@samva/cli 0.17.0 → 0.19.0

package/AGENTS.md

@@ -37,6 +37,12 @@ confirmation (`--yes` outside a terminal), and every mutation supports `--dry-ru
 `SAMVA_API_KEY`, `samva org current` asks the API who the key is (`GET /v1/whoami`) and reports its
 organization and key; with OAuth it reports the profile's selected organization.
 
+`samva webhooks secret <id>` reads the current signing secret with `webhooks:update` permission.
+Human output includes the secret, its creation time, and when the previous secret stops verifying
+if one exists. `--json` returns `{secret, createdAt, previousExpiresAt}` inside the result envelope.
+`create` and `rotate-secret` return readable secrets too; retrieve them again with `secret <id>`.
+Their JSON results contain `secret` and `warning` (`create` also includes `endpoint`).
+
 `samva templates export --out <dir>` renders every local template's fixtures to HTML
 and text with the asset manifest, needing a Samva credential only to resolve a live `samva:brand`; `--asset-base <origin>` is for an
 export that will be delivered, which cannot carry a relative reference.
@@ -73,6 +79,14 @@ uploads again. `--dry-run` lists each attachment and uploads nothing.
 or the newest publication that still validates input identically. They are mutually exclusive and
 each requires `--template-id`, because a reference is a statement about one template's history.
 
+`samva templates list --shared true|false` filters by whether the template's project is shared with
+every namespace, and every listed template reports `shared`. Sharing belongs to an organization-level
+project: `templates create --shared` shares the new project and refuses a namespace (exit `2`), and
+`templates update <id> --data '{}' --shared true|false` shares or unshares the project for every
+entry in it. `--shared` that disagrees with `shared` in `--data` exits `2`. A namespace-scoped key
+lists, reads, and sends shared templates but gets 403 changing them, and the API refuses moving a
+shared project into a namespace.
+
 `samva templates workspace <open|diff|patch|add-asset|check|fixture|save|history|publish>` is the
 hosted project workspace over the CLI, for a caller with no clone: an agent in a sandbox, a CI job,
 a script. It reaches the same operations the hosted MCP tools reach, so an agent can start a journey in one

package/dist/bin.mjs

@@ -14106,7 +14106,7 @@ var layer12 = /* @__PURE__ */ layer.pipe(/* @__PURE__ */ provideMerge(/* @__PURE
 // package.json
 var package_default = {
   name: "@samva/cli",
-  version: "0.17.0",
+  version: "0.19.0",
   description: "Samva CLI \u2014 email and platform operations from your terminal",
   keywords: [
     "cli",
@@ -14157,21 +14157,21 @@ var package_default = {
     "@samva/contracts": "workspace:*",
     "@samva/core": "workspace:*",
     "@samva/mailbox": "workspace:*",
-    "@samva/markup": "^0.13.1",
-    "@samva/vite": "^0.13.1",
+    "@samva/markup": "catalog:",
+    "@samva/vite": "catalog:",
     "@types/node": "catalog:",
     "better-auth": "catalog:",
     effect: "catalog:effect",
-    samva: "workspace:0.20.0",
+    samva: "workspace:0.22.0",
     typescript: "catalog:",
     vite: "~8.3.0",
     vitest: "catalog:"
   },
   optionalDependencies: {
-    "@samva/cli-darwin-arm64": "workspace:0.17.0",
-    "@samva/cli-darwin-x64": "workspace:0.17.0",
-    "@samva/cli-linux-arm64": "workspace:0.17.0",
-    "@samva/cli-linux-x64": "workspace:0.17.0"
+    "@samva/cli-darwin-arm64": "workspace:0.19.0",
+    "@samva/cli-darwin-x64": "workspace:0.19.0",
+    "@samva/cli-linux-arm64": "workspace:0.19.0",
+    "@samva/cli-linux-x64": "workspace:0.19.0"
   },
   engines: {
     node: ">=18"
@@ -19596,6 +19596,9 @@ var ENTITY_PREFIXES = {
   waflow: "WhatsAppFlowId",
   wafver: "WhatsAppFlowVersionId",
   wafreg: "WhatsAppFlowRegistrationId",
+  wafkey: "WhatsAppFlowEncryptionKeyId",
+  wafx: "WhatsAppFlowExchangeId",
+  wasl: "WhatsAppSetupLinkId",
   mbx: "MailboxId",
   mbxep: "MailboxEndpointId",
   thread: "MailboxThreadId",
@@ -19691,6 +19694,9 @@ var WhatsAppBusinessAccountId = entityId("waba").pipe(brand(ENTITY_PREFIXES.waba
 var WhatsAppFlowId = entityId("waflow").pipe(brand(ENTITY_PREFIXES.waflow));
 var WhatsAppFlowVersionId = entityId("wafver").pipe(brand(ENTITY_PREFIXES.wafver));
 var WhatsAppFlowRegistrationId = entityId("wafreg").pipe(brand(ENTITY_PREFIXES.wafreg));
+var WhatsAppFlowEncryptionKeyId = entityId("wafkey").pipe(brand(ENTITY_PREFIXES.wafkey));
+var WhatsAppFlowExchangeId = entityId("wafx").pipe(brand(ENTITY_PREFIXES.wafx));
+var WhatsAppSetupLinkId = entityId("wasl").pipe(brand(ENTITY_PREFIXES.wasl));
 var WhatsAppServiceWindowId = entityId("wasw").pipe(brand(ENTITY_PREFIXES.wasw));
 var WebhookEndpointId = entityId("wep").pipe(brand(ENTITY_PREFIXES.wep));
 var WebhookCredentialId = entityId("whcred").pipe(brand(ENTITY_PREFIXES.whcred));
@@ -20398,6 +20404,7 @@ var DOMAIN_WEBHOOK_EVENT_TYPE_VALUES = [
 var domainWebhookEventTypeSchema = Literals(DOMAIN_WEBHOOK_EVENT_TYPE_VALUES);
 var TEMPLATE_WEBHOOK_EVENT_TYPE_VALUES = ["template.registration.updated"];
 var FLOW_WEBHOOK_EVENT_TYPE_VALUES = ["flow.registration.updated"];
+var WHATSAPP_NUMBER_WEBHOOK_EVENT_TYPE_VALUES = ["whatsapp.number.connected"];
 var MAILBOX_WEBHOOK_EVENT_TYPE_VALUES = [
   "mailbox.message.received",
   "mailbox.message.sent",
@@ -20422,6 +20429,7 @@ var WEBHOOK_EVENT_TYPE_VALUES = [
   ...DOMAIN_WEBHOOK_EVENT_TYPE_VALUES,
   ...TEMPLATE_WEBHOOK_EVENT_TYPE_VALUES,
   ...FLOW_WEBHOOK_EVENT_TYPE_VALUES,
+  ...WHATSAPP_NUMBER_WEBHOOK_EVENT_TYPE_VALUES,
   ...MAILBOX_WEBHOOK_EVENT_TYPE_VALUES,
   ...JOURNEY_WEBHOOK_EVENT_TYPE_VALUES
 ];
@@ -24149,6 +24157,7 @@ var CreateTemplatePayload = /* @__PURE__ */ Struct({
   ]), Null2]), Null2])),
   isActive: optionalKey2(Union2([Boolean3, Null2])),
   namespaceId: optionalKey2(Union2([NamespaceId2, Null2]).annotate({ description: "The namespace the new template project belongs to; the project and every entry added to it share it. Omit for organization level. A namespace-scoped key always creates in its own namespace." })),
+  shared: optionalKey2(Union2([Boolean3, Null2]).annotate({ description: "Share the new organization-level project with every namespace: namespace-scoped keys read and send its entries but cannot change them. Defaults to false. Not with `namespaceId`, and not from a namespace-scoped key." })),
   idempotencyKey: String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(255).annotate({ expected: "a string with at most 255 code points" })).check(isMaxLength(255).annotate({ expected: "a value with a length of at most 255" }))
 }).annotate({ identifier: "CreateTemplatePayload" });
 var CreateWebhookPayload = /* @__PURE__ */ Struct({
@@ -24180,6 +24189,9 @@ var CreateWebhookPayload = /* @__PURE__ */ Struct({
     Literal2("webhook.test"),
     Literal2("domain.updated"),
     Literal2("domain.warming.updated"),
+    Literal2("template.registration.updated"),
+    Literal2("flow.registration.updated"),
+    Literal2("whatsapp.number.connected"),
     Literal2("mailbox.message.received"),
     Literal2("mailbox.message.sent"),
     Literal2("mailbox.action.pending_approval"),
@@ -24224,6 +24236,9 @@ var UpdateWebhookPayload = /* @__PURE__ */ Struct({
     Literal2("webhook.test"),
     Literal2("domain.updated"),
     Literal2("domain.warming.updated"),
+    Literal2("template.registration.updated"),
+    Literal2("flow.registration.updated"),
+    Literal2("whatsapp.number.connected"),
     Literal2("mailbox.message.received"),
     Literal2("mailbox.message.sent"),
     Literal2("mailbox.action.pending_approval"),
@@ -24462,7 +24477,8 @@ var UpdateTemplatePayload = /* @__PURE__ */ Struct({ data: Struct({
   ]), Null2]), Null2])),
   fromDefault: optionalKey2(Union2([Union2([TemplateFromDefault, Null2]), Null2])),
   replyToDefault: optionalKey2(Union2([Union2([ArraySchema(String4), Null2]), Null2])),
-  isActive: optionalKey2(Union2([Boolean3, Null2]))
+  isActive: optionalKey2(Union2([Boolean3, Null2])),
+  shared: optionalKey2(Union2([Boolean3, Null2]).annotate({ description: "Share the template's project with every namespace, or stop sharing it. Applies to every entry in the project. Only an organization-level project is shared." }))
 }) }).annotate({ identifier: "UpdateTemplatePayload" });
 var ApiKeyAccess = /* @__PURE__ */ Union2([Struct({ mode: Literal2("full") }), Struct({
   mode: Literal2("restricted"),
@@ -24799,6 +24815,7 @@ var apiStatuses = {
   MailboxSendConflictError: 409,
   MailboxSendRefusedError: 403,
   CursorExpiredError: 410,
+  WhatsAppSetupLinkUnavailableError: 410,
   MethodNotAllowedError: 405,
   UpgradeRequiredError: 426,
   RateLimitedError: 429,
@@ -25082,7 +25099,7 @@ var __exportAll = (all, no_symbols) => {
 };
 
 // ../sdk/dist/package.js
-var version = "0.20.0";
+var version = "0.22.0";
 
 // ../sdk/dist/client-attribution.js
 var SDK_VERSION = version;
@@ -25421,6 +25438,7 @@ var commandTree = {
     list: {},
     get: {},
     create: {},
+    "from-website": {},
     update: {},
     remove: {}
   },
@@ -25473,6 +25491,7 @@ var commandTree = {
   webhooks: {
     list: {},
     get: {},
+    secret: {},
     create: {},
     update: {},
     test: {},
@@ -25903,7 +25922,12 @@ var getAuthenticatedJsonForContext = fn2("CliClient.getAuthenticatedJson")(funct
   };
   const url = `${config.baseUrl.replace(/\/$/, "")}${path}`;
   const response = yield* tryPromise2({
-    try: (signal) => fetch(url, request === undefined ? { headers, signal } : { method: "POST", headers, body: JSON.stringify(request.body), signal }),
+    try: (signal) => fetch(url, request === undefined ? { headers, signal } : {
+      method: request.method ?? "POST",
+      headers,
+      body: JSON.stringify(request.body),
+      signal
+    }),
     catch: (cause) => new SamvaCliError({ message: `Request to ${url} failed: ${String(cause)}` })
   });
   const body = yield* tryPromise2({
@@ -27045,6 +27069,7 @@ var SDK_OPERATION_CALLS = {
   },
   templatesList: { kind: "params" },
   templatesCreate: { kind: "payload" },
+  templatesCreateFromWebsite: { kind: "payload" },
   templatesAddEntry: {
     kind: "pathPayload",
     paths: ["id"]
@@ -27166,6 +27191,10 @@ var SDK_OPERATION_CALLS = {
   whoamiGet: { kind: "none" },
   webhooksList: { kind: "params" },
   webhooksCreate: { kind: "payload" },
+  webhooksGetSecret: {
+    kind: "path",
+    paths: ["id"]
+  },
   webhooksGet: {
     kind: "path",
     paths: ["id"]
@@ -28532,6 +28561,7 @@ var SamvaOperations = {
   templatesAttachFamilyMember: operationMetadata85,
   templatesDetachFamilyMember: operationMetadata87,
   templatesCreateFamilyFromTemplate: operationMetadata85,
+  templatesCreateFromWebsite: operationMetadata85,
   templatesAddEntry: operationMetadata85,
   unsubscribeList: operationMetadata90,
   unsubscribeCreate: operationMetadata91,
@@ -28558,6 +28588,7 @@ var SamvaOperations = {
   webhooksRetryDelivery: operationMetadata96,
   webhooksGetLogs: operationMetadata95,
   webhooksRegenerateSecret: operationMetadata96,
+  webhooksGetSecret: operationMetadata97,
   webhooksGetStats: operationMetadata97,
   webhooksTest: operationMetadata96,
   whoamiGet: {
@@ -28804,6 +28835,7 @@ var ApiKey = /* @__PURE__ */ Struct({
   name: String4,
   key: optionalKey2(Union2([String4, Null2])),
   start: Union2([String4, Null2]),
+  end: Union2([String4, Null2]),
   description: optionalKey2(Union2([String4, Null2])),
   createdAt: String4,
   expiresAt: Union2([String4, Null2]),
@@ -28817,6 +28849,7 @@ var ApiKeyWithSecret = /* @__PURE__ */ Struct({
   name: String4,
   key: SensitiveString,
   start: Union2([String4, Null2]),
+  end: Union2([String4, Null2]),
   description: optionalKey2(Union2([String4, Null2])),
   createdAt: String4,
   expiresAt: Union2([String4, Null2]),
@@ -29427,6 +29460,10 @@ var apiKeysCommand = make29("api-keys").pipe(withDescription3("Create, inspect,
 
 // src/commands/brands.ts
 import { join as join3, relative, resolve as resolve5 } from "path";
+// ../../node_modules/.bun/@samva+markup@0.15.0+a19bcd7db259aaf7/node_modules/@samva/markup/dist/dark-scheme-CbCwGDWH.js
+var DARK_SCHEME_QUERY = /^(?:only\s+)?(?:screen\s+and\s+)?\(\s*prefers-color-scheme\s*:\s*dark\s*\)$/i;
+var isDarkSchemeQuery = (prelude) => DARK_SCHEME_QUERY.test(prelude.trim());
+
 // ../../node_modules/.bun/css-tree@3.2.1/node_modules/css-tree/lib/tokenizer/types.js
 var EOF = 0;
 var Ident = 1;
@@ -53199,21 +53236,21 @@ var $ = (e) => {
 };
 var ae = { ok: l, isOk: u, err: d, isError: f, try: T, tryPromise: E, map: D, mapError: O, tryRecover: k, andThen: A, tryRecoverAsync: ee, andThenAsync: te, match: ne, tap: j, tapAsync: M, tapError: N6, tapErrorAsync: P, tapBoth: F4, tapBothAsync: I, unwrap: L, unwrapOr: z, gen: B, await: V, codec: re, all: Q, allAsync: ie, partition: $, partitionAsync: async (e) => $(await Z(e, `Result.partitionAsync input promise rejected`)), flatten: (e) => e.status === `ok` ? e.value : e };
 
-// ../../node_modules/.bun/@samva+markup@0.13.1+a19bcd7db259aaf7/node_modules/@samva/markup/dist/theme-css-CEUrDpqq.js
+// ../../node_modules/.bun/@samva+markup@0.15.0+a19bcd7db259aaf7/node_modules/@samva/markup/dist/theme-css-s9QwD5Ko.js
 var BRAND_NAMESPACES = [
   "--color-",
   "--font-",
   "--text-",
   "--leading-",
   "--tracking-",
-  "--radius-",
+  "--radius",
   "--spacing",
   "--container-",
   "--shadow-"
 ];
+var inNamespace = (property, namespace) => namespace.endsWith("-") ? property.startsWith(namespace) : property === namespace || property.startsWith(`${namespace}-`);
 var BRAND_PROPERTY = /^--[a-z][a-z0-9-]*$/;
 var BRAND_UNSAFE_VALUE = /[{};<>\\@]|url\s*\(|expression\s*\(|\/\*/i;
-var BRAND_DARK_MEDIA = /^\(\s*prefers-color-scheme\s*:\s*dark\s*\)$/i;
 var BRAND_FONT_DESCRIPTORS = /* @__PURE__ */ new Set([
   "font-family",
   "src",
@@ -53222,7 +53259,6 @@ var BRAND_FONT_DESCRIPTORS = /* @__PURE__ */ new Set([
   "font-display",
   "unicode-range"
 ]);
-var darkVariableName = (property) => `${property}-dark`;
 var spanOfNode = (node) => ({
   start: node.loc?.start.offset ?? 0,
   end: node.loc?.end.offset ?? 0
@@ -53232,6 +53268,7 @@ var unquoteFamily = (value) => {
   const quoted = /^(['"])(.*)\1$/s.exec(trimmed);
   return quoted === null ? trimmed : quoted[2].replace(/\\(.)/g, "$1");
 };
+var quoteFamily = (family) => `"${family.replace(/["\\]/g, "\\$&")}"`;
 var parseBrandCss = (css) => {
   const diagnostics = [];
   const report = (code, message, span) => {
@@ -53273,7 +53310,7 @@ var parseBrandCss = (css) => {
         report("brand-css-property", `${property} is not a theme variable; name theme variables --namespace-name.`, span);
         continue;
       }
-      if (!BRAND_NAMESPACES.some((namespace) => property.startsWith(namespace))) {
+      if (!BRAND_NAMESPACES.some((namespace) => inNamespace(property, namespace))) {
         report("brand-css-namespace", `${property} is outside the brand namespaces (${BRAND_NAMESPACES.map((namespace) => namespace.endsWith("-") ? `${namespace}*` : namespace).join(", ")}).`, span);
         continue;
       }
@@ -53369,7 +53406,7 @@ var parseBrandCss = (css) => {
           readFontFace(node);
           continue;
         }
-        if (name === "media" && node.prelude !== null && BRAND_DARK_MEDIA.test(generate55(node.prelude).trim())) {
+        if (name === "media" && node.prelude !== null && isDarkSchemeQuery(generate55(node.prelude))) {
           for (const child of node.block.children)
             if (child.type === "Atrule" && child.name.toLowerCase() === "theme")
               readTheme(child, dark, "dark");
@@ -53380,19 +53417,103 @@ var parseBrandCss = (css) => {
       }
       report("brand-css-unsupported", "A brand theme contains only @theme, a dark-mode @theme (@media (prefers-color-scheme: dark)), and @font-face.", spanOfNode(node));
     }
-  for (const property of Object.keys(dark))
-    if (darkVariableName(property) in variables)
-      report("brand-css-dark-conflict", `${darkVariableName(property)} and the dark-mode ${property} name the same theme variable; keep one.`, {
-        start: 0,
-        end: 0
-      });
   return diagnostics.length > 0 ? ae.err(diagnostics) : ae.ok({
     variables,
     dark,
     fontFaces
   });
 };
-// ../../node_modules/.bun/@samva+markup@0.13.1+a19bcd7db259aaf7/node_modules/@samva/markup/dist/diagnostic-codes-DdZ4tka5.js
+var printDeclarations = (entries, indent) => Object.entries(entries).map(([property, value]) => `${indent}${property}: ${value};`).join(`
+`);
+var printFontFace = (face) => [
+  "@font-face {",
+  `  font-family: ${quoteFamily(face.family)};`,
+  `  src: ${face.src};`,
+  ...face.weight === undefined ? [] : [`  font-weight: ${face.weight};`],
+  ...face.style === undefined ? [] : [`  font-style: ${face.style};`],
+  ...face.display === undefined ? [] : [`  font-display: ${face.display};`],
+  ...face.unicodeRange === undefined ? [] : [`  unicode-range: ${face.unicodeRange};`],
+  "}"
+].join(`
+`);
+var printBrandCss = (brand) => {
+  const blocks = [
+    ...brand.fontFaces.map(printFontFace),
+    ...Object.keys(brand.variables).length === 0 ? [] : [`@theme {
+${printDeclarations(brand.variables, "  ")}
+}`],
+    ...Object.keys(brand.dark).length === 0 ? [] : [`@media (prefers-color-scheme: dark) {
+  @theme {
+${printDeclarations(brand.dark, "    ")}
+  }
+}`]
+  ];
+  return blocks.length === 0 ? "" : `${blocks.join(`
+
+`)}
+`;
+};
+var THEME_COLOR_ROLES = {
+  background: "The page, behind everything.",
+  foreground: "Text on the page.",
+  card: "A surface that groups the message's content.",
+  "card-foreground": "Text on a card.",
+  primary: "The main action's fill (a button), and links.",
+  "primary-foreground": "Text on a primary fill.",
+  secondary: "A quieter action's fill.",
+  "secondary-foreground": "Text on a secondary fill.",
+  muted: "A subdued surface: a code block, a table header.",
+  "muted-foreground": "Secondary text on the page, a card or a muted surface: labels, captions, the footer.",
+  accent: "A highlighted surface: a callout, a selected row.",
+  "accent-foreground": "Text on an accent surface.",
+  border: "Rules, dividers and outlines."
+};
+var THEME_COLORS = Object.keys(THEME_COLOR_ROLES);
+var colorVariables = (colors) => Object.fromEntries(THEME_COLORS.map((name) => [`--color-${name}`, colors[name]]));
+var DEFAULT_THEME = {
+  variables: {
+    ...colorVariables({
+      background: "#ffffff",
+      foreground: "#0a0a0a",
+      card: "#ffffff",
+      "card-foreground": "#0a0a0a",
+      primary: "#171717",
+      "primary-foreground": "#fafafa",
+      secondary: "#f5f5f5",
+      "secondary-foreground": "#171717",
+      muted: "#f5f5f5",
+      "muted-foreground": "#737373",
+      accent: "#f5f5f5",
+      "accent-foreground": "#171717",
+      border: "#e5e5e5"
+    }),
+    "--radius": "8px",
+    "--radius-sm": "calc(var(--radius) - 4px)",
+    "--radius-md": "calc(var(--radius) - 2px)",
+    "--radius-lg": "var(--radius)",
+    "--radius-xl": "calc(var(--radius) + 4px)",
+    "--font-sans": '-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif',
+    "--font-heading": "var(--font-sans)"
+  },
+  dark: colorVariables({
+    background: "#0a0a0a",
+    foreground: "#fafafa",
+    card: "#171717",
+    "card-foreground": "#fafafa",
+    primary: "#fafafa",
+    "primary-foreground": "#171717",
+    secondary: "#262626",
+    "secondary-foreground": "#fafafa",
+    muted: "#262626",
+    "muted-foreground": "#a3a3a3",
+    accent: "#262626",
+    "accent-foreground": "#fafafa",
+    border: "#2e2e2e"
+  }),
+  fontFaces: []
+};
+var DEFAULT_THEME_CSS = printBrandCss(DEFAULT_THEME);
+// ../../node_modules/.bun/@samva+markup@0.15.0+a19bcd7db259aaf7/node_modules/@samva/markup/dist/diagnostic-codes-UXwOO3A-.js
 var buildLineMap = (source) => {
   const lineStarts = [0];
   for (let index = 0;index < source.length; index++) {
@@ -53617,10 +53738,22 @@ var DIAGNOSTIC_CODES = codes2({
     summary: "<Columns per> is not a positive integer literal.",
     fix: "Write per={2}."
   },
+  "invalid-columns-gap": {
+    summary: "<Columns gap> is set on a Columns whose cells are repeated with each or rendered conditionally.",
+    fix: "Write each Column out unconditionally, or pad the cells instead of using gap."
+  },
+  "invalid-columns-stack": {
+    summary: "<Columns stack> is not a true or false literal.",
+    fix: "Write stack={false}, or leave it out to stack on narrow screens."
+  },
   "invalid-button-number": {
     summary: "A Button size prop is not a finite number.",
     fix: "Pass a finite number."
   },
+  "invalid-number-prop": {
+    summary: "A primitive's numeric prop, such as <Email gutter>, is not a finite number in range.",
+    fix: "Pass a finite number the message allows, for example gutter={16}."
+  },
   "unsupported-element": {
     summary: "An element outside the supported email vocabulary.",
     fix: "Use an element from the contract's element table."
@@ -53721,6 +53854,18 @@ var DIAGNOSTIC_CODES = codes2({
     summary: "A custom property is redefined inside a conditional at-rule.",
     fix: "Keep the override on a class rule."
   },
+  "email-contrast": {
+    summary: "Text, or a filled button against its surroundings, falls below the contrast ratio in light or dark mode (below 1.5:1 a button is indistinguishable from its surface; WCAG 1.4.11 asks 3:1).",
+    fix: "Pair background and text tokens (bg-primary with text-primary-foreground), give the theme's dark-mode @theme a value for the token, or choose colors that reach the required ratio.",
+    upgrade: [
+      "Move the project's theme onto the theme vocabulary with one dark-mode block. In starter.css and theme.css, rename each color token to the vocabulary name for its role (reference.md, Theme): a page color to --color-background, the main text to --color-foreground, a surface to --color-card with --color-card-foreground, the brand or action color to --color-primary with --color-primary-foreground, subdued text to --color-muted-foreground, a highlight to --color-accent with --color-accent-foreground, rules to --color-border, body and heading fonts to --font-sans and --font-heading, and a corner radius to --radius. Keep every value.",
+      "Move each --color-<name>-dark value into @media (prefers-color-scheme: dark) { @theme { --color-<name>: <value>; } } under the renamed token, and delete the -dark tokens. In every template and partial, rename the utilities to match (bg-surface to bg-card, text-muted to text-muted-foreground, and so on) and delete each dark:\u2026-dark class whose token now has a dark value; keep a dark: class only where it picks a different token in dark mode.",
+      "Then fix what email-contrast still reports at its location: pair each fill with its -foreground token, or give the dark block a value that reaches the ratio. Do not weaken the design to pass: keep the brand's colors and adjust the paired token.",
+      "Compile every entry and render every fixture in light and dark mode; confirm the light render is unchanged apart from fixes. Resolve errors before requesting one saved version for the whole project, approved by the user; do not publish."
+    ].join(`
+
+`)
+  },
   "email-font-fallback": {
     summary: "A font stack names a project font without a generic fallback.",
     fix: "End the stack with sans-serif, serif or monospace."
@@ -54206,6 +54351,7 @@ var CampaignLatestRun = /* @__PURE__ */ Struct({
   dispatchedCount: Finite.check(isFinite4().annotate({ expected: "a finite number" })),
   failedCount: Finite.check(isFinite4().annotate({ expected: "a finite number" })),
   skippedCount: Finite.check(isFinite4().annotate({ expected: "a finite number" })),
+  pendingCount: Finite.check(isFinite4().annotate({ expected: "a finite number" })),
   estimatedCompletionAt: Union2([String4, Null2])
 }).annotate({ identifier: "CampaignLatestRun" });
 var CampaignRecipientPage = /* @__PURE__ */ Struct({
@@ -54304,11 +54450,14 @@ var CampaignRun = /* @__PURE__ */ Struct({
   dispatchedCount: Finite.check(isFinite4().annotate({ expected: "a finite number" })),
   failedCount: Finite.check(isFinite4().annotate({ expected: "a finite number" })),
   skippedCount: Finite.check(isFinite4().annotate({ expected: "a finite number" })),
+  pendingCount: Finite.check(isFinite4().annotate({ expected: "a finite number" })),
   skippedReasons: ArraySchema(CampaignRunSkippedReason),
   estimatedCompletionAt: Union2([String4, Null2]),
   failureReason: Union2([String4, Null2]),
   holdReason: Union2([String4, Null2]),
   holdDomainId: Union2([EmailDomainId2, Null2]),
+  holdUntil: Union2([String4, Null2]),
+  capacityWarning: Union2([String4, Null2]),
   lastContactId: Union2([String4, Null2]),
   createdBy: Union2([String4, Null2]),
   actorEmail: String4,
@@ -54659,6 +54808,23 @@ var resumeRun = /* @__PURE__ */ make42("campaignsResumeRun");
 var cancelRun = /* @__PURE__ */ make42("campaignsCancelRun");
 var listRecipients = /* @__PURE__ */ make42("campaignsListRecipients");
 
+// src/lib/run-hold.ts
+var WHATSAPP_MESSAGING_LIMIT_HOLD = "whatsapp_messaging_limit";
+var holdLabel = (reason) => reason === null || reason === undefined ? null : reason === WHATSAPP_MESSAGING_LIMIT_HOLD ? `${reason} (the messaging limit its business portfolio shares across numbers; the run resumes on its own, sooner if Meta raises the limit)` : reason;
+var holdFields = (run) => [
+  ["Held", holdLabel(run.holdReason)],
+  ["Resumes by", run.holdUntil]
+];
+var campaignPacingFields = (run, options) => [
+  ...holdFields(run),
+  [
+    "Pending",
+    run.pendingCount !== undefined && (run.pendingCount > 0 || run.holdReason != null) ? String(run.pendingCount) : null
+  ],
+  ["Est. completion", run.estimatedCompletionAt],
+  ...options.warning ? [["Capacity warning", run.capacityWarning]] : []
+];
+
 // src/lib/template-reference.ts
 var publicationIdFlag = String9("publication-id").pipe(withDescription2("Pin one exact publication, so nothing published later changes what this renders"), optional4);
 var inputContractIdFlag = String9("input-contract-id").pipe(withDescription2("Follow the newest publication that still validates input identically to this contract"), optional4);
@@ -55131,7 +55297,7 @@ var archive2 = make29("archive", {
     ["Definition", data.definition.state]
   ]);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var printRun = (run) => printFields([
+var printRun = (run, options = { warning: true }) => printFields([
   ["Run ID", run.id],
   ["Campaign", run.campaignId],
   ["Status", run.status],
@@ -55146,8 +55312,10 @@ var printRun = (run) => printFields([
     "Skipped by reason",
     (run.skippedReasons ?? []).map(({ reason, count }) => `${reason} ${count}`).join(", ")
   ],
-  ["Failure", run.failureReason]
+  ["Failure", run.failureReason],
+  ...campaignPacingFields(run, options)
 ]);
+var warnCapacity = (run) => run.capacityWarning ? error(`Warning: ${run.capacityWarning}`) : void_3;
 var runCreate = make29("create", {
   campaignId: String10("campaignId"),
   at: atFlag,
@@ -55186,7 +55354,8 @@ var runCreate = make29("create", {
     return yield* printJson(data);
   yield* logInfo(`Run scheduled.
 `);
-  yield* printRun(data);
+  yield* printRun(data, { warning: false });
+  yield* warnCapacity(data);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var runList = make29("list", {
   campaignId: String10("campaignId"),
@@ -67136,6 +67305,18 @@ class WhatsAppTemplateIneligibleError extends TaggedError3()("WhatsAppTemplateIn
   message: String4
 }, { httpApiStatus: 422 }) {
 }
+
+class WhatsAppSetupLinkUnavailableError extends TaggedError3()("WhatsAppSetupLinkUnavailableError", {
+  reason: Literals(["completed", "revoked", "expired"]),
+  message: String4
+}, { httpApiStatus: 410 }) {
+  static new(reason) {
+    return new WhatsAppSetupLinkUnavailableError({
+      reason,
+      message: reason === "completed" ? "This setup link already connected a WhatsApp number. Ask for a new link to connect another." : reason === "revoked" ? "This setup link was revoked. Ask for a new link." : "This setup link expired. Ask for a new link."
+    });
+  }
+}
 var EmailChannelErrorReason = Literals([
   "transport",
   "rejected",
@@ -67678,6 +67859,8 @@ var JourneyRun = /* @__PURE__ */ Struct({
   exitReason: Union2([JourneyRunExitReason, Null2]),
   failureReason: Union2([String4, Null2]),
   currentNodeId: Union2([JourneyNodeId, Null2]),
+  holdReason: Union2([String4, Null2]),
+  holdUntil: Union2([String4, Null2]),
   trigger: JourneyRunTrigger,
   enteredAt: String4,
   endedAt: Union2([String4, Null2])
@@ -67701,6 +67884,8 @@ var JourneyRunDetail = /* @__PURE__ */ Struct({
   exitReason: Union2([JourneyRunExitReason, Null2]),
   failureReason: Union2([String4, Null2]),
   currentNodeId: Union2([JourneyNodeId, Null2]),
+  holdReason: Union2([String4, Null2]),
+  holdUntil: Union2([String4, Null2]),
   trigger: JourneyRunTrigger,
   enteredAt: String4,
   endedAt: Union2([String4, Null2]),
@@ -68329,6 +68514,7 @@ var printRun2 = (run) => printFields([
   ["Exit reason", run.exitReason],
   ["Failure", run.failureReason],
   ["Current node", run.currentNodeId],
+  ...holdFields(run),
   ["Entered", run.enteredAt],
   ["Ended", run.endedAt]
 ]);
@@ -73851,7 +74037,8 @@ var TemplateFamilyId2 = /* @__PURE__ */ String4.check(isPattern2(/* @__PURE__ */
 var VersionCursor2 = /* @__PURE__ */ String4.annotate({ identifier: "VersionCursor" });
 var BrandFooterBlock = /* @__PURE__ */ Struct({
   html: String4,
-  text: String4
+  text: String4,
+  headCss: optionalKey2(Union2([String4, Null2]))
 }).annotate({ identifier: "BrandFooterBlock" });
 var TemplatePublicationRender = /* @__PURE__ */ Struct({
   subject: String4,
@@ -73894,7 +74081,8 @@ var TemplateSummary = /* @__PURE__ */ Struct({
   name: String4,
   channel: Literal2("email"),
   projectId: TemplateProjectId2,
-  namespaceId: Union2([NamespaceId2, Null2]).annotate({ description: "The namespace the template's project belongs to; every entry in a project shares it. Null at organization level. A namespace-scoped key reaches only its own namespace's templates." }),
+  namespaceId: Union2([NamespaceId2, Null2]).annotate({ description: "The namespace the template's project belongs to; every entry in a project shares it. Null at organization level. A namespace-scoped key reaches only its own namespace's templates and shared ones." }),
+  shared: Boolean3.annotate({ description: "Whether the template's project is shared with every namespace. Every entry in a project shares it. A namespace-scoped key reads and sends a shared template in its own namespace but cannot change it. Only an organization-level project is shared." }),
   entryPath: String4.check(isMaxCodePoints(1024).annotate({ expected: "a string with at most 1024 code points" })).check(isPattern2(/* @__PURE__ */ new RegExp("^(?!\\/)(?!.*\\\\)(?!.*(?:^|\\/)\\.{1,2}(?:\\/|$))(?!.*(?:^|\\/)\\.git(?:\\/|$))(?:templates|emails)\\/.+\\.tsx$", "u")).annotate({ expected: "a string matching the RegExp ^(?!\\/)(?!.*\\\\)(?!.*(?:^|\\/)\\.{1,2}(?:\\/|$))(?!.*(?:^|\\/)\\.git(?:\\/|$))(?:templates|emails)\\/.+\\.tsx$" })).check(isMaxLength(1024).annotate({ expected: "a value with a length of at most 1024" })),
   status: Union2([
     Literal2("draft"),
@@ -73919,7 +74107,8 @@ var Template = /* @__PURE__ */ Struct({
   name: String4,
   channel: Literal2("email"),
   projectId: TemplateProjectId2,
-  namespaceId: Union2([NamespaceId2, Null2]).annotate({ description: "The namespace the template's project belongs to; every entry in a project shares it. Null at organization level. A namespace-scoped key reaches only its own namespace's templates." }),
+  namespaceId: Union2([NamespaceId2, Null2]).annotate({ description: "The namespace the template's project belongs to; every entry in a project shares it. Null at organization level. A namespace-scoped key reaches only its own namespace's templates and shared ones." }),
+  shared: Boolean3.annotate({ description: "Whether the template's project is shared with every namespace. Every entry in a project shares it. A namespace-scoped key reads and sends a shared template in its own namespace but cannot change it. Only an organization-level project is shared." }),
   entryPath: String4.check(isMaxCodePoints(1024).annotate({ expected: "a string with at most 1024 code points" })).check(isPattern2(/* @__PURE__ */ new RegExp("^(?!\\/)(?!.*\\\\)(?!.*(?:^|\\/)\\.{1,2}(?:\\/|$))(?!.*(?:^|\\/)\\.git(?:\\/|$))(?:templates|emails)\\/.+\\.tsx$", "u")).annotate({ expected: "a string matching the RegExp ^(?!\\/)(?!.*\\\\)(?!.*(?:^|\\/)\\.{1,2}(?:\\/|$))(?!.*(?:^|\\/)\\.git(?:\\/|$))(?:templates|emails)\\/.+\\.tsx$" })).check(isMaxLength(1024).annotate({ expected: "a value with a length of at most 1024" })),
   status: Union2([
     Literal2("draft"),
@@ -73977,6 +74166,14 @@ var TemplatePage = /* @__PURE__ */ Struct({
   items: ArraySchema(TemplateSummary),
   nextCursor: Union2([String4, Null2])
 }).annotate({ identifier: "TemplatePage" });
+var TemplateFromWebsite = /* @__PURE__ */ Struct({
+  template: Template,
+  website: Struct({
+    url: String4.annotate({ description: "The address Samva checked, normalized." }),
+    host: String4
+  }),
+  ask: String4.annotate({ description: "The request to send the template assistant in the editor. The assistant reads the site, rebuilds the project's theme and blocks to match it, and proposes a brand that changes nothing until the customer applies it." })
+}).annotate({ identifier: "TemplateFromWebsite" });
 var TemplateFamilyPage = /* @__PURE__ */ Struct({
   items: ArraySchema(TemplateFamily),
   nextCursor: Union2([String4, Null2])
@@ -74004,7 +74201,8 @@ var TemplatesListQuery = /* @__PURE__ */ Struct({
   ]), Null2])),
   search: optionalKey2(Union2([String4, Null2])),
   projectId: optionalKey2(Union2([TemplateProjectId2, Null2])),
-  namespaceId: optionalKey2(Union2([NamespaceId2, Null2]).annotate({ description: "Only templates in this namespace. A namespace-scoped key lists its own namespace's templates only." }))
+  namespaceId: optionalKey2(Union2([NamespaceId2, Null2]).annotate({ description: "Only the templates this namespace uses: its own and those shared with every namespace (add `shared=false` for its own only). A namespace-scoped key lists its own namespace's and shared templates." })),
+  shared: optionalKey2(Union2([Union2([Literal2("true"), Literal2("false")]), Null2]).annotate({ description: "Only templates whose project is shared with every namespace (true), or only unshared ones (false)." }))
 });
 var TemplatesList200 = TemplatePage;
 var TemplatesList401 = UnauthorizedError2;
@@ -74030,6 +74228,7 @@ var TemplatesCreateRequestJson = /* @__PURE__ */ Struct({
   ]), Null2]), Null2])),
   isActive: optionalKey2(Union2([Boolean3, Null2])),
   namespaceId: optionalKey2(Union2([NamespaceId2, Null2]).annotate({ description: "The namespace the new template project belongs to; the project and every entry added to it share it. Omit for organization level. A namespace-scoped key always creates in its own namespace." })),
+  shared: optionalKey2(Union2([Boolean3, Null2]).annotate({ description: "Share the new organization-level project with every namespace: namespace-scoped keys read and send its entries but cannot change them. Defaults to false. Not with `namespaceId`, and not from a namespace-scoped key." })),
   idempotencyKey: String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(255).annotate({ expected: "a string with at most 255 code points" })).check(isMaxLength(255).annotate({ expected: "a value with a length of at most 255" }))
 });
 var TemplatesCreate201 = Template;
@@ -74073,7 +74272,8 @@ var TemplatesUpdateRequestJson = /* @__PURE__ */ Struct({ data: Struct({
   ]), Null2]), Null2])),
   fromDefault: optionalKey2(Union2([Union2([TemplateFromDefault, Null2]), Null2])),
   replyToDefault: optionalKey2(Union2([Union2([ArraySchema(String4), Null2]), Null2])),
-  isActive: optionalKey2(Union2([Boolean3, Null2]))
+  isActive: optionalKey2(Union2([Boolean3, Null2])),
+  shared: optionalKey2(Union2([Boolean3, Null2]).annotate({ description: "Share the template's project with every namespace, or stop sharing it. Applies to every entry in the project. Only an organization-level project is shared." }))
 }) });
 var TemplatesUpdate200 = Template;
 var TemplatesUpdate401 = UnauthorizedError2;
@@ -75621,6 +75821,20 @@ var TemplatesCreateFamilyFromTemplate409 = ConflictError2;
 var TemplatesCreateFamilyFromTemplate422 = ValidationError2;
 var TemplatesCreateFamilyFromTemplate500 = InternalError2;
 var TemplatesCreateFamilyFromTemplate504 = GatewayTimeoutError2;
+var TemplatesCreateFromWebsiteRequestJson = /* @__PURE__ */ Struct({
+  url: String4.annotate({ description: "The website whose look the template should match: a public https address, or a bare domain such as `example.com`." }).check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(2048).annotate({ expected: "a string with at most 2048 code points" })).check(isMaxLength(2048).annotate({ expected: "a value with a length of at most 2048" })),
+  name: optionalKey2(Union2([String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(200).annotate({ expected: "a string with at most 200 code points" })).check(isMaxLength(200).annotate({ expected: "a value with a length of at most 200" })), Null2])),
+  namespaceId: optionalKey2(Union2([NamespaceId2, Null2]).annotate({ description: "The namespace the new template project belongs to. Omit for organization level. A namespace-scoped key always creates in its own namespace." })),
+  idempotencyKey: String4.annotate({ description: "Repeating a request with the same key, address, name, and namespace returns the project the first one created, even if the site has since stopped answering. The same key with another address, name, or namespace is refused with a 409." }).check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })).check(isMaxCodePoints(255).annotate({ expected: "a string with at most 255 code points" })).check(isMaxLength(255).annotate({ expected: "a value with a length of at most 255" }))
+});
+var TemplatesCreateFromWebsite201 = TemplateFromWebsite;
+var TemplatesCreateFromWebsite401 = UnauthorizedError2;
+var TemplatesCreateFromWebsite403 = ForbiddenError2;
+var TemplatesCreateFromWebsite404 = ResourceNotFoundError2;
+var TemplatesCreateFromWebsite409 = ConflictError2;
+var TemplatesCreateFromWebsite422 = ValidationError2;
+var TemplatesCreateFromWebsite500 = InternalError2;
+var TemplatesCreateFromWebsite504 = GatewayTimeoutError2;
 var TemplatesAddEntryPathParams = /* @__PURE__ */ Struct({ id: TemplateProjectId2 });
 var TemplatesAddEntryRequestJson = /* @__PURE__ */ Struct({
   entryPath: String4.check(isMaxCodePoints(1024).annotate({ expected: "a string with at most 1024 code points" })).check(isPattern2(/* @__PURE__ */ new RegExp("^(?!\\/)(?!.*\\\\)(?!.*(?:^|\\/)\\.{1,2}(?:\\/|$))(?!.*(?:^|\\/)\\.git(?:\\/|$))(?:templates|emails)\\/.+\\.tsx$", "u")).annotate({ expected: "a string matching the RegExp ^(?!\\/)(?!.*\\\\)(?!.*(?:^|\\/)\\.{1,2}(?:\\/|$))(?!.*(?:^|\\/)\\.git(?:\\/|$))(?:templates|emails)\\/.+\\.tsx$" })).check(isMaxLength(1024).annotate({ expected: "a value with a length of at most 1024" })),
@@ -76033,7 +76247,19 @@ var TemplatesGroup = class extends make37("Templates").add(get5("templatesList",
     TemplatesCreateFamilyFromTemplate500,
     TemplatesCreateFamilyFromTemplate504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "templates.createFamilyFromTemplate").annotate(Summary, "Create a family from a template").annotate(Description, "Creates a template family containing the specified template and returns the new family with status 201."), post("templatesAddEntry", "/v1/templates/projects/:id/entries", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "templates.createFamilyFromTemplate").annotate(Summary, "Create a family from a template").annotate(Description, "Creates a template family containing the specified template and returns the new family with status 201."), post("templatesCreateFromWebsite", "/v1/templates/from-website", {
+  payload: TemplatesCreateFromWebsiteRequestJson,
+  success: TemplatesCreateFromWebsite201.pipe(status(201)),
+  error: [
+    TemplatesCreateFromWebsite401.pipe(status(401)),
+    TemplatesCreateFromWebsite403.pipe(status(403)),
+    TemplatesCreateFromWebsite404.pipe(status(404)),
+    TemplatesCreateFromWebsite409.pipe(status(409)),
+    TemplatesCreateFromWebsite422.pipe(status(422)),
+    TemplatesCreateFromWebsite500,
+    TemplatesCreateFromWebsite504.pipe(status(504))
+  ]
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "templates.createFromWebsite").annotate(Summary, "Create a template from a website").annotate(Description, "Checks that the website is a public page Samva can read, creates an email template project from Samva's canonical TSX starter, and returns the template with status 201 and the request that makes the template assistant match the site. The assistant runs when the request is sent in the editor; it rebuilds the project's theme and blocks from the site and proposes a brand that applies only after the customer approves it. A 422 names why the site cannot be matched: not a web address, not public, no answer, a missing page, refused automated visits, or not a web page."), post("templatesAddEntry", "/v1/templates/projects/:id/entries", {
   params: TemplatesAddEntryPathParams,
   payload: TemplatesAddEntryRequestJson,
   success: TemplatesAddEntry201.pipe(status(201)),
@@ -76053,6 +76279,7 @@ var TemplatesGroup = class extends make37("Templates").add(get5("templatesList",
 var make54 = /* @__PURE__ */ forGroup(TemplatesGroup);
 var list26 = /* @__PURE__ */ make54("templatesList");
 var create15 = /* @__PURE__ */ make54("templatesCreate");
+var createFromWebsite = /* @__PURE__ */ make54("templatesCreateFromWebsite");
 var addEntry = /* @__PURE__ */ make54("templatesAddEntry");
 var getById = /* @__PURE__ */ make54("templatesGetById");
 var remove13 = /* @__PURE__ */ make54("templatesRemove");
@@ -76652,6 +76879,66 @@ var formatReportedDiagnostic = (diagnostic) => {
   Upgrade: ${diagnostic.upgrade}`;
 };
 
+// src/commands/templates/from-website-command.ts
+var webOriginForApi = (apiUrl) => {
+  if (!URL.canParse(apiUrl))
+    return null;
+  const url = new URL(apiUrl);
+  if (!url.hostname.startsWith("api."))
+    return null;
+  url.hostname = url.hostname.slice("api.".length);
+  return url.origin;
+};
+var editorPath = (orgSlug, templateId, ask) => `/dashboard/${encodeURIComponent(orgSlug)}/templates/${encodeURIComponent(templateId)}/edit?ask=${encodeURIComponent(ask)}`;
+var urlArgument = String10("url").pipe(withDescription4("The website to match: a public https address or a bare domain"));
+var fromWebsiteCommand = make29("from-website", {
+  url: urlArgument,
+  name: String9("name").pipe(withDescription2("Name for the new template; defaults to one derived from the site"), optional4),
+  namespace: namespaceFlag("create"),
+  idempotencyKey: String9("idempotency-key").pipe(withDescription2("Key (1-255 characters) so a retry returns the original template; generated per run when omitted"), optional4),
+  json: jsonFlag
+}).pipe(withDescription3("Create a template project from a website, then open the editor to have the assistant match its brand"), withExamples([
+  {
+    command: "samva templates from-website example.com",
+    description: "Check the site, create the project, and print the editor link"
+  },
+  {
+    command: 'samva templates from-website https://example.com --name "Example welcome" --json',
+    description: "Machine-readable result with the template, website, ask, and editor link"
+  }
+]), withHandler(({ url, name, namespace, idempotencyKey, json }) => gen2(function* () {
+  const key = getOrUndefined(idempotencyKey);
+  if (key !== undefined && (key.length < 1 || key.length > 255))
+    return yield* new SamvaCliError({
+      message: "--idempotency-key must contain between 1 and 255 characters."
+    });
+  const client = yield* getClientProvider;
+  const context = yield* resolveExecutionContext;
+  const orgSlug = context.apiKey ? (yield* get25().pipe(client.provide, mapError2((error) => toCliApiError("Could not look up the organization", error)))).organization.slug : context.orgSlug;
+  const result = yield* createFromWebsite({
+    url,
+    ...isSome2(name) ? { name: name.value } : {},
+    ...namespaceField(namespace),
+    idempotencyKey: key ?? crypto.randomUUID()
+  }).pipe(client.provide, mapError2((error) => toCliApiError("Could not create a template from the website", error)));
+  const path = orgSlug === undefined ? null : editorPath(orgSlug, result.template.id, result.ask);
+  const origin = webOriginForApi(context.apiUrl);
+  const editorUrl = path !== null && origin !== null ? `${origin}${path}` : null;
+  if (json)
+    return yield* printJson({
+      template: { id: result.template.id, name: result.template.name },
+      website: result.website,
+      ask: result.ask,
+      editorUrl
+    });
+  yield* printFields([
+    ["Template", result.template.id],
+    ["Website", result.website.host],
+    ...editorUrl !== null ? [["Editor", editorUrl]] : [["Ask", result.ask]]
+  ]);
+  yield* log(editorUrl !== null ? "The brand proposal applies only when you approve it in the editor." : "Open the template in the dashboard editor and send the ask above; the brand proposal applies only when you approve it there.");
+}).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
+
 // src/commands/templates/local-build.ts
 import { resolve as resolve9 } from "path";
 var buildDir = (dir, assetBase) => runToolchain({
@@ -78776,13 +79063,18 @@ var build3 = make29("build", {
     yield* logInfo(`Built ${built.files.length} template file(s) with compiler ${artifact.compilerVersion} to ${target}`);
   }
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
+var sharedFilterFlag = Literals3("shared", ["true", "false"]).pipe(withDescription2("Only templates shared with every namespace (true), or only unshared ones (false)"), optional4);
 var listRemote = make29("list", {
   cursor: String9("cursor").pipe(withDescription2("Resume after this nextCursor from a previous page"), optional4),
   limit: Int5("limit").pipe(withDescription2("Items per page"), optional4),
   namespace: namespaceFlag("list"),
+  shared: sharedFilterFlag,
   all: Boolean6("all").pipe(withDescription2("Traverse every page (requires --jsonl)"), withDefault5(false)),
   json: jsonFlag
-}).pipe(withDescription3("List remote templates"), withExamples([{ command: "samva templates list --json" }]), withHandler(({ cursor, limit, namespace, all, json }) => gen2(function* () {
+}).pipe(withDescription3("List remote templates"), withExamples([
+  { command: "samva templates list --json" },
+  { command: "samva templates list --shared true --json" }
+]), withHandler(({ cursor, limit, namespace, shared, all, json }) => gen2(function* () {
   if (all && !isJsonLinesRequested())
     return yield* new CliUsageError({
       code: "all_requires_jsonl",
@@ -78794,7 +79086,8 @@ var listRemote = make29("list", {
   const query = {
     cursor: cursorValue,
     limit: limitValue?.toString(),
-    ...namespaceField(namespace)
+    ...namespaceField(namespace),
+    ...match(shared, { onNone: () => ({}), onSome: (value) => ({ shared: value }) })
   };
   if (all) {
     let nextCursor = cursorValue;
@@ -78821,7 +79114,8 @@ var listRemote = make29("list", {
       ["Name", item.name],
       ["Slug", item.slug],
       ["Status", item.status],
-      ["Namespace", item.namespaceId ?? "organization"]
+      ["Namespace", item.namespaceId ?? "organization"],
+      ["Shared", item.shared ? "yes" : "no"]
     ]);
   if (data.nextCursor !== null)
     yield* printFields([["Next cursor", data.nextCursor]]);
@@ -78836,20 +79130,35 @@ var getRemote = make29("get", { id: templateIdArgument2, json: jsonFlag }).pipe(
 var createRemote = make29("create", {
   data: String9("data").pipe(withDescription2("Complete template JSON payload")),
   namespace: namespaceFlag("create"),
+  shared: Boolean6("shared").pipe(withDescription2("Share the new organization-level project with every namespace; namespace-scoped keys read and send it but cannot change it"), withDefault5(false)),
   dryRun: dryRunFlag6,
   json: jsonFlag
 }).pipe(withDescription3("Create a remote template from JSON"), withExamples([
   {
     command: `samva templates create --data '{"name":"Welcome","projectName":"welcome-email","idempotencyKey":"welcome-email-v1"}' --dry-run`
   }
-]), withHandler(({ data, namespace, dryRun, json }) => gen2(function* () {
+]), withHandler(({ data, namespace, shared, dryRun, json }) => gen2(function* () {
   const decoded = yield* decodePayload(data, "--data", CreateTemplatePayload);
+  if (shared && decoded.shared === false)
+    return yield* new CliUsageError({
+      code: "shared_conflict",
+      message: "--shared and shared: false in --data disagree."
+    });
+  if (shared && (isSome2(namespace) || decoded.namespaceId != null))
+    return yield* new CliUsageError({
+      code: "shared_namespace_conflict",
+      message: "--shared shares an organization-level project; it cannot have a namespace."
+    });
   if (isSome2(namespace) && decoded.namespaceId != null && decoded.namespaceId !== namespace.value)
     return yield* new CliUsageError({
       code: "namespace_conflict",
       message: "--namespace and the namespaceId in --data name different namespaces."
     });
-  const payload = { ...decoded, ...namespaceField(namespace) };
+  const payload = {
+    ...decoded,
+    ...namespaceField(namespace),
+    ...shared ? { shared: true } : {}
+  };
   if (dryRun)
     return yield* json ? printJson({ dryRun: true, action: "templates.create", request: payload }) : printFields([
       ["Action", "templates.create"],
@@ -78864,14 +79173,22 @@ var createRemote = make29("create", {
 var updateRemote = make29("update", {
   id: templateIdArgument2,
   data: String9("data").pipe(withDescription2("JSON object of template fields to update")),
+  shared: Literals3("shared", ["true", "false"]).pipe(withDescription2("Share the template's organization-level project with every namespace (true) or stop sharing it (false); applies to every entry in the project"), optional4),
   dryRun: dryRunFlag6,
   json: jsonFlag
 }).pipe(withDescription3("Update a remote template from JSON"), withExamples([
   {
     command: `samva templates update tmpl_abc123 --data '{"name":"Welcome back"}' --dry-run`
   }
-]), withHandler(({ id, data, dryRun, json }) => gen2(function* () {
-  const changes = yield* parseObject(data, "--data");
+]), withHandler(({ id, data, shared, dryRun, json }) => gen2(function* () {
+  const parsed = yield* parseObject(data, "--data");
+  const sharedValue = map(shared, (value) => value === "true");
+  if (isSome2(sharedValue) && parsed.shared !== undefined && parsed.shared !== sharedValue.value)
+    return yield* new CliUsageError({
+      code: "shared_conflict",
+      message: "--shared and shared in --data disagree."
+    });
+  const changes = isSome2(sharedValue) ? { ...parsed, shared: sharedValue.value } : parsed;
   const payload = yield* decodePayload(JSON.stringify({ data: changes }), "--data", UpdateTemplatePayload);
   if (dryRun)
     return yield* json ? printJson({ dryRun: true, action: "templates.update", id, request: payload }) : printFields([
@@ -78983,6 +79300,10 @@ var templatesCommand = make29("templates").pipe(withDescription3("Create, author
     command: "samva templates clone tmpl_abc123 --dir welcome-email",
     description: "Clone an existing project with its repository credential helper"
   },
+  {
+    command: "samva templates from-website example.com",
+    description: "Create a project from a website and print the editor link that matches its brand"
+  },
   {
     command: "samva templates dev",
     description: "Start the local visual editor for templates/ and emails/"
@@ -79023,6 +79344,7 @@ var templatesCommand = make29("templates").pipe(withDescription3("Create, author
   createRemote,
   updateRemote,
   removeRemote,
+  fromWebsiteCommand,
   devCommand,
   check5,
   renderCommand,
@@ -79060,6 +79382,11 @@ var WebhookDailyDeliveries = /* @__PURE__ */ Struct({
   exhausted: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" })),
   cancelled: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" }))
 }).annotate({ identifier: "WebhookDailyDeliveries" });
+var WebhookSigningSecret = /* @__PURE__ */ Struct({
+  secret: SensitiveString,
+  createdAt: String4,
+  previousExpiresAt: Union2([String4, Null2])
+}).annotate({ identifier: "WebhookSigningSecret" });
 var WebhookEndpoint = /* @__PURE__ */ Struct({
   id: WebhookEndpointId2,
   name: String4,
@@ -79090,6 +79417,9 @@ var WebhookEndpoint = /* @__PURE__ */ Struct({
     Literal2("webhook.test"),
     Literal2("domain.updated"),
     Literal2("domain.warming.updated"),
+    Literal2("template.registration.updated"),
+    Literal2("flow.registration.updated"),
+    Literal2("whatsapp.number.connected"),
     Literal2("mailbox.message.received"),
     Literal2("mailbox.message.sent"),
     Literal2("mailbox.action.pending_approval"),
@@ -79139,6 +79469,9 @@ var WebhookEndpointListItem = /* @__PURE__ */ Struct({
     Literal2("webhook.test"),
     Literal2("domain.updated"),
     Literal2("domain.warming.updated"),
+    Literal2("template.registration.updated"),
+    Literal2("flow.registration.updated"),
+    Literal2("whatsapp.number.connected"),
     Literal2("mailbox.message.received"),
     Literal2("mailbox.message.sent"),
     Literal2("mailbox.action.pending_approval"),
@@ -79253,6 +79586,9 @@ var WebhooksCreateRequestJson = /* @__PURE__ */ Struct({
     Literal2("webhook.test"),
     Literal2("domain.updated"),
     Literal2("domain.warming.updated"),
+    Literal2("template.registration.updated"),
+    Literal2("flow.registration.updated"),
+    Literal2("whatsapp.number.connected"),
     Literal2("mailbox.message.received"),
     Literal2("mailbox.message.sent"),
     Literal2("mailbox.action.pending_approval"),
@@ -79328,6 +79664,9 @@ var WebhooksUpdateRequestJson = /* @__PURE__ */ Struct({
     Literal2("webhook.test"),
     Literal2("domain.updated"),
     Literal2("domain.warming.updated"),
+    Literal2("template.registration.updated"),
+    Literal2("flow.registration.updated"),
+    Literal2("whatsapp.number.connected"),
     Literal2("mailbox.message.received"),
     Literal2("mailbox.message.sent"),
     Literal2("mailbox.action.pending_approval"),
@@ -79388,6 +79727,14 @@ var WebhooksRegenerateSecret404 = ResourceNotFoundError2;
 var WebhooksRegenerateSecret422 = ValidationError2;
 var WebhooksRegenerateSecret500 = InternalError2;
 var WebhooksRegenerateSecret504 = GatewayTimeoutError2;
+var WebhooksGetSecretPathParams = /* @__PURE__ */ Struct({ id: WebhookEndpointId2 });
+var WebhooksGetSecret200 = WebhookSigningSecret;
+var WebhooksGetSecret401 = UnauthorizedError2;
+var WebhooksGetSecret403 = ForbiddenError2;
+var WebhooksGetSecret404 = ResourceNotFoundError2;
+var WebhooksGetSecret422 = ValidationError2;
+var WebhooksGetSecret500 = InternalError2;
+var WebhooksGetSecret504 = GatewayTimeoutError2;
 var WebhooksGetStatsPathParams = /* @__PURE__ */ Struct({ id: WebhookEndpointId2 });
 var WebhooksGetStatsQuery = /* @__PURE__ */ Struct({
   after: optionalKey2(Union2([String4, Null2])),
@@ -79437,7 +79784,7 @@ var WebhooksGroup = class extends make37("Webhooks").add(get5("webhooksList", "/
     WebhooksCreate502.pipe(status(502)),
     WebhooksCreate504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "webhooks.create").annotate(Summary, "Create a webhook").annotate(Description, "Creates a signed webhook endpoint for Samva delivery and inbound events, stores subscriptions, and returns the endpoint and signing secret with a 201 response. `mailboxIds` and `namespaceId` confine mailbox events; when both are set, every mailbox must belong to the namespace."), get5("webhooksGet", "/v1/webhooks/:id", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "webhooks.create").annotate(Summary, "Create a webhook").annotate(Description, "Creates a signed webhook endpoint for Samva delivery and inbound events, stores subscriptions, and returns the endpoint and signing secret with a 201 response. `namespaceId` confines the endpoint to one namespace's events and `mailboxIds` to those mailboxes' events; when both are set, every mailbox must belong to the namespace."), get5("webhooksGet", "/v1/webhooks/:id", {
   params: WebhooksGetPathParams,
   success: WebhooksGet200,
   error: [
@@ -79508,7 +79855,18 @@ var WebhooksGroup = class extends make37("Webhooks").add(get5("webhooksList", "/
     WebhooksRegenerateSecret500,
     WebhooksRegenerateSecret504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "webhooks.regenerateSecret").annotate(Summary, "Rotate a webhook signing secret").annotate(Description, "Generates and returns a new signing secret. The previous secret remains valid for a 24-hour rotation overlap."), get5("webhooksGetStats", "/v1/webhooks/:id/stats", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "webhooks.regenerateSecret").annotate(Summary, "Rotate a webhook signing secret").annotate(Description, "Generates and returns a new signing secret. The previous secret remains valid for a 24-hour rotation overlap."), get5("webhooksGetSecret", "/v1/webhooks/:id/secret", {
+  params: WebhooksGetSecretPathParams,
+  success: WebhooksGetSecret200,
+  error: [
+    WebhooksGetSecret401.pipe(status(401)),
+    WebhooksGetSecret403.pipe(status(403)),
+    WebhooksGetSecret404.pipe(status(404)),
+    WebhooksGetSecret422.pipe(status(422)),
+    WebhooksGetSecret500,
+    WebhooksGetSecret504.pipe(status(504))
+  ]
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "webhooks.getSecret").annotate(Summary, "Get a webhook signing secret").annotate(Description, "Returns the endpoint's current signing secret and when a rotated-out secret stops verifying. It needs the same permission as rotating the secret."), get5("webhooksGetStats", "/v1/webhooks/:id/stats", {
   params: WebhooksGetStatsPathParams,
   query: WebhooksGetStatsQuery,
   success: WebhooksGetStats200,
@@ -79539,6 +79897,7 @@ var WebhooksGroup = class extends make37("Webhooks").add(get5("webhooksList", "/
 var make55 = /* @__PURE__ */ forGroup(WebhooksGroup);
 var list27 = /* @__PURE__ */ make55("webhooksList");
 var create16 = /* @__PURE__ */ make55("webhooksCreate");
+var getSecret = /* @__PURE__ */ make55("webhooksGetSecret");
 var get28 = /* @__PURE__ */ make55("webhooksGet");
 var remove14 = /* @__PURE__ */ make55("webhooksRemove");
 var update13 = /* @__PURE__ */ make55("webhooksUpdate");
@@ -79628,6 +79987,18 @@ var get29 = make29("get", { id: idArgument4, json: jsonFlag }).pipe(withDescript
     ["URL", data.url]
   ]);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
+var secret = make29("secret", { id: idArgument4, json: jsonFlag }).pipe(withDescription3("Read the current webhook signing secret (requires webhooks:update)"), withExamples([{ command: "samva webhooks secret wep_abc123 --json" }]), withHandler(({ id, json }) => gen2(function* () {
+  const client = yield* getClientProvider;
+  const data = yield* getSecret({ id }).pipe(client.provide, mapError2((error) => toCliApiError("Could not read webhook signing secret", error)));
+  if (json)
+    return yield* printJson({ ...data, secret: value2(data.secret) });
+  yield* printFields([
+    ["Signing secret", value2(data.secret)],
+    ["Created at", data.createdAt]
+  ]);
+  if (data.previousExpiresAt !== null)
+    yield* log(`The previous secret keeps verifying until ${data.previousExpiresAt}.`);
+}).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var logs = make29("logs", {
   id: idArgument4,
   limit: Int5("limit").pipe(optional4),
@@ -79785,15 +80156,15 @@ var rotate3 = make29("rotate-secret", {
   yield* confirmDestructive({
     yes,
     json,
-    message: `Rotate the signing secret for webhook ${id}? The current secret will stop working.`,
+    message: `Rotate the signing secret for webhook ${id}? The previous secret keeps verifying for 24 hours.`,
     nonInteractiveMessage: "Secret rotation requires --yes in non-interactive mode. Preview with --dry-run."
   });
   const client = yield* getClientProvider;
   const data = yield* regenerateSecret({ id }).pipe(client.provide, mapError2((error) => toCliApiError("Could not rotate webhook secret", error)));
-  const warning = "This signing secret is shown once. Store it now; the previous secret remains valid for 24 hours.";
+  const warning = `Read this signing secret again with samva webhooks secret ${id}. The previous secret remains valid for 24 hours.`;
   const secret = value2(data.secret);
   if (json)
-    return yield* printJson({ secret, displayOnce: true, warning });
+    return yield* printJson({ secret, warning });
   yield* error(`WARNING: ${warning}`);
   yield* log(secret);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
@@ -79814,10 +80185,10 @@ var create17 = make29("create", {
     ]);
   const client = yield* getClientProvider;
   const result = yield* create16(payload).pipe(client.provide, mapError2((error) => toCliApiError("Could not create webhook", error)));
-  const warning = "This signing secret is shown once. Store it now; `samva webhooks rotate-secret` issues a new one.";
+  const warning = `Read this signing secret again with samva webhooks secret ${result.endpoint.id}.`;
   const secret = value2(result.secret);
   if (json)
-    return yield* printJson({ endpoint: result.endpoint, secret, displayOnce: true, warning });
+    return yield* printJson({ endpoint: result.endpoint, secret, warning });
   yield* error(`WARNING: ${warning}`);
   yield* printFields([
     ["ID", result.endpoint.id],
@@ -79873,7 +80244,19 @@ var remove15 = make29("remove", {
     return yield* printJson(result);
   yield* log(`Removed webhook ${id}.`);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var webhooksCommand = make29("webhooks").pipe(withDescription3("Inspect, test, and recover customer webhooks"), withExamples([{ command: "samva webhooks list --json" }]), withSubcommands([list28, get29, create17, update14, test2, logs, stats3, retry4, rotate3, remove15]));
+var webhooksCommand = make29("webhooks").pipe(withDescription3("Inspect, test, and recover customer webhooks"), withExamples([{ command: "samva webhooks list --json" }]), withSubcommands([
+  list28,
+  get29,
+  secret,
+  create17,
+  update14,
+  test2,
+  logs,
+  stats3,
+  retry4,
+  rotate3,
+  remove15
+]));
 
 // src/lib/root-commands.ts
 var rootCommands = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@samva/cli",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "description": "Samva CLI — email and platform operations from your terminal",
   "keywords": [
     "cli",
@@ -50,22 +50,22 @@
     "@effect/vitest": "4.0.0",
     "@samva/contracts": "0.0.0",
     "@samva/core": "0.0.0",
-    "@samva/mailbox": "0.5.0",
-    "@samva/markup": "^0.13.1",
-    "@samva/vite": "^0.13.1",
+    "@samva/mailbox": "0.5.2",
+    "@samva/markup": "0.15.0",
+    "@samva/vite": "0.15.0",
     "@types/node": "^26.6.2",
     "better-auth": "1.7.5",
     "effect": "4.0.0",
-    "samva": "0.20.0",
+    "samva": "0.22.0",
     "typescript": "^7.0.2",
     "vite": "~8.3.0",
     "vitest": "^5.0.3"
   },
   "optionalDependencies": {
-    "@samva/cli-darwin-arm64": "0.17.0",
-    "@samva/cli-darwin-x64": "0.17.0",
-    "@samva/cli-linux-arm64": "0.17.0",
-    "@samva/cli-linux-x64": "0.17.0"
+    "@samva/cli-darwin-arm64": "0.19.0",
+    "@samva/cli-darwin-x64": "0.19.0",
+    "@samva/cli-linux-arm64": "0.19.0",
+    "@samva/cli-linux-x64": "0.19.0"
   },
   "engines": {
     "node": ">=18"