@samva/cli 0.15.0 → 0.17.0

package/dist/bin.mjs

@@ -14106,7 +14106,7 @@ var layer12 = /* @__PURE__ */ layer.pipe(/* @__PURE__ */ provideMerge(/* @__PURE
 // package.json
 var package_default = {
   name: "@samva/cli",
-  version: "0.15.0",
+  version: "0.17.0",
   description: "Samva CLI \u2014 email and platform operations from your terminal",
   keywords: [
     "cli",
@@ -14162,16 +14162,16 @@ var package_default = {
     "@types/node": "catalog:",
     "better-auth": "catalog:",
     effect: "catalog:effect",
-    samva: "workspace:0.19.0",
+    samva: "workspace:0.20.0",
     typescript: "catalog:",
     vite: "~8.3.0",
     vitest: "catalog:"
   },
   optionalDependencies: {
-    "@samva/cli-darwin-arm64": "workspace:0.15.0",
-    "@samva/cli-darwin-x64": "workspace:0.15.0",
-    "@samva/cli-linux-arm64": "workspace:0.15.0",
-    "@samva/cli-linux-x64": "workspace:0.15.0"
+    "@samva/cli-darwin-arm64": "workspace:0.17.0",
+    "@samva/cli-darwin-x64": "workspace:0.17.0",
+    "@samva/cli-linux-arm64": "workspace:0.17.0",
+    "@samva/cli-linux-x64": "workspace:0.17.0"
   },
   engines: {
     node: ">=18"
@@ -19353,6 +19353,7 @@ var Literals4 = (name, choices) => Literals2(argumentKind, name, choices);
 var optional5 = (arg) => optional3(arg);
 var withDescription4 = /* @__PURE__ */ dual(2, (self, description) => withDescription(self, description));
 var withDefault6 = withDefault4;
+var atLeast3 = /* @__PURE__ */ dual(2, (self, min) => atLeast(self, min));
 var withSchema3 = /* @__PURE__ */ dual(2, (self, schema) => withSchema(self, schema));
 var filterMap3 = /* @__PURE__ */ dual(3, (self, f, onNone) => filterMap2(self, f, onNone));
 
@@ -20513,6 +20514,9 @@ var CAMPAIGN_RECIPIENT_SKIPPED_REASON_VALUES = [
   "unsubscribed",
   "blocked",
   "suppressed",
+  "opted_out",
+  "consent_required",
+  "unreachable",
   "no_identity",
   "inactive",
   "run_cancelled",
@@ -20746,6 +20750,56 @@ var categorize = (errorClass, meta) => {
   return errorClass;
 };
 
+// ../core/src/shared/json.ts
+var JsonObject = Record(String4, Json2).annotate({
+  identifier: "JsonObject"
+});
+var UnknownRecord = Record(String4, Unknown2).annotate({
+  identifier: "UnknownRecord"
+});
+var decodeJsonString = decodeSync(fromJsonString2(Json2));
+
+// ../core/src/templates/variable-values.ts
+var TemplateVariableValues = JsonObject;
+
+// ../core/src/mailboxes/chat.ts
+var MailboxChatChannel = Literals(["whatsapp", "sms"]);
+var mailboxChatContentFields = {
+  text: optional2(String4.check(isMinLength(1))),
+  templateId: optional2(TemplateId),
+  templateData: optional2(TemplateVariableValues)
+};
+var exactlyOneChatContent = makeFilter2((payload) => payload.text === undefined !== (payload.templateId === undefined) && (payload.templateId === undefined || payload.channel === "whatsapp") && (payload.templateData === undefined || payload.templateId !== undefined), {
+  message: "Set exactly one of `text` or `templateId`; a template (with its `templateData`) sends on WhatsApp only."
+});
+var MailboxChatTemplate = Struct({
+  templateId: TemplateId,
+  templateChannelVariantId: TemplateChannelVariantId,
+  templateData: NullOr(TemplateVariableValues)
+}).annotate({ identifier: "MailboxChatTemplate" });
+
+class WhatsAppServiceWindowClosedError extends TaggedError3()("WhatsAppServiceWindowClosedError", {
+  message: String4,
+  closedAt: NullOr(String4)
+}, { httpApiStatus: 422 }) {
+}
+categorize(WhatsAppServiceWindowClosedError, { categories: ["validation"], retryable: false });
+var MailboxWhatsAppTemplateOption = Struct({
+  templateId: TemplateId,
+  slug: String4,
+  name: String4,
+  providerName: NullOr(String4),
+  language: NullOr(String4),
+  category: NullOr(String4),
+  sendable: Boolean3,
+  reason: NullOr(String4),
+  inputSchema: NullOr(JsonObject)
+}).annotate({ identifier: "MailboxWhatsAppTemplateOption" });
+var MailboxWhatsAppTemplateOptions = Struct({
+  endpointId: MailboxEndpointId,
+  items: ArraySchema(MailboxWhatsAppTemplateOption)
+}).annotate({ identifier: "MailboxWhatsAppTemplateOptions" });
+
 // ../core/src/shared/errors.ts
 class ResourceNotFoundError extends TaggedError3()("ResourceNotFoundError", {
   resource: String4,
@@ -20965,6 +21019,31 @@ class UnknownStatusError extends TaggedError3()("UnknownStatusError", {
   }
 }
 
+// ../core/src/mailboxes/endpoint-binding.ts
+var MailboxEmailEndpointBinding = Struct({
+  channel: Literal2("email"),
+  source: Literals(["samvaHosted", "verifiedDomain"]),
+  localPart: String4,
+  domain: String4,
+  domainId: optional2(String4),
+  subdomain: optional2(String4)
+}).annotate({ identifier: "MailboxEmailEndpointBinding" });
+var MailboxWhatsAppEndpointBinding = Struct({
+  channel: Literal2("whatsapp"),
+  businessAccountId: WhatsAppBusinessAccountId
+}).annotate({ identifier: "MailboxWhatsAppEndpointBinding" });
+var MailboxSmsEndpointBinding = Struct({
+  channel: Literal2("sms"),
+  phoneNumberId: SmsPhoneNumberId
+}).annotate({ identifier: "MailboxSmsEndpointBinding" });
+var MailboxEndpointBinding = Union2([
+  MailboxEmailEndpointBinding,
+  MailboxWhatsAppEndpointBinding,
+  MailboxSmsEndpointBinding
+]).annotate({
+  identifier: "MailboxEndpointBinding"
+});
+
 // ../core/src/mailboxes/mailbox.ts
 var mailboxChannels = ["email", "whatsapp", "sms"];
 var mailboxEventTypes = [
@@ -21065,10 +21144,6 @@ var MailboxChannel = Literals(mailboxChannels).annotate({
   identifier: "MailboxChannel",
   description: "The channel an endpoint, thread, or message belongs to."
 });
-
-class MailboxChannelUnsupportedError extends TaggedError3()("MailboxChannelUnsupportedError", { message: String4, channel: String4 }, { httpApiStatus: 422 }) {
-}
-categorize(MailboxChannelUnsupportedError, { categories: ["validation"], retryable: false });
 var endpointFields = {
   id: MailboxEndpointId,
   address: String4,
@@ -21081,7 +21156,21 @@ var MailboxEmailEndpoint = Struct({
   source: Literals(["samvaHosted", "verifiedDomain"]),
   domainId: NullOr(String4)
 }).annotate({ identifier: "MailboxEmailEndpoint" });
-var MailboxEndpoint = Union2([MailboxEmailEndpoint]).annotate({
+var MailboxWhatsAppEndpoint = Struct({
+  ...endpointFields,
+  channel: Literal2("whatsapp"),
+  businessAccountId: WhatsAppBusinessAccountId
+}).annotate({ identifier: "MailboxWhatsAppEndpoint" });
+var MailboxSmsEndpoint = Struct({
+  ...endpointFields,
+  channel: Literal2("sms"),
+  phoneNumberId: SmsPhoneNumberId
+}).annotate({ identifier: "MailboxSmsEndpoint" });
+var MailboxEndpoint = Union2([
+  MailboxEmailEndpoint,
+  MailboxWhatsAppEndpoint,
+  MailboxSmsEndpoint
+]).annotate({
   identifier: "MailboxEndpoint"
 });
 var MailboxSendMode = Literals(mailboxSendModes).annotate({
@@ -21198,7 +21287,7 @@ var MailboxSendAttachment = Struct({
     })
   ])
 });
-var MailboxSendIntent = Struct({
+var MailboxEmailSendIntent = Struct({
   channel: Literal2("email"),
   draftRevision: PositiveInt,
   from: String4,
@@ -21216,7 +21305,26 @@ var MailboxSendIntent = Struct({
   inReplyToMessageId: NullOr(MessageId)
 }).check(makeFilter2((intent) => intent.text !== null || intent.html !== null, {
   message: "A send intent requires text or html"
-})).annotate({ identifier: "MailboxSendIntent" });
+})).annotate({ identifier: "MailboxEmailSendIntent" });
+var MailboxChatSendIntent = Struct({
+  channel: MailboxChatChannel,
+  draftRevision: PositiveInt,
+  endpointId: MailboxEndpointId,
+  sender: Union2([MailboxWhatsAppEndpointBinding, MailboxSmsEndpointBinding]),
+  from: String4,
+  to: String4,
+  text: NullOr(String4),
+  template: NullOr(MailboxChatTemplate),
+  threadId: NullOr(MailboxThreadId),
+  conversationId: NullOr(ConversationId),
+  inReplyToMessageId: NullOr(MessageId)
+}).check(makeFilter2((intent) => intent.sender.channel === intent.channel && intent.text === null !== (intent.template === null) && (intent.template === null || intent.channel === "whatsapp"), {
+  message: "A chat send intent carries text or a WhatsApp template, from an endpoint on its channel"
+})).annotate({ identifier: "MailboxChatSendIntent" });
+var MailboxSendIntent = Union2([
+  MailboxEmailSendIntent,
+  MailboxChatSendIntent
+]).annotate({ identifier: "MailboxSendIntent" });
 var authorityFields = {
   actor: MailboxActorRef,
   installationId: NullOr(ExtensionInstallationId)
@@ -21277,10 +21385,10 @@ var SendMailboxEmailPayload = Struct({
   ...BodyFields
 }).annotate({ identifier: "SendMailboxEmailPayload" });
 var SendMailboxChatPayload = Struct({
-  channel: Literals(["whatsapp", "sms"]),
+  channel: MailboxChatChannel,
   to: String4,
-  text: String4.check(isMinLength(1))
-}).annotate({ identifier: "SendMailboxChatPayload" });
+  ...mailboxChatContentFields
+}).check(exactlyOneChatContent).annotate({ identifier: "SendMailboxChatPayload" });
 var SendMailboxMessagePayload = Union2([
   SendMailboxEmailPayload,
   SendMailboxChatPayload
@@ -21292,9 +21400,9 @@ var ReplyMailboxEmailPayload = Struct({
   ...BodyFields
 }).annotate({ identifier: "ReplyMailboxEmailPayload" });
 var ReplyMailboxChatPayload = Struct({
-  channel: Literals(["whatsapp", "sms"]),
-  text: String4.check(isMinLength(1))
-}).annotate({ identifier: "ReplyMailboxChatPayload" });
+  channel: MailboxChatChannel,
+  ...mailboxChatContentFields
+}).check(exactlyOneChatContent).annotate({ identifier: "ReplyMailboxChatPayload" });
 var ReplyMailboxMessagePayload = Union2([
   ReplyMailboxEmailPayload,
   ReplyMailboxChatPayload
@@ -21337,10 +21445,14 @@ var MailboxSendReceipt = Struct({
     return hasIdentity;
   return receipt.state === "uncertain" || !hasIdentity;
 }, { message: "A public message identity requires canonical acceptance" })).annotate({ identifier: "MailboxSendReceipt" });
-var MailboxSendSnapshot = Struct({
-  ...MailboxSendIntent.fields,
+var MailboxEmailSendSnapshot = Struct({
+  ...MailboxEmailSendIntent.fields,
   attachments: EmailAttachments
-}).annotate({ identifier: "MailboxSendSnapshot" });
+}).annotate({ identifier: "MailboxEmailSendSnapshot" });
+var MailboxSendSnapshot = Union2([
+  MailboxEmailSendSnapshot,
+  MailboxChatSendIntent
+]).annotate({ identifier: "MailboxSendSnapshot" });
 
 class MailboxSendConflictError extends TaggedError3()("MailboxSendConflictError", {
   message: String4,
@@ -21368,7 +21480,7 @@ var CreateMailboxEmailDraftPayload = Struct({
   inReplyToMessageId: optional2(MessageId)
 }).annotate({ identifier: "CreateMailboxEmailDraftPayload" });
 var CreateMailboxChatDraftPayload = Struct({
-  channel: Literals(["whatsapp", "sms"]),
+  channel: MailboxChatChannel,
   to: optional2(String4),
   text: optional2(String4),
   inReplyToMessageId: optional2(MessageId)
@@ -23641,7 +23753,7 @@ var TemplateId2 = /* @__PURE__ */ String4.check(isPattern2(/* @__PURE__ */ new R
   expected: "a string matching the RegExp ^tmpl_[0-9a-hjkmnp-tv-z]{16,24}$",
   identifier: "TemplateId"
 })).pipe(brand("TemplateId"));
-var JsonObject = /* @__PURE__ */ Record(String4, JsonValue).annotate({ identifier: "JsonObject" });
+var JsonObject2 = /* @__PURE__ */ Record(String4, JsonValue).annotate({ identifier: "JsonObject" });
 var RenderLocale = /* @__PURE__ */ String4.check(isMaxCodePoints(64).annotate({
   expected: "a string with at most 64 code points",
   identifier: "RenderLocale"
@@ -23829,11 +23941,6 @@ var MailboxEndpointId2 = /* @__PURE__ */ String4.check(isPattern2(/* @__PURE__ *
   expected: "a string matching the RegExp ^mbxep_[0-9a-hjkmnp-tv-z]{16,24}$",
   identifier: "MailboxEndpointId"
 })).pipe(brand("MailboxEndpointId"));
-var MailboxChannelUnsupportedError2 = class extends TaggedError3()("MailboxChannelUnsupportedError", Struct({
-  message: String4,
-  channel: String4
-})) {
-};
 var MailboxMetadataPatch2 = /* @__PURE__ */ Record(String4, Union2([String4.check(isMaxCodePoints(512).annotate({ expected: "a string with at most 512 code points" })).check(isMaxLength(512).annotate({ expected: "a value with a length of at most 512" })), Null2])).check(isPropertyNames(String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(64).annotate({ expected: "a string with at most 64 code points" }))).annotate({
   expected: "an object with property names matching the schema",
   identifier: "MailboxMetadataPatch"
@@ -23990,6 +24097,16 @@ var DeliveryUnavailableError = class extends TaggedError3()("DeliveryUnavailable
 })) {
 };
 var IanaTimezone = /* @__PURE__ */ String4.annotate({ identifier: "IanaTimezone" });
+var NamespaceMetadata = /* @__PURE__ */ Record(String4, String4).annotate({
+  description: "Your own labels for the namespace, such as the id of your customer it serves. Samva stores them and never reads them.",
+  identifier: "NamespaceMetadata"
+});
+var NamespaceResourceType = /* @__PURE__ */ Union2([
+  Literal2("domain"),
+  Literal2("sender"),
+  Literal2("contact"),
+  Literal2("template")
+]).annotate({ identifier: "NamespaceResourceType" });
 var OperationResource = /* @__PURE__ */ Struct({
   type: String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(80).annotate({ expected: "a string with at most 80 code points" })).check(isMaxLength(80).annotate({ expected: "a value with a length of at most 80" })),
   id: String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(255).annotate({ expected: "a string with at most 255 code points" })).check(isMaxLength(255).annotate({ expected: "a value with a length of at most 255" }))
@@ -23998,6 +24115,22 @@ var TemplateFromDefault = /* @__PURE__ */ Struct({
   email: String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })),
   name: optionalKey2(Union2([String4, Null2]))
 }).annotate({ identifier: "TemplateFromDefault" });
+var TestWebhookPayload = /* @__PURE__ */ Struct({ data: optionalKey2(Union2([Record(String4, JsonValue), Null2])) }).annotate({ identifier: "TestWebhookPayload" });
+var ApiKeyMailboxAccess = /* @__PURE__ */ Struct({
+  permissions: TupleWithRest(Tuple2([Union2([
+    Literal2("read"),
+    Literal2("update"),
+    Literal2("send"),
+    Literal2("quarantine.read")
+  ])]), [Union2([
+    Literal2("read"),
+    Literal2("update"),
+    Literal2("send"),
+    Literal2("quarantine.read")
+  ])]).annotate({ description: "`read` reads mailboxes, threads, and messages; `update` changes thread state, labels, drafts, and notes; `send` sends and replies; `quarantine.read` reads quarantined mail." }),
+  mailboxIds: optionalKey2(Union2([TupleWithRest(Tuple2([MailboxId2]), [MailboxId2]), Null2]).annotate({ description: "The mailboxes the key may act on. Omit to reach every mailbox the owner can." })),
+  sendMode: optionalKey2(Union2([MailboxSendMode2, Null2]).annotate({ description: "Defaults to `send`. With `approval`, each send waits until a person other than the key approves it." }))
+}).annotate({ identifier: "ApiKeyMailboxAccess" });
 var CreateTemplatePayload = /* @__PURE__ */ Struct({
   name: String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(200).annotate({ expected: "a string with at most 200 code points" })).check(isMaxLength(200).annotate({ expected: "a value with a length of at most 200" })),
   projectName: optionalKey2(Union2([String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(200).annotate({ expected: "a string with at most 200 code points" })).check(isMaxLength(200).annotate({ expected: "a value with a length of at most 200" })), Null2])),
@@ -24015,24 +24148,9 @@ var CreateTemplatePayload = /* @__PURE__ */ Struct({
     Literal2("alert")
   ]), Null2]), Null2])),
   isActive: optionalKey2(Union2([Boolean3, Null2])),
+  namespaceId: optionalKey2(Union2([NamespaceId2, Null2]).annotate({ description: "The namespace the new template project belongs to; the project and every entry added to it share it. Omit for organization level. A namespace-scoped key always creates in its own namespace." })),
   idempotencyKey: String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(255).annotate({ expected: "a string with at most 255 code points" })).check(isMaxLength(255).annotate({ expected: "a value with a length of at most 255" }))
 }).annotate({ identifier: "CreateTemplatePayload" });
-var TestWebhookPayload = /* @__PURE__ */ Struct({ data: optionalKey2(Union2([Record(String4, JsonValue), Null2])) }).annotate({ identifier: "TestWebhookPayload" });
-var ApiKeyMailboxAccess = /* @__PURE__ */ Struct({
-  permissions: TupleWithRest(Tuple2([Union2([
-    Literal2("read"),
-    Literal2("update"),
-    Literal2("send"),
-    Literal2("quarantine.read")
-  ])]), [Union2([
-    Literal2("read"),
-    Literal2("update"),
-    Literal2("send"),
-    Literal2("quarantine.read")
-  ])]).annotate({ description: "`read` reads mailboxes, threads, and messages; `update` changes thread state, labels, drafts, and notes; `send` sends and replies; `quarantine.read` reads quarantined mail." }),
-  mailboxIds: optionalKey2(Union2([TupleWithRest(Tuple2([MailboxId2]), [MailboxId2]), Null2]).annotate({ description: "The mailboxes the key may act on. Omit to reach every mailbox the owner can." })),
-  sendMode: optionalKey2(Union2([MailboxSendMode2, Null2]).annotate({ description: "Defaults to `send`. With `approval`, each send waits until a person other than the key approves it." }))
-}).annotate({ identifier: "ApiKeyMailboxAccess" });
 var CreateWebhookPayload = /* @__PURE__ */ Struct({
   name: String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(100).annotate({ expected: "a string with at most 100 code points" })).check(isMaxLength(100).annotate({ expected: "a value with a length of at most 100" })),
   url: String4,
@@ -24167,14 +24285,14 @@ var EmailAttachment2 = /* @__PURE__ */ Struct({
   contentType: String4,
   size: Finite.check(isInt().annotate({ expected: "an integer" })).check(isLessThanOrEqualTo3(26214400).annotate({ expected: "a value less than or equal to 26214400" })).check(isGreaterThan2(0).annotate({ expected: "a value greater than 0" }))
 }).annotate({ identifier: "EmailAttachment" });
-var TemplateData = /* @__PURE__ */ Union2([JsonObject, Null2]).annotate({ identifier: "TemplateData" });
+var TemplateData = /* @__PURE__ */ Union2([JsonObject2, Null2]).annotate({ identifier: "TemplateData" });
 var ContactConsent = /* @__PURE__ */ Struct({
   status: Union2([Literal2("opted_in"), Literal2("opted_out")]),
   source: String4,
   capturedAt: String4,
-  proof: Union2([JsonObject, Null2])
+  proof: Union2([JsonObject2, Null2])
 }).annotate({ identifier: "ContactConsent" });
-var JourneyWebhookConfig = /* @__PURE__ */ Struct({ data: optionalKey2(JsonObject) }).annotate({ identifier: "JourneyWebhookConfig" });
+var JourneyWebhookConfig = /* @__PURE__ */ Struct({ data: optionalKey2(JsonObject2) }).annotate({ identifier: "JourneyWebhookConfig" });
 var SkippedRecipient2 = /* @__PURE__ */ Struct({
   address: String4,
   reason: Union2([
@@ -24191,7 +24309,7 @@ var ContactEvent = /* @__PURE__ */ Struct({
   contactId: ContactId2,
   name: String4,
   source: Union2([Literal2("api"), Literal2("samva")]),
-  properties: JsonObject,
+  properties: JsonObject2,
   occurredAt: String4,
   recordedAt: String4
 }).annotate({ identifier: "ContactEvent" });
@@ -24224,7 +24342,7 @@ var JourneyGroupJoinedTrigger = /* @__PURE__ */ Struct({
 var JourneySendEmailConfig = /* @__PURE__ */ Struct({
   template: Union2([TemplateId2, String4.check(isPattern2(/* @__PURE__ */ new RegExp("^(?=.{1,100}$)[a-z0-9]+(?:-[a-z0-9]+)*$", "u")).annotate({ expected: "a string matching the RegExp ^(?=.{1,100}$)[a-z0-9]+(?:-[a-z0-9]+)*$" }))]),
   senderId: optionalKey2(EmailSenderId2),
-  templateData: optionalKey2(JsonObject)
+  templateData: optionalKey2(JsonObject2)
 }).annotate({ identifier: "JourneySendEmailConfig" });
 var ExtensionVersionRef = /* @__PURE__ */ Struct({
   id: ExtensionVersionId2,
@@ -24350,7 +24468,7 @@ var ApiKeyAccess = /* @__PURE__ */ Union2([Struct({ mode: Literal2("full") }), S
   mode: Literal2("restricted"),
   resources: ApiKeyResourceAccess,
   mailboxes: optionalKey2(Union2([ApiKeyMailboxAccess, Null2])),
-  namespaceId: optionalKey2(Union2([NamespaceId2, Null2]).annotate({ description: "Confines the key to one namespace: it reaches only that namespace's mailboxes. A key scoped to a namespace or to listed mailboxes holds mailbox access only." }))
+  namespaceId: optionalKey2(Union2([NamespaceId2, Null2]).annotate({ description: "Confines the key to one namespace: it reaches only that namespace's domains, senders, numbers, mailboxes, contacts, templates, and messages, never organization-level ones, and only endpoints that confine to a namespace (others answer 403). It holds grants only on `mailboxes`, `messages`, `email`, `domains`, `contacts`, and `templates`. A key scoped to listed mailboxes holds mailbox access only." }))
 })]).annotate({ identifier: "ApiKeyAccess" });
 var MessagePage = /* @__PURE__ */ Struct({
   items: ArraySchema(MessageSummary2),
@@ -24369,7 +24487,7 @@ var ContactIdentityChannel = /* @__PURE__ */ Struct({
 var CreateEventPayload = /* @__PURE__ */ Struct({
   contact: ContactEventReference,
   name: String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(255).annotate({ expected: "a string with at most 255 code points" })).check(isMaxLength(255).annotate({ expected: "a value with a length of at most 255" })).check(isPattern2(/* @__PURE__ */ new RegExp("^(?!(?:[Cc][Oo][Nn][Tt][Aa][Cc][Tt]|[Ss][Aa][Mm][Vv][Aa])\\.)[A-Za-z][A-Za-z0-9_.-]*$")).annotate({ expected: "a string matching the RegExp ^(?!(?:[Cc][Oo][Nn][Tt][Aa][Cc][Tt]|[Ss][Aa][Mm][Vv][Aa])\\.)[A-Za-z][A-Za-z0-9_.-]*$" })),
-  properties: optionalKey2(Union2([JsonObject, Null2])),
+  properties: optionalKey2(Union2([JsonObject2, Null2])),
   occurredAt: optionalKey2(Union2([String4, Null2])),
   idempotencyKey: optionalKey2(Union2([String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(255).annotate({ expected: "a string with at most 255 code points" })).check(isMaxLength(255).annotate({ expected: "a value with a length of at most 255" })), Null2]))
 }).annotate({ identifier: "CreateEventPayload" });
@@ -24698,6 +24816,7 @@ var apiStatuses = {
   NotImplementedError: 501,
   UnknownStatusError: 400,
   WhatsAppTemplateIneligibleError: 422,
+  WhatsAppServiceWindowClosedError: 422,
   InternalError: 500,
   ExternalServiceError: 502,
   GatewayTimeoutError: 504
@@ -24760,6 +24879,9 @@ var apiErrorGuidance = (error) => {
     case "MailboxSendRefusedError":
       next = "Read the original action with samva mailboxes actions get; preserve its action ID and send key. Accepted email cannot be withdrawn; uncertain work requires reconciliation. Never create a replacement key as recovery.";
       break;
+    case "WhatsAppServiceWindowClosedError":
+      next = "Free-form WhatsApp text needs the customer's open 24-hour service window. Send an approved template instead: --template <templateId> with --data.";
+      break;
     case "ConflictError":
       next = "Read the resource and resolve the conflict before retrying.";
       break;
@@ -24960,7 +25082,7 @@ var __exportAll = (all, no_symbols) => {
 };
 
 // ../sdk/dist/package.js
-var version = "0.19.0";
+var version = "0.20.0";
 
 // ../sdk/dist/client-attribution.js
 var SDK_VERSION = version;
@@ -25320,6 +25442,16 @@ var commandTree = {
     actions: { list: {}, get: {}, approve: {}, deny: {}, cancel: {}, retry: {} },
     quarantine: { list: {}, release: {}, discard: {} }
   },
+  namespaces: {
+    list: {},
+    create: {},
+    get: {},
+    update: {},
+    delete: {},
+    assign: {},
+    unassign: {},
+    usage: {}
+  },
   extensions: {
     init: {},
     build: {},
@@ -25785,6 +25917,7 @@ var getAuthenticatedJsonForContext = fn2("CliClient.getAuthenticatedJson")(funct
   return yield* isObject(body) && typeof body._tag === "string" ? toCliApiError(`Request to ${url} failed`, body) : new SamvaCliError({ message: `Request to ${url} failed: HTTP ${response.status}` });
 });
 var getAuthenticatedJson = (path) => flatMap3(resolveExecutionContext, (context) => getAuthenticatedJsonForContext(context, path));
+var postAuthenticatedJson = (path, request) => flatMap3(resolveExecutionContext, (context) => getAuthenticatedJsonForContext(context, path, request));
 
 // src/lib/output.ts
 var CLI_SCHEMA_VERSION = 1;
@@ -26437,6 +26570,7 @@ var API_KEY_STATEMENT = {
 };
 var API_KEY_RESOURCES = Object.keys(API_KEY_STATEMENT);
 var API_KEY_LEVEL_RESOURCES = API_KEY_RESOURCES.filter((resource) => resource !== "mailboxes");
+var API_KEY_MAILBOX_ACTIONS = mailboxKeyActions;
 function apiKeyAccessLevels(resource) {
   return API_KEY_STATEMENT[resource].some((action) => action !== "read") ? ["read", "write"] : ["read"];
 }
@@ -27450,6 +27584,22 @@ var SDK_OPERATION_CALLS = {
     kind: "path",
     paths: ["id"]
   },
+  namespacesAssignResource: {
+    kind: "pathPayload",
+    paths: ["id"]
+  },
+  namespacesRemoveResource: {
+    kind: "path",
+    paths: [
+      "id",
+      "type",
+      "resourceId"
+    ]
+  },
+  namespacesGetUsage: {
+    kind: "pathParams",
+    paths: ["id"]
+  },
   extensionsList: { kind: "params" },
   extensionsPublish: { kind: "payload" },
   extensionsGet: {
@@ -27546,10 +27696,6 @@ var SamvaErrorMetadata = {
     categories: ["transient"],
     retryable: true
   },
-  MailboxChannelUnsupportedError: {
-    categories: [],
-    retryable: false
-  },
   MailboxSendConflictError: {
     categories: [],
     retryable: false
@@ -28340,6 +28486,9 @@ var SamvaOperations = {
   namespacesGet: operationMetadata74,
   namespacesRemove: operationMetadata75,
   namespacesUpdate: operationMetadata76,
+  namespacesAssignResource: operationMetadata73,
+  namespacesRemoveResource: operationMetadata75,
+  namespacesGetUsage: operationMetadata74,
   operationsList: operationMetadata77,
   operationsGet: operationMetadata78,
   operationsRetry: operationMetadata79,
@@ -28919,7 +29068,7 @@ var parseGrant = (raw) => {
   if (resource === "mailboxes") {
     return new CliUsageError({
       code: "invalid_grant",
-      message: "--grant does not cover mailboxes; mailbox and namespace access are set with `samva api`."
+      message: "--grant does not cover mailboxes; use --mailbox-permission <action> (with optional --mailbox and --send-mode) instead."
     });
   }
   if (!isLevelResource(resource) || !isGrantLevel(level)) {
@@ -28936,19 +29085,52 @@ var parseGrant = (raw) => {
   }
   return { resource, level };
 };
-var accessFromFlags = (grants, fullAccess) => gen2(function* () {
-  if (fullAccess && grants.length > 0) {
+var repeated = (values) => values.find((value, index) => values.indexOf(value) !== index);
+var mailboxAccessFromFlags = (flags) => gen2(function* () {
+  if (flags.permissions.length === 0) {
+    if (flags.mailboxIds.length > 0 || isSome2(flags.sendMode)) {
+      return yield* new CliUsageError({
+        code: "mailbox_permission_required",
+        message: `--mailbox and --send-mode narrow mailbox access; also pass --mailbox-permission ${API_KEY_MAILBOX_ACTIONS.join("|")}.`
+      });
+    }
+    return;
+  }
+  const duplicatePermission = repeated(flags.permissions);
+  if (duplicatePermission !== undefined) {
+    return yield* new CliUsageError({
+      code: "invalid_mailbox_access",
+      message: `--mailbox-permission names ${duplicatePermission} more than once.`
+    });
+  }
+  const duplicateMailbox = repeated(flags.mailboxIds);
+  if (duplicateMailbox !== undefined) {
+    return yield* new CliUsageError({
+      code: "invalid_mailbox_access",
+      message: `--mailbox names ${duplicateMailbox} more than once.`
+    });
+  }
+  return {
+    permissions: flags.permissions,
+    ...flags.mailboxIds.length > 0 ? { mailboxIds: flags.mailboxIds } : {},
+    ...isSome2(flags.sendMode) ? { sendMode: flags.sendMode.value } : {}
+  };
+});
+var accessFromFlags = (grants, fullAccess, mailbox, namespace) => gen2(function* () {
+  const restrictedFlags = grants.length > 0 || mailbox.permissions.length > 0 || mailbox.mailboxIds.length > 0 || isSome2(mailbox.sendMode) || isSome2(namespace);
+  if (fullAccess && restrictedFlags) {
     return yield* new CliUsageError({
       code: "access_conflict",
-      message: "Pass either --full-access or --grant <resource>=read|write, not both."
+      message: "Pass either --full-access or restricted access (--grant, --mailbox-permission, --namespace), not both."
     });
   }
   if (fullAccess)
     return { mode: "full" };
-  if (grants.length === 0) {
+  const mailboxes = yield* mailboxAccessFromFlags(mailbox);
+  if (grants.length === 0 && mailboxes === undefined) {
     return yield* new CliUsageError({
       code: "access_required",
-      message: "Choose the key's access: --full-access, or one or more --grant <resource>=read|write."
+      message: "Choose the key's access: --full-access, or one or more --grant <resource>=read|write and/or --mailbox-permission <action>."
     });
   }
   const resources = {};
@@ -28964,7 +29146,12 @@ var accessFromFlags = (grants, fullAccess) => gen2(function* () {
     }
     resources[grant.resource] = grant.level;
   }
-  return { mode: "restricted", resources };
+  return {
+    mode: "restricted",
+    resources,
+    ...mailboxes === undefined ? {} : { mailboxes },
+    ...isSome2(namespace) ? { namespaceId: namespace.value } : {}
+  };
 });
 var parseExpiresAt = (raw) => Number.isNaN(Date.parse(raw)) ? fail6(new CliUsageError({
   code: "invalid_expires_at",
@@ -28978,7 +29165,12 @@ var describeAccess = (access) => {
     return "full";
   const grants = Object.entries(access.resources).filter(([, level]) => level !== undefined).map(([resource, level]) => `${resource}:${level}`);
   if (access.mailboxes !== undefined && access.mailboxes !== null) {
-    grants.push(`mailboxes:${access.mailboxes.permissions.join("+")}`);
+    const { permissions, mailboxIds, sendMode } = access.mailboxes;
+    const scope = [
+      ...mailboxIds === undefined || mailboxIds === null ? [] : [mailboxIds.join("+")],
+      ...sendMode === undefined || sendMode === "send" ? [] : [`${sendMode} sends`]
+    ];
+    grants.push(`mailboxes:${permissions.join("+")}${scope.length === 0 ? "" : ` [${scope.join("; ")}]`}`);
   }
   if (access.namespaceId !== undefined && access.namespaceId !== null)
     grants.push(`namespace:${access.namespaceId}`);
@@ -29057,11 +29249,19 @@ var create2 = make29("create", {
   description: String9("description").pipe(withDescription2("What the key is for"), optional4),
   expiresAt: String9("expires-at").pipe(withDescription2("When the key stops working, an ISO 8601 instant"), optional4),
   grant: String9("grant").pipe(withDescription2(`Give a restricted key a resource at a level, <resource>=read|write (repeatable). Resources: ${GRANTABLE_RESOURCES.join(", ")}`), atLeast2(0)),
-  fullAccess: Boolean6("full-access").pipe(withDescription2("Give the key its owner's full access instead of --grant"), withDefault5(false)),
+  mailboxPermission: Literals3("mailbox-permission", API_KEY_MAILBOX_ACTIONS).pipe(withDescription2(`Let a restricted key work in mailboxes with this action (repeatable): ${API_KEY_MAILBOX_ACTIONS.join(", ")}`), atLeast2(0)),
+  mailbox: String9("mailbox").pipe(withSchema2(MailboxId), withDescription2("Confine the mailbox access to this mailbox (repeatable); omit for every mailbox the owner reaches"), atLeast2(0)),
+  sendMode: Literals3("send-mode", mailboxSendModes).pipe(withDescription2("With approval, each send waits until a person other than the key approves it (default send)"), optional4),
+  namespace: String9("namespace").pipe(withSchema2(NamespaceId), withDescription2("Confine a restricted key to one namespace (ns_...)"), optional4),
+  fullAccess: Boolean6("full-access").pipe(withDescription2("Give the key its owner's full access instead of restricted access"), withDefault5(false)),
   dryRun: dryRunFlag,
   json: jsonFlag
 }).pipe(withDescription3("Create an API key. The secret is shown once; the API refuses access you do not hold."), withExamples([
   { command: "samva api-keys create --name ci --grant email=write --dry-run" },
+  {
+    command: "samva api-keys create --name agent --mailbox-permission read --mailbox-permission send --mailbox mbx_1234567890123456 --send-mode approval",
+    description: "A key that works in one mailbox and needs a person to approve each send"
+  },
   {
     command: "samva api-keys create --name ci --grant email=write --json | jq -r .data.key",
     description: "Pipe the secret into another tool"
@@ -29069,8 +29269,20 @@ var create2 = make29("create", {
   {
     command: "samva api-keys create --name deploy --full-access --expires-at 2027-01-01T00:00:00Z"
   }
-]), withHandler(({ name, description, expiresAt, grant, fullAccess, dryRun, json }) => withJsonQuiet(json, gen2(function* () {
-  const access = yield* accessFromFlags(grant, fullAccess);
+]), withHandler(({
+  name,
+  description,
+  expiresAt,
+  grant,
+  mailboxPermission,
+  mailbox,
+  sendMode,
+  namespace,
+  fullAccess,
+  dryRun,
+  json
+}) => withJsonQuiet(json, gen2(function* () {
+  const access = yield* accessFromFlags(grant, fullAccess, { permissions: mailboxPermission, mailboxIds: mailbox, sendMode }, namespace);
   const expires = yield* match(expiresAt, {
     onNone: () => void_3,
     onSome: parseExpiresAt
@@ -29086,7 +29298,11 @@ var create2 = make29("create", {
   });
   if (dryRun) {
     if (json) {
-      return yield* printJson({ dryRun: true, action: "api-keys.create", request: payload });
+      return yield* printJson({
+        dryRun: true,
+        action: "api-keys.create",
+        request: payload
+      });
     }
     return yield* printFields([
       ["Action", "api-keys.create"],
@@ -29109,13 +29325,17 @@ var update3 = make29("update", {
   id: idArgument,
   name: String9("name").pipe(withDescription2("New key name"), optional4),
   description: String9("description").pipe(withDescription2("New description"), optional4),
+  sendMode: Literals3("send-mode", mailboxSendModes).pipe(withDescription2("Change a mailbox key's send mode: approval holds each send for a person other than the key, send releases them. Takes a person signed in with samva login"), optional4),
   dryRun: dryRunFlag,
   json: jsonFlag
-}).pipe(withDescription3("Rename an API key or change its description. Access is fixed at creation; create a new key to change it."), withExamples([{ command: "samva api-keys update key_abc123 --name ci-prod --dry-run" }]), withHandler(({ id, name, description, dryRun, json }) => withJsonQuiet(json, gen2(function* () {
-  if (isNone2(name) && isNone2(description)) {
+}).pipe(withDescription3("Rename an API key, change its description, or change a mailbox key's send mode. Its other access is fixed at creation; create a new key to change it."), withExamples([
+  { command: "samva api-keys update key_abc123 --name ci-prod --dry-run" },
+  { command: "samva api-keys update key_abc123 --send-mode approval" }
+]), withHandler(({ id, name, description, sendMode, dryRun, json }) => withJsonQuiet(json, gen2(function* () {
+  if (isNone2(name) && isNone2(description) && isNone2(sendMode)) {
     return yield* new CliUsageError({
       code: "update_required",
-      message: "Pass --name, --description, or both."
+      message: "Pass --name, --description, --send-mode, or a combination."
     });
   }
   const payload = yield* decodeRequest(ApiKeysUpdateRequestJson, {
@@ -29123,6 +29343,10 @@ var update3 = make29("update", {
     ...match(description, {
       onNone: () => ({}),
       onSome: (value) => ({ description: value })
+    }),
+    ...match(sendMode, {
+      onNone: () => ({}),
+      onSome: (value) => ({ mailboxes: { sendMode: value } })
     })
   });
   if (dryRun) {
@@ -29138,7 +29362,8 @@ var update3 = make29("update", {
       ["Action", "api-keys.update"],
       ["API key", id],
       ["Name", payload.name],
-      ["Description", payload.description]
+      ["Description", payload.description],
+      ["Send mode", payload.mailboxes?.sendMode]
     ]);
   }
   const client = yield* getClientProvider;
@@ -53935,6 +54160,20 @@ var CampaignRunId2 = /* @__PURE__ */ String4.check(isPattern2(/* @__PURE__ */ ne
   expected: "a string matching the RegExp ^crun_[0-9a-hjkmnp-tv-z]{16,24}$",
   identifier: "CampaignRunId"
 })).pipe(brand("CampaignRunId"));
+var CampaignRunSkippedReason = /* @__PURE__ */ Struct({
+  reason: Union2([
+    Literal2("unsubscribed"),
+    Literal2("blocked"),
+    Literal2("suppressed"),
+    Literal2("opted_out"),
+    Literal2("unreachable"),
+    Literal2("no_identity"),
+    Literal2("inactive"),
+    Literal2("run_cancelled"),
+    Literal2("run_failed")
+  ]),
+  count: Finite.check(isFinite4().annotate({ expected: "a finite number" }))
+}).annotate({ identifier: "CampaignRunSkippedReason" });
 var CampaignRecipientId2 = /* @__PURE__ */ String4.check(isPattern2(/* @__PURE__ */ new RegExp("^crcpt_[0-9a-hjkmnp-tv-z]{16,24}$", "u")).annotate({
   expected: "a string matching the RegExp ^crcpt_[0-9a-hjkmnp-tv-z]{16,24}$",
   identifier: "CampaignRecipientId"
@@ -53987,6 +54226,8 @@ var CampaignRecipientPage = /* @__PURE__ */ Struct({
       Literal2("unsubscribed"),
       Literal2("blocked"),
       Literal2("suppressed"),
+      Literal2("opted_out"),
+      Literal2("unreachable"),
       Literal2("no_identity"),
       Literal2("inactive"),
       Literal2("run_cancelled"),
@@ -54063,6 +54304,7 @@ var CampaignRun = /* @__PURE__ */ Struct({
   dispatchedCount: Finite.check(isFinite4().annotate({ expected: "a finite number" })),
   failedCount: Finite.check(isFinite4().annotate({ expected: "a finite number" })),
   skippedCount: Finite.check(isFinite4().annotate({ expected: "a finite number" })),
+  skippedReasons: ArraySchema(CampaignRunSkippedReason),
   estimatedCompletionAt: Union2([String4, Null2]),
   failureReason: Union2([String4, Null2]),
   holdReason: Union2([String4, Null2]),
@@ -54900,6 +55142,10 @@ var printRun = (run) => printFields([
   ["Dispatched", String(run.dispatchedCount)],
   ["Failed", String(run.failedCount)],
   ["Skipped", String(run.skippedCount)],
+  [
+    "Skipped by reason",
+    (run.skippedReasons ?? []).map(({ reason, count }) => `${reason} ${count}`).join(", ")
+  ],
   ["Failure", run.failureReason]
 ]);
 var runCreate = make29("create", {
@@ -54993,7 +55239,11 @@ var runList = make29("list", {
       ["Scheduled for", run.scheduledFor],
       ["Dispatched", String(run.dispatchedCount)],
       ["Failed", String(run.failedCount)],
-      ["Skipped", String(run.skippedCount)]
+      ["Skipped", String(run.skippedCount)],
+      [
+        "Skipped by reason",
+        run.skippedReasons.map(({ reason, count }) => `${reason} ${count}`).join(", ")
+      ]
     ]);
     yield* log("");
   }
@@ -55305,6 +55555,7 @@ var ContactProfileUpdate = /* @__PURE__ */ Struct({
 }).annotate({ identifier: "ContactProfileUpdate" });
 var ContactSummary = /* @__PURE__ */ Struct({
   id: ContactId2,
+  namespaceId: Union2([NamespaceId2, Null2]),
   name: String4,
   displayName: Union2([String4, Null2]),
   status: Union2([
@@ -55327,6 +55578,7 @@ var ContactPage = /* @__PURE__ */ Struct({
 }).annotate({ identifier: "ContactPage" });
 var Contact = /* @__PURE__ */ Struct({
   id: ContactId2,
+  namespaceId: Union2([NamespaceId2, Null2]),
   name: String4,
   displayName: Union2([String4, Null2]),
   avatar: Union2([String4, Null2]),
@@ -55342,13 +55594,14 @@ var Contact = /* @__PURE__ */ Struct({
   profile: Union2([ContactProfile, Null2]),
   preferences: Union2([ContactPreferences, Null2]),
   tags: ArraySchema(String4),
-  metadata: Union2([JsonObject, Null2]),
+  metadata: Union2([JsonObject2, Null2]),
   createdAt: String4,
   updatedAt: String4
 }).annotate({ identifier: "Contact" });
 var ContactsListQuery = /* @__PURE__ */ Struct({
   limit: optionalKey2(Union2([String4, Null2])),
   cursor: optionalKey2(Union2([Cursor, Null2])),
+  namespaceId: optionalKey2(Union2([NamespaceId2, Null2])),
   search: optionalKey2(Union2([String4, Null2])),
   status: optionalKey2(Union2([Union2([
     Literal2("active"),
@@ -55369,6 +55622,7 @@ var ContactsList422 = ValidationError2;
 var ContactsList500 = InternalError2;
 var ContactsList504 = GatewayTimeoutError2;
 var ContactsCreateRequestJson = /* @__PURE__ */ Struct({
+  namespaceId: optionalKey2(Union2([NamespaceId2, Null2])),
   name: String4,
   displayName: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
   avatar: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
@@ -55384,12 +55638,13 @@ var ContactsCreateRequestJson = /* @__PURE__ */ Struct({
   ]), Null2])),
   statusReason: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
   externalId: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
-  metadata: optionalKey2(Union2([Union2([JsonObject, Null2]), Null2]))
+  metadata: optionalKey2(Union2([Union2([JsonObject2, Null2]), Null2]))
 });
 var ContactsCreate201 = Contact;
 var ContactsCreate401 = UnauthorizedError2;
 var ContactsCreate402 = PaymentRequiredError2;
 var ContactsCreate403 = ForbiddenError2;
+var ContactsCreate404 = ResourceNotFoundError2;
 var ContactsCreate409 = ConflictError2;
 var ContactsCreate422 = ValidationError2;
 var ContactsCreate500 = InternalError2;
@@ -55427,7 +55682,7 @@ var ContactsUpdateRequestJson = /* @__PURE__ */ Struct({
   ]), Null2])),
   statusReason: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
   externalId: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
-  metadata: optionalKey2(Union2([JsonObject, Null2]))
+  metadata: optionalKey2(Union2([JsonObject2, Null2]))
 });
 var ContactsUpdate200 = Contact;
 var ContactsUpdate401 = UnauthorizedError2;
@@ -55512,7 +55767,7 @@ var ContactsSetConsentRequestJson = /* @__PURE__ */ Struct({
   status: Union2([Literal2("opted_in"), Literal2("opted_out")]),
   source: String4.annotate({ description: "Where the consent was captured, such as a form URL or a checkout step." }).check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(200).annotate({ expected: "a string with at most 200 code points" })).check(isMaxLength(200).annotate({ expected: "a value with a length of at most 200" })),
   capturedAt: String4,
-  proof: optionalKey2(Union2([JsonObject, Null2]))
+  proof: optionalKey2(Union2([JsonObject2, Null2]))
 });
 var ContactsSetConsent200 = Contact;
 var ContactsSetConsent401 = UnauthorizedError2;
@@ -55551,6 +55806,7 @@ var ContactsBulkDelete500 = InternalError2;
 var ContactsBulkDelete502 = BillingProviderError;
 var ContactsBulkDelete504 = GatewayTimeoutError2;
 var ContactsBulkImportRequestJson = /* @__PURE__ */ Struct({
+  namespaceId: optionalKey2(Union2([NamespaceId2, Null2])),
   contacts: ArraySchema(Struct({
     name: String4,
     displayName: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
@@ -55567,7 +55823,7 @@ var ContactsBulkImportRequestJson = /* @__PURE__ */ Struct({
     ]), Null2])),
     statusReason: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
     externalId: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
-    metadata: optionalKey2(Union2([Union2([JsonObject, Null2]), Null2]))
+    metadata: optionalKey2(Union2([Union2([JsonObject2, Null2]), Null2]))
   })),
   onConflict: optionalKey2(Union2([Union2([Literal2("skip"), Literal2("update")]), Null2]))
 });
@@ -55592,6 +55848,7 @@ var ContactsBulkImport200 = /* @__PURE__ */ Struct({
 var ContactsBulkImport401 = UnauthorizedError2;
 var ContactsBulkImport402 = PaymentRequiredError2;
 var ContactsBulkImport403 = ForbiddenError2;
+var ContactsBulkImport404 = ResourceNotFoundError2;
 var ContactsBulkImport422 = ValidationError2;
 var ContactsBulkImport500 = InternalError2;
 var ContactsBulkImport502 = BillingProviderError;
@@ -55653,6 +55910,7 @@ var ContactsExport422 = ValidationError2;
 var ContactsExport500 = InternalError2;
 var ContactsExport504 = GatewayTimeoutError2;
 var ContactsFindRequestJson = /* @__PURE__ */ Struct({
+  namespaceId: optionalKey2(Union2([NamespaceId2, Null2])),
   email: optionalKey2(Union2([String4, Null2])),
   phone: optionalKey2(Union2([String4, Null2])),
   externalId: optionalKey2(Union2([String4, Null2]))
@@ -55660,11 +55918,13 @@ var ContactsFindRequestJson = /* @__PURE__ */ Struct({
 var ContactsFind200 = /* @__PURE__ */ Union2([Contact, Null2]);
 var ContactsFind401 = UnauthorizedError2;
 var ContactsFind403 = ForbiddenError2;
+var ContactsFind404 = ResourceNotFoundError2;
 var ContactsFind409 = ConflictError2;
 var ContactsFind422 = ValidationError2;
 var ContactsFind500 = InternalError2;
 var ContactsFind504 = GatewayTimeoutError2;
 var ContactsFindOrCreateRequestJson = /* @__PURE__ */ Struct({
+  namespaceId: optionalKey2(Union2([NamespaceId2, Null2])),
   lookup: ContactLookup,
   create: optionalKey2(Union2([Struct({
     name: optionalKey2(Union2([String4, Null2])),
@@ -55682,6 +55942,7 @@ var ContactsFindOrCreate200 = /* @__PURE__ */ Struct({
 var ContactsFindOrCreate401 = UnauthorizedError2;
 var ContactsFindOrCreate402 = PaymentRequiredError2;
 var ContactsFindOrCreate403 = ForbiddenError2;
+var ContactsFindOrCreate404 = ResourceNotFoundError2;
 var ContactsFindOrCreate409 = ConflictError2;
 var ContactsFindOrCreate422 = ValidationError2;
 var ContactsFindOrCreate500 = InternalError2;
@@ -55704,6 +55965,7 @@ var ContactsGroup = class extends make37("Contacts").add(get5("contactsList", "/
     ContactsCreate401.pipe(status(401)),
     ContactsCreate402.pipe(status(402)),
     ContactsCreate403.pipe(status(403)),
+    ContactsCreate404.pipe(status(404)),
     ContactsCreate409.pipe(status(409)),
     ContactsCreate422.pipe(status(422)),
     ContactsCreate500,
@@ -55860,6 +56122,7 @@ var ContactsGroup = class extends make37("Contacts").add(get5("contactsList", "/
     ContactsBulkImport401.pipe(status(401)),
     ContactsBulkImport402.pipe(status(402)),
     ContactsBulkImport403.pipe(status(403)),
+    ContactsBulkImport404.pipe(status(404)),
     ContactsBulkImport422.pipe(status(422)),
     ContactsBulkImport500,
     ContactsBulkImport502.pipe(status(502)),
@@ -55903,6 +56166,7 @@ var ContactsGroup = class extends make37("Contacts").add(get5("contactsList", "/
   error: [
     ContactsFind401.pipe(status(401)),
     ContactsFind403.pipe(status(403)),
+    ContactsFind404.pipe(status(404)),
     ContactsFind409.pipe(status(409)),
     ContactsFind422.pipe(status(422)),
     ContactsFind500,
@@ -55915,6 +56179,7 @@ var ContactsGroup = class extends make37("Contacts").add(get5("contactsList", "/
     ContactsFindOrCreate401.pipe(status(401)),
     ContactsFindOrCreate402.pipe(status(402)),
     ContactsFindOrCreate403.pipe(status(403)),
+    ContactsFindOrCreate404.pipe(status(404)),
     ContactsFindOrCreate409.pipe(status(409)),
     ContactsFindOrCreate422.pipe(status(422)),
     ContactsFindOrCreate500,
@@ -55930,6 +56195,15 @@ var list7 = /* @__PURE__ */ make43("contactsList");
 var get13 = /* @__PURE__ */ make43("contactsGet");
 var listEvents = /* @__PURE__ */ forGroup(ContactEventsGroup)("contactEventsListEvents");
 
+// src/lib/namespace.ts
+var namespaceFlag = (what) => String9("namespace").pipe(withSchema2(NamespaceId), withDescription2(what === "list" ? "Only resources in this namespace (ns_...)" : "Place the resource in this namespace (ns_...); omit for organization level"), optional4);
+var namespaceField = (namespace) => match(namespace, {
+  onNone: () => ({}),
+  onSome: (namespaceId) => ({ namespaceId })
+});
+var placedAsRequested = (namespace, existing) => isNone2(namespace) || existing === namespace.value;
+var placementLabel = (namespaceId) => namespaceId === null ? "organization level" : `namespace ${namespaceId}`;
+
 // src/commands/contacts.ts
 var optionalString = (name, description) => String9(name).pipe(withDescription2(description), optional4);
 var list8 = make29("list", {
@@ -55942,6 +56216,7 @@ var list8 = make29("list", {
   limit: Int5("limit").pipe(withDescription2("Maximum contacts per page"), optional4),
   after: optionalString("after", "Only contacts created after this ISO 8601 instant"),
   before: optionalString("before", "Only contacts created before this ISO 8601 instant"),
+  namespace: namespaceFlag("list"),
   all: Boolean6("all").pipe(withDescription2("Traverse every page (requires --jsonl)"), withDefault5(false)),
   json: jsonFlag
 }).pipe(withDescription3("List and search contacts with optional custom-field projection and filtering"), withExamples([
@@ -55959,6 +56234,7 @@ var list8 = make29("list", {
   limit,
   after,
   before,
+  namespace,
   all,
   json
 }) => gen2(function* () {
@@ -55989,7 +56265,8 @@ var list8 = make29("list", {
     customFieldValue: getOrUndefined(customFieldValue),
     limit: getOrUndefined(limit)?.toString(),
     after: getOrUndefined(after),
-    before: getOrUndefined(before)
+    before: getOrUndefined(before),
+    ...namespaceField(namespace)
   };
   const listPage = (pageCursor) => list7({ ...query, cursor: pageCursor }).pipe(client.provide, mapError2((error) => toCliApiError("Could not list contacts", error, { cursor: pageCursor ?? null })));
   let nextCursor = getOrUndefined(cursor);
@@ -56014,6 +56291,7 @@ var list8 = make29("list", {
           ["Last active", contact.lastActiveAt],
           ["Created", contact.createdAt],
           ["Status", contact.status],
+          ["Namespace", contact.namespaceId ?? "organization"],
           ["Tags", contact.tags.join(", ")],
           [
             "Custom fields",
@@ -56044,6 +56322,7 @@ var get14 = make29("get", {
     ["Display name", contact.displayName],
     ["Avatar", contact.avatar],
     ["Status", contact.status],
+    ["Namespace", contact.namespaceId ?? "organization"],
     ["Reason", contact.statusReason],
     ["External ID", contact.externalId],
     ["Identities", JSON.stringify(contact.identities)],
@@ -56418,6 +56697,7 @@ var EmailDomainPage = /* @__PURE__ */ Struct({
     ]),
     dkimSelector: optionalKey2(Union2([String4, Null2])),
     dkimPublicKey: optionalKey2(Union2([String4, Null2])),
+    namespaceId: Union2([NamespaceId2, Null2]).annotate({ description: "The namespace the domain belongs to, or null at organization level. Only that namespace's keys and organization-wide callers reach it." }),
     isDefault: Boolean3,
     deliverability: DeliverabilityFacts,
     series: SendsSeries,
@@ -56459,6 +56739,7 @@ var EmailDomainDetailed = /* @__PURE__ */ Struct({
     priority: optionalKey2(Union2([Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" })), Null2]))
   })),
   verifiedAt: Union2([String4, Null2]),
+  namespaceId: Union2([NamespaceId2, Null2]).annotate({ description: "The namespace the domain belongs to, or null at organization level. Only that namespace's keys and organization-wide callers reach it." }),
   isDefault: Boolean3,
   deliverability: DeliverabilityFacts,
   createdAt: String4,
@@ -56651,6 +56932,7 @@ var EmailSenderPage = /* @__PURE__ */ Struct({
     email: String4,
     name: Union2([String4, Null2]),
     domainId: Union2([EmailDomainId2, Null2]),
+    namespaceId: Union2([NamespaceId2, Null2]).annotate({ description: "The namespace the sender belongs to, or null at organization level. A sender on a domain takes the domain's namespace." }),
     verificationStatus: Union2([
       Literal2("pending"),
       Literal2("verified"),
@@ -57069,7 +57351,8 @@ var EmailGetCatchAllStats504 = GatewayTimeoutError2;
 var EmailListDomainsQuery = /* @__PURE__ */ Struct({
   limit: optionalKey2(Union2([String4, Null2])),
   cursor: optionalKey2(Union2([Cursor, Null2])),
-  sendable: optionalKey2(Union2([Literal2("true"), Null2]))
+  sendable: optionalKey2(Union2([Literal2("true"), Null2])),
+  namespaceId: optionalKey2(Union2([NamespaceId2, Null2]))
 });
 var EmailListDomains200 = EmailDomainPage;
 var EmailListDomains401 = UnauthorizedError2;
@@ -57082,12 +57365,14 @@ var EmailAddDomainRequestJson = /* @__PURE__ */ Struct({
   connection: optionalKey2(Union2([Struct({
     connectionId: String4,
     zone: String4
-  }), Null2]))
+  }), Null2])),
+  namespaceId: optionalKey2(Union2([NamespaceId2, Null2]))
 });
 var EmailAddDomain201 = EmailDomainDetailed;
 var EmailAddDomain401 = UnauthorizedError2;
 var EmailAddDomain402 = PaymentRequiredError2;
 var EmailAddDomain403 = ForbiddenError2;
+var EmailAddDomain404 = ResourceNotFoundError2;
 var EmailAddDomain409 = ConflictError2;
 var EmailAddDomain422 = ValidationError2;
 var EmailAddDomain429 = RateLimitedError2;
@@ -57139,6 +57424,7 @@ var EmailGetCustomTrackingPathParams = /* @__PURE__ */ Struct({ id: EmailDomainI
 var EmailGetCustomTracking200 = CustomTrackingStatus;
 var EmailGetCustomTracking401 = UnauthorizedError2;
 var EmailGetCustomTracking403 = ForbiddenError2;
+var EmailGetCustomTracking404 = ResourceNotFoundError2;
 var EmailGetCustomTracking422 = ValidationError2;
 var EmailGetCustomTracking500 = InternalError2;
 var EmailGetCustomTracking504 = GatewayTimeoutError2;
@@ -57147,6 +57433,7 @@ var EmailEnableCustomTrackingRequestJson = /* @__PURE__ */ Struct({ label: optio
 var EmailEnableCustomTracking200 = CustomTrackingStatus;
 var EmailEnableCustomTracking401 = UnauthorizedError2;
 var EmailEnableCustomTracking403 = ForbiddenError2;
+var EmailEnableCustomTracking404 = ResourceNotFoundError2;
 var EmailEnableCustomTracking409 = ConflictError2;
 var EmailEnableCustomTracking422 = ValidationError2;
 var EmailEnableCustomTracking500 = InternalError2;
@@ -57156,6 +57443,7 @@ var EmailDisableCustomTrackingPathParams = /* @__PURE__ */ Struct({ id: EmailDom
 var EmailDisableCustomTracking200 = SuccessResult;
 var EmailDisableCustomTracking401 = UnauthorizedError2;
 var EmailDisableCustomTracking403 = ForbiddenError2;
+var EmailDisableCustomTracking404 = ResourceNotFoundError2;
 var EmailDisableCustomTracking409 = ConflictError2;
 var EmailDisableCustomTracking422 = ValidationError2;
 var EmailDisableCustomTracking500 = InternalError2;
@@ -57188,6 +57476,7 @@ var EmailCompleteCustomTrackingDomainConnectRequestJson = /* @__PURE__ */ Struct
 var EmailCompleteCustomTrackingDomainConnect200 = CustomTrackingDomainConnectCompleteResult;
 var EmailCompleteCustomTrackingDomainConnect401 = UnauthorizedError2;
 var EmailCompleteCustomTrackingDomainConnect403 = ForbiddenError2;
+var EmailCompleteCustomTrackingDomainConnect404 = ResourceNotFoundError2;
 var EmailCompleteCustomTrackingDomainConnect422 = ValidationError2;
 var EmailCompleteCustomTrackingDomainConnect500 = InternalError2;
 var EmailCompleteCustomTrackingDomainConnect504 = GatewayTimeoutError2;
@@ -57297,6 +57586,7 @@ var EmailDetectRegistrar200 = /* @__PURE__ */ Struct({
 });
 var EmailDetectRegistrar401 = UnauthorizedError2;
 var EmailDetectRegistrar403 = ForbiddenError2;
+var EmailDetectRegistrar404 = ResourceNotFoundError2;
 var EmailDetectRegistrar422 = ValidationError2;
 var EmailDetectRegistrar500 = InternalError2;
 var EmailDetectRegistrar504 = GatewayTimeoutError2;
@@ -57540,7 +57830,8 @@ var EmailListSendersQuery = /* @__PURE__ */ Struct({
     Literal2("failed")
   ]), Null2])),
   isActive: optionalKey2(Union2([String4, Null2])),
-  isDefault: optionalKey2(Union2([String4, Null2]))
+  isDefault: optionalKey2(Union2([String4, Null2])),
+  namespaceId: optionalKey2(Union2([NamespaceId2, Null2]))
 });
 var EmailListSenders200 = EmailSenderPage;
 var EmailListSenders401 = UnauthorizedError2;
@@ -57553,7 +57844,8 @@ var EmailAddSenderRequestJson = /* @__PURE__ */ Struct({
   email: String4,
   domainId: optionalKey2(Union2([EmailDomainId2, Null2])),
   name: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
-  replyToEmails: optionalKey2(Union2([Union2([ArraySchema(String4), Null2]), Null2]))
+  replyToEmails: optionalKey2(Union2([Union2([ArraySchema(String4), Null2]), Null2])),
+  namespaceId: optionalKey2(Union2([NamespaceId2, Null2]))
 });
 var EmailAddSender201 = /* @__PURE__ */ Struct({
   id: EmailSenderId2,
@@ -57587,6 +57879,7 @@ var EmailGetSender200 = /* @__PURE__ */ Struct({
   email: String4,
   name: Union2([String4, Null2]),
   domainId: Union2([EmailDomainId2, Null2]),
+  namespaceId: Union2([NamespaceId2, Null2]).annotate({ description: "The namespace the sender belongs to, or null at organization level. A sender on a domain takes the domain's namespace." }),
   verificationStatus: Union2([
     Literal2("pending"),
     Literal2("verified"),
@@ -57842,13 +58135,14 @@ var EmailGroup = class extends make37("Email").add(get5("emailListBlocks", "/v1/
     EmailListDomains500,
     EmailListDomains504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.listDomains").annotate(Summary, "List sending domains").annotate(Description, "Returns the organization's sending domains, newest first. Pass `nextCursor` back as `cursor` for the next page; it is null on the last page. `sendable=true` lists only domains a send can use now: active, and verified, or verified before and degraded since. Each row carries `deliverability` (bounce and complaint rates over the last 24 hours, the window the 5% bounce limit is enforced over) and `series`, the last 14 days of daily email sends attributed to the domain, oldest first."), post("emailAddDomain", "/v1/email/domains", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.listDomains").annotate(Summary, "List sending domains").annotate(Description, "Returns the organization's sending domains, newest first. A namespace-scoped key lists only its namespace's domains; an organization-wide caller lists every domain, or one namespace's with `namespaceId`. Pass `nextCursor` back as `cursor` for the next page; it is null on the last page. `sendable=true` lists only domains a send can use now: active, and verified, or verified before and degraded since. Each row carries `deliverability` (bounce and complaint rates over the last 24 hours, the window the 5% bounce limit is enforced over) and `series`, the last 14 days of daily email sends attributed to the domain, oldest first."), post("emailAddDomain", "/v1/email/domains", {
   payload: EmailAddDomainRequestJson,
   success: EmailAddDomain201.pipe(status(201)),
   error: [
     EmailAddDomain401.pipe(status(401)),
     EmailAddDomain402.pipe(status(402)),
     EmailAddDomain403.pipe(status(403)),
+    EmailAddDomain404.pipe(status(404)),
     EmailAddDomain409.pipe(status(409)),
     EmailAddDomain422.pipe(status(422)),
     EmailAddDomain429.pipe(status(429)),
@@ -57856,7 +58150,7 @@ var EmailGroup = class extends make37("Email").add(get5("emailListBlocks", "/v1/
     EmailAddDomain502.pipe(status(502)),
     EmailAddDomain504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.addDomain").annotate(Summary, "Add a sending domain").annotate(Description, "Registers a domain for sending and returns it with the DNS records required to verify ownership and configure DKIM. Responds with 201. Supplying a connection attaches the domain to that DNS account; the domain must sit inside the zone given with it. When Samva cannot register another sending domain right now, this responds with 429 and no domain is created. A banned organization is refused with 403."), get5("emailGetDomainById", "/v1/email/domains/:id", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.addDomain").annotate(Summary, "Add a sending domain").annotate(Description, "Registers a domain for sending and returns it with the DNS records required to verify ownership and configure DKIM. Responds with 201. Supplying a connection attaches the domain to that DNS account; the domain must sit inside the zone given with it. When Samva cannot register another sending domain right now, this responds with 429 and no domain is created. A banned organization is refused with 403. `namespaceId` places the domain in a namespace, and only that namespace's keys and organization-wide callers reach it; a namespace-scoped key always adds to its own namespace."), get5("emailGetDomainById", "/v1/email/domains/:id", {
   params: EmailGetDomainByIdPathParams,
   success: EmailGetDomainById200,
   error: [
@@ -57897,6 +58191,7 @@ var EmailGroup = class extends make37("Email").add(get5("emailListBlocks", "/v1/
   error: [
     EmailGetCustomTracking401.pipe(status(401)),
     EmailGetCustomTracking403.pipe(status(403)),
+    EmailGetCustomTracking404.pipe(status(404)),
     EmailGetCustomTracking422.pipe(status(422)),
     EmailGetCustomTracking500,
     EmailGetCustomTracking504.pipe(status(504))
@@ -57908,6 +58203,7 @@ var EmailGroup = class extends make37("Email").add(get5("emailListBlocks", "/v1/
   error: [
     EmailEnableCustomTracking401.pipe(status(401)),
     EmailEnableCustomTracking403.pipe(status(403)),
+    EmailEnableCustomTracking404.pipe(status(404)),
     EmailEnableCustomTracking409.pipe(status(409)),
     EmailEnableCustomTracking422.pipe(status(422)),
     EmailEnableCustomTracking500,
@@ -57920,6 +58216,7 @@ var EmailGroup = class extends make37("Email").add(get5("emailListBlocks", "/v1/
   error: [
     EmailDisableCustomTracking401.pipe(status(401)),
     EmailDisableCustomTracking403.pipe(status(403)),
+    EmailDisableCustomTracking404.pipe(status(404)),
     EmailDisableCustomTracking409.pipe(status(409)),
     EmailDisableCustomTracking422.pipe(status(422)),
     EmailDisableCustomTracking500,
@@ -57957,6 +58254,7 @@ var EmailGroup = class extends make37("Email").add(get5("emailListBlocks", "/v1/
   error: [
     EmailCompleteCustomTrackingDomainConnect401.pipe(status(401)),
     EmailCompleteCustomTrackingDomainConnect403.pipe(status(403)),
+    EmailCompleteCustomTrackingDomainConnect404.pipe(status(404)),
     EmailCompleteCustomTrackingDomainConnect422.pipe(status(422)),
     EmailCompleteCustomTrackingDomainConnect500,
     EmailCompleteCustomTrackingDomainConnect504.pipe(status(504))
@@ -58079,6 +58377,7 @@ var EmailGroup = class extends make37("Email").add(get5("emailListBlocks", "/v1/
   error: [
     EmailDetectRegistrar401.pipe(status(401)),
     EmailDetectRegistrar403.pipe(status(403)),
+    EmailDetectRegistrar404.pipe(status(404)),
     EmailDetectRegistrar422.pipe(status(422)),
     EmailDetectRegistrar500,
     EmailDetectRegistrar504.pipe(status(504))
@@ -58306,7 +58605,7 @@ var EmailGroup = class extends make37("Email").add(get5("emailListBlocks", "/v1/
     EmailListSenders500,
     EmailListSenders504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.listSenders").annotate(Summary, "List senders").annotate(Description, "Returns senders, newest first, optionally filtered by verification status, active state, or default flag. Pass `nextCursor` back as `cursor` for the next page; it is null on the last page. Each row carries `deliverability` (bounce and complaint rates over the last 24 hours) and `series`, the last 14 days of daily email sends from the address, oldest first."), post("emailAddSender", "/v1/email/senders", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.listSenders").annotate(Summary, "List senders").annotate(Description, "Returns senders, newest first. A namespace-scoped key lists only its namespace's senders; an organization-wide caller lists every sender, or one namespace's with `namespaceId`. Optionally filtered by verification status, active state, or default flag. Pass `nextCursor` back as `cursor` for the next page; it is null on the last page. Each row carries `deliverability` (bounce and complaint rates over the last 24 hours) and `series`, the last 14 days of daily email sends from the address, oldest first."), post("emailAddSender", "/v1/email/senders", {
   headers: EmailAddSenderHeaders,
   payload: EmailAddSenderRequestJson,
   success: EmailAddSender201.pipe(status(201)),
@@ -58320,7 +58619,7 @@ var EmailGroup = class extends make37("Email").add(get5("emailListBlocks", "/v1/
     EmailAddSender502.pipe(status(502)),
     EmailAddSender504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.addSender").annotate(Summary, "Add a sender").annotate(Description, "Creates a sender. The required Idempotency-Key replays the original sender for an identical request and conflicts when reused with different input."), get5("emailGetSender", "/v1/email/senders/:id", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.addSender").annotate(Summary, "Add a sender").annotate(Description, "Creates a sender. A sender on a domain takes the domain's namespace, and a `namespaceId` that names another namespace is refused; a sender with no domain joins `namespaceId`, or its key's namespace. A namespace-scoped key cannot add a sender on a domain outside its namespace. The required Idempotency-Key replays the original sender for an identical request and conflicts when reused with different input."), get5("emailGetSender", "/v1/email/senders/:id", {
   params: EmailGetSenderPathParams,
   success: EmailGetSender200,
   error: [
@@ -58353,7 +58652,7 @@ var EmailGroup = class extends make37("Email").add(get5("emailListBlocks", "/v1/
     EmailSetDefaultSender500,
     EmailSetDefaultSender504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.setDefaultSender").annotate(Summary, "Set the organization default sender").annotate(Description, "Marks a verified, active sender as the organization default, atomically clearing any previous default. Omitted-`from` sends use it when neither the request nor the template names a `from`; with no default, the organization's sole verified sender is used."), get5("emailCheckSenderVerification", "/v1/email/senders/:id/verification", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.setDefaultSender").annotate(Summary, "Set the default sender").annotate(Description, "Marks a verified, active sender as the default of its scope, atomically clearing the previous default of the same scope: the organization level, or the sender's namespace. Omitted-`from` sends use it when neither the request nor the template names a `from`; with no default, the organization's sole verified sender is used."), get5("emailCheckSenderVerification", "/v1/email/senders/:id/verification", {
   params: EmailCheckSenderVerificationPathParams,
   success: EmailCheckSenderVerification200,
   error: [
@@ -58969,6 +59268,7 @@ var MessagesListQuery = /* @__PURE__ */ Struct({
   conversationId: optionalKey2(Union2([ConversationId2, Null2])),
   contactId: optionalKey2(Union2([ContactId2, Null2])),
   from: optionalKey2(Union2([String4, Null2])),
+  namespaceId: optionalKey2(Union2([NamespaceId2, Null2]).annotate({ description: "Only this namespace's messages. A key scoped to a namespace always lists its own." })),
   after: optionalKey2(Union2([String4, Null2])),
   before: optionalKey2(Union2([String4, Null2]))
 });
@@ -59806,12 +60106,13 @@ ${payload.limitations}`);
 var list9 = make29("list", {
   cursor: String9("cursor").pipe(withDescription2("Resume after this nextCursor from a previous page"), optional4),
   limit: Int5("limit").pipe(withDescription2("Items per page"), optional4),
+  namespace: namespaceFlag("list"),
   all: Boolean6("all").pipe(withDescription2("Traverse every page (requires --jsonl)"), withDefault5(false)),
   json: jsonFlag
 }).pipe(withDescription3("List email sending domains"), withExamples([
   { command: "samva email domains list" },
   { command: "samva email domains list --json" }
-]), withHandler(({ cursor, limit, all, json }) => gen2(function* () {
+]), withHandler(({ cursor, limit, namespace, all, json }) => gen2(function* () {
   if (all && !isJsonLinesRequested())
     return yield* new CliUsageError({
       code: "all_requires_jsonl",
@@ -59820,7 +60121,11 @@ var list9 = make29("list", {
   const client = yield* getClientProvider;
   const cursorValue = getOrUndefined(cursor);
   const limitValue = getOrUndefined(limit);
-  const query = { cursor: cursorValue, limit: limitValue?.toString() };
+  const query = {
+    cursor: cursorValue,
+    limit: limitValue?.toString(),
+    ...namespaceField(namespace)
+  };
   if (all) {
     let nextCursor = cursorValue;
     for (;; ) {
@@ -59848,6 +60153,7 @@ var list9 = make29("list", {
       ["Domain", domain.domain],
       ["Phase", domain.phase],
       ["Default", domain.isDefault ? "yes" : "no"],
+      ["Namespace", domain.namespaceId ?? "organization"],
       ["ID", domain.id]
     ]);
     yield* log("");
@@ -59857,6 +60163,7 @@ var list9 = make29("list", {
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var add2 = make29("add", {
   domain: String9("domain").pipe(withDescription2("Domain to add, e.g. example.com")),
+  namespace: namespaceFlag("create"),
   dryRun: Boolean6("dry-run").pipe(withDescription2("Print the planned change without calling the API"), withDefault5(false)),
   json: jsonFlag
 }).pipe(withDescription3("Add an email sending domain"), withExamples([
@@ -59867,15 +60174,24 @@ var add2 = make29("add", {
   {
     command: "samva email domains add --domain example.com",
     description: "Apply domain add"
+  },
+  {
+    command: "samva email domains add --domain customer.example --namespace ns_7q2xk9mvt4znw8rh",
+    description: "Add the domain to a namespace"
   }
-]), withHandler(({ domain, dryRun, json }) => gen2(function* () {
+]), withHandler(({ domain, namespace, dryRun, json }) => gen2(function* () {
   if (dryRun) {
     if (json)
-      return yield* printJson({ dryRun: true, action: "email.domains.add", domain });
+      return yield* printJson({
+        dryRun: true,
+        action: "email.domains.add",
+        domain,
+        ...namespaceField(namespace)
+      });
     return yield* log(`[dry-run] Would add domain "${domain}".`);
   }
   const client = yield* getClientProvider;
-  yield* matchEffect3(addDomain({ domain }).pipe(client.provide), {
+  yield* matchEffect3(addDomain({ domain, ...namespaceField(namespace) }).pipe(client.provide), {
     onFailure: (error) => {
       const conflict = getConflictError(error);
       if (!conflict) {
@@ -59901,6 +60217,8 @@ var add2 = make29("add", {
       });
       return gen2(function* () {
         const existing = yield* findExisting;
+        if (!placedAsRequested(namespace, existing.namespaceId))
+          return yield* toCliApiError(`Domain "${existing.domain}" already exists at ${placementLabel(existing.namespaceId)}; move it with \`samva namespaces assign\``, error);
         if (json)
           yield* printJson({ ...existing, idempotent: true });
         else
@@ -60414,7 +60732,7 @@ var waitingLine = (message) => {
   const reason = message.waitReason.replaceAll("-", " ");
   return message.reviewExpectedAt === null ? reason : `${reason} (expected by ${message.reviewExpectedAt})`;
 };
-var skippedRecipientsLine = (message) => message.skippedRecipients.length === 0 ? null : message.skippedRecipients.map((recipient) => `${recipient.address} (${recipient.reason}${recipient.unsubscribeGroupId === undefined ? "" : `, group ${recipient.unsubscribeGroupId}`})`).join("; ");
+var skippedRecipientsLine = (message) => message.skippedRecipients.length === 0 ? null : message.skippedRecipients.map((recipient) => `${recipient.address} (${recipient.reason}${recipient.unsubscribeGroupId == null ? "" : `, group ${recipient.unsubscribeGroupId}`})`).join("; ");
 var printMessage = (message) => printFields([
   ["Message ID", message.id],
   ["Channel", message.channel],
@@ -60985,12 +61303,13 @@ ${truncateForDisplay(JSON.stringify(request.templateData, null, 2))}`);
 var list12 = make29("list", {
   cursor: String9("cursor").pipe(withDescription2("Resume after this nextCursor from a previous page"), optional4),
   limit: Int5("limit").pipe(withDescription2("Items per page"), optional4),
+  namespace: namespaceFlag("list"),
   all: Boolean6("all").pipe(withDescription2("Traverse every page (requires --jsonl)"), withDefault5(false)),
   json: jsonFlag
 }).pipe(withDescription3("List verified sender addresses"), withExamples([
   { command: "samva email senders list" },
   { command: "samva email senders list --json" }
-]), withHandler(({ cursor, limit, all, json }) => gen2(function* () {
+]), withHandler(({ cursor, limit, namespace, all, json }) => gen2(function* () {
   if (all && !isJsonLinesRequested())
     return yield* new CliUsageError({
       code: "all_requires_jsonl",
@@ -60999,7 +61318,11 @@ var list12 = make29("list", {
   const client = yield* getClientProvider;
   const cursorValue = getOrUndefined(cursor);
   const limitValue = getOrUndefined(limit);
-  const query = { cursor: cursorValue, limit: limitValue?.toString() };
+  const query = {
+    cursor: cursorValue,
+    limit: limitValue?.toString(),
+    ...namespaceField(namespace)
+  };
   if (all) {
     let nextCursor = cursorValue;
     for (;; ) {
@@ -61029,6 +61352,7 @@ var list12 = make29("list", {
       ["Status", sender.verificationStatus],
       ["Provider", sender.providerLifecycle],
       ["Default", sender.isDefault ? "yes" : "no"],
+      ["Namespace", sender.namespaceId ?? "organization"],
       ["ID", sender.id]
     ]);
     yield* log("");
@@ -61039,6 +61363,7 @@ var list12 = make29("list", {
 var add3 = make29("add", {
   email: String9("email").pipe(withDescription2("Sender email address")),
   name: String9("name").pipe(withDescription2("Display name for the sender"), optional4),
+  namespace: namespaceFlag("create"),
   dryRun: Boolean6("dry-run").pipe(withDescription2("Print the planned change without calling the API"), withDefault5(false)),
   json: jsonFlag
 }).pipe(withDescription3("Add a sender address"), withExamples([
@@ -61050,7 +61375,7 @@ var add3 = make29("add", {
     command: "samva email senders add --email hello@example.com",
     description: "Apply sender add"
   }
-]), withHandler(({ email, name, dryRun, json }) => gen2(function* () {
+]), withHandler(({ email, name, namespace, dryRun, json }) => gen2(function* () {
   const nameValue = getOrUndefined(name);
   if (dryRun) {
     if (json)
@@ -61058,14 +61383,16 @@ var add3 = make29("add", {
         dryRun: true,
         action: "email.senders.add",
         email,
-        name: nameValue
+        name: nameValue,
+        ...namespaceField(namespace)
       });
     return yield* log(`[dry-run] Would add sender "${email}".`);
   }
   const client = yield* getClientProvider;
   yield* matchEffect3(addSender({
     email,
-    ...nameValue === undefined ? {} : { name: nameValue }
+    ...nameValue === undefined ? {} : { name: nameValue },
+    ...namespaceField(namespace)
   }).pipe(client.provide), {
     onFailure: (error) => {
       const conflict = getConflictError(error);
@@ -61078,6 +61405,8 @@ var add3 = make29("add", {
           const listed = yield* listSenders({ cursor, limit: "100" }).pipe(client.provide, mapError2((listError) => toCliApiError("Sender may already exist but could not verify idempotently", listError)));
           const existing = (conflict.id ? listed.items.find((item) => item.id === conflict.id) : undefined) ?? listed.items.find((item) => item.email === email);
           if (existing) {
+            if (!placedAsRequested(namespace, existing.namespaceId))
+              return yield* toCliApiError(`Sender "${existing.email}" already exists at ${placementLabel(existing.namespaceId)}; move its domain, or the sender, with \`samva namespaces assign\``, error);
             if (json)
               yield* printJson({ ...existing, idempotent: true });
             else {
@@ -61319,7 +61648,7 @@ var BatchEventsResult = /* @__PURE__ */ Struct({
 var EventsCreateRequestJson = /* @__PURE__ */ Struct({
   contact: ContactEventReference,
   name: String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(255).annotate({ expected: "a string with at most 255 code points" })).check(isMaxLength(255).annotate({ expected: "a value with a length of at most 255" })).check(isPattern2(/* @__PURE__ */ new RegExp("^(?!(?:[Cc][Oo][Nn][Tt][Aa][Cc][Tt]|[Ss][Aa][Mm][Vv][Aa])\\.)[A-Za-z][A-Za-z0-9_.-]*$")).annotate({ expected: "a string matching the RegExp ^(?!(?:[Cc][Oo][Nn][Tt][Aa][Cc][Tt]|[Ss][Aa][Mm][Vv][Aa])\\.)[A-Za-z][A-Za-z0-9_.-]*$" })),
-  properties: optionalKey2(Union2([JsonObject, Null2])),
+  properties: optionalKey2(Union2([JsonObject2, Null2])),
   occurredAt: optionalKey2(Union2([String4, Null2])),
   idempotencyKey: optionalKey2(Union2([String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(255).annotate({ expected: "a string with at most 255 code points" })).check(isMaxLength(255).annotate({ expected: "a value with a length of at most 255" })), Null2]))
 });
@@ -62135,6 +62464,7 @@ Bun.serve({ fetch: createWebhookHandler(extension, { apiKey, webhookSecret }) })
 });
 // src/lib/mailbox-errors.ts
 var undecodedStatus = (error) => isHttpClientError(error) ? error.response?.status : undefined;
+var isUnreadable404 = (error) => error instanceof SamvaCliError && error.message.includes("HTTP 404, unreadable body");
 var GATED_NEXT = "Mailboxes are not enabled for this organization (the `mailbox` launch flag is off). Mailbox commands work once it is enabled.";
 var personOnlyNext = (action) => {
   switch (action) {
@@ -62159,12 +62489,21 @@ var personOnlyNext = (action) => {
   }
 };
 var mailboxApiError = (prefix, error, options = {}) => {
-  if (undecodedStatus(error) === 404)
+  if (undecodedStatus(error) === 404 || isUnreadable404(error))
     return new SamvaCliError({
       message: `${prefix}: mailboxes are not enabled for this organization.`,
       api: { reason: "FlagDisabledError", status: 404, details: {}, next: GATED_NEXT }
     });
   const failure = toCliApiError(prefix, error);
+  const flag = failure.api?.details.flag;
+  if (failure.api?.reason === "FlagDisabledError" && (flag === "whatsapp" || flag === "sms"))
+    return new SamvaCliError({
+      message: failure.message,
+      api: {
+        ...failure.api,
+        next: `${flag === "sms" ? "SMS" : "WhatsApp"} is not enabled for this organization. Mailboxes work on email until it is.`
+      }
+    });
   if (options.personOnly !== undefined && failure.api?.reason === "ForbiddenError")
     return new SamvaCliError({
       message: failure.message,
@@ -64332,10 +64671,10 @@ var MailboxesCreateRequestJson = /* @__PURE__ */ Struct({
 var MailboxesCreate201 = Mailbox2;
 var MailboxesCreate401 = UnauthorizedError2;
 var MailboxesCreate402 = PaymentRequiredError2;
-var MailboxesCreate403 = ForbiddenError2;
+var MailboxesCreate403 = /* @__PURE__ */ Union2([FlagDisabledError, ForbiddenError2]);
 var MailboxesCreate404 = ResourceNotFoundError2;
 var MailboxesCreate409 = ConflictError2;
-var MailboxesCreate422 = /* @__PURE__ */ Union2([ValidationError2, MailboxChannelUnsupportedError2]);
+var MailboxesCreate422 = ValidationError2;
 var MailboxesCreate500 = InternalError2;
 var MailboxesCreate502 = BillingProviderError;
 var MailboxesCreate504 = GatewayTimeoutError2;
@@ -64419,13 +64758,14 @@ var MailboxesApproveAction202 = MailboxPendingAction;
 var MailboxesApproveAction401 = UnauthorizedError2;
 var MailboxesApproveAction402 = PaymentRequiredError2;
 var MailboxesApproveAction403 = /* @__PURE__ */ Union2([
+  FlagDisabledError,
   MailboxSendRefusedError2,
   OnboardingReviewRequiredError2,
   ForbiddenError2
 ]);
 var MailboxesApproveAction404 = ResourceNotFoundError2;
 var MailboxesApproveAction409 = /* @__PURE__ */ Union2([MailboxSendConflictError2, ConflictError2]);
-var MailboxesApproveAction422 = /* @__PURE__ */ Union2([MailboxChannelUnsupportedError2, ValidationError2]);
+var MailboxesApproveAction422 = ValidationError2;
 var MailboxesApproveAction429 = RateLimitedError2;
 var MailboxesApproveAction500 = InternalError2;
 var MailboxesApproveAction502 = BillingProviderError;
@@ -64440,13 +64780,14 @@ var MailboxesCancelAction202 = MailboxPendingSendReceipt;
 var MailboxesCancelAction401 = UnauthorizedError2;
 var MailboxesCancelAction402 = PaymentRequiredError2;
 var MailboxesCancelAction403 = /* @__PURE__ */ Union2([
+  FlagDisabledError,
   MailboxSendRefusedError2,
   OnboardingReviewRequiredError2,
   ForbiddenError2
 ]);
 var MailboxesCancelAction404 = ResourceNotFoundError2;
 var MailboxesCancelAction409 = /* @__PURE__ */ Union2([MailboxSendConflictError2, ConflictError2]);
-var MailboxesCancelAction422 = /* @__PURE__ */ Union2([MailboxChannelUnsupportedError2, ValidationError2]);
+var MailboxesCancelAction422 = ValidationError2;
 var MailboxesCancelAction429 = RateLimitedError2;
 var MailboxesCancelAction500 = InternalError2;
 var MailboxesCancelAction502 = BillingProviderError;
@@ -64474,13 +64815,14 @@ var MailboxesRetryAction202 = MailboxPendingSendReceipt;
 var MailboxesRetryAction401 = UnauthorizedError2;
 var MailboxesRetryAction402 = PaymentRequiredError2;
 var MailboxesRetryAction403 = /* @__PURE__ */ Union2([
+  FlagDisabledError,
   MailboxSendRefusedError2,
   OnboardingReviewRequiredError2,
   ForbiddenError2
 ]);
 var MailboxesRetryAction404 = ResourceNotFoundError2;
 var MailboxesRetryAction409 = /* @__PURE__ */ Union2([MailboxSendConflictError2, ConflictError2]);
-var MailboxesRetryAction422 = /* @__PURE__ */ Union2([MailboxChannelUnsupportedError2, ValidationError2]);
+var MailboxesRetryAction422 = ValidationError2;
 var MailboxesRetryAction429 = RateLimitedError2;
 var MailboxesRetryAction500 = InternalError2;
 var MailboxesRetryAction502 = BillingProviderError;
@@ -64529,7 +64871,7 @@ var MailboxesCreateDraft201 = MailboxDraft;
 var MailboxesCreateDraft401 = UnauthorizedError2;
 var MailboxesCreateDraft403 = ForbiddenError2;
 var MailboxesCreateDraft404 = ResourceNotFoundError2;
-var MailboxesCreateDraft422 = /* @__PURE__ */ Union2([MailboxChannelUnsupportedError2, ValidationError2]);
+var MailboxesCreateDraft422 = ValidationError2;
 var MailboxesCreateDraft500 = InternalError2;
 var MailboxesCreateDraft504 = GatewayTimeoutError2;
 var MailboxesGetDraftPathParams = /* @__PURE__ */ Struct({
@@ -64586,13 +64928,14 @@ var MailboxesSendDraft202 = MailboxPendingSendReceipt;
 var MailboxesSendDraft401 = UnauthorizedError2;
 var MailboxesSendDraft402 = PaymentRequiredError2;
 var MailboxesSendDraft403 = /* @__PURE__ */ Union2([
+  FlagDisabledError,
   MailboxSendRefusedError2,
   OnboardingReviewRequiredError2,
   ForbiddenError2
 ]);
 var MailboxesSendDraft404 = ResourceNotFoundError2;
 var MailboxesSendDraft409 = /* @__PURE__ */ Union2([MailboxSendConflictError2, ConflictError2]);
-var MailboxesSendDraft422 = /* @__PURE__ */ Union2([MailboxChannelUnsupportedError2, ValidationError2]);
+var MailboxesSendDraft422 = ValidationError2;
 var MailboxesSendDraft429 = RateLimitedError2;
 var MailboxesSendDraft500 = InternalError2;
 var MailboxesSendDraft502 = BillingProviderError;
@@ -64606,10 +64949,10 @@ var MailboxesCreateEndpointRequestJson = /* @__PURE__ */ Struct({
 });
 var MailboxesCreateEndpoint201 = Mailbox2;
 var MailboxesCreateEndpoint401 = UnauthorizedError2;
-var MailboxesCreateEndpoint403 = ForbiddenError2;
+var MailboxesCreateEndpoint403 = /* @__PURE__ */ Union2([FlagDisabledError, ForbiddenError2]);
 var MailboxesCreateEndpoint404 = ResourceNotFoundError2;
 var MailboxesCreateEndpoint409 = ConflictError2;
-var MailboxesCreateEndpoint422 = /* @__PURE__ */ Union2([ValidationError2, MailboxChannelUnsupportedError2]);
+var MailboxesCreateEndpoint422 = ValidationError2;
 var MailboxesCreateEndpoint500 = InternalError2;
 var MailboxesCreateEndpoint504 = GatewayTimeoutError2;
 var MailboxesRemoveEndpointPathParams = /* @__PURE__ */ Struct({
@@ -64794,13 +65137,14 @@ var MailboxesSendMessage202 = MailboxPendingSendReceipt;
 var MailboxesSendMessage401 = UnauthorizedError2;
 var MailboxesSendMessage402 = PaymentRequiredError2;
 var MailboxesSendMessage403 = /* @__PURE__ */ Union2([
+  FlagDisabledError,
   MailboxSendRefusedError2,
   OnboardingReviewRequiredError2,
   ForbiddenError2
 ]);
 var MailboxesSendMessage404 = ResourceNotFoundError2;
 var MailboxesSendMessage409 = /* @__PURE__ */ Union2([MailboxSendConflictError2, ConflictError2]);
-var MailboxesSendMessage422 = /* @__PURE__ */ Union2([MailboxChannelUnsupportedError2, ValidationError2]);
+var MailboxesSendMessage422 = ValidationError2;
 var MailboxesSendMessage429 = RateLimitedError2;
 var MailboxesSendMessage500 = InternalError2;
 var MailboxesSendMessage502 = BillingProviderError;
@@ -64873,13 +65217,14 @@ var MailboxesForward202 = MailboxPendingSendReceipt;
 var MailboxesForward401 = UnauthorizedError2;
 var MailboxesForward402 = PaymentRequiredError2;
 var MailboxesForward403 = /* @__PURE__ */ Union2([
+  FlagDisabledError,
   MailboxSendRefusedError2,
   OnboardingReviewRequiredError2,
   ForbiddenError2
 ]);
 var MailboxesForward404 = ResourceNotFoundError2;
 var MailboxesForward409 = /* @__PURE__ */ Union2([MailboxSendConflictError2, ConflictError2]);
-var MailboxesForward422 = /* @__PURE__ */ Union2([MailboxChannelUnsupportedError2, ValidationError2]);
+var MailboxesForward422 = ValidationError2;
 var MailboxesForward429 = RateLimitedError2;
 var MailboxesForward500 = InternalError2;
 var MailboxesForward502 = BillingProviderError;
@@ -64926,13 +65271,14 @@ var MailboxesReply202 = MailboxPendingSendReceipt;
 var MailboxesReply401 = UnauthorizedError2;
 var MailboxesReply402 = PaymentRequiredError2;
 var MailboxesReply403 = /* @__PURE__ */ Union2([
+  FlagDisabledError,
   MailboxSendRefusedError2,
   OnboardingReviewRequiredError2,
   ForbiddenError2
 ]);
 var MailboxesReply404 = ResourceNotFoundError2;
 var MailboxesReply409 = /* @__PURE__ */ Union2([MailboxSendConflictError2, ConflictError2]);
-var MailboxesReply422 = /* @__PURE__ */ Union2([MailboxChannelUnsupportedError2, ValidationError2]);
+var MailboxesReply422 = ValidationError2;
 var MailboxesReply429 = RateLimitedError2;
 var MailboxesReply500 = InternalError2;
 var MailboxesReply502 = BillingProviderError;
@@ -64956,13 +65302,14 @@ var MailboxesReplyAll202 = MailboxPendingSendReceipt;
 var MailboxesReplyAll401 = UnauthorizedError2;
 var MailboxesReplyAll402 = PaymentRequiredError2;
 var MailboxesReplyAll403 = /* @__PURE__ */ Union2([
+  FlagDisabledError,
   MailboxSendRefusedError2,
   OnboardingReviewRequiredError2,
   ForbiddenError2
 ]);
 var MailboxesReplyAll404 = ResourceNotFoundError2;
 var MailboxesReplyAll409 = /* @__PURE__ */ Union2([MailboxSendConflictError2, ConflictError2]);
-var MailboxesReplyAll422 = /* @__PURE__ */ Union2([MailboxChannelUnsupportedError2, ValidationError2]);
+var MailboxesReplyAll422 = ValidationError2;
 var MailboxesReplyAll429 = RateLimitedError2;
 var MailboxesReplyAll500 = InternalError2;
 var MailboxesReplyAll502 = BillingProviderError;
@@ -65247,7 +65594,7 @@ var MailboxesGroup = class extends make37("Mailboxes").add(get5("mailboxesList",
     MailboxesCreate502.pipe(status(502)),
     MailboxesCreate504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.create").annotate(Summary, "Create a mailbox").annotate(Description, "Creates a mailbox with one endpoint and returns it with status 201; the caller gets an admin grant on it. Email is the channel a mailbox endpoint uses today; another channel is refused (422). An email endpoint's address must be under the organization's Samva-hosted mail domain or a verified domain with receiving enabled, and the mailbox sends from it. The slug defaults to the address's local part. Pass `slug` when that is taken or not a valid slug. The mailbox receives mail from now on; mail that arrived earlier is not added to it. Conflicts if the address or slug is already in use. Returns 402 when the organization is at its plan's mailbox allowance or at its mailbox storage allowance; incoming mail is still received past the storage allowance."), get5("mailboxesGet", "/v1/mailboxes/:id", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.create").annotate(Summary, "Create a mailbox").annotate(Description, "Creates a mailbox with one endpoint and returns it with status 201; the caller gets an admin grant on it. An email endpoint's address must be under the organization's Samva-hosted mail domain or a verified domain with receiving enabled, and the mailbox sends from it. A phone endpoint's address is a number the organization connected on that channel, in E.164 form. The slug defaults to the address's local part, or a phone number's digits. Pass `slug` when that is taken or not a valid slug. The mailbox receives mail from now on; mail that arrived earlier is not added to it. Conflicts if the address or slug is already in use. Returns 402 when the organization is at its plan's mailbox allowance or at its mailbox storage allowance; incoming mail is still received past the storage allowance."), get5("mailboxesGet", "/v1/mailboxes/:id", {
   params: MailboxesGetPathParams,
   success: MailboxesGet200,
   error: [
@@ -65402,7 +65749,7 @@ var MailboxesGroup = class extends make37("Mailboxes").add(get5("mailboxesList",
     MailboxesCreateDraft500,
     MailboxesCreateDraft504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.createDraft").annotate(Summary, "Create a draft").annotate(Description, "Saves a draft of a new message, or of a reply when `inReplyToMessageId` names a message in the mailbox, and returns it with status 201. Email drafts are the kind a mailbox saves today; another channel is refused (422). Send it with `POST /v1/mailboxes/{id}/drafts/{draftId}/send`."), get5("mailboxesGetDraft", "/v1/mailboxes/:id/drafts/:draftId", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.createDraft").annotate(Summary, "Create a draft").annotate(Description, "Saves a draft of a new message, or of a reply when `inReplyToMessageId` names a message in the mailbox, and returns it with status 201. A phone channel's draft holds a recipient number and text. Send it with `POST /v1/mailboxes/{id}/drafts/{draftId}/send`."), get5("mailboxesGetDraft", "/v1/mailboxes/:id/drafts/:draftId", {
   params: MailboxesGetDraftPathParams,
   success: MailboxesGetDraft200,
   error: [
@@ -65467,7 +65814,7 @@ var MailboxesGroup = class extends make37("Mailboxes").add(get5("mailboxesList",
     MailboxesCreateEndpoint500,
     MailboxesCreateEndpoint504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.createEndpoint").annotate(Summary, "Add an endpoint to a mailbox").annotate(Description, "Adds an endpoint to a mailbox and returns the mailbox with status 201. It follows the same rules as the endpoint of a new mailbox: email is the channel a mailbox endpoint uses today (422 otherwise), the address must be under the organization's Samva-hosted mail domain or a verified domain with receiving enabled, and no mailbox may already hold it (409). Messages sent to it reach the mailbox from now on. It becomes the default on its channel only when the mailbox has no endpoint there yet."), del("mailboxesRemoveEndpoint", "/v1/mailboxes/:id/endpoints/:endpointId", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.createEndpoint").annotate(Summary, "Add an endpoint to a mailbox").annotate(Description, "Adds an endpoint to a mailbox and returns the mailbox with status 201. It follows the same rules as the endpoint of a new mailbox: an email address must be under the organization's Samva-hosted mail domain or a verified domain with receiving enabled, a phone number must be one the organization connected on that channel, and no mailbox may already hold it (409). Messages sent to it reach the mailbox from now on. It becomes the default on its channel only when the mailbox has no endpoint there yet."), del("mailboxesRemoveEndpoint", "/v1/mailboxes/:id/endpoints/:endpointId", {
   params: MailboxesRemoveEndpointPathParams,
   success: MailboxesRemoveEndpoint200,
   error: [
@@ -65628,7 +65975,7 @@ var MailboxesGroup = class extends make37("Mailboxes").add(get5("mailboxesList",
     MailboxesSendMessage503.pipe(status(503)),
     MailboxesSendMessage504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.sendMessage").annotate(Summary, "Send a new message").annotate(Description, "Starts a new conversation from the mailbox's default endpoint on the channel the body names (email when omitted); a channel the mailbox cannot send on yet is refused (422). Records a send action and returns 202 with its current receipt and a Location for action status. An installation, grant, or policy may require approval; otherwise the send is queued. Observe the same action through acceptance and mailbox completion. A policy refusal returns 403 with the recorded receipt."), get5("mailboxesGetMessage", "/v1/mailboxes/:id/messages/:messageId", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.sendMessage").annotate(Summary, "Send a new message").annotate(Description, "Starts a new conversation from the mailbox's default endpoint on the channel the body names (email when omitted); a mailbox with no endpoint on that channel is refused (422). A message to a number joins the mailbox's thread with that number when it has one. Records a send action and returns 202 with its current receipt and a Location for action status. An installation, grant, or policy may require approval; otherwise the send is queued. Observe the same action through acceptance and mailbox completion. A policy refusal returns 403 with the recorded receipt."), get5("mailboxesGetMessage", "/v1/mailboxes/:id/messages/:messageId", {
   params: MailboxesGetMessagePathParams,
   success: MailboxesGetMessage200,
   error: [
@@ -65734,7 +66081,7 @@ var MailboxesGroup = class extends make37("Mailboxes").add(get5("mailboxesList",
     MailboxesReply503.pipe(status(503)),
     MailboxesReply504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.reply").annotate(Summary, "Reply to a message").annotate(Description, "Replies to the message's Reply-To address, or its sender, in the same thread and from the thread's endpoint. The server sets the recipients, subject, and threading headers. The body's `channel` must match the thread's."), post("mailboxesReplyAll", "/v1/mailboxes/:id/messages/:messageId/reply-all", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.reply").annotate(Summary, "Reply to a message").annotate(Description, "Replies to the message's Reply-To address, or its sender, in the same thread and from the thread's endpoint. The server sets the recipients, subject, and threading headers. The body's `channel` must match the thread's. On a phone channel the reply goes to the number on the other side of the thread."), post("mailboxesReplyAll", "/v1/mailboxes/:id/messages/:messageId/reply-all", {
   params: MailboxesReplyAllPathParams,
   headers: MailboxesReplyAllHeaders,
   payload: MailboxesReplyAllRequestJson,
@@ -65752,7 +66099,7 @@ var MailboxesGroup = class extends make37("Mailboxes").add(get5("mailboxesList",
     MailboxesReplyAll503.pipe(status(503)),
     MailboxesReplyAll504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.replyAll").annotate(Summary, "Reply to all recipients of a message").annotate(Description, "Replies to the sender and every other recipient of the message except the mailbox itself, in the same thread and from the thread's endpoint."), post("mailboxesPause", "/v1/mailboxes/:id/pause", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.replyAll").annotate(Summary, "Reply to all recipients of a message").annotate(Description, "Replies to the sender and every other recipient of the message except the mailbox itself, in the same thread and from the thread's endpoint. A phone thread has one other side, so it answers like a reply."), post("mailboxesPause", "/v1/mailboxes/:id/pause", {
   params: MailboxesPausePathParams,
   success: MailboxesPause200,
   error: [
@@ -66133,7 +66480,7 @@ var refusalNext = (failure) => {
     case "ForbiddenError":
       return "Use a credential that may read mailboxes and follow the API message.";
     case "ResourceNotFoundError":
-      return "Run samva mailboxes list to find the mailboxes this credential can read, then retry with those --mailbox ids.";
+      return "Run samva mailboxes list to find the mailboxes this credential can read, then retry with those mailbox ids.";
     case "CursorExpiredError":
       return "Events after your cursor expired. Read current state from the API and reconnect without --cursor.";
     case "ValidationError":
@@ -66260,12 +66607,16 @@ var tailEvents = (options) => gen2(function* () {
   })), mapError4(streamError), options.limit === undefined ? (stream) => stream : take3(options.limit), interruptWhen2(interrupted), runForEach2(options.onEvent), raceFirst2(interrupted.pipe(andThen2(sleep2(HANDLER_DRAIN)))))));
 });
 var mailboxesEventsCommand = make29("events", {
+  mailbox: String10("mailbox-id").pipe(withDescription4("Mailboxes to follow; omit to follow every mailbox the credential reads"), withSchema3(MailboxId), atLeast3(0)),
   cursor: String9("cursor").pipe(withDescription2("Replay events after a cursor from an earlier event frame, then go live"), optional4),
-  mailbox: String9("mailbox").pipe(withSchema2(MailboxId), atLeast2(0)),
   limit: Int5("limit").pipe(optional4),
   noReconnect: Boolean6("no-reconnect").pipe(withDefault5(false), withDescription2("Exit non-zero with the last cursor when the connection drops, instead of reconnecting from it"))
 }).pipe(withDescription3("Tail mailbox events, one record per line; --jsonl wraps each in a result envelope; a dropped connection reconnects from the last cursor; Ctrl+C exits cleanly"), withExamples([
-  { command: "samva mailboxes events --mailbox mbx_1234567890123456 --limit 10" },
+  { command: "samva mailboxes events mbx_1234567890123456 --limit 10" },
+  {
+    command: "samva mailboxes events mbx_1234567890123456 mbx_6543210987654321 --jsonl",
+    description: "Follow several mailboxes"
+  },
   { command: "samva mailboxes events --jsonl", description: "Stream envelopes for automation" },
   { command: "samva mailboxes events --cursor <cursor-from-an-event-frame>" },
   {
@@ -66553,17 +66904,36 @@ var HumanProfile = Struct({
   source: optional2(Literals(["api", "import", "manual", "form"]))
 });
 
-// ../core/src/shared/json.ts
-var JsonObject2 = Record(String4, Json2).annotate({
-  identifier: "JsonObject"
-});
-var UnknownRecord = Record(String4, Unknown2).annotate({
-  identifier: "UnknownRecord"
-});
-var decodeJsonString = decodeSync(fromJsonString2(Json2));
-
-// ../core/src/templates/variable-values.ts
-var TemplateVariableValues = JsonObject2;
+// ../core/src/whatsapp/template-dispatch.ts
+var CONTACT_BINDING_FIELDS = [
+  "id",
+  "name",
+  "displayName",
+  "externalId",
+  "phone",
+  "email",
+  "firstName",
+  "lastName",
+  "company",
+  "jobTitle"
+];
+var WhatsAppTemplateBinding = Union2([
+  Struct({ contact: Literals(CONTACT_BINDING_FIELDS) }).pipe(rejectExcessProperties).annotate({ identifier: "WhatsAppTemplateContactBinding" }),
+  Struct({ customField: NonEmptyString }).pipe(rejectExcessProperties).annotate({ identifier: "WhatsAppTemplateCustomFieldBinding" })
+]).annotate({ identifier: "WhatsAppTemplateBinding" });
+var WhatsAppTemplateBindings = Record(NonEmptyString, WhatsAppTemplateBinding).annotate({
+  identifier: "WhatsAppTemplateBindings",
+  description: "Template parameters filled per recipient: parameter name to the contact field it reads."
+});
+var WhatsAppTemplateDispatch = Struct({
+  template: TemplateRef,
+  templateData: optionalKey2(TemplateVariableValues).annotate({
+    identifier: "WhatsAppTemplateDispatchData"
+  }),
+  bindings: optionalKey2(WhatsAppTemplateBindings),
+  businessAccountId: optionalKey2(WhatsAppBusinessAccountId)
+}).pipe(rejectExcessProperties).annotate({ identifier: "WhatsAppTemplateDispatch" });
+var BoundTemplateData = taggedEnum();
 // ../core/src/organizations/reserved-hostnames.ts
 var RESERVED_HOSTNAMES = new Set([
   "apex",
@@ -66690,6 +67060,9 @@ class AnyGrant extends Service()("samva/ResourcePermission/AnyGrant") {
 
 class Unscoped extends Service()("samva/ResourcePermission/Unscoped") {
 }
+
+class NamespaceScoped extends Service()("samva/ResourcePermission/NamespaceScoped") {
+}
 function sendGrants(channel) {
   return [
     { resource: "messages", action: "create" },
@@ -66928,7 +67301,7 @@ var ContactEventReference2 = Union2([
 var CreateEventPayload2 = Struct({
   contact: ContactEventReference2,
   name: NonEmptyString.check(isMaxLength(EVENT_NAME_MAX_LENGTH), isPattern2(EVENT_NAME_PATTERN)),
-  properties: optional2(JsonObject2),
+  properties: optional2(JsonObject),
   occurredAt: optional2(DateFromString),
   idempotencyKey: optional2(NonEmptyString.check(isMaxLength(EVENT_IDEMPOTENCY_KEY_MAX_LENGTH)))
 }).annotate({ identifier: "CreateEventPayload" });
@@ -66937,7 +67310,7 @@ var ContactEvent2 = Struct({
   contactId: ContactId,
   name: String4,
   source: Literals(["api", "samva"]),
-  properties: JsonObject2,
+  properties: JsonObject,
   occurredAt: DateFromString,
   recordedAt: DateFromString
 }).annotate({ identifier: "ContactEvent" });
@@ -66980,7 +67353,7 @@ class EventsGroup2 extends make37("events").add(post("create", "/", {
 }).annotateMerge(annotations({
   summary: "Record contact events in a batch",
   description: "Validates the full request shape, contact references, and event names before processing. A schema failure rejects the entire batch without writes. Between 1 and 100 valid entries are then processed in input order, with independent indexed results for properties limits, contact resolution, and idempotency."
-}))).prefix("/v1/events").middleware(ResourceAuthorization).middleware(JourneysGate).middleware(OrgContext).annotate(GroupResource, "contacts").annotateMerge(annotations({ title: "Events", description: "Custom contact event ingestion" })) {
+}))).prefix("/v1/events").middleware(ResourceAuthorization).middleware(JourneysGate).middleware(OrgContext).annotate(GroupResource, "contacts").annotate(NamespaceScoped, "Events resolve and list contacts only in the key's namespace").annotateMerge(annotations({ title: "Events", description: "Custom contact event ingestion" })) {
 }
 
 class ContactEventsGroup2 extends make37("contactEvents").add(get5("listEvents", "/:id/events", {
@@ -66991,7 +67364,7 @@ class ContactEventsGroup2 extends make37("contactEvents").add(get5("listEvents",
 }).annotateMerge(annotations({
   summary: "List contact events",
   description: "Returns custom and Samva lifecycle events, newest occurrence first, within the 90-day retention window. Pass nextCursor back as cursor for the next page."
-}))).prefix("/v1/contacts").middleware(ResourceAuthorization).middleware(JourneysGate).middleware(OrgContext).annotate(GroupResource, "contacts").annotateMerge(annotations({
+}))).prefix("/v1/contacts").middleware(ResourceAuthorization).middleware(JourneysGate).middleware(OrgContext).annotate(GroupResource, "contacts").annotate(NamespaceScoped, "Events resolve and list contacts only in the key's namespace").annotateMerge(annotations({
   title: "Contact events",
   description: "A contact's custom and lifecycle event timeline"
 })) {
@@ -67116,7 +67489,7 @@ var JourneyUpdateTagsConfig2 = Struct({
   });
   return issues;
 })).pipe(rejectExcessProperties).annotate({ identifier: "JourneyUpdateTagsConfig" });
-var JourneyWebhookConfig2 = Struct({ data: optionalKey2(JsonObject2) }).pipe(rejectExcessProperties).annotate({ identifier: "JourneyWebhookConfig" });
+var JourneyWebhookConfig2 = Struct({ data: optionalKey2(JsonObject) }).pipe(rejectExcessProperties).annotate({ identifier: "JourneyWebhookConfig" });
 var JourneyEmptyConfig2 = Record(String4, Never2).annotate({
   identifier: "JourneyEmptyConfig"
 });
@@ -67138,6 +67511,11 @@ var JourneyNode2 = Union2([
     config: JourneySendEmailConfig2,
     next: nextNode
   }).pipe(rejectExcessProperties).annotate({ identifier: "JourneySendEmailNode" }),
+  Struct({
+    type: Literal2("send_whatsapp"),
+    config: WhatsAppTemplateDispatch,
+    next: nextNode
+  }).pipe(rejectExcessProperties).annotate({ identifier: "WhatsAppJourneySendNode" }),
   Struct({ type: Literal2("wait"), config: JourneyWaitConfig2, next: nextNode }).pipe(rejectExcessProperties).annotate({ identifier: "JourneyWaitNode" }),
   Struct({
     type: Literal2("wait_for_event"),
@@ -67261,7 +67639,7 @@ var JourneyRunCounts = /* @__PURE__ */ Struct({
 var JourneyRunTrigger = /* @__PURE__ */ Struct({
   eventId: String4,
   eventName: String4,
-  properties: JsonObject
+  properties: JsonObject2
 }).annotate({ identifier: "JourneyRunTrigger" });
 var JourneyListItem = /* @__PURE__ */ Struct({
   id: JourneyId2,
@@ -67367,7 +67745,7 @@ var JourneysCreateRequestJson = /* @__PURE__ */ Struct({
 var JourneysCreate201 = Journey;
 var JourneysCreate401 = UnauthorizedError2;
 var JourneysCreate402 = PaymentRequiredError2;
-var JourneysCreate403 = ForbiddenError2;
+var JourneysCreate403 = /* @__PURE__ */ Union2([FlagDisabledError, ForbiddenError2]);
 var JourneysCreate404 = ResourceNotFoundError2;
 var JourneysCreate409 = ConflictError2;
 var JourneysCreate422 = ValidationError2;
@@ -67417,7 +67795,7 @@ var JourneysReplaceDraftRequestJson = /* @__PURE__ */ Struct({
 var JourneysReplaceDraft200 = Journey;
 var JourneysReplaceDraft401 = UnauthorizedError2;
 var JourneysReplaceDraft402 = PaymentRequiredError2;
-var JourneysReplaceDraft403 = ForbiddenError2;
+var JourneysReplaceDraft403 = /* @__PURE__ */ Union2([FlagDisabledError, ForbiddenError2]);
 var JourneysReplaceDraft404 = ResourceNotFoundError2;
 var JourneysReplaceDraft409 = ConflictError2;
 var JourneysReplaceDraft422 = ValidationError2;
@@ -67438,7 +67816,7 @@ var JourneysPublishRequestJson = /* @__PURE__ */ Struct({ revision: String4.chec
 var JourneysPublish200 = Journey;
 var JourneysPublish401 = UnauthorizedError2;
 var JourneysPublish402 = PaymentRequiredError2;
-var JourneysPublish403 = ForbiddenError2;
+var JourneysPublish403 = /* @__PURE__ */ Union2([FlagDisabledError, ForbiddenError2]);
 var JourneysPublish404 = ResourceNotFoundError2;
 var JourneysPublish409 = ConflictError2;
 var JourneysPublish422 = ValidationError2;
@@ -67449,7 +67827,7 @@ var JourneysResumePathParams = /* @__PURE__ */ Struct({ id: JourneyId2 });
 var JourneysResume200 = Journey;
 var JourneysResume401 = UnauthorizedError2;
 var JourneysResume402 = PaymentRequiredError2;
-var JourneysResume403 = ForbiddenError2;
+var JourneysResume403 = /* @__PURE__ */ Union2([FlagDisabledError, ForbiddenError2]);
 var JourneysResume404 = ResourceNotFoundError2;
 var JourneysResume409 = ConflictError2;
 var JourneysResume422 = ValidationError2;
@@ -70910,10 +71288,15 @@ var MailboxThreadState2 = Struct({
 var MailboxThreadSummary2 = Struct(threadSummaryFields).annotate({
   identifier: "MailboxThreadSummary"
 });
+var MailboxWhatsAppServiceWindow = Struct({
+  open: Boolean3,
+  expiresAt: NullOr(DateFromString)
+}).annotate({ identifier: "MailboxWhatsAppServiceWindow" });
 var MailboxThread2 = Struct({
   ...threadSummaryFields,
   conversationId: ConversationId,
   participants: ArraySchema(MailboxThreadParticipantSchema),
+  whatsappServiceWindow: NullOr(MailboxWhatsAppServiceWindow),
   createdAt: DateFromString
 }).annotate({ identifier: "MailboxThread" });
 var MailboxMessageAuthentication2 = Struct({
@@ -70960,18 +71343,23 @@ var MailboxEmailMessage = Struct({
   attachments: ArraySchema(MailboxMessageAttachmentSchema)
 }).annotate({ identifier: "MailboxEmailMessage" });
 var MailboxChatMedia = Struct({
-  id: AttachmentId,
-  contentType: String4,
+  type: String4,
+  contentType: NullOr(String4),
   filename: NullOr(String4),
-  size: NullOr(Count),
   caption: NullOr(String4)
 }).annotate({ identifier: "MailboxChatMedia" });
+var MailboxChatMessageTemplate = Struct({
+  name: String4,
+  language: String4
+}).annotate({ identifier: "MailboxChatMessageTemplate" });
 var MailboxChatMessage = Struct({
   ...messageFields,
   channel: Literals(["whatsapp", "sms"]),
   to: ArraySchema(String4),
   text: NullOr(String4),
   media: ArraySchema(MailboxChatMedia),
+  template: NullOr(MailboxChatMessageTemplate),
+  summary: NullOr(String4),
   contextMessageId: NullOr(MessageId)
 }).annotate({ identifier: "MailboxChatMessage" });
 var MailboxMessage2 = Union2([MailboxEmailMessage, MailboxChatMessage]).annotate({
@@ -71083,6 +71471,10 @@ var printMailboxSummary = (data) => gen2(function* () {
     ["Created", data.createdAt]
   ]);
 });
+var endpointLine = (endpoint) => {
+  const where = endpoint.channel === "email" ? `${endpoint.source}${endpoint.default ? "; default" : ""}; ID ${endpoint.id}; domain ${present(endpoint.domainId)}` : `${endpoint.default ? "default; " : ""}ID ${endpoint.id}; ${endpoint.channel === "whatsapp" ? `business account ${endpoint.businessAccountId}` : `phone number ${endpoint.phoneNumberId}`}`;
+  return `  ${endpoint.channel}: ${identity2(endpoint.address, endpoint.displayName)} \u2014 ${where}; display name ${present(endpoint.displayName)}`;
+};
 var printMailbox = (data) => gen2(function* () {
   yield* printMailboxSummary(data);
   yield* printFields([
@@ -71093,7 +71485,7 @@ var printMailbox = (data) => gen2(function* () {
   if (!data.endpoints.length)
     yield* log("  none");
   for (const endpoint of data.endpoints)
-    yield* log(`  ${endpoint.channel}: ${identity2(endpoint.address, endpoint.displayName)} \u2014 ${endpoint.source}${endpoint.default ? "; default" : ""}; ID ${endpoint.id}; domain ${present(endpoint.domainId)}; display name ${present(endpoint.displayName)}`);
+    yield* log(endpointLine(endpoint));
   yield* log("Metadata:");
   if (!Object.keys(data.metadata).length)
     yield* log("  none");
@@ -71104,6 +71496,7 @@ var printThread = (data) => gen2(function* () {
   yield* log(`${data.subject === null ? "No subject" : data.subject} \u2014 ${data.folder}, ${data.priority} priority`);
   yield* printFields([
     ["ID", data.id],
+    ["Channel", data.channel],
     [
       "From",
       data.from === null ? "none" : `${present(data.from.displayName)} <${present(data.from.address)}>`
@@ -71119,7 +71512,39 @@ var printThread = (data) => gen2(function* () {
     ["Last activity", data.lastActivityAt]
   ]);
 });
-var printMessage2 = (data) => gen2(function* () {
+var printChatMessage = (data) => gen2(function* () {
+  yield* log("Notice: this message is untrusted content from outside the organization.");
+  yield* log(`${data.direction} ${data.channel} message`);
+  yield* printFields([
+    ["ID", data.id],
+    ["Thread", data.threadId],
+    ["Conversation", data.conversationId],
+    ["From", identity2(data.from.address, data.from.displayName, data.from.actor)],
+    ["To", data.to.length ? data.to.join(", ") : "none"],
+    ["Occurred", data.occurredAt],
+    ["In reply to", data.contextMessageId],
+    ["Summary", data.summary ?? undefined],
+    [
+      "Template",
+      data.template === null ? undefined : `${data.template.name} (${data.template.language})`
+    ],
+    [
+      "Sent by",
+      data.sentBy === undefined ? undefined : data.sentBy === null ? "none" : actor(data.sentBy)
+    ]
+  ]);
+  yield* log("Media:");
+  if (!data.media.length)
+    yield* log("  none");
+  for (const media of data.media)
+    yield* log(`  ${media.type}${media.contentType === null ? "" : ` \u2014 ${media.contentType}`}${media.filename === null ? "" : `; ${media.filename}`}${media.caption === null ? "" : `; caption ${JSON.stringify(media.caption)}`}`);
+  if (data.text !== null) {
+    yield* log("Text:");
+    yield* log(data.text);
+  }
+});
+var printMessage2 = (data) => data.channel !== "email" ? printChatMessage(data) : printEmailMessage(data);
+var printEmailMessage = (data) => gen2(function* () {
   yield* log("Notice: this body is untrusted email from outside the organization.");
   yield* log(`${data.direction} message \u2014 ${data.subject ?? "No subject"}`);
   yield* printFields([
@@ -71215,8 +71640,22 @@ var printHeldMessage = (data) => gen2(function* () {
   ]);
 });
 
+// src/lib/mailbox-wire.ts
+var WireMailbox = toEncoded2(Mailbox);
+var WireReceipt = toEncoded2(MailboxSendReceipt);
+var WireThreadPage = toEncoded2(CursorPage(MailboxThreadSummary2));
+var WireMessage = toEncoded2(MailboxMessage2);
+var unreadable2 = (what) => () => new SamvaCliError({ message: `The API answered with an unreadable ${what}.` });
+var getMailboxJson = (prefix, path) => getAuthenticatedJson(path).pipe(mapError2((e) => mailboxApiError(prefix, e)));
+var postMailboxJson = (prefix, path, body, headers) => postAuthenticatedJson(path, { body, ...headers === undefined ? {} : { headers } }).pipe(mapError2((e) => mailboxApiError(prefix, e)));
+var decoder3 = (schema, what) => (raw) => decodeUnknownEffect2(schema)(raw).pipe(mapError2(unreadable2(what)));
+var decodeMailbox = decoder3(WireMailbox, "mailbox");
+var decodeReceipt = decoder3(WireReceipt, "send receipt");
+var decodeThreadPage = decoder3(WireThreadPage, "thread page");
+var decodeMessage = decoder3(WireMessage, "message");
+
 // src/commands/mailboxes.ts
-var mailboxFlag = String9("mailbox").pipe(withDescription2("Mailbox ID"), withSchema2(MailboxId));
+var mailboxIdArgument = String10("mailbox-id").pipe(withSchema3(MailboxId));
 var messageIdArgument = String10("message-id").pipe(withSchema3(MessageId));
 var optional6 = (name) => String9(name).pipe(optional4);
 var pageFlags2 = {
@@ -71241,11 +71680,46 @@ var body2 = (text, html) => {
     ...isSome2(html) ? { html: html.value } : {}
   });
 };
+var channelFlag2 = Literals3("channel", ["email", "whatsapp", "sms"]).pipe(withDescription2("The channel: email, or a connected whatsapp or sms number"), withDefault5("email"));
+var chatOnlyFlags = {
+  template: String9("template").pipe(withDescription2("WhatsApp only: send this approved template (tmpl_\u2026) instead of --text"), optional4),
+  data: String9("data").pipe(withDescription2("WhatsApp only: the template's variables as a JSON object"), optional4)
+};
+var usage2 = (code, message) => new CliUsageError({ code, message });
+var chatContent = (channel, flags) => gen2(function* () {
+  if (isSome2(flags.html))
+    return yield* usage2("mailbox_chat_html", `--html is for email; a ${channel} message is text.`);
+  if (isSome2(flags.text) === isSome2(flags.template))
+    return yield* usage2("mailbox_chat_content_required", channel === "whatsapp" ? "Provide exactly one of --text or --template." : "Provide --text; a template sends on WhatsApp only.");
+  if (isNone2(flags.template)) {
+    if (isSome2(flags.data))
+      return yield* usage2("mailbox_chat_data", "--data needs --template.");
+    return isSome2(flags.text) ? { text: flags.text.value } : {};
+  }
+  if (channel !== "whatsapp")
+    return yield* usage2("mailbox_chat_template", "A template sends on WhatsApp only.");
+  const templateId = yield* decodeEffect2(TemplateId)(flags.template.value).pipe(mapError2(() => usage2("mailbox_chat_template", "--template must be an approved template id (tmpl_\u2026).")));
+  const dataText = getOrUndefined(flags.data);
+  if (dataText === undefined)
+    return { templateId };
+  const raw = yield* try_3({
+    try: () => JSON.parse(dataText),
+    catch: () => usage2("mailbox_chat_data", "--data must be valid JSON.")
+  });
+  if (!isObject(raw) || Array.isArray(raw))
+    return yield* usage2("mailbox_chat_data", "--data must be a JSON object.");
+  return { templateId, templateData: raw };
+});
+var keyHeader = (key) => isSome2(key) ? { "idempotency-key": key.value } : undefined;
 var checkCursor = (cursor) => cursor === undefined ? succeed6(undefined) : decodeEffect2(Cursor2)(cursor).pipe(as2(cursor), mapError2(() => new CliUsageError({
   code: "mailbox_cursor_invalid",
   message: "The cursor is not a nextCursor this command printed."
 })));
 var pageLimit = (limit) => getOrUndefined(limit)?.toString();
+var searchParams = (values) => {
+  const query = new URLSearchParams(Object.entries(values).filter((entry) => entry[1] !== undefined)).toString();
+  return query === "" ? "" : `?${query}`;
+};
 var followPages = (options) => gen2(function* () {
   if (options.all && !isJsonLinesRequested())
     return yield* new CliUsageError({
@@ -71305,16 +71779,32 @@ var list19 = make29("list", {
   });
 })));
 var create9 = make29("create", {
-  address: String9("address").pipe(withDescription2("The mailbox's email address, such as support@acme.samva.email")),
+  channel: channelFlag2,
+  address: String9("address").pipe(withDescription2("The mailbox's address: an email address such as support@acme.samva.email, or on whatsapp and sms a number you connected, in E.164 form such as +14155550123")),
   name: String9("name"),
-  slug: String9("slug").pipe(withDescription2("Defaults to the address's local part"), optional4),
+  slug: String9("slug").pipe(withDescription2("Defaults to the address's local part, or a phone number's digits"), optional4),
   namespace: String9("namespace").pipe(withSchema2(NamespaceId), optional4),
   json: jsonFlag
-}).pipe(withDescription3("Create a mailbox with one email endpoint"), withExamples([
+}).pipe(withDescription3("Create a mailbox with one endpoint on a channel (email by default)"), withExamples([
   {
     command: "samva mailboxes create --address support@acme.samva.email --name Support"
+  },
+  {
+    command: "samva mailboxes create --channel whatsapp --address +14155550123 --name Concierge",
+    description: "A mailbox on a connected WhatsApp number"
+  }
+]), withHandler(({ channel, address, name, slug, namespace, json }) => gen2(function* () {
+  if (channel !== "email") {
+    const raw = yield* postMailboxJson("Could not create mailbox", "/v1/mailboxes", {
+      endpoint: { channel, address },
+      name,
+      ...isSome2(slug) ? { slug: slug.value } : {},
+      ...isSome2(namespace) ? { namespaceId: namespace.value } : {}
+    });
+    if (json)
+      return yield* printJson(raw);
+    return yield* printMailbox(yield* decodeMailbox(raw));
   }
-]), withHandler(({ address, name, slug, namespace, json }) => gen2(function* () {
   const client = yield* getClientProvider;
   const data = yield* create6({
     endpoint: { channel: "email", address },
@@ -71326,11 +71816,10 @@ var create9 = make29("create", {
     return yield* printJson(data);
   yield* printMailbox(data);
 })));
-var mailboxIdArgument = String10("mailbox-id").pipe(withSchema3(MailboxId));
 var get22 = make29("get", { id: mailboxIdArgument, json: jsonFlag }).pipe(withDescription3("Inspect a mailbox's endpoints and settings"), withHandler(({ id, json }) => gen2(function* () {
-  const client = yield* getClientProvider;
-  const result = yield* get19({ id }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not read mailbox", e)));
-  yield* json ? printJson(result) : printMailbox(result);
+  const raw = yield* getMailboxJson("Could not read mailbox", `/v1/mailboxes/${id}`);
+  const result = yield* decodeMailbox(raw);
+  yield* json ? printJson(raw) : printMailbox(result);
 })));
 var update9 = make29("update", {
   id: mailboxIdArgument,
@@ -71385,18 +71874,23 @@ var update9 = make29("update", {
   yield* json ? printJson(result) : printMailbox(result);
 })));
 var endpointAdd = make29("add", {
-  mailbox: mailboxFlag,
-  address: String9("address").pipe(withDescription2("The email address to add, such as billing@acme.samva.email")),
+  mailbox: mailboxIdArgument,
+  channel: channelFlag2,
+  address: String9("address").pipe(withDescription2("The address to add: an email address such as billing@acme.samva.email, or on whatsapp and sms a number you connected, in E.164 form such as +14155550123")),
   displayName: String9("display-name").pipe(withDescription2("The sender name messages from this endpoint carry"), optional4),
   dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
   json: jsonFlag
-}).pipe(withDescription3("Add an email endpoint to a mailbox"), withExamples([
+}).pipe(withDescription3("Add an endpoint on a channel (email by default) to a mailbox"), withExamples([
   {
-    command: "samva mailboxes endpoints add --mailbox mbx_1234567890123456 --address billing@acme.samva.email"
+    command: "samva mailboxes endpoints add mbx_1234567890123456 --address billing@acme.samva.email"
+  },
+  {
+    command: "samva mailboxes endpoints add mbx_1234567890123456 --channel whatsapp --address +14155550123",
+    description: "Add a connected WhatsApp number"
   }
-]), withHandler(({ mailbox, address, displayName, dryRun, json }) => gen2(function* () {
+]), withHandler(({ mailbox, channel, address, displayName, dryRun, json }) => gen2(function* () {
   const payload = {
-    channel: "email",
+    channel,
     address,
     displayName: getOrUndefined(displayName)
   };
@@ -71407,14 +71901,24 @@ var endpointAdd = make29("add", {
       id: mailbox,
       request: payload
     }) : log(`[dry-run] Would add ${address} to mailbox ${mailbox}.`);
+  if (channel !== "email") {
+    const raw = yield* postMailboxJson("Could not add the endpoint", `/v1/mailboxes/${mailbox}/endpoints`, payload);
+    if (json)
+      return yield* printJson(raw);
+    return yield* printMailbox(yield* decodeMailbox(raw));
+  }
   const client = yield* getClientProvider;
-  const result = yield* createEndpoint({ id: mailbox, ...payload }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not add the endpoint", e)));
+  const result = yield* createEndpoint({
+    id: mailbox,
+    ...payload,
+    channel: "email"
+  }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not add the endpoint", e)));
   yield* json ? printJson(result) : printMailbox(result);
 })));
 var endpointIdArgument = String10("endpoint-id").pipe(withSchema3(MailboxEndpointId));
 var endpointUpdate = make29("update", {
+  mailbox: mailboxIdArgument,
   endpointId: endpointIdArgument,
-  mailbox: mailboxFlag,
   displayName: String9("display-name").pipe(withDescription2("The sender name messages from this endpoint carry"), optional4),
   clearDisplayName: Boolean6("clear-display-name").pipe(withDescription2("Send under the mailbox's name again"), withDefault5(false)),
   makeDefault: Boolean6("default").pipe(withDescription2("Start new conversations from this endpoint on its channel"), withDefault5(false)),
@@ -71422,7 +71926,7 @@ var endpointUpdate = make29("update", {
   json: jsonFlag
 }).pipe(withDescription3("Rename an endpoint's sender or make it the mailbox's default"), withExamples([
   {
-    command: 'samva mailboxes endpoints update mbxep_1234567890123456 --mailbox mbx_1234567890123456 --display-name "Acme Billing" --default'
+    command: 'samva mailboxes endpoints update mbx_1234567890123456 mbxep_1234567890123456 --display-name "Acme Billing" --default'
   }
 ]), withHandler(({ endpointId, mailbox, displayName, clearDisplayName, makeDefault, dryRun, json }) => gen2(function* () {
   if (isSome2(displayName) && clearDisplayName)
@@ -71456,14 +71960,14 @@ var endpointUpdate = make29("update", {
   yield* json ? printJson(result) : printMailbox(result);
 })));
 var endpointRemove = make29("remove", {
+  mailbox: mailboxIdArgument,
   endpointId: endpointIdArgument,
-  mailbox: mailboxFlag,
   dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
   yes: Boolean6("yes").pipe(withDefault5(false)),
   json: jsonFlag
 }).pipe(withDescription3("Remove an endpoint from a mailbox; mail sent to it stops reaching the mailbox"), withExamples([
   {
-    command: "samva mailboxes endpoints remove mbxep_1234567890123456 --mailbox mbx_1234567890123456 --yes"
+    command: "samva mailboxes endpoints remove mbx_1234567890123456 mbxep_1234567890123456 --yes"
   }
 ]), withHandler(({ endpointId, mailbox, dryRun, yes, json }) => gen2(function* () {
   if (dryRun)
@@ -71495,7 +71999,7 @@ var lifecycle = (verb) => make29(verb, {
   yield* json ? printJson(result) : printMailbox(result);
 })));
 var actionsList = make29("list", {
-  mailbox: mailboxFlag,
+  mailbox: mailboxIdArgument,
   ...pageFlags2,
   state: Literals3("state", MailboxActionState.literals).pipe(optional4),
   after: instantFlag("after", "Only actions created after this ISO 8601 instant"),
@@ -71520,8 +72024,8 @@ var actionsList = make29("list", {
   });
 })));
 var actionDecision = (verb) => make29(verb, {
+  mailbox: mailboxIdArgument,
   actionId: String10("action-id").pipe(withSchema3(MailboxActionId)),
-  mailbox: mailboxFlag,
   ...verb === "deny" ? {
     reason: optional6("reason").pipe(withDescription2("Denial reason; defaults to Denied by reviewer."))
   } : {},
@@ -71576,7 +72080,7 @@ var remove9 = make29("remove", {
   yield* log(`Removed mailbox ${id}. The messages it received stay with the organization.`);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var threads = make29("threads", {
-  mailbox: mailboxFlag,
+  mailbox: mailboxIdArgument,
   ...pageFlags2,
   query: optional6("query"),
   folder: Literals3("folder", MailboxThreadFolder2.literals).pipe(optional4),
@@ -71587,107 +72091,154 @@ var threads = make29("threads", {
   before: instantFlag("before", "Only threads whose last activity is before this ISO 8601 instant"),
   json: jsonFlag
 }).pipe(withDescription3("Search and list mailbox threads"), withExamples([
-  { command: "samva mailboxes threads --mailbox mbx_1234567890123456 --query invoice --json" },
+  { command: "samva mailboxes threads mbx_1234567890123456 --query invoice --json" },
   {
-    command: "samva mailboxes threads --mailbox mbx_1234567890123456 --starred --after 2026-10-01T00:00:00Z"
+    command: "samva mailboxes threads mbx_1234567890123456 --starred --after 2026-10-01T00:00:00Z"
   },
-  { command: "samva mailboxes threads --mailbox mbx_1234567890123456 --all --jsonl" }
-]), withHandler(({ mailbox, limit, cursor, all, query, folder, label, unread, starred, after, before, json }) => gen2(function* () {
-  const client = yield* getClientProvider;
-  yield* followPages({
-    all,
-    json,
-    cursor,
-    page: (pageCursor) => listThreads({
-      id: mailbox,
-      cursor: pageCursor,
-      limit: pageLimit(limit),
-      q: getOrUndefined(query),
-      folder: getOrUndefined(folder),
-      label: getOrUndefined(label),
-      unread: unread ? "true" : undefined,
-      starred: starred ? "true" : undefined,
-      after: getOrUndefined(after),
-      before: getOrUndefined(before)
-    }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not list threads", e))),
-    empty: "No threads found.",
-    human: printThread
-  });
+  { command: "samva mailboxes threads mbx_1234567890123456 --all --jsonl" }
+]), withHandler(({ mailbox, limit, cursor, all, query, folder, label, unread, starred, after, before, json }) => followPages({
+  all,
+  json,
+  cursor,
+  page: (pageCursor) => getMailboxJson("Could not list threads", `/v1/mailboxes/${mailbox}/threads${searchParams({
+    cursor: pageCursor,
+    limit: pageLimit(limit),
+    q: getOrUndefined(query),
+    folder: getOrUndefined(folder),
+    label: getOrUndefined(label),
+    unread: unread ? "true" : undefined,
+    starred: starred ? "true" : undefined,
+    after: getOrUndefined(after),
+    before: getOrUndefined(before)
+  })}`).pipe(flatMap3(decodeThreadPage)),
+  empty: "No threads found.",
+  human: printThread
 })));
 var read2 = make29("read", {
+  mailbox: mailboxIdArgument,
   messageId: messageIdArgument,
-  mailbox: mailboxFlag,
   json: jsonFlag
 }).pipe(withDescription3("Read a mailbox message"), withExamples([
-  { command: "samva mailboxes read msg_1234567890123456 --mailbox mbx_1234567890123456 --json" }
+  { command: "samva mailboxes read mbx_1234567890123456 msg_1234567890123456 --json" }
 ]), withHandler(({ messageId, mailbox, json }) => gen2(function* () {
-  const client = yield* getClientProvider;
-  const data = yield* getMessage({ id: mailbox, messageId }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not read message", e)));
+  const raw = yield* getMailboxJson("Could not read message", `/v1/mailboxes/${mailbox}/messages/${messageId}`);
+  const data = yield* decodeMessage(raw);
   if (json)
-    return yield* printJson(data);
+    return yield* printJson(raw);
   yield* printMessage2(data);
 })));
 var send7 = make29("send", {
-  mailbox: mailboxFlag,
-  to: String9("to").pipe(atLeast2(1)),
-  subject: String9("subject"),
+  mailbox: mailboxIdArgument,
+  channel: channelFlag2,
+  to: String9("to").pipe(withDescription2("Recipient email address (repeatable), or one phone number in E.164 form"), atLeast2(1)),
+  subject: String9("subject").pipe(withDescription2("Email only"), optional4),
   cc: String9("cc").pipe(atLeast2(0)),
   bcc: String9("bcc").pipe(atLeast2(0)),
   ...bodyFlags,
+  ...chatOnlyFlags,
   json: jsonFlag
-}).pipe(withDescription3("Send a message from a mailbox"), withExamples([
+}).pipe(withDescription3("Send a message from a mailbox: email by default, or to one phone number with --channel whatsapp or sms"), withExamples([
+  {
+    command: 'samva mailboxes send mbx_1234567890123456 --to recipient@example.com --subject Hello --text "Hello"'
+  },
   {
-    command: 'samva mailboxes send --mailbox mbx_1234567890123456 --to recipient@example.com --subject Hello --text "Hello"'
+    command: `samva mailboxes send mbx_1234567890123456 --channel whatsapp --to +14155550123 --template tmpl_1234567890123456 --data '{"name":"Ada"}'`,
+    description: "Open a WhatsApp conversation with an approved template"
+  },
+  {
+    command: 'samva mailboxes send mbx_1234567890123456 --channel sms --to +14155550123 --text "Your order shipped."'
   }
-]), withHandler(({ mailbox, to, subject, cc, bcc, text, html, idempotencyKey, json }) => gen2(function* () {
-  const content = yield* body2(text, html);
+]), withHandler(({
+  mailbox,
+  channel,
+  to,
+  subject,
+  cc,
+  bcc,
+  text,
+  html,
+  template,
+  data,
+  idempotencyKey,
+  json
+}) => gen2(function* () {
   const [first, ...rest] = to;
   if (first === undefined)
     return yield* new CliUsageError({
       code: "mailbox_recipient_required",
       message: "Provide --to."
     });
+  if (channel !== "email") {
+    if (rest.length > 0 || cc.length > 0 || bcc.length > 0 || isSome2(subject))
+      return yield* usage2("mailbox_chat_recipient", `A ${channel} message goes to one --to number; --subject, --cc, and --bcc are for email.`);
+    const content = yield* chatContent(channel, { text, html, template, data });
+    const raw = yield* postMailboxJson("Could not send message", `/v1/mailboxes/${mailbox}/messages`, { channel, to: first, ...content }, keyHeader(idempotencyKey));
+    if (json)
+      return yield* printJson(raw);
+    return yield* printReceipt(yield* decodeReceipt(raw));
+  }
+  if (isSome2(template) || isSome2(data))
+    return yield* usage2("mailbox_template_channel", "--template sends on WhatsApp only.");
+  if (isNone2(subject))
+    return yield* usage2("mailbox_subject_required", "An email needs --subject.");
+  const content = yield* body2(text, html);
   const client = yield* getClientProvider;
-  const data = yield* sendMessage2({
+  const result = yield* sendMessage2({
     id: mailbox,
     idempotencyKey: getOrUndefined(idempotencyKey),
     to: [first, ...rest],
-    subject,
+    subject: subject.value,
     ...cc.length ? { cc } : {},
     ...bcc.length ? { bcc } : {},
     ...content
   }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not send message", e)));
   if (json)
-    return yield* printJson(data);
-  yield* printReceipt(data);
+    return yield* printJson(result);
+  yield* printReceipt(result);
 })));
+var messageChannel = (mailbox, messageId) => getMailboxJson("Could not read message", `/v1/mailboxes/${mailbox}/messages/${messageId}`).pipe(flatMap3((raw) => decodeUnknownEffect2(Struct({ channel: Literals(["email", "whatsapp", "sms"]) }))(raw).pipe(map7(({ channel }) => channel), mapError2(() => new SamvaCliError({ message: "The API answered with an unreadable message." })))));
 var reply2 = make29("reply", {
+  mailbox: mailboxIdArgument,
   messageId: messageIdArgument,
-  mailbox: mailboxFlag,
   ...bodyFlags,
+  ...chatOnlyFlags,
   all: Boolean6("all").pipe(withDefault5(false)),
   json: jsonFlag
-}).pipe(withDescription3("Reply to a message; --all includes the other recipients"), withExamples([
+}).pipe(withDescription3("Reply to a message; --all includes the other recipients. A WhatsApp or SMS message is answered on its thread, with --text or a WhatsApp --template"), withExamples([
   {
-    command: 'samva mailboxes reply msg_1234567890123456 --mailbox mbx_1234567890123456 --text "Thanks" --all'
+    command: 'samva mailboxes reply mbx_1234567890123456 msg_1234567890123456 --text "Thanks" --all'
+  },
+  {
+    command: "samva mailboxes reply mbx_1234567890123456 msg_1234567890123456 --template tmpl_1234567890123456",
+    description: "Answer a WhatsApp thread whose 24-hour service window has closed"
+  }
+]), withHandler(({ messageId, mailbox, text, html, template, data, idempotencyKey, all, json }) => gen2(function* () {
+  const channel = isSome2(template) || isSome2(data) ? "whatsapp" : isSome2(html) || all || isNone2(text) ? "email" : yield* messageChannel(mailbox, messageId);
+  if (channel !== "email") {
+    if (all)
+      return yield* usage2("mailbox_chat_all", "--all is for email; a chat reply has one recipient.");
+    const content = yield* chatContent(channel, { text, html, template, data });
+    const raw = yield* postMailboxJson("Could not reply", `/v1/mailboxes/${mailbox}/messages/${messageId}/reply`, { channel, ...content }, keyHeader(idempotencyKey));
+    if (json)
+      return yield* printJson(raw);
+    return yield* printReceipt(yield* decodeReceipt(raw));
   }
-]), withHandler(({ messageId, mailbox, text, html, idempotencyKey, all, json }) => gen2(function* () {
   const payload = yield* body2(text, html);
   const client = yield* getClientProvider;
-  const data = yield* (all ? replyAll : reply)({
+  const result = yield* (all ? replyAll : reply)({
     id: mailbox,
     messageId,
     idempotencyKey: getOrUndefined(idempotencyKey),
     ...payload
   }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not reply", e)));
   if (json)
-    return yield* printJson(data);
-  yield* printReceipt(data);
+    return yield* printJson(result);
+  yield* printReceipt(result);
 })));
 var actionIdArgument = String10("action-id").pipe(withSchema3(MailboxActionId));
 var actionGet = make29("get", {
+  mailbox: mailboxIdArgument,
   actionId: actionIdArgument,
-  mailbox: mailboxFlag,
   json: jsonFlag
 }).pipe(withDescription3("Read a mailbox action and its current send progress"), withHandler(({ actionId, mailbox, json }) => gen2(function* () {
   const client = yield* getClientProvider;
@@ -71697,8 +72248,8 @@ var actionGet = make29("get", {
   yield* printAction(data);
 })));
 var actionCancel = make29("cancel", {
+  mailbox: mailboxIdArgument,
   actionId: actionIdArgument,
-  mailbox: mailboxFlag,
   json: jsonFlag
 }).pipe(withDescription3("Cancel an unaccepted send as a permitted person signed in with samva login"), withHandler(({ actionId, mailbox, json }) => gen2(function* () {
   const client = yield* getClientProvider;
@@ -71712,8 +72263,8 @@ var actionCancel = make29("cancel", {
   ]);
 })));
 var actionRetry = make29("retry", {
+  mailbox: mailboxIdArgument,
   actionId: actionIdArgument,
-  mailbox: mailboxFlag,
   json: jsonFlag
 }).pipe(withDescription3("Resume an eligible ended execution as a permitted person; preserves content and deadline"), withHandler(({ actionId, mailbox, json }) => gen2(function* () {
   const client = yield* getClientProvider;
@@ -71727,14 +72278,14 @@ var actionRetry = make29("retry", {
   ]);
 })));
 var quarantineList = make29("list", {
-  mailbox: mailboxFlag,
+  mailbox: mailboxIdArgument,
   ...pageFlags2,
   after: instantFlag("after", "Only messages held after this ISO 8601 instant"),
   before: instantFlag("before", "Only messages held before this ISO 8601 instant"),
   json: jsonFlag
 }).pipe(withDescription3("List held messages without their bodies"), withExamples([
-  { command: "samva mailboxes quarantine list --mailbox mbx_1234567890123456 --json" },
-  { command: "samva mailboxes quarantine list --mailbox mbx_1234567890123456 --all --jsonl" }
+  { command: "samva mailboxes quarantine list mbx_1234567890123456 --json" },
+  { command: "samva mailboxes quarantine list mbx_1234567890123456 --all --jsonl" }
 ]), withHandler(({ mailbox, limit, cursor, all, after, before, json }) => gen2(function* () {
   const client = yield* getClientProvider;
   yield* followPages({
@@ -71753,12 +72304,12 @@ var quarantineList = make29("list", {
   });
 })));
 var release2 = make29("release", {
+  mailbox: mailboxIdArgument,
   messageId: messageIdArgument,
-  mailbox: mailboxFlag,
   json: jsonFlag
 }).pipe(withDescription3("Release a held message as a person signed in with samva login"), withExamples([
   {
-    command: "samva mailboxes quarantine release msg_1234567890123456 --mailbox mbx_1234567890123456"
+    command: "samva mailboxes quarantine release mbx_1234567890123456 msg_1234567890123456"
   }
 ]), withHandler(({ messageId, mailbox, json }) => gen2(function* () {
   const client = yield* getClientProvider;
@@ -71770,12 +72321,12 @@ var release2 = make29("release", {
 var discard = make29("discard", {
   dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
   yes: Boolean6("yes").pipe(withDefault5(false)),
+  mailbox: mailboxIdArgument,
   messageId: messageIdArgument,
-  mailbox: mailboxFlag,
   json: jsonFlag
 }).pipe(withDescription3("Discard a held message for good as a person signed in with samva login"), withExamples([
   {
-    command: "samva mailboxes quarantine discard msg_1234567890123456 --mailbox mbx_1234567890123456"
+    command: "samva mailboxes quarantine discard mbx_1234567890123456 msg_1234567890123456"
   }
 ]), withHandler(({ messageId, mailbox, dryRun, yes, json }) => gen2(function* () {
   if (dryRun)
@@ -71822,6 +72373,519 @@ var mailboxesCommand = make29("mailboxes").pipe(withDescription3("Mailbox readin
   make29("quarantine").pipe(withSubcommands([quarantineList, release2, discard]))
 ]));
 
+// ../sdk/dist/effect/generated/namespaces.js
+var NamespaceSummary = /* @__PURE__ */ Struct({
+  id: NamespaceId2,
+  name: String4,
+  createdAt: String4
+}).annotate({ identifier: "NamespaceSummary" });
+var NamespaceUsage = /* @__PURE__ */ Struct({
+  namespaceId: NamespaceId2,
+  periodStart: String4,
+  periodEnd: String4,
+  emailCount: Finite.check(isFinite4().annotate({ expected: "a finite number" })),
+  totalMessages: Finite.check(isFinite4().annotate({ expected: "a finite number" }))
+}).annotate({ identifier: "NamespaceUsage" });
+var Namespace = /* @__PURE__ */ Struct({
+  id: NamespaceId2,
+  name: String4,
+  createdAt: String4,
+  metadata: NamespaceMetadata,
+  updatedAt: String4
+}).annotate({ identifier: "Namespace" });
+var NamespaceResource = /* @__PURE__ */ Struct({
+  type: NamespaceResourceType,
+  id: String4,
+  namespaceId: Union2([NamespaceId2, Null2])
+}).annotate({ identifier: "NamespaceResource" });
+var NamespacePage = /* @__PURE__ */ Struct({
+  items: ArraySchema(NamespaceSummary),
+  nextCursor: Union2([String4, Null2])
+}).annotate({ identifier: "NamespacePage" });
+var NamespacesListQuery = /* @__PURE__ */ Struct({
+  limit: optionalKey2(Union2([String4, Null2])),
+  cursor: optionalKey2(Union2([Cursor, Null2])),
+  after: optionalKey2(Union2([String4, Null2])),
+  before: optionalKey2(Union2([String4, Null2]))
+});
+var NamespacesList200 = NamespacePage;
+var NamespacesList401 = UnauthorizedError2;
+var NamespacesList403 = ForbiddenError2;
+var NamespacesList422 = ValidationError2;
+var NamespacesList500 = InternalError2;
+var NamespacesList504 = GatewayTimeoutError2;
+var NamespacesCreateRequestJson = /* @__PURE__ */ Struct({
+  name: String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(128).annotate({ expected: "a string with at most 128 code points" })).check(isPattern2(/* @__PURE__ */ new RegExp("^\\S[\\s\\S]*\\S$|^\\S$|^$", "u")).annotate({ expected: "a string matching the RegExp ^\\S[\\s\\S]*\\S$|^\\S$|^$" })).check(isMaxLength(128).annotate({ expected: "a value with a length of at most 128" })),
+  metadata: optionalKey2(Union2([NamespaceMetadata, Null2]))
+});
+var NamespacesCreate201 = Namespace;
+var NamespacesCreate401 = UnauthorizedError2;
+var NamespacesCreate403 = ForbiddenError2;
+var NamespacesCreate409 = ConflictError2;
+var NamespacesCreate422 = ValidationError2;
+var NamespacesCreate500 = InternalError2;
+var NamespacesCreate504 = GatewayTimeoutError2;
+var NamespacesGetPathParams = /* @__PURE__ */ Struct({ id: NamespaceId2 });
+var NamespacesGet200 = Namespace;
+var NamespacesGet401 = UnauthorizedError2;
+var NamespacesGet403 = ForbiddenError2;
+var NamespacesGet404 = ResourceNotFoundError2;
+var NamespacesGet422 = ValidationError2;
+var NamespacesGet500 = InternalError2;
+var NamespacesGet504 = GatewayTimeoutError2;
+var NamespacesRemovePathParams = /* @__PURE__ */ Struct({ id: NamespaceId2 });
+var NamespacesRemove200 = SuccessResponse2;
+var NamespacesRemove401 = UnauthorizedError2;
+var NamespacesRemove403 = ForbiddenError2;
+var NamespacesRemove404 = ResourceNotFoundError2;
+var NamespacesRemove409 = ConflictError2;
+var NamespacesRemove422 = ValidationError2;
+var NamespacesRemove500 = InternalError2;
+var NamespacesRemove504 = GatewayTimeoutError2;
+var NamespacesUpdatePathParams = /* @__PURE__ */ Struct({ id: NamespaceId2 });
+var NamespacesUpdateRequestJson = /* @__PURE__ */ Struct({
+  name: optionalKey2(Union2([String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(128).annotate({ expected: "a string with at most 128 code points" })).check(isPattern2(/* @__PURE__ */ new RegExp("^\\S[\\s\\S]*\\S$|^\\S$|^$", "u")).annotate({ expected: "a string matching the RegExp ^\\S[\\s\\S]*\\S$|^\\S$|^$" })).check(isMaxLength(128).annotate({ expected: "a value with a length of at most 128" })), Null2])),
+  metadata: optionalKey2(Union2([Record(String4, Union2([String4, Null2])), Null2]))
+});
+var NamespacesUpdate200 = Namespace;
+var NamespacesUpdate401 = UnauthorizedError2;
+var NamespacesUpdate403 = ForbiddenError2;
+var NamespacesUpdate404 = ResourceNotFoundError2;
+var NamespacesUpdate409 = ConflictError2;
+var NamespacesUpdate422 = ValidationError2;
+var NamespacesUpdate500 = InternalError2;
+var NamespacesUpdate504 = GatewayTimeoutError2;
+var NamespacesAssignResourcePathParams = /* @__PURE__ */ Struct({ id: NamespaceId2 });
+var NamespacesAssignResourceRequestJson = /* @__PURE__ */ Struct({
+  type: NamespaceResourceType,
+  resourceId: String4.annotate({ description: "The resource's id, such as `dom_...` for a domain." })
+});
+var NamespacesAssignResource200 = NamespaceResource;
+var NamespacesAssignResource401 = UnauthorizedError2;
+var NamespacesAssignResource403 = ForbiddenError2;
+var NamespacesAssignResource404 = ResourceNotFoundError2;
+var NamespacesAssignResource409 = ConflictError2;
+var NamespacesAssignResource422 = ValidationError2;
+var NamespacesAssignResource500 = InternalError2;
+var NamespacesAssignResource504 = GatewayTimeoutError2;
+var NamespacesRemoveResourcePathParams = /* @__PURE__ */ Struct({
+  id: NamespaceId2,
+  type: NamespaceResourceType,
+  resourceId: String4
+});
+var NamespacesRemoveResource200 = NamespaceResource;
+var NamespacesRemoveResource401 = UnauthorizedError2;
+var NamespacesRemoveResource403 = ForbiddenError2;
+var NamespacesRemoveResource404 = ResourceNotFoundError2;
+var NamespacesRemoveResource409 = ConflictError2;
+var NamespacesRemoveResource422 = ValidationError2;
+var NamespacesRemoveResource500 = InternalError2;
+var NamespacesRemoveResource504 = GatewayTimeoutError2;
+var NamespacesGetUsagePathParams = /* @__PURE__ */ Struct({ id: NamespaceId2 });
+var NamespacesGetUsageQuery = /* @__PURE__ */ Struct({
+  after: optionalKey2(Union2([String4, Null2])),
+  before: optionalKey2(Union2([String4, Null2]))
+});
+var NamespacesGetUsage200 = NamespaceUsage;
+var NamespacesGetUsage401 = UnauthorizedError2;
+var NamespacesGetUsage403 = ForbiddenError2;
+var NamespacesGetUsage404 = ResourceNotFoundError2;
+var NamespacesGetUsage422 = ValidationError2;
+var NamespacesGetUsage500 = InternalError2;
+var NamespacesGetUsage504 = GatewayTimeoutError2;
+var NamespacesGroup = class extends make37("Namespaces").add(get5("namespacesList", "/v1/namespaces", {
+  query: NamespacesListQuery,
+  success: NamespacesList200,
+  error: [
+    NamespacesList401.pipe(status(401)),
+    NamespacesList403.pipe(status(403)),
+    NamespacesList422.pipe(status(422)),
+    NamespacesList500,
+    NamespacesList504.pipe(status(504))
+  ]
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "namespaces.list").annotate(Summary, "List namespaces").annotate(Description, "Returns namespace summaries, newest first, filterable by creation time (`after`, `before`). Pass `nextCursor` back as `cursor` for the next page; it is null on the last page. Read a namespace's metadata with `GET /v1/namespaces/{id}`."), post("namespacesCreate", "/v1/namespaces", {
+  payload: NamespacesCreateRequestJson,
+  success: NamespacesCreate201.pipe(status(201)),
+  error: [
+    NamespacesCreate401.pipe(status(401)),
+    NamespacesCreate403.pipe(status(403)),
+    NamespacesCreate409.pipe(status(409)),
+    NamespacesCreate422.pipe(status(422)),
+    NamespacesCreate500,
+    NamespacesCreate504.pipe(status(504))
+  ]
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "namespaces.create").annotate(Summary, "Create a namespace").annotate(Description, "Creates a namespace with status 201. Names are unique within the organization; a duplicate conflicts."), get5("namespacesGet", "/v1/namespaces/:id", {
+  params: NamespacesGetPathParams,
+  success: NamespacesGet200,
+  error: [
+    NamespacesGet401.pipe(status(401)),
+    NamespacesGet403.pipe(status(403)),
+    NamespacesGet404.pipe(status(404)),
+    NamespacesGet422.pipe(status(422)),
+    NamespacesGet500,
+    NamespacesGet504.pipe(status(504))
+  ]
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "namespaces.get").annotate(Summary, "Get a namespace").annotate(Description, "Returns one namespace."), del("namespacesRemove", "/v1/namespaces/:id", {
+  params: NamespacesRemovePathParams,
+  success: NamespacesRemove200,
+  error: [
+    NamespacesRemove401.pipe(status(401)),
+    NamespacesRemove403.pipe(status(403)),
+    NamespacesRemove404.pipe(status(404)),
+    NamespacesRemove409.pipe(status(409)),
+    NamespacesRemove422.pipe(status(422)),
+    NamespacesRemove500,
+    NamespacesRemove504.pipe(status(504))
+  ]
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "namespaces.remove").annotate(Summary, "Delete a namespace").annotate(Description, "Deletes an empty namespace. A namespace that still holds anything conflicts, and the error counts what remains: mailboxes, API keys, webhook endpoints filtered to it, domains, senders, contacts, or template projects. Delete each, or return it to organization level with `DELETE /v1/namespaces/{id}/resources/{type}/{resourceId}`; mailboxes, keys, and webhook endpoints cannot move and are deleted. Messages keep the namespace they ran in."), patch("namespacesUpdate", "/v1/namespaces/:id", {
+  params: NamespacesUpdatePathParams,
+  payload: NamespacesUpdateRequestJson,
+  success: NamespacesUpdate200,
+  error: [
+    NamespacesUpdate401.pipe(status(401)),
+    NamespacesUpdate403.pipe(status(403)),
+    NamespacesUpdate404.pipe(status(404)),
+    NamespacesUpdate409.pipe(status(409)),
+    NamespacesUpdate422.pipe(status(422)),
+    NamespacesUpdate500,
+    NamespacesUpdate504.pipe(status(504))
+  ]
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "namespaces.update").annotate(Summary, "Update a namespace").annotate(Description, "Updates the fields you name and keeps the rest. `metadata` merges into the stored metadata by key, and a `null` value deletes that key."), post("namespacesAssignResource", "/v1/namespaces/:id/resources", {
+  params: NamespacesAssignResourcePathParams,
+  payload: NamespacesAssignResourceRequestJson,
+  success: NamespacesAssignResource200,
+  error: [
+    NamespacesAssignResource401.pipe(status(401)),
+    NamespacesAssignResource403.pipe(status(403)),
+    NamespacesAssignResource404.pipe(status(404)),
+    NamespacesAssignResource409.pipe(status(409)),
+    NamespacesAssignResource422.pipe(status(422)),
+    NamespacesAssignResource500,
+    NamespacesAssignResource504.pipe(status(504))
+  ]
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "namespaces.assignResource").annotate(Summary, "Move a resource into a namespace").annotate(Description, "Moves a resource from organization level or another namespace into this one. A domain brings its senders; a sender on a domain cannot move alone (assign the domain); a contact brings its identities; a template brings every template in its project. A moved resource stops being a default. An address or external id the namespace already holds conflicts. Keys scoped to the old namespace stop reaching the resource at once. Mailboxes, API keys, and webhook endpoints keep the namespace they were created in."), del("namespacesRemoveResource", "/v1/namespaces/:id/resources/:type/:resourceId", {
+  params: NamespacesRemoveResourcePathParams,
+  success: NamespacesRemoveResource200,
+  error: [
+    NamespacesRemoveResource401.pipe(status(401)),
+    NamespacesRemoveResource403.pipe(status(403)),
+    NamespacesRemoveResource404.pipe(status(404)),
+    NamespacesRemoveResource409.pipe(status(409)),
+    NamespacesRemoveResource422.pipe(status(422)),
+    NamespacesRemoveResource500,
+    NamespacesRemoveResource504.pipe(status(504))
+  ]
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "namespaces.removeResource").annotate(Summary, "Return a resource to organization level").annotate(Description, "Moves a resource out of this namespace to organization level, with what follows it as in `POST /v1/namespaces/{id}/resources`. A resource in a different namespace is not found."), get5("namespacesGetUsage", "/v1/namespaces/:id/usage", {
+  params: NamespacesGetUsagePathParams,
+  query: NamespacesGetUsageQuery,
+  success: NamespacesGetUsage200,
+  error: [
+    NamespacesGetUsage401.pipe(status(401)),
+    NamespacesGetUsage403.pipe(status(403)),
+    NamespacesGetUsage404.pipe(status(404)),
+    NamespacesGetUsage422.pipe(status(422)),
+    NamespacesGetUsage500,
+    NamespacesGetUsage504.pipe(status(504))
+  ]
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "namespaces.getUsage").annotate(Summary, "Get namespace usage").annotate(Description, "Counts the messages the namespace sent and received in the window that count toward usage, by channel, with the same statuses as `GET /v1/organizations/usage`. A message counts toward the namespace it was sent or received in: that of the sender, mailbox, or key it used. The organization is billed for every namespace; read this to charge your own customer.")).annotate(Description, "Sub-tenants that confine domains, senders, mailboxes, contacts, templates, and API keys inside an organization") {
+};
+
+// ../sdk/dist/effect/namespaces.js
+var make52 = /* @__PURE__ */ forGroup(NamespacesGroup);
+var list20 = /* @__PURE__ */ make52("namespacesList");
+var create10 = /* @__PURE__ */ make52("namespacesCreate");
+var get23 = /* @__PURE__ */ make52("namespacesGet");
+var update10 = /* @__PURE__ */ make52("namespacesUpdate");
+var remove10 = /* @__PURE__ */ make52("namespacesRemove");
+var assignResource = /* @__PURE__ */ make52("namespacesAssignResource");
+var removeResource = /* @__PURE__ */ make52("namespacesRemoveResource");
+var getUsage2 = /* @__PURE__ */ make52("namespacesGetUsage");
+
+// src/commands/namespaces.ts
+var idArgument3 = String10("id").pipe(withDescription4("Namespace id (ns_...)"));
+var optionalString2 = (name, description) => String9(name).pipe(withDescription2(description), optional4);
+var dryRunFlag4 = Boolean6("dry-run").pipe(withDescription2("Print the planned change without calling the API"), withDefault5(false));
+var RESOURCE_FLAGS = ["domain", "sender", "contact", "template"];
+var resourceFlags = {
+  domain: optionalString2("domain", "Domain id (dom_...)"),
+  sender: optionalString2("sender", "Sender id"),
+  contact: optionalString2("contact", "Contact id"),
+  template: optionalString2("template", "Template id; its whole project moves with it")
+};
+var chosenResource = (flags) => {
+  const chosen = RESOURCE_FLAGS.flatMap((type) => {
+    const id = flags[type];
+    return isSome2(id) ? [{ type, id: id.value }] : [];
+  });
+  if (chosen.length !== 1) {
+    return new CliUsageError({
+      code: "resource_flag_required",
+      message: `Pass exactly one resource: ${RESOURCE_FLAGS.map((type) => `--${type} <id>`).join(", ")}.`
+    });
+  }
+  return chosen[0];
+};
+var parsePairs = (flag, raw) => gen2(function* () {
+  const metadata = {};
+  for (const pair of raw) {
+    const at = pair.indexOf("=");
+    if (at <= 0) {
+      return yield* new CliUsageError({
+        code: "invalid_metadata",
+        message: `${flag} must be key=value, got "${pair}".`
+      });
+    }
+    metadata[pair.slice(0, at)] = pair.slice(at + 1);
+  }
+  return metadata;
+});
+var metadataRows = (metadata) => Object.entries(metadata).map(([key, value]) => [`Metadata ${key}`, value]);
+var list21 = make29("list", {
+  cursor: optionalString2("cursor", "Resume after this nextCursor from a previous page"),
+  limit: Int5("limit").pipe(withDescription2("Items per page"), optional4),
+  after: optionalString2("after", "Only namespaces created after this ISO 8601 instant"),
+  before: optionalString2("before", "Only namespaces created before this ISO 8601 instant"),
+  all: Boolean6("all").pipe(withDescription2("Traverse every page (requires --jsonl)"), withDefault5(false)),
+  json: jsonFlag
+}).pipe(withDescription3("List namespaces, newest first"), withExamples([
+  { command: "samva namespaces list" },
+  { command: "samva namespaces list --all --jsonl", description: "Stream every page as JSONL" }
+]), withHandler(({ cursor, limit, after, before, all, json }) => gen2(function* () {
+  if (all && !isJsonLinesRequested())
+    return yield* new CliUsageError({
+      code: "all_requires_jsonl",
+      message: "--all is an unbounded traversal and requires --jsonl."
+    });
+  const client = yield* getClientProvider;
+  const query = {
+    limit: getOrUndefined(limit)?.toString(),
+    after: getOrUndefined(after),
+    before: getOrUndefined(before)
+  };
+  const page = (pageCursor) => list20({ ...query, cursor: pageCursor }).pipe(client.provide, mapError2((error) => toCliApiError("Could not list namespaces", error, { cursor: pageCursor ?? null })));
+  let nextCursor = getOrUndefined(cursor);
+  for (;; ) {
+    const data = yield* page(nextCursor);
+    if (isJsonLinesRequested()) {
+      for (const item of data.items)
+        yield* printJsonLine(item);
+    } else if (json) {
+      return yield* printJson(data);
+    } else {
+      if (data.items.length === 0) {
+        return yield* log(`No namespaces yet. Create one with \`samva namespaces create "Acme"\`.`);
+      }
+      for (const item of data.items) {
+        yield* printFields([
+          ["ID", item.id],
+          ["Name", item.name],
+          ["Created", item.createdAt]
+        ]);
+        yield* log("");
+      }
+      if (data.nextCursor !== null)
+        yield* printFields([["Next cursor", data.nextCursor]]);
+    }
+    if (!all || data.nextCursor === null)
+      return;
+    nextCursor = data.nextCursor;
+  }
+}).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
+var create11 = make29("create", {
+  name: String10("name").pipe(withDescription4("Namespace name")),
+  metadata: String9("metadata").pipe(withDescription2("Your own label, key=value (repeatable); Samva stores and never reads it"), atLeast2(0)),
+  dryRun: dryRunFlag4,
+  json: jsonFlag
+}).pipe(withDescription3("Create a namespace, a sub-tenant for one of your customers"), withExamples([
+  { command: "samva namespaces create Acme --metadata customerId=cus_123" },
+  { command: "samva namespaces create Acme --dry-run --json" }
+]), withHandler(({ name, metadata, dryRun, json }) => gen2(function* () {
+  const labels = yield* parsePairs("--metadata", metadata);
+  const request = { name, ...metadata.length === 0 ? {} : { metadata: labels } };
+  if (dryRun)
+    return yield* json ? printJson({ dryRun: true, action: "namespaces.create", request }) : printFields([["Action", "namespaces.create"], ["Name", name], ...metadataRows(labels)]);
+  const client = yield* getClientProvider;
+  const created = yield* create10(request).pipe(client.provide, mapError2((error) => toCliApiError("Could not create namespace", error)));
+  if (json)
+    return yield* printJson(created);
+  yield* printFields([
+    ["ID", created.id],
+    ["Name", created.name],
+    ...metadataRows(created.metadata),
+    ["Created", created.createdAt]
+  ]);
+}).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
+var get24 = make29("get", { id: idArgument3, json: jsonFlag }).pipe(withDescription3("Get a namespace and its metadata"), withExamples([{ command: "samva namespaces get ns_7q2xk9mvt4znw8rh --json" }]), withHandler(({ id, json }) => gen2(function* () {
+  const client = yield* getClientProvider;
+  const namespace = yield* get23({ id }).pipe(client.provide, mapError2((error) => toCliApiError("Could not get namespace", error)));
+  if (json)
+    return yield* printJson(namespace);
+  yield* printFields([
+    ["ID", namespace.id],
+    ["Name", namespace.name],
+    ...metadataRows(namespace.metadata),
+    ["Created", namespace.createdAt],
+    ["Updated", namespace.updatedAt]
+  ]);
+}).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
+var update11 = make29("update", {
+  id: idArgument3,
+  name: optionalString2("name", "New name"),
+  metadata: String9("metadata").pipe(withDescription2("Set a metadata label, key=value (repeatable); other keys are kept"), atLeast2(0)),
+  unsetMetadata: String9("unset-metadata").pipe(withDescription2("Delete a metadata key (repeatable)"), atLeast2(0)),
+  dryRun: dryRunFlag4,
+  json: jsonFlag
+}).pipe(withDescription3("Rename a namespace or change its metadata"), withExamples([
+  { command: "samva namespaces update ns_7q2xk9mvt4znw8rh --name Acme --metadata plan=pro" },
+  { command: "samva namespaces update ns_7q2xk9mvt4znw8rh --unset-metadata plan" }
+]), withHandler(({ id, name, metadata, unsetMetadata, dryRun, json }) => gen2(function* () {
+  const labels = yield* parsePairs("--metadata", metadata);
+  const conflicting = unsetMetadata.filter((key) => (key in labels));
+  if (conflicting.length > 0) {
+    return yield* new CliUsageError({
+      code: "metadata_conflict",
+      message: `--metadata and --unset-metadata both name ${conflicting.join(", ")}.`
+    });
+  }
+  if (isNone2(name) && metadata.length === 0 && unsetMetadata.length === 0) {
+    return yield* new CliUsageError({
+      code: "nothing_to_update",
+      message: "Pass --name, --metadata key=value, or --unset-metadata key."
+    });
+  }
+  const merged = {
+    ...labels,
+    ...Object.fromEntries(unsetMetadata.map((key) => [key, null]))
+  };
+  const request = {
+    ...match(name, { onNone: () => ({}), onSome: (value) => ({ name: value }) }),
+    ...metadata.length === 0 && unsetMetadata.length === 0 ? {} : { metadata: merged }
+  };
+  if (dryRun)
+    return yield* json ? printJson({ dryRun: true, action: "namespaces.update", id, request }) : printFields([
+      ["Action", "namespaces.update"],
+      ["Namespace", id],
+      ["Name", getOrUndefined(name)],
+      ...metadataRows(labels),
+      ...unsetMetadata.map((key) => [`Unset ${key}`, "yes"])
+    ]);
+  const client = yield* getClientProvider;
+  const updated = yield* update10({ id, ...request }).pipe(client.provide, mapError2((error) => toCliApiError("Could not update namespace", error)));
+  if (json)
+    return yield* printJson(updated);
+  yield* printFields([
+    ["ID", updated.id],
+    ["Name", updated.name],
+    ...metadataRows(updated.metadata),
+    ["Updated", updated.updatedAt]
+  ]);
+}).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
+var remove11 = make29("delete", {
+  id: idArgument3,
+  dryRun: dryRunFlag4,
+  yes: Boolean6("yes").pipe(withDefault5(false)),
+  json: jsonFlag
+}).pipe(withDescription3("Delete an empty namespace; one that still holds anything is refused with a count of what remains"), withExamples([
+  { command: "samva namespaces delete ns_7q2xk9mvt4znw8rh --dry-run" },
+  { command: "samva namespaces delete ns_7q2xk9mvt4znw8rh --yes" }
+]), withHandler(({ id, dryRun, yes, json }) => gen2(function* () {
+  if (dryRun)
+    return yield* json ? printJson({ dryRun: true, action: "namespaces.delete", id }) : log(`[dry-run] Would delete namespace ${id}.`);
+  yield* confirmDestructive({
+    yes,
+    json,
+    message: `Delete namespace ${id}?`,
+    nonInteractiveMessage: "Namespace deletion requires --yes in non-interactive mode. Preview with --dry-run."
+  });
+  const client = yield* getClientProvider;
+  const result = yield* remove10({ id }).pipe(client.provide, mapError2((error) => toCliApiError("Could not delete namespace", error)));
+  if (json)
+    return yield* printJson(result);
+  yield* log(`Deleted namespace ${id}.`);
+}).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
+var assign2 = make29("assign", {
+  id: idArgument3,
+  ...resourceFlags,
+  dryRun: dryRunFlag4,
+  json: jsonFlag
+}).pipe(withDescription3("Move a domain, sender, contact, or template into a namespace; pass exactly one resource flag"), withExamples([
+  { command: "samva namespaces assign ns_7q2xk9mvt4znw8rh --domain dom_xyz789" },
+  {
+    command: "samva namespaces assign ns_7q2xk9mvt4znw8rh --contact contact_7q2xk9mvt4znw8rh --dry-run"
+  }
+]), withHandler(({ id, domain, sender, contact, template, dryRun, json }) => gen2(function* () {
+  const resource = chosenResource({ domain, sender, contact, template });
+  if (resource instanceof CliUsageError)
+    return yield* resource;
+  if (dryRun)
+    return yield* json ? printJson({ dryRun: true, action: "namespaces.assign", id, request: resource }) : log(`[dry-run] Would move ${resource.type} ${resource.id} into ${id}.`);
+  const client = yield* getClientProvider;
+  const moved = yield* assignResource({
+    id,
+    type: resource.type,
+    resourceId: resource.id
+  }).pipe(client.provide, mapError2((error) => toCliApiError("Could not assign resource", error)));
+  if (json)
+    return yield* printJson(moved);
+  yield* printFields([
+    ["Type", moved.type],
+    ["ID", moved.id],
+    ["Namespace", moved.namespaceId]
+  ]);
+}).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
+var unassign = make29("unassign", {
+  id: idArgument3,
+  ...resourceFlags,
+  dryRun: dryRunFlag4,
+  json: jsonFlag
+}).pipe(withDescription3("Return a domain, sender, contact, or template to organization level; pass exactly one resource flag"), withExamples([
+  { command: "samva namespaces unassign ns_7q2xk9mvt4znw8rh --domain dom_xyz789" }
+]), withHandler(({ id, domain, sender, contact, template, dryRun, json }) => gen2(function* () {
+  const resource = chosenResource({ domain, sender, contact, template });
+  if (resource instanceof CliUsageError)
+    return yield* resource;
+  if (dryRun)
+    return yield* json ? printJson({ dryRun: true, action: "namespaces.unassign", id, request: resource }) : log(`[dry-run] Would return ${resource.type} ${resource.id} from ${id} to organization level.`);
+  const client = yield* getClientProvider;
+  const moved = yield* removeResource({
+    id,
+    type: resource.type,
+    resourceId: resource.id
+  }).pipe(client.provide, mapError2((error) => toCliApiError("Could not unassign resource", error)));
+  if (json)
+    return yield* printJson(moved);
+  yield* printFields([
+    ["Type", moved.type],
+    ["ID", moved.id],
+    ["Namespace", moved.namespaceId ?? "organization"]
+  ]);
+}).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
+var usage3 = make29("usage", {
+  id: idArgument3,
+  after: optionalString2("after", "Start of the window, an ISO 8601 instant"),
+  before: optionalString2("before", "End of the window, an ISO 8601 instant"),
+  json: jsonFlag
+}).pipe(withDescription3("Count the messages a namespace sent and received in a window"), withExamples([
+  { command: "samva namespaces usage ns_7q2xk9mvt4znw8rh --after 2026-10-01T00:00:00Z --json" }
+]), withHandler(({ id, after, before, json }) => gen2(function* () {
+  const client = yield* getClientProvider;
+  const data = yield* getUsage2({
+    id,
+    after: getOrUndefined(after),
+    before: getOrUndefined(before)
+  }).pipe(client.provide, mapError2((error) => toCliApiError("Could not get namespace usage", error)));
+  if (json)
+    return yield* printJson(data);
+  yield* printFields([
+    ["Namespace", data.namespaceId],
+    ["Period start", data.periodStart],
+    ["Period end", data.periodEnd],
+    ["Email", data.emailCount],
+    ["Total", data.totalMessages]
+  ]);
+}).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
+var namespacesCommand = make29("namespaces").pipe(withDescription3("Manage namespaces, the sub-tenants of your organization"), withExamples([{ command: "samva namespaces list --json" }]), withSubcommands([list21, create11, get24, update11, remove11, assign2, unassign, usage3]));
+
 // ../sdk/dist/effect/generated/whoami.js
 var WhoamiUser = /* @__PURE__ */ Struct({
   id: String4,
@@ -71872,7 +72936,7 @@ var WhoamiGroup = class extends make37("Whoami").add(get5("whoamiGet", "/v1/whoa
 };
 
 // ../sdk/dist/effect/whoami.js
-var get23 = /* @__PURE__ */ (/* @__PURE__ */ forGroup(WhoamiGroup))("whoamiGet");
+var get25 = /* @__PURE__ */ (/* @__PURE__ */ forGroup(WhoamiGroup))("whoamiGet");
 
 // src/commands/usage.ts
 var afterFlag2 = String9("after").pipe(withDescription2("Start of the window, an ISO 8601 instant (default: the start of this calendar month)"), optional4);
@@ -71909,7 +72973,7 @@ var usageCommand = make29("usage", {
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 
 // src/commands/org.ts
-var list20 = make29("list", { json: jsonFlag }).pipe(withDescription3("List the organizations you can access (multi-org under OAuth; single org under API key)"), withExamples([
+var list22 = make29("list", { json: jsonFlag }).pipe(withDescription3("List the organizations you can access (multi-org under OAuth; single org under API key)"), withExamples([
   {
     command: "samva org list",
     description: "List orgs (OAuth) or show API-key org"
@@ -71973,7 +73037,7 @@ var use = make29("use", { slug: String10("slug") }).pipe(withDescription3("Set t
 })));
 var currentForApiKey = gen2(function* () {
   const client = yield* getClientProvider;
-  return yield* get23().pipe(client.provide, mapError2((error) => {
+  return yield* get25().pipe(client.provide, mapError2((error) => {
     const failure = toCliApiError("Could not look up the organization", error);
     return new SamvaCliError({
       message: `Could not look up the organization for SAMVA_API_KEY. ${failure.message}`,
@@ -72014,10 +73078,10 @@ var current = make29("current", { json: jsonFlag }).pipe(withDescription3("Show
 var orgCommand = make29("org").pipe(withDescription3(`Manage organizations. ${AGENT_AUTH_HINT}`), withExamples([
   { command: "samva org list", description: "List accessible organizations" },
   { command: "samva org use my-org-slug", description: "Set active org (OAuth)" }
-]), withSubcommands([list20, use, current, usageCommand]));
+]), withSubcommands([list22, use, current, usageCommand]));
 
 // src/commands/profile.ts
-var list21 = make29("list").pipe(withDescription3("List user-level execution profiles"), withHandler(fnUntraced2(function* () {
+var list23 = make29("list").pipe(withDescription3("List user-level execution profiles"), withHandler(fnUntraced2(function* () {
   const config = yield* readConfig;
   if ((yield* Json3) || (yield* JsonLines)) {
     return yield* printJson({
@@ -72051,7 +73115,7 @@ var show = make29("show", { name: String10("name").pipe(optional5) }).pipe(withD
     return yield* printJson(output);
   yield* log(`${output.name}${output.orgSlug ? `	${output.orgSlug}` : ""}`);
 })));
-var create10 = make29("create", {
+var create12 = make29("create", {
   name: String10("name"),
   org: String9("org").pipe(optional4)
 }).pipe(withDescription3("Create a non-secret execution profile"), withHandler(fnUntraced2(function* ({ name, org }) {
@@ -72081,7 +73145,7 @@ var use2 = make29("use", { name: String10("name") }).pipe(withDescription3("Sele
   yield* writeConfig({ ...config, activeProfile: name });
   yield* printResult({ action: "profile.use", name }, `Active profile set to ${name}.`);
 })));
-var remove10 = make29("delete", {
+var remove12 = make29("delete", {
   name: String10("name"),
   yes: Boolean6("yes").pipe(withDefault5(false))
 }).pipe(withDescription3("Delete a profile and its OS-keyring credential"), withHandler(fnUntraced2(function* ({ name, yes }) {
@@ -72106,7 +73170,7 @@ var remove10 = make29("delete", {
     yield* (yield* Service4).clear(name);
   yield* printResult({ action: "profile.delete", name }, `Deleted profile ${name}.`);
 })));
-var profileCommand = make29("profile").pipe(withDescription3("Manage user-level credential identity and organization contexts"), withSubcommands([list21, show, create10, use2, remove10]));
+var profileCommand = make29("profile").pipe(withDescription3("Manage user-level credential identity and organization contexts"), withSubcommands([list23, show, create12, use2, remove12]));
 
 // ../sdk/dist/effect/generated/scheduled-messages.js
 var ScheduledMessageId2 = /* @__PURE__ */ String4.check(isPattern2(/* @__PURE__ */ new RegExp("^sched_[0-9a-hjkmnp-tv-z]{16,24}$", "u")).annotate({
@@ -72293,12 +73357,12 @@ var ScheduledMessagesGroup = class extends make37("Scheduled Messages").add(get5
 };
 
 // ../sdk/dist/effect/scheduled-messages.js
-var make52 = /* @__PURE__ */ forGroup(ScheduledMessagesGroup);
-var list22 = /* @__PURE__ */ make52("scheduledMessagesList");
-var create11 = /* @__PURE__ */ make52("scheduledMessagesCreate");
-var get24 = /* @__PURE__ */ make52("scheduledMessagesGet");
-var cancel = /* @__PURE__ */ make52("scheduledMessagesCancel");
-var resume4 = /* @__PURE__ */ make52("scheduledMessagesResume");
+var make53 = /* @__PURE__ */ forGroup(ScheduledMessagesGroup);
+var list24 = /* @__PURE__ */ make53("scheduledMessagesList");
+var create13 = /* @__PURE__ */ make53("scheduledMessagesCreate");
+var get26 = /* @__PURE__ */ make53("scheduledMessagesGet");
+var cancel = /* @__PURE__ */ make53("scheduledMessagesCancel");
+var resume4 = /* @__PURE__ */ make53("scheduledMessagesResume");
 
 // src/commands/scheduled.ts
 var SCHEDULED_STATUSES = [
@@ -72363,14 +73427,14 @@ var atFlag2 = String9("at").pipe(withDescription2("Absolute send instant as an I
 var timezoneFlag = String9("timezone").pipe(withDescription2("IANA timezone for the schedule, e.g. America/New_York"), optional4);
 var idempotencyKeyFlag3 = String9("idempotency-key").pipe(withDescription2("Idempotency key so retries do not schedule duplicates"), optional4);
 var referenceIdFlag = String9("reference-id").pipe(withDescription2("Your own reference id to correlate this schedule"), optional4);
-var dryRunFlag4 = Boolean6("dry-run").pipe(withDescription2("Validate inputs and print the request payload without calling the API"), withDefault5(false));
+var dryRunFlag5 = Boolean6("dry-run").pipe(withDescription2("Validate inputs and print the request payload without calling the API"), withDefault5(false));
 var trackOpensFlag3 = Literals3("track-opens", ["on", "off"]).pipe(withDescription2("Override open tracking for this scheduled send; recipient opt-out wins"), optional4);
 var trackClicksFlag3 = Literals3("track-clicks", ["on", "off"]).pipe(withDescription2("Override click tracking for this scheduled send; recipient opt-out wins"), optional4);
 var statusFlag2 = Literals3("status", SCHEDULED_STATUSES).pipe(withDescription2("Filter by status"), optional4);
 var cursorFlag4 = String9("cursor").pipe(withDescription2("Resume after this nextCursor from a previous page"), optional4);
 var limitFlag4 = Int5("limit").pipe(withDescription2("Items per page"), optional4);
 var allFlag4 = Boolean6("all").pipe(withDescription2("Traverse every page (requires --jsonl)"), withDefault5(false));
-var create12 = make29("create", {
+var create14 = make29("create", {
   to: toFlag2,
   cc: ccFlag2,
   bcc: bccFlag2,
@@ -72388,7 +73452,7 @@ var create12 = make29("create", {
   referenceId: referenceIdFlag,
   trackOpens: trackOpensFlag3,
   trackClicks: trackClicksFlag3,
-  dryRun: dryRunFlag4,
+  dryRun: dryRunFlag5,
   json: jsonFlag
 }).pipe(withDescription3("Schedule an email to send at a future time"), withExamples([
   {
@@ -72497,7 +73561,7 @@ Payload:
 ${truncateForDisplay(JSON.stringify(payload, null, 2))}`);
   }
   const client = yield* getClientProvider;
-  const data = yield* create11(payload).pipe(client.provide, mapError2((error) => toCliApiError("Failed to schedule message", error)));
+  const data = yield* create13(payload).pipe(client.provide, mapError2((error) => toCliApiError("Failed to schedule message", error)));
   if (json)
     return yield* printJson(data);
   yield* logInfo(`Message scheduled.
@@ -72511,7 +73575,7 @@ ${truncateForDisplay(JSON.stringify(payload, null, 2))}`);
   yield* logInfo(`
 Inspect it:  samva scheduled-messages get ${data.id}`);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var list23 = make29("list", {
+var list25 = make29("list", {
   status: statusFlag2,
   cursor: cursorFlag4,
   limit: limitFlag4,
@@ -72546,7 +73610,7 @@ var list23 = make29("list", {
   if (all) {
     let nextCursor = cursorValue;
     for (;; ) {
-      const data = yield* list22({ ...query, cursor: nextCursor }).pipe(client.provide, mapError2((error) => toCliApiError("Could not list scheduled messages", error)));
+      const data = yield* list24({ ...query, cursor: nextCursor }).pipe(client.provide, mapError2((error) => toCliApiError("Could not list scheduled messages", error)));
       for (const item of data.items)
         yield* printJsonLine(item);
       if (data.nextCursor === null)
@@ -72554,7 +73618,7 @@ var list23 = make29("list", {
       nextCursor = data.nextCursor;
     }
   }
-  const data = yield* list22(query).pipe(client.provide, mapError2((error) => toCliApiError("Could not list scheduled messages", error)));
+  const data = yield* list24(query).pipe(client.provide, mapError2((error) => toCliApiError("Could not list scheduled messages", error)));
   if (isJsonLinesRequested()) {
     for (const item of data.items)
       yield* printJsonLine(item);
@@ -72578,9 +73642,9 @@ var list23 = make29("list", {
   if (data.nextCursor !== null)
     yield* printFields([["Next cursor", data.nextCursor]]);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var get25 = make29("get", { id: String10("id"), json: jsonFlag }).pipe(withDescription3("Show a scheduled message by id"), withExamples([{ command: "samva scheduled-messages get sched_abc123" }]), withHandler(({ id, json }) => gen2(function* () {
+var get27 = make29("get", { id: String10("id"), json: jsonFlag }).pipe(withDescription3("Show a scheduled message by id"), withExamples([{ command: "samva scheduled-messages get sched_abc123" }]), withHandler(({ id, json }) => gen2(function* () {
   const client = yield* getClientProvider;
-  const data = yield* get24({ id }).pipe(client.provide, mapError2((error) => toCliApiError("Could not fetch scheduled message", error)));
+  const data = yield* get26({ id }).pipe(client.provide, mapError2((error) => toCliApiError("Could not fetch scheduled message", error)));
   if (json)
     return yield* printJson(data);
   yield* printFields([
@@ -72661,7 +73725,7 @@ var scheduledMessagesCommand = make29("scheduled-messages").pipe(withDescription
     description: "Schedule an email"
   },
   { command: "samva scheduled-messages list", description: "List scheduled messages" }
-]), withSubcommands([create12, list23, get25, cancel2, resume5]));
+]), withSubcommands([create14, list25, get27, cancel2, resume5]));
 
 // ../sdk/dist/effect/generated/subscriptions.js
 var SubscribeResult = /* @__PURE__ */ Struct({
@@ -72830,6 +73894,7 @@ var TemplateSummary = /* @__PURE__ */ Struct({
   name: String4,
   channel: Literal2("email"),
   projectId: TemplateProjectId2,
+  namespaceId: Union2([NamespaceId2, Null2]).annotate({ description: "The namespace the template's project belongs to; every entry in a project shares it. Null at organization level. A namespace-scoped key reaches only its own namespace's templates." }),
   entryPath: String4.check(isMaxCodePoints(1024).annotate({ expected: "a string with at most 1024 code points" })).check(isPattern2(/* @__PURE__ */ new RegExp("^(?!\\/)(?!.*\\\\)(?!.*(?:^|\\/)\\.{1,2}(?:\\/|$))(?!.*(?:^|\\/)\\.git(?:\\/|$))(?:templates|emails)\\/.+\\.tsx$", "u")).annotate({ expected: "a string matching the RegExp ^(?!\\/)(?!.*\\\\)(?!.*(?:^|\\/)\\.{1,2}(?:\\/|$))(?!.*(?:^|\\/)\\.git(?:\\/|$))(?:templates|emails)\\/.+\\.tsx$" })).check(isMaxLength(1024).annotate({ expected: "a value with a length of at most 1024" })),
   status: Union2([
     Literal2("draft"),
@@ -72854,6 +73919,7 @@ var Template = /* @__PURE__ */ Struct({
   name: String4,
   channel: Literal2("email"),
   projectId: TemplateProjectId2,
+  namespaceId: Union2([NamespaceId2, Null2]).annotate({ description: "The namespace the template's project belongs to; every entry in a project shares it. Null at organization level. A namespace-scoped key reaches only its own namespace's templates." }),
   entryPath: String4.check(isMaxCodePoints(1024).annotate({ expected: "a string with at most 1024 code points" })).check(isPattern2(/* @__PURE__ */ new RegExp("^(?!\\/)(?!.*\\\\)(?!.*(?:^|\\/)\\.{1,2}(?:\\/|$))(?!.*(?:^|\\/)\\.git(?:\\/|$))(?:templates|emails)\\/.+\\.tsx$", "u")).annotate({ expected: "a string matching the RegExp ^(?!\\/)(?!.*\\\\)(?!.*(?:^|\\/)\\.{1,2}(?:\\/|$))(?!.*(?:^|\\/)\\.git(?:\\/|$))(?:templates|emails)\\/.+\\.tsx$" })).check(isMaxLength(1024).annotate({ expected: "a value with a length of at most 1024" })),
   status: Union2([
     Literal2("draft"),
@@ -72937,7 +74003,8 @@ var TemplatesListQuery = /* @__PURE__ */ Struct({
     Literal2("archived")
   ]), Null2])),
   search: optionalKey2(Union2([String4, Null2])),
-  projectId: optionalKey2(Union2([TemplateProjectId2, Null2]))
+  projectId: optionalKey2(Union2([TemplateProjectId2, Null2])),
+  namespaceId: optionalKey2(Union2([NamespaceId2, Null2]).annotate({ description: "Only templates in this namespace. A namespace-scoped key lists its own namespace's templates only." }))
 });
 var TemplatesList200 = TemplatePage;
 var TemplatesList401 = UnauthorizedError2;
@@ -72962,11 +74029,13 @@ var TemplatesCreateRequestJson = /* @__PURE__ */ Struct({
     Literal2("alert")
   ]), Null2]), Null2])),
   isActive: optionalKey2(Union2([Boolean3, Null2])),
+  namespaceId: optionalKey2(Union2([NamespaceId2, Null2]).annotate({ description: "The namespace the new template project belongs to; the project and every entry added to it share it. Omit for organization level. A namespace-scoped key always creates in its own namespace." })),
   idempotencyKey: String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(255).annotate({ expected: "a string with at most 255 code points" })).check(isMaxLength(255).annotate({ expected: "a value with a length of at most 255" }))
 });
 var TemplatesCreate201 = Template;
 var TemplatesCreate401 = UnauthorizedError2;
 var TemplatesCreate403 = ForbiddenError2;
+var TemplatesCreate404 = ResourceNotFoundError2;
 var TemplatesCreate409 = ConflictError2;
 var TemplatesCreate422 = ValidationError2;
 var TemplatesCreate500 = InternalError2;
@@ -74592,6 +75661,7 @@ var TemplatesGroup = class extends make37("Templates").add(get5("templatesList",
   error: [
     TemplatesCreate401.pipe(status(401)),
     TemplatesCreate403.pipe(status(403)),
+    TemplatesCreate404.pipe(status(404)),
     TemplatesCreate409.pipe(status(409)),
     TemplatesCreate422.pipe(status(422)),
     TemplatesCreate500,
@@ -74668,7 +75738,7 @@ var TemplatesGroup = class extends make37("Templates").add(get5("templatesList",
     TemplatesPublish500,
     TemplatesPublish504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "templates.publish").annotate(Summary, "Publish an exact template commit").annotate(Description, "Builds an exact Git commit and entry path, stores the immutable compiled IR and its assets, records the input contract it validates against, and makes that publication current."), get5("templatesGetPublication", "/v1/templates/:id/publications/:publicationId", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "templates.publish").annotate(Summary, "Publish an exact template commit").annotate(Description, "Builds an exact Git commit and entry path, stores the immutable compiled IR and its assets, records the input contract it validates against, and makes that publication current. A commit that compiles to the same build as an existing publication makes that publication current again instead of recording another."), get5("templatesGetPublication", "/v1/templates/:id/publications/:publicationId", {
   params: TemplatesGetPublicationPathParams,
   success: TemplatesGetPublication200,
   error: [
@@ -74980,24 +76050,24 @@ var TemplatesGroup = class extends make37("Templates").add(get5("templatesList",
 };
 
 // ../sdk/dist/effect/templates.js
-var make53 = /* @__PURE__ */ forGroup(TemplatesGroup);
-var list24 = /* @__PURE__ */ make53("templatesList");
-var create13 = /* @__PURE__ */ make53("templatesCreate");
-var addEntry = /* @__PURE__ */ make53("templatesAddEntry");
-var getById = /* @__PURE__ */ make53("templatesGetById");
-var remove11 = /* @__PURE__ */ make53("templatesRemove");
-var update10 = /* @__PURE__ */ make53("templatesUpdate");
-var openWorkspace = /* @__PURE__ */ make53("templatesOpenWorkspace");
-var getGitRepository = /* @__PURE__ */ make53("templatesGetGitRepository");
-var issueGitCredential = /* @__PURE__ */ make53("templatesIssueGitCredential");
-var patchWorkspace = /* @__PURE__ */ make53("templatesPatchWorkspace");
-var putWorkspaceAsset = /* @__PURE__ */ make53("templatesPutWorkspaceAsset");
-var saveWorkspace = /* @__PURE__ */ make53("templatesSaveWorkspace");
-var checkWorkspace = /* @__PURE__ */ make53("templatesCheckWorkspace");
-var renderWorkspaceFixture = /* @__PURE__ */ make53("templatesRenderWorkspaceFixture");
-var publish5 = /* @__PURE__ */ make53("templatesPublish");
-var diffWorkspace = /* @__PURE__ */ make53("templatesDiffWorkspace");
-var workspaceHistory = /* @__PURE__ */ make53("templatesWorkspaceHistory");
+var make54 = /* @__PURE__ */ forGroup(TemplatesGroup);
+var list26 = /* @__PURE__ */ make54("templatesList");
+var create15 = /* @__PURE__ */ make54("templatesCreate");
+var addEntry = /* @__PURE__ */ make54("templatesAddEntry");
+var getById = /* @__PURE__ */ make54("templatesGetById");
+var remove13 = /* @__PURE__ */ make54("templatesRemove");
+var update12 = /* @__PURE__ */ make54("templatesUpdate");
+var openWorkspace = /* @__PURE__ */ make54("templatesOpenWorkspace");
+var getGitRepository = /* @__PURE__ */ make54("templatesGetGitRepository");
+var issueGitCredential = /* @__PURE__ */ make54("templatesIssueGitCredential");
+var patchWorkspace = /* @__PURE__ */ make54("templatesPatchWorkspace");
+var putWorkspaceAsset = /* @__PURE__ */ make54("templatesPutWorkspaceAsset");
+var saveWorkspace = /* @__PURE__ */ make54("templatesSaveWorkspace");
+var checkWorkspace = /* @__PURE__ */ make54("templatesCheckWorkspace");
+var renderWorkspaceFixture = /* @__PURE__ */ make54("templatesRenderWorkspaceFixture");
+var publish5 = /* @__PURE__ */ make54("templatesPublish");
+var diffWorkspace = /* @__PURE__ */ make54("templatesDiffWorkspace");
+var workspaceHistory = /* @__PURE__ */ make54("templatesWorkspaceHistory");
 
 // src/commands/templates/dev-command.ts
 import { resolve as resolve8 } from "path";
@@ -75659,7 +76729,7 @@ var listProjectTemplates = fn2("Templates.listProjectTemplates")(function* (proj
   const templates = [];
   let cursor;
   for (;; ) {
-    const data = yield* list24({
+    const data = yield* list26({
       projectId,
       cursor,
       limit: PROJECT_PAGE_SIZE.toString()
@@ -75818,7 +76888,7 @@ ${starter.value}` : ""}`))).slice(0, 48)}`
     }
   }
   const client = yield* getClientProvider;
-  const created = yield* create13(request).pipe(client.provide, mapError2((error) => toCliApiError("Could not create template project", error)));
+  const created = yield* create15(request).pipe(client.provide, mapError2((error) => toCliApiError("Could not create template project", error)));
   const result = yield* cloneProject({ id: created.id, dir: root });
   const payload = { ...result, action: "templates.init" };
   if (json)
@@ -75988,7 +77058,7 @@ var move = make29("move", {
     });
   }
   const client = yield* getClientProvider;
-  const moved = yield* update10({ id: template.id, data: { entryPath: to } }).pipe(client.provide, mapError2((error) => toCliApiError("Could not move template entry", error)));
+  const moved = yield* update12({ id: template.id, data: { entryPath: to } }).pipe(client.provide, mapError2((error) => toCliApiError("Could not move template entry", error)));
   if (json)
     return yield* printJson(moved);
   yield* printFields([
@@ -77019,7 +78089,7 @@ var readCatalog = fn2("templates.types.readCatalog")(function* () {
   const ids = [];
   let cursor;
   for (;; ) {
-    const data = yield* list24({
+    const data = yield* list26({
       cursor,
       limit: CATALOG_PAGE_SIZE.toString()
     }).pipe(client.provide, mapError2(catalogError));
@@ -77343,7 +78413,7 @@ var workspaceCommand = make29("workspace").pipe(withDescription3("Author a templ
 
 // src/commands/templates.ts
 var tsconfigFlag = String9("tsconfig").pipe(withDescription2("TypeScript project used to check authored templates"), withDefault5("tsconfig.json"));
-var dryRunFlag5 = Boolean6("dry-run").pipe(withDescription2("Show the request without calling the API"), withDefault5(false));
+var dryRunFlag6 = Boolean6("dry-run").pipe(withDescription2("Show the request without calling the API"), withDefault5(false));
 var templateIdArgument2 = String10("id").pipe(withDescription4("Remote template id"));
 var parseObject = (raw, flag) => try_3({
   try: () => JSON.parse(raw),
@@ -77709,9 +78779,10 @@ var build3 = make29("build", {
 var listRemote = make29("list", {
   cursor: String9("cursor").pipe(withDescription2("Resume after this nextCursor from a previous page"), optional4),
   limit: Int5("limit").pipe(withDescription2("Items per page"), optional4),
+  namespace: namespaceFlag("list"),
   all: Boolean6("all").pipe(withDescription2("Traverse every page (requires --jsonl)"), withDefault5(false)),
   json: jsonFlag
-}).pipe(withDescription3("List remote templates"), withExamples([{ command: "samva templates list --json" }]), withHandler(({ cursor, limit, all, json }) => gen2(function* () {
+}).pipe(withDescription3("List remote templates"), withExamples([{ command: "samva templates list --json" }]), withHandler(({ cursor, limit, namespace, all, json }) => gen2(function* () {
   if (all && !isJsonLinesRequested())
     return yield* new CliUsageError({
       code: "all_requires_jsonl",
@@ -77720,11 +78791,15 @@ var listRemote = make29("list", {
   const client = yield* getClientProvider;
   const cursorValue = getOrUndefined(cursor);
   const limitValue = getOrUndefined(limit);
-  const query = { cursor: cursorValue, limit: limitValue?.toString() };
+  const query = {
+    cursor: cursorValue,
+    limit: limitValue?.toString(),
+    ...namespaceField(namespace)
+  };
   if (all) {
     let nextCursor = cursorValue;
     for (;; ) {
-      const data = yield* list24({ ...query, cursor: nextCursor }).pipe(client.provide, mapError2((error) => toCliApiError("Could not list templates", error)));
+      const data = yield* list26({ ...query, cursor: nextCursor }).pipe(client.provide, mapError2((error) => toCliApiError("Could not list templates", error)));
       for (const item of data.items)
         yield* printJsonLine(item);
       if (data.nextCursor === null)
@@ -77732,7 +78807,7 @@ var listRemote = make29("list", {
       nextCursor = data.nextCursor;
     }
   }
-  const data = yield* list24(query).pipe(client.provide, mapError2((error) => toCliApiError("Could not list templates", error)));
+  const data = yield* list26(query).pipe(client.provide, mapError2((error) => toCliApiError("Could not list templates", error)));
   if (isJsonLinesRequested()) {
     for (const item of data.items)
       yield* printJsonLine(item);
@@ -77745,7 +78820,8 @@ var listRemote = make29("list", {
       ["ID", item.id],
       ["Name", item.name],
       ["Slug", item.slug],
-      ["Status", item.status]
+      ["Status", item.status],
+      ["Namespace", item.namespaceId ?? "organization"]
     ]);
   if (data.nextCursor !== null)
     yield* printFields([["Next cursor", data.nextCursor]]);
@@ -77759,21 +78835,28 @@ var getRemote = make29("get", { id: templateIdArgument2, json: jsonFlag }).pipe(
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var createRemote = make29("create", {
   data: String9("data").pipe(withDescription2("Complete template JSON payload")),
-  dryRun: dryRunFlag5,
+  namespace: namespaceFlag("create"),
+  dryRun: dryRunFlag6,
   json: jsonFlag
 }).pipe(withDescription3("Create a remote template from JSON"), withExamples([
   {
     command: `samva templates create --data '{"name":"Welcome","projectName":"welcome-email","idempotencyKey":"welcome-email-v1"}' --dry-run`
   }
-]), withHandler(({ data, dryRun, json }) => gen2(function* () {
-  const payload = yield* decodePayload(data, "--data", CreateTemplatePayload);
+]), withHandler(({ data, namespace, dryRun, json }) => gen2(function* () {
+  const decoded = yield* decodePayload(data, "--data", CreateTemplatePayload);
+  if (isSome2(namespace) && decoded.namespaceId != null && decoded.namespaceId !== namespace.value)
+    return yield* new CliUsageError({
+      code: "namespace_conflict",
+      message: "--namespace and the namespaceId in --data name different namespaces."
+    });
+  const payload = { ...decoded, ...namespaceField(namespace) };
   if (dryRun)
     return yield* json ? printJson({ dryRun: true, action: "templates.create", request: payload }) : printFields([
       ["Action", "templates.create"],
       ...objectRows(payload, { explicit: true })
     ]);
   const client = yield* getClientProvider;
-  const result = yield* create13(payload).pipe(client.provide, mapError2((error) => toCliApiError("Could not create template", error)));
+  const result = yield* create15(payload).pipe(client.provide, mapError2((error) => toCliApiError("Could not create template", error)));
   if (json)
     return yield* printJson(result);
   yield* printFields(objectRows(result));
@@ -77781,7 +78864,7 @@ var createRemote = make29("create", {
 var updateRemote = make29("update", {
   id: templateIdArgument2,
   data: String9("data").pipe(withDescription2("JSON object of template fields to update")),
-  dryRun: dryRunFlag5,
+  dryRun: dryRunFlag6,
   json: jsonFlag
 }).pipe(withDescription3("Update a remote template from JSON"), withExamples([
   {
@@ -77797,14 +78880,14 @@ var updateRemote = make29("update", {
       ...objectRows(payload, { explicit: true })
     ]);
   const client = yield* getClientProvider;
-  const result = yield* update10({ id, ...payload }).pipe(client.provide, mapError2((error) => toCliApiError("Could not update template", error)));
+  const result = yield* update12({ id, ...payload }).pipe(client.provide, mapError2((error) => toCliApiError("Could not update template", error)));
   if (json)
     return yield* printJson(result);
   yield* printFields(objectRows(result));
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var removeRemote = make29("remove", {
   id: templateIdArgument2,
-  dryRun: dryRunFlag5,
+  dryRun: dryRunFlag6,
   yes: Boolean6("yes").pipe(withDescription2("Confirm destructive state change"), withDefault5(false)),
   json: jsonFlag
 }).pipe(withDescription3("Deactivate a remote template; its project file and publications remain"), withExamples([{ command: "samva templates remove tmpl_abc123 --dry-run" }]), withHandler(({ id, dryRun, yes, json }) => gen2(function* () {
@@ -77817,7 +78900,7 @@ var removeRemote = make29("remove", {
     nonInteractiveMessage: "remove requires --yes in non-interactive mode. Preview with --dry-run."
   });
   const client = yield* getClientProvider;
-  const result = yield* remove11({ id }).pipe(client.provide, mapError2((error) => toCliApiError("Could not remove template", error)));
+  const result = yield* remove13({ id }).pipe(client.provide, mapError2((error) => toCliApiError("Could not remove template", error)));
   if (json)
     return yield* printJson(result);
   yield* printFields([
@@ -78453,20 +79536,20 @@ var WebhooksGroup = class extends make37("Webhooks").add(get5("webhooksList", "/
 };
 
 // ../sdk/dist/effect/webhooks.js
-var make54 = /* @__PURE__ */ forGroup(WebhooksGroup);
-var list25 = /* @__PURE__ */ make54("webhooksList");
-var create14 = /* @__PURE__ */ make54("webhooksCreate");
-var get26 = /* @__PURE__ */ make54("webhooksGet");
-var remove12 = /* @__PURE__ */ make54("webhooksRemove");
-var update11 = /* @__PURE__ */ make54("webhooksUpdate");
-var test = /* @__PURE__ */ make54("webhooksTest");
-var getLogs = /* @__PURE__ */ make54("webhooksGetLogs");
-var getStats = /* @__PURE__ */ make54("webhooksGetStats");
-var retryDelivery = /* @__PURE__ */ make54("webhooksRetryDelivery");
-var regenerateSecret = /* @__PURE__ */ make54("webhooksRegenerateSecret");
+var make55 = /* @__PURE__ */ forGroup(WebhooksGroup);
+var list27 = /* @__PURE__ */ make55("webhooksList");
+var create16 = /* @__PURE__ */ make55("webhooksCreate");
+var get28 = /* @__PURE__ */ make55("webhooksGet");
+var remove14 = /* @__PURE__ */ make55("webhooksRemove");
+var update13 = /* @__PURE__ */ make55("webhooksUpdate");
+var test = /* @__PURE__ */ make55("webhooksTest");
+var getLogs = /* @__PURE__ */ make55("webhooksGetLogs");
+var getStats = /* @__PURE__ */ make55("webhooksGetStats");
+var retryDelivery = /* @__PURE__ */ make55("webhooksRetryDelivery");
+var regenerateSecret = /* @__PURE__ */ make55("webhooksRegenerateSecret");
 
 // src/commands/webhooks.ts
-var idArgument3 = String10("id").pipe(withDescription4("Webhook id"));
+var idArgument4 = String10("id").pipe(withDescription4("Webhook id"));
 var parseObject2 = (raw, flag) => try_3({
   try: () => JSON.parse(raw),
   catch: () => new SamvaCliError({ message: `${flag} must be a valid JSON object.` })
@@ -78487,7 +79570,7 @@ var readData = (raw) => {
     message: `Could not read webhook test data from ${path}.`
   })));
 };
-var list26 = make29("list", {
+var list28 = make29("list", {
   cursor: String9("cursor").pipe(withDescription2("Resume after this nextCursor from a previous page"), optional4),
   limit: Int5("limit").pipe(withDescription2("Items per page"), optional4),
   all: Boolean6("all").pipe(withDescription2("Traverse every page (requires --jsonl)"), withDefault5(false)),
@@ -78505,7 +79588,7 @@ var list26 = make29("list", {
   if (all) {
     let nextCursor = cursorValue;
     for (;; ) {
-      const data = yield* list25({ ...query, cursor: nextCursor }).pipe(client.provide, mapError2((error) => toCliApiError("Could not list webhooks", error)));
+      const data = yield* list27({ ...query, cursor: nextCursor }).pipe(client.provide, mapError2((error) => toCliApiError("Could not list webhooks", error)));
       for (const item of data.items)
         yield* printJsonLine(item);
       if (data.nextCursor === null)
@@ -78513,7 +79596,7 @@ var list26 = make29("list", {
       nextCursor = data.nextCursor;
     }
   }
-  const data = yield* list25(query).pipe(client.provide, mapError2((error) => toCliApiError("Could not list webhooks", error)));
+  const data = yield* list27(query).pipe(client.provide, mapError2((error) => toCliApiError("Could not list webhooks", error)));
   if (isJsonLinesRequested()) {
     for (const item of data.items)
       yield* printJsonLine(item);
@@ -78533,9 +79616,9 @@ var list26 = make29("list", {
   if (data.nextCursor !== null)
     yield* printFields([["Next cursor", data.nextCursor]]);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var get27 = make29("get", { id: idArgument3, json: jsonFlag }).pipe(withDescription3("Get a customer webhook"), withExamples([{ command: "samva webhooks get wep_abc123 --json" }]), withHandler(({ id, json }) => gen2(function* () {
+var get29 = make29("get", { id: idArgument4, json: jsonFlag }).pipe(withDescription3("Get a customer webhook"), withExamples([{ command: "samva webhooks get wep_abc123 --json" }]), withHandler(({ id, json }) => gen2(function* () {
   const client = yield* getClientProvider;
-  const data = yield* get26({ id }).pipe(client.provide, mapError2((error) => toCliApiError("Could not get webhook", error)));
+  const data = yield* get28({ id }).pipe(client.provide, mapError2((error) => toCliApiError("Could not get webhook", error)));
   if (json)
     return yield* printJson(data);
   yield* printFields([
@@ -78546,7 +79629,7 @@ var get27 = make29("get", { id: idArgument3, json: jsonFlag }).pipe(withDescript
   ]);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var logs = make29("logs", {
-  id: idArgument3,
+  id: idArgument4,
   limit: Int5("limit").pipe(optional4),
   cursor: String9("cursor").pipe(withDescription2("Resume after this nextCursor from a previous page"), optional4),
   json: jsonFlag
@@ -78609,7 +79692,7 @@ var logs = make29("logs", {
 var statsAfterFlag = String9("after").pipe(withDescription2("Start of the daily series, an ISO 8601 instant (default: 30 days back)"), optional4);
 var statsBeforeFlag = String9("before").pipe(withDescription2("End of the daily series, an ISO 8601 instant (default: end of today)"), optional4);
 var stats3 = make29("stats", {
-  id: idArgument3,
+  id: idArgument4,
   after: statsAfterFlag,
   before: statsBeforeFlag,
   json: jsonFlag
@@ -78637,7 +79720,7 @@ var stats3 = make29("stats", {
   ]);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var test2 = make29("test", {
-  id: idArgument3,
+  id: idArgument4,
   data: String9("data").pipe(withDescription2("JSON object or @file to send as the signed test payload"), optional4),
   dryRun: Boolean6("dry-run").pipe(withDescription2("Validate and preview without sending a request"), withDefault5(false)),
   json: jsonFlag
@@ -78669,7 +79752,7 @@ var test2 = make29("test", {
   ]);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var retry4 = make29("retry", {
-  id: idArgument3,
+  id: idArgument4,
   deliveryId: String10("delivery-id").pipe(withDescription4("Webhook delivery id")),
   dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
   json: jsonFlag
@@ -78689,7 +79772,7 @@ var retry4 = make29("retry", {
   ]);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var rotate3 = make29("rotate-secret", {
-  id: idArgument3,
+  id: idArgument4,
   dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
   yes: Boolean6("yes").pipe(withDefault5(false)),
   json: jsonFlag
@@ -78714,7 +79797,7 @@ var rotate3 = make29("rotate-secret", {
   yield* error(`WARNING: ${warning}`);
   yield* log(secret);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var create15 = make29("create", {
+var create17 = make29("create", {
   data: String9("data").pipe(withDescription2("Webhook JSON: name, url, eventTypes, and optional retry settings")),
   dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
   json: jsonFlag
@@ -78730,7 +79813,7 @@ var create15 = make29("create", {
       ...objectRows(payload, { explicit: true })
     ]);
   const client = yield* getClientProvider;
-  const result = yield* create14(payload).pipe(client.provide, mapError2((error) => toCliApiError("Could not create webhook", error)));
+  const result = yield* create16(payload).pipe(client.provide, mapError2((error) => toCliApiError("Could not create webhook", error)));
   const warning = "This signing secret is shown once. Store it now; `samva webhooks rotate-secret` issues a new one.";
   const secret = value2(result.secret);
   if (json)
@@ -78744,8 +79827,8 @@ var create15 = make29("create", {
     ["Signing secret", secret]
   ]);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var update12 = make29("update", {
-  id: idArgument3,
+var update14 = make29("update", {
+  id: idArgument4,
   data: String9("data").pipe(withDescription2("JSON object of webhook fields to update")),
   dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
   json: jsonFlag
@@ -78762,13 +79845,13 @@ var update12 = make29("update", {
       ...objectRows(payload, { explicit: true })
     ]);
   const client = yield* getClientProvider;
-  const result = yield* update11({ id, ...payload }).pipe(client.provide, mapError2((error) => toCliApiError("Could not update webhook", error)));
+  const result = yield* update13({ id, ...payload }).pipe(client.provide, mapError2((error) => toCliApiError("Could not update webhook", error)));
   if (json)
     return yield* printJson(result);
   yield* printFields(objectRows(result));
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var remove13 = make29("remove", {
-  id: idArgument3,
+var remove15 = make29("remove", {
+  id: idArgument4,
   dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
   yes: Boolean6("yes").pipe(withDefault5(false)),
   json: jsonFlag
@@ -78785,12 +79868,12 @@ var remove13 = make29("remove", {
     nonInteractiveMessage: "Permanent webhook deletion requires --yes in non-interactive mode. Preview with --dry-run."
   });
   const client = yield* getClientProvider;
-  const result = yield* remove12({ id }).pipe(client.provide, mapError2((error) => toCliApiError("Could not remove webhook", error)));
+  const result = yield* remove14({ id }).pipe(client.provide, mapError2((error) => toCliApiError("Could not remove webhook", error)));
   if (json)
     return yield* printJson(result);
   yield* log(`Removed webhook ${id}.`);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var webhooksCommand = make29("webhooks").pipe(withDescription3("Inspect, test, and recover customer webhooks"), withExamples([{ command: "samva webhooks list --json" }]), withSubcommands([list26, get27, create15, update12, test2, logs, stats3, retry4, rotate3, remove13]));
+var webhooksCommand = make29("webhooks").pipe(withDescription3("Inspect, test, and recover customer webhooks"), withExamples([{ command: "samva webhooks list --json" }]), withSubcommands([list28, get29, create17, update14, test2, logs, stats3, retry4, rotate3, remove15]));
 
 // src/lib/root-commands.ts
 var rootCommands = [
@@ -78808,6 +79891,7 @@ var rootCommands = [
   templatesCommand,
   brandsCommand,
   mailboxesCommand,
+  namespacesCommand,
   extensionsCommand,
   webhooksCommand,
   apiCommand,