 			"type": "object",
+			"additionalProperties": false,
 			"properties": {
-				"api_key": {
-					"type": "string",
-					"description": "Legacy alias for access_token. New CLI builds should persist access_token and refresh_token."
+				"display_name": {
+					"type": ["string", "null"],
+					"maxLength": 200
 				},
-				"key_id": {
+				"if_version": {
 					"type": "string",
 					"format": "uuid",
-					"description": "Legacy alias for oauth_grant_id"
-				},
-				"key_prefix": {
-					"type": "string",
-					"description": "Legacy display prefix derived from access_token"
-				},
-				"access_token": {
-					"type": "string",
-					"description": "OAuth access token for CLI API authentication"
-				},
-				"refresh_token": {
-					"type": "string",
-					"description": "OAuth refresh token used by the CLI to renew access"
-				},
-				"token_type": {
+					"description": "Opaque CAS token. Changes on mutations and cannot be reused after deletion/recreation."
+				}
+			},
+			"required": ["if_version"]
+		}] },
+		"responseSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": {
+				"address": {
 					"type": "string",
-					"enum": ["Bearer"]
+					"format": "email",
+					"maxLength": 254,
+					"description": "Bare email address; trim and lowercase, preserving dots and plus tags."
 				},
-				"expires_in": {
-					"type": "integer",
-					"description": "Seconds until access_token expires"
+				"display_name": {
+					"type": ["string", "null"],
+					"maxLength": 200
 				},
-				"auth_method": {
+				"version": {
 					"type": "string",
-					"enum": ["oauth"]
+					"format": "uuid",
+					"description": "Opaque CAS token. Changes on mutations and cannot be reused after deletion/recreation."
 				},
-				"oauth_grant_id": {
+				"created_at": {
 					"type": "string",
-					"format": "uuid"
+					"format": "date-time"
 				},
-				"oauth_client_id": { "type": "string" },
-				"org_id": {
+				"updated_at": {
 					"type": "string",
-					"format": "uuid"
-				},
-				"org_name": { "type": ["string", "null"] }
+					"format": "date-time"
+				}
 			},
 			"required": [
-				"api_key",
-				"key_id",
-				"key_prefix",
-				"access_token",
-				"refresh_token",
-				"token_type",
-				"expires_in",
-				"auth_method",
-				"oauth_grant_id",
-				"oauth_client_id",
-				"org_id",
-				"org_name"
+				"address",
+				"display_name",
+				"version",
+				"created_at",
+				"updated_at"
 			]
 		},
-		"sdkName": "verifyCliSignup",
-		"summary": "Verify CLI signup and create OAuth session",
-		"tag": "CLI",
-		"tagCommand": "cli"
+		"sdkName": "putContact",
+		"summary": "put Contact",
+		"tag": "Contacts",
+		"tagCommand": "contacts"
 	},
 	{
 		"binaryResponse": false,
@@ -15270,7 +17590,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "search-emails",
-		"description": "Searches inbound emails with structured filters and optional\nfull-text matching across parsed email fields. This endpoint is\noptimized for filtered inbox views and CLI polling workflows:\ncallers that only need new accepted mail can pass\n`sort=received_at_asc`, `snippet=false`, `include_facets=false`,\nand a `date_from` timestamp.\n\n`q`, `subject`, and `body` use the same English full-text index\nas the web inbox search. Structured filters such as `from`, `to`,\n`domain_id`, status, attachment presence, and spam score bounds\nare combined with the text query.\n",
+		"description": "Searches inbound emails with structured filters and optional\nfull-text matching across parsed email fields. This endpoint is\noptimized for filtered inbox views and CLI polling workflows:\ncallers that only need new accepted mail can pass\n`sort=received_at_asc`, `snippet=false`, `include_facets=false`,\nand a `date_from` timestamp.\n\n`q`, `subject`, and `body` use the same English full-text index\nas the web inbox search. Structured filters such as `from`, `to`,\n`domain_id`, status, attachment presence, and spam score bounds\nare combined with the text query.\n\nConnected-agent credentials search only mail received by their own\naddress. This applies to results, totals, facets, and every page;\nsearch filters cannot widen the credential's scope. When\n`reply_to_sent_email_id` is supplied, its parent send must belong\nto the connected address in the same organization. An unavailable\nparent returns 404. Sender filters are not authentication proof;\ninspect the email detail's authentication evidence before trusting it.\n",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "searchEmails",