@samva/cli 0.8.0 → 0.10.0

package/dist/bin.mjs

@@ -13982,7 +13982,7 @@ var layer12 = /* @__PURE__ */ layer.pipe(/* @__PURE__ */ provideMerge(/* @__PURE
 // package.json
 var package_default = {
   name: "@samva/cli",
-  version: "0.8.0",
+  version: "0.10.0",
   description: "Samva CLI \u2014 email and platform operations from your terminal",
   keywords: [
     "cli",
@@ -14037,16 +14037,16 @@ var package_default = {
     "@types/node": "catalog:",
     "better-auth": "catalog:",
     effect: "catalog:effect",
-    samva: "workspace:0.11.0",
+    samva: "workspace:0.13.0",
     typescript: "catalog:",
     vite: "~8.3.0",
     vitest: "catalog:"
   },
   optionalDependencies: {
-    "@samva/cli-darwin-arm64": "workspace:0.8.0",
-    "@samva/cli-darwin-x64": "workspace:0.8.0",
-    "@samva/cli-linux-arm64": "workspace:0.8.0",
-    "@samva/cli-linux-x64": "workspace:0.8.0"
+    "@samva/cli-darwin-arm64": "workspace:0.10.0",
+    "@samva/cli-darwin-x64": "workspace:0.10.0",
+    "@samva/cli-linux-arm64": "workspace:0.10.0",
+    "@samva/cli-linux-x64": "workspace:0.10.0"
   },
   engines: {
     node: ">=18"
@@ -43621,6 +43621,121 @@ var DIAGNOSTIC_CODES = codes2({
     channelOnly: true
   }
 });
+// ../sdk/dist/inline-attachments-B56eS0MF.js
+var SDK_VERSION = "0.13.0";
+var CLIENT_ATTRIBUTION_HEADER = "x-samva-client";
+var clientAttribution = (surface) => `${surface}/${SDK_VERSION}`;
+var MediaUploadError = class extends Error {
+  _tag = "MediaUploadError";
+  filename;
+  mediaId;
+  status;
+  cause;
+  constructor(input) {
+    super(input.status === undefined ? `Uploading attachment "${input.filename}" (${input.mediaId}) failed before storage answered` : `Uploading attachment "${input.filename}" (${input.mediaId}) failed with storage status ${input.status}`, { cause: input.cause });
+    this.name = "MediaUploadError";
+    this.filename = input.filename;
+    this.mediaId = input.mediaId;
+    this.status = input.status;
+    this.cause = input.cause;
+  }
+};
+var isRecord = (value) => typeof value === "object" && value !== null;
+var attachmentsOf = (payload) => {
+  const email = payload.email;
+  if (!isRecord(email))
+    return [];
+  const attachments = email.attachments;
+  return Array.isArray(attachments) ? attachments : [];
+};
+var decodedBase64Bytes = (content) => {
+  const length = content.length;
+  if (length === 0)
+    return 0;
+  let padding = 0;
+  if (content.endsWith("=="))
+    padding = 2;
+  else if (content.endsWith("="))
+    padding = 1;
+  return Math.floor(length * 3 / 4) - padding;
+};
+var base64ToBytes = (content) => {
+  let binary;
+  try {
+    binary = atob(content);
+  } catch {
+    return;
+  }
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0;index < binary.length; index += 1)
+    bytes[index] = binary.charCodeAt(index);
+  return bytes;
+};
+var planInlineUploads = (payload) => {
+  const inline = [];
+  for (const [index, entry] of attachmentsOf(payload).entries()) {
+    if (!isRecord(entry))
+      continue;
+    const attachment = entry;
+    if (typeof attachment.content !== "string")
+      continue;
+    if (attachment.mediaId !== undefined)
+      return [];
+    inline.push({
+      index,
+      filename: typeof attachment.filename === "string" ? attachment.filename : "attachment",
+      contentType: typeof attachment.contentType === "string" ? attachment.contentType : "application/octet-stream",
+      content: attachment.content,
+      sizeBytes: typeof attachment.size === "number" ? attachment.size : decodedBase64Bytes(attachment.content)
+    });
+  }
+  let remaining = inline.reduce((total, upload) => total + upload.sizeBytes, 0);
+  if (remaining <= 4194304)
+    return [];
+  const chosen = [];
+  const largestFirst = [...inline].sort((left, right) => right.sizeBytes - left.sizeBytes || left.index - right.index);
+  for (const { content, ...upload } of largestFirst) {
+    if (remaining <= 4194304)
+      break;
+    const bytes = base64ToBytes(content);
+    if (bytes === undefined)
+      return [];
+    chosen.push({
+      ...upload,
+      bytes
+    });
+    remaining -= upload.sizeBytes;
+  }
+  return chosen;
+};
+var mediaCreateBody = (upload) => ({
+  filename: upload.filename,
+  contentType: upload.contentType,
+  sizeBytes: upload.sizeBytes,
+  purpose: "attachment"
+});
+var uploadContentType = (headers) => Object.entries(headers).find(([name]) => name.toLowerCase() === "content-type")?.[1];
+var withUploadedAttachments = (payload, uploaded) => {
+  const email = payload.email;
+  const attachments = email.attachments.map((entry, index) => {
+    const replacement = uploaded.get(index);
+    if (replacement === undefined)
+      return entry;
+    const { content: _content, ...rest } = entry;
+    return {
+      ...rest,
+      mediaId: replacement.mediaId
+    };
+  });
+  return {
+    ...payload,
+    email: {
+      ...email,
+      attachments
+    }
+  };
+};
+
 // ../sdk/dist/normalize-B79uJIeb.js
 function toRecipientArray(recipient) {
   return Array.isArray(recipient) ? recipient : [recipient];
@@ -43690,11 +43805,6 @@ function buildMessagesSendPayload(input) {
   };
 }
 
-// ../sdk/dist/client-attribution-Ct2FKITg.js
-var SDK_VERSION = "0.11.0";
-var CLIENT_ATTRIBUTION_HEADER = "x-samva-client";
-var clientAttribution = (surface) => `${surface}/${SDK_VERSION}`;
-
 // ../../node_modules/.bun/effect@4.0.0/node_modules/effect/dist/Random.js
 var Random2 = Random;
 var randomWith = (f) => withFiber2((fiber) => succeed6(f(fiber.getRef(Random2))));
@@ -43946,6 +44056,7 @@ var baseUrl = () => {
 
 // ../../node_modules/.bun/effect@4.0.0/node_modules/effect/dist/http/HttpClientRequest.js
 var TypeId40 = "~effect/http/HttpClientRequest";
+var isHttpClientRequest = (u) => hasProperty(u, TypeId40);
 var Proto13 = {
   [TypeId40]: TypeId40,
   ...BaseProto,
@@ -44044,6 +44155,7 @@ var setHash = /* @__PURE__ */ dual(2, (self, hash) => makeWith(self.method, self
 var setBody = /* @__PURE__ */ dual(2, (self, body) => {
   return makeWith(self.method, self.url, self.urlParams, self.hash, updateHeaders(self.headers, body), body);
 });
+var bodyUint8Array = /* @__PURE__ */ dual((args) => isHttpClientRequest(args[0]), (self, body, contentType) => setBody(self, uint8Array(body, contentType)));
 var bodyFormData = /* @__PURE__ */ dual(2, (self, body) => setBody(self, formData(body)));
 function toUrl(self) {
   const r = make32(self.url, self.urlParams, getOrUndefined(self.hash));
@@ -46053,7 +46165,7 @@ var fetch2 = /* @__PURE__ */ make34((request, url, signal, fiber) => {
 });
 var layer15 = /* @__PURE__ */ layerMergedContext(/* @__PURE__ */ succeed6(fetch2));
 
-// ../sdk/dist/client-8YXjfsVc.js
+// ../sdk/dist/client-DYPNDvVU.js
 var Sensitive = (schema) => RedactedFromValue(schema);
 var SensitiveString = Sensitive(String4);
 var ABSOLUTE_ISO_INSTANT_PATTERN = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?(Z|([+-])(\d{2}):(\d{2}))$/;
@@ -46290,6 +46402,12 @@ var CampaignFooterRequiredError = class extends TaggedError3()("CampaignFooterRe
 };
 var ExternalServiceError = class extends TaggedError3()("ExternalServiceError", Struct({ message: String4 })) {
 };
+var SenderNotReadyError = class extends TaggedError3()("SenderNotReadyError", Struct({
+  message: String4,
+  sender: String4,
+  retryAfterSeconds: optionalKey2(Union2([Finite.check(isFinite4().annotate({ expected: "a finite number" })), Null2]))
+})) {
+};
 var CampaignRecipientId = String4.check(isPattern2(/* @__PURE__ */ new RegExp("^crcpt_[0-9a-hjkmnp-tv-z]{16,24}$", "u")).annotate({
   expected: "a string matching the RegExp ^crcpt_[0-9a-hjkmnp-tv-z]{16,24}$",
   identifier: "CampaignRecipientId"
@@ -46327,11 +46445,11 @@ var ContactPreferences = Struct({
     }), Null2]))
   }), Null2]))
 }).annotate({ identifier: "ContactPreferences" });
-var UnknownRecord = Record(String4, JsonValue).annotate({ identifier: "UnknownRecord" });
 var BulkUpdateResult = Struct({
   updated: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" })),
   failed: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" }))
 }).annotate({ identifier: "BulkUpdateResult" });
+var UnknownRecord = Record(String4, JsonValue).annotate({ identifier: "UnknownRecord" });
 var CustomFieldDefinitionId = String4.check(isPattern2(/* @__PURE__ */ new RegExp("^cfield_[0-9a-hjkmnp-tv-z]{16,24}$", "u")).annotate({
   expected: "a string matching the RegExp ^cfield_[0-9a-hjkmnp-tv-z]{16,24}$",
   identifier: "CustomFieldDefinitionId"
@@ -46381,6 +46499,25 @@ var EmailChannelError = class extends TaggedError3()("EmailChannelError", Struct
   statusCode: optionalKey2(Union2([Finite.check(isFinite4().annotate({ expected: "a finite number" })), Null2]))
 })) {
 };
+var CustomTrackingCertificate = Struct({
+  reason: Struct({
+    code: Union2([
+      Literal2("initializing"),
+      Literal2("awaiting-hostname"),
+      Literal2("awaiting-dcv"),
+      Literal2("issuing"),
+      Literal2("caa-blocked"),
+      Literal2("validation-error"),
+      Literal2("timed-out"),
+      Literal2("verifying-route"),
+      Literal2("ready"),
+      Literal2("provider-unreachable")
+    ]),
+    message: String4
+  }),
+  lastCheckedAt: Union2([String4, Null2]),
+  nextCheckAt: Union2([String4, Null2])
+}).annotate({ identifier: "CustomTrackingCertificate" });
 var CustomTrackingDnsRecord = Struct({
   name: String4,
   type: String4,
@@ -46567,6 +46704,36 @@ var ExtensionRun = Struct({
   error: Union2([String4, Null2]),
   logs: ArraySchema(String4)
 }).annotate({ identifier: "ExtensionRun" });
+var ExtensionPermissionDiff = Struct({
+  added: ArraySchema(Union2([
+    Literal2("permission:read"),
+    Literal2("permission:update"),
+    Literal2("permission:send"),
+    Literal2("permission:quarantine.read"),
+    Literal2("event:mailbox.message.received"),
+    Literal2("event:mailbox.message.sent"),
+    Literal2("event:mailbox.action.pending_approval"),
+    Literal2("event:mailbox.message.quarantined"),
+    Literal2("event:mailbox.message.released"),
+    Literal2("event:mailbox.message.discarded")
+  ])),
+  removed: ArraySchema(Union2([
+    Literal2("permission:read"),
+    Literal2("permission:update"),
+    Literal2("permission:send"),
+    Literal2("permission:quarantine.read"),
+    Literal2("event:mailbox.message.received"),
+    Literal2("event:mailbox.message.sent"),
+    Literal2("event:mailbox.action.pending_approval"),
+    Literal2("event:mailbox.message.quarantined"),
+    Literal2("event:mailbox.message.released"),
+    Literal2("event:mailbox.message.discarded")
+  ]))
+}).annotate({ identifier: "ExtensionPermissionDiff" });
+var UserId = String4.check(isPattern2(/* @__PURE__ */ new RegExp("^user_[0-9a-hjkmnp-tv-z]{16,24}$", "u")).annotate({
+  expected: "a string matching the RegExp ^user_[0-9a-hjkmnp-tv-z]{16,24}$",
+  identifier: "UserId"
+})).pipe(brand("UserId"));
 var ExtensionBundle = Struct({
   sha256: String4,
   sizeBytes: Finite.check(isInt().annotate({ expected: "an integer" }))
@@ -46617,6 +46784,39 @@ var MailboxPolicyId = String4.check(isPattern2(/* @__PURE__ */ new RegExp("^mbxp
   expected: "a string matching the RegExp ^mbxpol_[0-9a-hjkmnp-tv-z]{16,24}$",
   identifier: "MailboxPolicyId"
 })).pipe(brand("MailboxPolicyId"));
+var OnboardingReviewRequiredError = class extends TaggedError3()("OnboardingReviewRequiredError", Struct({
+  message: String4,
+  code: Union2([
+    Literal2("review_required"),
+    Literal2("review_in_progress"),
+    Literal2("information_required"),
+    Literal2("review_rejected"),
+    Literal2("identity_review_required"),
+    Literal2("identity_review_rejected"),
+    Literal2("identity_changed")
+  ]),
+  decision: Union2([
+    Literal2("undecided"),
+    Literal2("approved"),
+    Literal2("rejected")
+  ]),
+  stage: Union2([
+    Literal2("collecting"),
+    Literal2("automated_review"),
+    Literal2("manual_review"),
+    Literal2("information_requested"),
+    Literal2("complete")
+  ]),
+  nextAction: Union2([
+    Literal2("wait_for_review"),
+    Literal2("provide_information"),
+    Literal2("verify_sending_identity"),
+    Literal2("reapply"),
+    Literal2("contact_support")
+  ]),
+  identityId: optionalKey2(Union2([String4, Null2]))
+})) {
+};
 var MailboxAgentActivity = Struct({
   actions: Struct({
     byType: ArraySchema(Struct({
@@ -46690,10 +46890,6 @@ var MailboxGrantId = String4.check(isPattern2(/* @__PURE__ */ new RegExp("^mbxac
   expected: "a string matching the RegExp ^mbxacl_[0-9a-hjkmnp-tv-z]{16,24}$",
   identifier: "MailboxGrantId"
 })).pipe(brand("MailboxGrantId"));
-var UserId = String4.check(isPattern2(/* @__PURE__ */ new RegExp("^user_[0-9a-hjkmnp-tv-z]{16,24}$", "u")).annotate({
-  expected: "a string matching the RegExp ^user_[0-9a-hjkmnp-tv-z]{16,24}$",
-  identifier: "UserId"
-})).pipe(brand("UserId"));
 var MailboxGrantRole = Union2([
   Literal2("admin"),
   Literal2("collaborator"),
@@ -46800,39 +46996,6 @@ var EmailSender = Union2([Struct({
   email: String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })),
   name: optionalKey2(Union2([String4, Null2]))
 }), Null2]).annotate({ identifier: "EmailSender" });
-var OnboardingReviewRequiredError = class extends TaggedError3()("OnboardingReviewRequiredError", Struct({
-  message: String4,
-  code: Union2([
-    Literal2("review_required"),
-    Literal2("review_in_progress"),
-    Literal2("information_required"),
-    Literal2("review_rejected"),
-    Literal2("identity_review_required"),
-    Literal2("identity_review_rejected"),
-    Literal2("identity_changed")
-  ]),
-  decision: Union2([
-    Literal2("undecided"),
-    Literal2("approved"),
-    Literal2("rejected")
-  ]),
-  stage: Union2([
-    Literal2("collecting"),
-    Literal2("automated_review"),
-    Literal2("manual_review"),
-    Literal2("information_requested"),
-    Literal2("complete")
-  ]),
-  nextAction: Union2([
-    Literal2("wait_for_review"),
-    Literal2("provide_information"),
-    Literal2("verify_sending_identity"),
-    Literal2("reapply"),
-    Literal2("contact_support")
-  ]),
-  identityId: optionalKey2(Union2([String4, Null2]))
-})) {
-};
 var DeliveryUnavailableError = class extends TaggedError3()("DeliveryUnavailableError", Struct({
   message: String4,
   retryAfterSeconds: Finite.check(isFinite4().annotate({ expected: "a finite number" }))
@@ -47300,7 +47463,7 @@ var BrandFooter = Struct({
 }).annotate({ identifier: "BrandFooter" });
 var EmailAttachment = Struct({
   filename: String4,
-  content: optionalKey2(Union2([String4.check(isPattern2(/* @__PURE__ */ new RegExp("^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$", "u")).annotate({ expected: "a string matching the RegExp ^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$" })), Null2])),
+  content: optionalKey2(Union2([String4, Null2])),
   mediaId: optionalKey2(Union2([MediaId, Null2])),
   contentType: String4,
   size: Finite.check(isInt().annotate({ expected: "an integer" })).check(isLessThanOrEqualTo3(26214400).annotate({ expected: "a value less than or equal to 26214400" })).check(isGreaterThan2(0).annotate({ expected: "a value greater than 0" }))
@@ -47727,6 +47890,49 @@ var BlockLogPage = Struct({
   })),
   nextCursor: Union2([String4, Null2])
 }).annotate({ identifier: "BlockLogPage" });
+var ReceivingStatus = Struct({
+  domain: String4,
+  receivingHost: String4,
+  sending: Struct({
+    satisfied: Boolean3,
+    phase: Union2([
+      Literal2("dns-setup"),
+      Literal2("provisioning"),
+      Literal2("verifying"),
+      Literal2("ready"),
+      Literal2("degraded"),
+      Literal2("failed")
+    ])
+  }),
+  destination: Struct({
+    satisfied: Boolean3,
+    endpointId: Union2([WebhookEndpointId, Null2]),
+    forwardingRules: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" })),
+    mailboxes: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" }))
+  }),
+  receiving: Struct({
+    satisfied: Boolean3,
+    catchAll: Boolean3
+  }),
+  mx: Struct({
+    satisfied: Boolean3,
+    state: Union2([
+      Literal2("pointing-here"),
+      Literal2("elsewhere"),
+      Literal2("missing"),
+      Literal2("unknown")
+    ]),
+    expected: Struct({
+      exchange: String4,
+      priority: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" }))
+    }),
+    current: ArraySchema(Struct({
+      exchange: String4,
+      priority: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" }))
+    }))
+  }),
+  ready: Boolean3
+}).annotate({ identifier: "ReceivingStatus" });
 var WebhookEndpoint = Struct({
   id: WebhookEndpointId,
   name: String4,
@@ -47879,6 +48085,7 @@ var CustomTrackingStatus = Struct({
     hostname: String4,
     region: String4,
     sslStatus: Union2([String4, Null2]),
+    certificate: Union2([CustomTrackingCertificate, Null2]),
     dnsRecords: Struct({
       tracking: Union2([CustomTrackingDnsRecord, Null2]),
       dcvDelegation: Union2([CustomTrackingDnsRecord, Null2])
@@ -47967,10 +48174,11 @@ var ForwardingRuleList = Struct({ items: ArraySchema(Struct({
   id: EmailForwardingRuleId,
   name: String4,
   description: Union2([String4, Null2]),
+  domainId: Union2([EmailDomainId, Null2]),
   sourcePattern: Union2([String4, Null2]),
   forwardTo: ArraySchema(String4),
   preserveHeaders: Boolean3,
-  priority: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" })),
+  priority: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" })).check(isLessThanOrEqualTo3(2147483647).annotate({ expected: "a value less than or equal to 2147483647" })),
   isActive: Boolean3,
   forwardCount: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" })),
   failureCount: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" })),
@@ -48071,6 +48279,22 @@ var ExtensionVersionRef = Struct({
   id: ExtensionVersionId,
   version: String4
 }).annotate({ identifier: "ExtensionVersionRef" });
+Struct({
+  version: optionalKey2(Union2([Union2([String4.check(isPattern2(/* @__PURE__ */ new RegExp("^\\d{1,6}\\.\\d{1,6}\\.\\d{1,6}(?:-[0-9A-Za-z.-]{1,64})?$", "u")).annotate({ expected: "a string matching the RegExp ^\\d{1,6}\\.\\d{1,6}\\.\\d{1,6}(?:-[0-9A-Za-z.-]{1,64})?$" })), ExtensionVersionId]), Null2])),
+  acceptPermissions: optionalKey2(Union2([ArraySchema(Union2([
+    Literal2("permission:read"),
+    Literal2("permission:update"),
+    Literal2("permission:send"),
+    Literal2("permission:quarantine.read"),
+    Literal2("event:mailbox.message.received"),
+    Literal2("event:mailbox.message.sent"),
+    Literal2("event:mailbox.action.pending_approval"),
+    Literal2("event:mailbox.message.quarantined"),
+    Literal2("event:mailbox.message.released"),
+    Literal2("event:mailbox.message.discarded")
+  ])), Null2])),
+  dryRun: optionalKey2(Union2([Boolean3, Null2]))
+}).annotate({ identifier: "UpgradeExtensionPayload" });
 var ExtensionRunList = Struct({ items: ArraySchema(ExtensionRunSummary) }).annotate({ identifier: "ExtensionRunList" });
 var ExtensionVersion = Struct({
   id: ExtensionVersionId,
@@ -49334,6 +49558,17 @@ var ExtensionInstallation = Struct({
   updatedAt: String4,
   disabledAt: Union2([String4, Null2])
 }).annotate({ identifier: "ExtensionInstallation" });
+var ExtensionVersionChange = Struct({
+  id: String4,
+  organizationId: OrganizationId,
+  installationId: ExtensionInstallationId,
+  extensionId: ExtensionId,
+  fromVersion: ExtensionVersionRef,
+  toVersion: ExtensionVersionRef,
+  permissionDiff: ExtensionPermissionDiff,
+  changedBy: UserId,
+  changedAt: String4
+}).annotate({ identifier: "ExtensionVersionChange" });
 var Extension = Struct({
   id: ExtensionId,
   name: String4,
@@ -49599,6 +49834,14 @@ var InstallExtensionResponse = Struct({
     webhookSecret: SensitiveString
   }), Null2])
 }).annotate({ identifier: "InstallExtensionResponse" });
+var UpgradeExtensionResponse = Struct({
+  installation: ExtensionInstallation,
+  fromVersion: ExtensionVersionRef,
+  toVersion: ExtensionVersionRef,
+  permissionDiff: ExtensionPermissionDiff,
+  dryRun: Boolean3,
+  versionChange: Union2([ExtensionVersionChange, Null2])
+}).annotate({ identifier: "UpgradeExtensionResponse" });
 var ExtensionPage = Struct({
   items: ArraySchema(Extension),
   nextCursor: Union2([String4, Null2])
@@ -50190,6 +50433,7 @@ var CampaignsScheduleRun422 = Union2([
 ]);
 var CampaignsScheduleRun500 = InternalError;
 var CampaignsScheduleRun502 = ExternalServiceError;
+var CampaignsScheduleRun503 = SenderNotReadyError;
 var CampaignsScheduleRun504 = GatewayTimeoutError;
 var CampaignsGetRunPathParams = Struct({
   id: CampaignId,
@@ -50486,8 +50730,6 @@ var ContactGroupsRemoveMembers422 = ValidationError;
 var ContactGroupsRemoveMembers500 = InternalError;
 var ContactGroupsRemoveMembers504 = GatewayTimeoutError;
 var ContactGroupsPreviewRequestJson = Struct({ criteria: Struct({
-  contactTypes: optionalKey2(Union2([ArraySchema(String4), Null2])),
-  capabilities: optionalKey2(Union2([ArraySchema(String4), Null2])),
   tags: optionalKey2(Union2([ArraySchema(String4), Null2])),
   channels: optionalKey2(Union2([ArraySchema(String4), Null2])),
   match: optionalKey2(Union2([Union2([Literal2("all"), Literal2("any")]), Null2])),
@@ -50502,7 +50744,6 @@ var ContactGroupsPreview200 = Struct({
   sample: ArraySchema(Struct({
     id: ContactId,
     name: String4,
-    type: String4,
     status: String4
   }))
 });
@@ -50697,16 +50938,23 @@ var ContactsBulkDelete504 = GatewayTimeoutError;
 var ContactsBulkImportRequestJson = Struct({
   contacts: ArraySchema(Struct({
     name: String4,
-    email: optionalKey2(Union2([String4, Null2])),
-    phone: optionalKey2(Union2([String4, Null2])),
+    displayName: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
+    avatar: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
+    identities: optionalKey2(Union2([ArraySchema(ContactIdentityInput), Null2])),
+    profile: optionalKey2(Union2([Union2([ContactProfile, Null2]), Null2])),
+    preferences: optionalKey2(Union2([Union2([ContactPreferences, Null2]), Null2])),
     tags: optionalKey2(Union2([ArraySchema(String4), Null2])),
-    firstName: optionalKey2(Union2([String4, Null2])),
-    lastName: optionalKey2(Union2([String4, Null2])),
-    company: optionalKey2(Union2([String4, Null2])),
-    jobTitle: optionalKey2(Union2([String4, Null2])),
-    customFields: optionalKey2(Union2([UnknownRecord, Null2]))
+    status: optionalKey2(Union2([Union2([
+      Literal2("active"),
+      Literal2("paused"),
+      Literal2("blocked"),
+      Literal2("archived")
+    ]), Null2])),
+    statusReason: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
+    externalId: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
+    metadata: optionalKey2(Union2([Union2([JsonObject, Null2]), Null2]))
   })),
-  upsertByEmail: optionalKey2(Union2([Boolean3, Null2]))
+  onConflict: optionalKey2(Union2([Union2([Literal2("skip"), Literal2("update")]), Null2]))
 });
 var ContactsBulkImport200 = Struct({
   total: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" })),
@@ -51367,6 +51615,16 @@ var EmailCompleteCustomTrackingDomainConnect403 = ForbiddenError;
 var EmailCompleteCustomTrackingDomainConnect422 = ValidationError;
 var EmailCompleteCustomTrackingDomainConnect500 = InternalError;
 var EmailCompleteCustomTrackingDomainConnect504 = GatewayTimeoutError;
+var EmailRecheckCustomTrackingPathParams = Struct({ id: EmailDomainId });
+var EmailRecheckCustomTracking200 = CustomTrackingStatus;
+var EmailRecheckCustomTracking401 = UnauthorizedError;
+var EmailRecheckCustomTracking403 = ForbiddenError;
+var EmailRecheckCustomTracking404 = ResourceNotFoundError;
+var EmailRecheckCustomTracking409 = ConflictError;
+var EmailRecheckCustomTracking422 = ValidationError;
+var EmailRecheckCustomTracking500 = InternalError;
+var EmailRecheckCustomTracking502 = EmailChannelError;
+var EmailRecheckCustomTracking504 = GatewayTimeoutError;
 var EmailSetDefaultDomainPathParams = Struct({ id: EmailDomainId });
 var EmailSetDefaultDomain200 = SuccessResult;
 var EmailSetDefaultDomain401 = UnauthorizedError;
@@ -51436,7 +51694,7 @@ var EmailCompleteDomainConnect500 = InternalError;
 var EmailCompleteDomainConnect502 = EmailChannelError;
 var EmailCompleteDomainConnect504 = GatewayTimeoutError;
 var EmailEnableCatchAllPathParams = Struct({ id: EmailDomainId });
-var EmailEnableCatchAllRequestJson = Struct({ endpointId: WebhookEndpointId });
+var EmailEnableCatchAllRequestJson = Struct({ endpointId: optionalKey2(Union2([WebhookEndpointId, Null2])) });
 var EmailEnableCatchAll201 = Struct({ success: Literal2(true) });
 var EmailEnableCatchAll401 = UnauthorizedError;
 var EmailEnableCatchAll403 = ForbiddenError;
@@ -51462,6 +51720,14 @@ var EmailEnableReceiving404 = ResourceNotFoundError;
 var EmailEnableReceiving422 = ValidationError;
 var EmailEnableReceiving500 = InternalError;
 var EmailEnableReceiving504 = GatewayTimeoutError;
+var EmailGetReceivingStatusPathParams = Struct({ id: EmailDomainId });
+var EmailGetReceivingStatus200 = ReceivingStatus;
+var EmailGetReceivingStatus401 = UnauthorizedError;
+var EmailGetReceivingStatus403 = ForbiddenError;
+var EmailGetReceivingStatus404 = ResourceNotFoundError;
+var EmailGetReceivingStatus422 = ValidationError;
+var EmailGetReceivingStatus500 = InternalError;
+var EmailGetReceivingStatus504 = GatewayTimeoutError;
 var EmailDetectRegistrarPathParams = Struct({ id: EmailDomainId });
 var EmailDetectRegistrarRequestJson = Struct({ domain: String4 });
 var EmailDetectRegistrar200 = Struct({
@@ -51607,7 +51873,7 @@ var EmailCreateForwardingRuleRequestJson = Struct({
   preserveHeaders: optionalKey2(Union2([Boolean3, Null2])),
   appendNote: optionalKey2(Union2([String4, Null2])),
   conditions: optionalKey2(Union2([ForwardingConditions, Null2])),
-  priority: optionalKey2(Union2([Finite.check(isFinite4().annotate({ expected: "a finite number" })), Null2])),
+  priority: optionalKey2(Union2([Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" })).check(isLessThanOrEqualTo3(2147483647).annotate({ expected: "a value less than or equal to 2147483647" })), Null2])),
   isActive: optionalKey2(Union2([Boolean3, Null2])),
   metadata: optionalKey2(Union2([Union2([Record(String4, JsonValue), Null2]), Null2]))
 });
@@ -51615,7 +51881,7 @@ var EmailCreateForwardingRule201 = Struct({
   id: EmailForwardingRuleId,
   name: String4,
   forwardTo: ArraySchema(String4),
-  priority: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" })),
+  priority: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" })).check(isLessThanOrEqualTo3(2147483647).annotate({ expected: "a value less than or equal to 2147483647" })),
   isActive: Boolean3,
   createdAt: String4
 });
@@ -51644,7 +51910,7 @@ var EmailUpdateForwardingRuleRequestJson = Struct({
   preserveHeaders: optionalKey2(Union2([Boolean3, Null2])),
   appendNote: optionalKey2(Union2([String4, Null2])),
   conditions: optionalKey2(Union2([Union2([ForwardingConditions, Null2]), Null2])),
-  priority: optionalKey2(Union2([Finite.check(isFinite4().annotate({ expected: "a finite number" })), Null2])),
+  priority: optionalKey2(Union2([Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" })).check(isLessThanOrEqualTo3(2147483647).annotate({ expected: "a value less than or equal to 2147483647" })), Null2])),
   isActive: optionalKey2(Union2([Boolean3, Null2])),
   metadata: optionalKey2(Union2([Union2([Record(String4, JsonValue), Null2]), Null2]))
 });
@@ -51652,7 +51918,7 @@ var EmailUpdateForwardingRule200 = Struct({
   id: EmailForwardingRuleId,
   name: String4,
   forwardTo: ArraySchema(String4),
-  priority: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" })),
+  priority: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" })).check(isLessThanOrEqualTo3(2147483647).annotate({ expected: "a value less than or equal to 2147483647" })),
   isActive: Boolean3,
   updatedAt: String4
 });
@@ -51998,6 +52264,31 @@ var ExtensionInstallationsGetRun404 = ResourceNotFoundError;
 var ExtensionInstallationsGetRun422 = ValidationError;
 var ExtensionInstallationsGetRun500 = InternalError;
 var ExtensionInstallationsGetRun504 = GatewayTimeoutError;
+var ExtensionInstallationsUpgradePathParams = Struct({ id: ExtensionInstallationId });
+var ExtensionInstallationsUpgradeRequestJson = Struct({
+  version: optionalKey2(Union2([Union2([String4.check(isPattern2(/* @__PURE__ */ new RegExp("^\\d{1,6}\\.\\d{1,6}\\.\\d{1,6}(?:-[0-9A-Za-z.-]{1,64})?$", "u")).annotate({ expected: "a string matching the RegExp ^\\d{1,6}\\.\\d{1,6}\\.\\d{1,6}(?:-[0-9A-Za-z.-]{1,64})?$" })), ExtensionVersionId]), Null2])),
+  acceptPermissions: optionalKey2(Union2([ArraySchema(Union2([
+    Literal2("permission:read"),
+    Literal2("permission:update"),
+    Literal2("permission:send"),
+    Literal2("permission:quarantine.read"),
+    Literal2("event:mailbox.message.received"),
+    Literal2("event:mailbox.message.sent"),
+    Literal2("event:mailbox.action.pending_approval"),
+    Literal2("event:mailbox.message.quarantined"),
+    Literal2("event:mailbox.message.released"),
+    Literal2("event:mailbox.message.discarded")
+  ])), Null2])),
+  dryRun: optionalKey2(Union2([Boolean3, Null2]))
+});
+var ExtensionInstallationsUpgrade200 = UpgradeExtensionResponse;
+var ExtensionInstallationsUpgrade401 = UnauthorizedError;
+var ExtensionInstallationsUpgrade403 = ForbiddenError;
+var ExtensionInstallationsUpgrade404 = ResourceNotFoundError;
+var ExtensionInstallationsUpgrade409 = ConflictError;
+var ExtensionInstallationsUpgrade422 = ValidationError;
+var ExtensionInstallationsUpgrade500 = InternalError;
+var ExtensionInstallationsUpgrade504 = GatewayTimeoutError;
 var ExtensionsListQuery = Struct({
   limit: optionalKey2(Union2([String4, Null2])),
   cursor: optionalKey2(Union2([Cursor, Null2])),
@@ -52188,12 +52479,14 @@ var MailboxesApproveActionPathParams = Struct({
 var MailboxesApproveAction200 = MailboxAction;
 var MailboxesApproveAction401 = UnauthorizedError;
 var MailboxesApproveAction402 = PaymentRequiredError;
-var MailboxesApproveAction403 = ForbiddenError;
+var MailboxesApproveAction403 = Union2([ForbiddenError, OnboardingReviewRequiredError]);
 var MailboxesApproveAction404 = ResourceNotFoundError;
 var MailboxesApproveAction409 = ConflictError;
 var MailboxesApproveAction422 = ValidationError;
+var MailboxesApproveAction429 = RateLimitedError;
 var MailboxesApproveAction500 = InternalError;
 var MailboxesApproveAction502 = BillingProviderError;
+var MailboxesApproveAction503 = SenderNotReadyError;
 var MailboxesApproveAction504 = GatewayTimeoutError;
 var MailboxesDenyActionPathParams = Struct({
   id: MailboxId,
@@ -52304,12 +52597,14 @@ var MailboxesSendDraftHeaders = Struct({ "idempotency-key": optionalKey2(Union2(
 var MailboxesSendDraft200 = MailboxSendReceipt;
 var MailboxesSendDraft401 = UnauthorizedError;
 var MailboxesSendDraft402 = PaymentRequiredError;
-var MailboxesSendDraft403 = ForbiddenError;
+var MailboxesSendDraft403 = Union2([ForbiddenError, OnboardingReviewRequiredError]);
 var MailboxesSendDraft404 = ResourceNotFoundError;
 var MailboxesSendDraft409 = ConflictError;
 var MailboxesSendDraft422 = ValidationError;
+var MailboxesSendDraft429 = RateLimitedError;
 var MailboxesSendDraft500 = InternalError;
 var MailboxesSendDraft502 = BillingProviderError;
+var MailboxesSendDraft503 = SenderNotReadyError;
 var MailboxesSendDraft504 = GatewayTimeoutError;
 var MailboxesListEventsPathParams = Struct({ id: MailboxId });
 var MailboxesListEventsQuery = Struct({
@@ -52464,12 +52759,14 @@ var MailboxesSendMessageRequestJson = Struct({
 var MailboxesSendMessage200 = MailboxSendReceipt;
 var MailboxesSendMessage401 = UnauthorizedError;
 var MailboxesSendMessage402 = PaymentRequiredError;
-var MailboxesSendMessage403 = ForbiddenError;
+var MailboxesSendMessage403 = Union2([ForbiddenError, OnboardingReviewRequiredError]);
 var MailboxesSendMessage404 = ResourceNotFoundError;
 var MailboxesSendMessage409 = ConflictError;
 var MailboxesSendMessage422 = ValidationError;
+var MailboxesSendMessage429 = RateLimitedError;
 var MailboxesSendMessage500 = InternalError;
 var MailboxesSendMessage502 = BillingProviderError;
+var MailboxesSendMessage503 = SenderNotReadyError;
 var MailboxesSendMessage504 = GatewayTimeoutError;
 var MailboxesGetMessagePathParams = Struct({
   id: MailboxId,
@@ -52523,12 +52820,14 @@ var MailboxesForwardRequestJson = Struct({
 var MailboxesForward200 = MailboxSendReceipt;
 var MailboxesForward401 = UnauthorizedError;
 var MailboxesForward402 = PaymentRequiredError;
-var MailboxesForward403 = ForbiddenError;
+var MailboxesForward403 = Union2([ForbiddenError, OnboardingReviewRequiredError]);
 var MailboxesForward404 = ResourceNotFoundError;
 var MailboxesForward409 = ConflictError;
 var MailboxesForward422 = ValidationError;
+var MailboxesForward429 = RateLimitedError;
 var MailboxesForward500 = InternalError;
 var MailboxesForward502 = BillingProviderError;
+var MailboxesForward503 = SenderNotReadyError;
 var MailboxesForward504 = GatewayTimeoutError;
 var MailboxesGetMessageRawPathParams = Struct({
   id: MailboxId,
@@ -52568,12 +52867,14 @@ var MailboxesReplyRequestJson = Struct({
 var MailboxesReply200 = MailboxSendReceipt;
 var MailboxesReply401 = UnauthorizedError;
 var MailboxesReply402 = PaymentRequiredError;
-var MailboxesReply403 = ForbiddenError;
+var MailboxesReply403 = Union2([ForbiddenError, OnboardingReviewRequiredError]);
 var MailboxesReply404 = ResourceNotFoundError;
 var MailboxesReply409 = ConflictError;
 var MailboxesReply422 = ValidationError;
+var MailboxesReply429 = RateLimitedError;
 var MailboxesReply500 = InternalError;
 var MailboxesReply502 = BillingProviderError;
+var MailboxesReply503 = SenderNotReadyError;
 var MailboxesReply504 = GatewayTimeoutError;
 var MailboxesReplyAllPathParams = Struct({
   id: MailboxId,
@@ -52590,12 +52891,14 @@ var MailboxesReplyAllRequestJson = Struct({
 var MailboxesReplyAll200 = MailboxSendReceipt;
 var MailboxesReplyAll401 = UnauthorizedError;
 var MailboxesReplyAll402 = PaymentRequiredError;
-var MailboxesReplyAll403 = ForbiddenError;
+var MailboxesReplyAll403 = Union2([ForbiddenError, OnboardingReviewRequiredError]);
 var MailboxesReplyAll404 = ResourceNotFoundError;
 var MailboxesReplyAll409 = ConflictError;
 var MailboxesReplyAll422 = ValidationError;
+var MailboxesReplyAll429 = RateLimitedError;
 var MailboxesReplyAll500 = InternalError;
 var MailboxesReplyAll502 = BillingProviderError;
+var MailboxesReplyAll503 = SenderNotReadyError;
 var MailboxesReplyAll504 = GatewayTimeoutError;
 var MailboxesPausePathParams = Struct({ id: MailboxId });
 var MailboxesPause200 = Mailbox;
@@ -52946,7 +53249,7 @@ var MessagesSend422 = ValidationError;
 var MessagesSend429 = RateLimitedError;
 var MessagesSend500 = InternalError;
 var MessagesSend502 = Union2([BillingProviderError, ExternalServiceError]);
-var MessagesSend503 = DeliveryUnavailableError;
+var MessagesSend503 = Union2([SenderNotReadyError, DeliveryUnavailableError]);
 var MessagesSend504 = GatewayTimeoutError;
 var MessagesGetPathParams = Struct({ id: MessageId });
 var MessagesGet200 = Message;
@@ -53248,6 +53551,7 @@ var ScheduledMessagesResume409 = ConflictError;
 var ScheduledMessagesResume422 = ValidationError;
 var ScheduledMessagesResume500 = InternalError;
 var ScheduledMessagesResume502 = ExternalServiceError;
+var ScheduledMessagesResume503 = SenderNotReadyError;
 var ScheduledMessagesResume504 = GatewayTimeoutError;
 var MessagesValidateEmailRequestJson = Struct({
   conversationId: optionalKey2(Union2([Union2([ConversationId, Null2]), Null2])),
@@ -53265,6 +53569,7 @@ var MessagesValidateEmail403 = ForbiddenError;
 var MessagesValidateEmail404 = ResourceNotFoundError;
 var MessagesValidateEmail422 = ValidationError;
 var MessagesValidateEmail500 = InternalError;
+var MessagesValidateEmail503 = SenderNotReadyError;
 var MessagesValidateEmail504 = GatewayTimeoutError;
 var NamespacesListQuery = Struct({
   limit: optionalKey2(Union2([String4, Null2])),
@@ -55764,6 +56069,7 @@ var CampaignsGroup = class extends make38("Campaigns").add(get5("campaignsList",
     CampaignsScheduleRun422.pipe(status(422)),
     CampaignsScheduleRun500,
     CampaignsScheduleRun502.pipe(status(502)),
+    CampaignsScheduleRun503.pipe(status(503)),
     CampaignsScheduleRun504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "campaigns.scheduleRun").annotate(Summary, "Schedule a campaign run").annotate(Description, "Schedules an email campaign run at the absolute ISO-8601 instant in scheduledFor, or immediately when omitted. The optional idempotencyKey is scoped to the organization and replays return the original run. An email campaign must carry the brand footer: it is refused with CampaignFooterRequiredError when its footer is off and its template renders no BrandFooter, and with BrandAddressRequiredError when a brand that signs it off has no postal address."), get5("campaignsGetRun", "/v1/campaigns/:id/runs/:runId", {
@@ -56109,7 +56415,7 @@ var ContactsGroup = class extends make38("Contacts").add(get5("contactsList", "/
     ContactsBulkImport502.pipe(status(502)),
     ContactsBulkImport504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "contacts.bulkImport").annotate(Summary, "Bulk import contacts").annotate(Description, "Creates or updates contacts in bulk from a list, returning per-entry results with created, updated, skipped, and error counts."), post("contactsBulkUpdateStatus", "/v1/contacts/bulk-update-status", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "contacts.bulkImport").annotate(Summary, "Bulk import contacts").annotate(Description, 'Creates contacts in bulk from a list of entries shaped like a create request, returning per-entry results with created, updated, skipped, and error counts. An entry whose identities match an existing contact is skipped, or updates it with `onConflict: "update"`.'), post("contactsBulkUpdateStatus", "/v1/contacts/bulk-update-status", {
   payload: ContactsBulkUpdateStatusRequestJson,
   success: ContactsBulkUpdateStatus200,
   error: [
@@ -56589,7 +56895,20 @@ var EmailGroup = class extends make38("Email").add(get5("emailListBlocks", "/v1/
     EmailCompleteCustomTrackingDomainConnect500,
     EmailCompleteCustomTrackingDomainConnect504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.completeCustomTrackingDomainConnect").annotate(Summary, "Complete an automatic Custom Tracking Domain return").annotate(Description, "Validates the signed state returned by the DNS provider, then checks the tracking host again. Returning here never marks the host ready or changes which tracking host email uses."), post("emailSetDefaultDomain", "/v1/email/domains/:id/default", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.completeCustomTrackingDomainConnect").annotate(Summary, "Complete an automatic Custom Tracking Domain return").annotate(Description, "Validates the signed state returned by the DNS provider, then checks the tracking host again. Returning here never marks the host ready or changes which tracking host email uses."), post("emailRecheckCustomTracking", "/v1/email/domains/:id/custom-tracking/recheck", {
+  params: EmailRecheckCustomTrackingPathParams,
+  success: EmailRecheckCustomTracking200,
+  error: [
+    EmailRecheckCustomTracking401.pipe(status(401)),
+    EmailRecheckCustomTracking403.pipe(status(403)),
+    EmailRecheckCustomTracking404.pipe(status(404)),
+    EmailRecheckCustomTracking409.pipe(status(409)),
+    EmailRecheckCustomTracking422.pipe(status(422)),
+    EmailRecheckCustomTracking500,
+    EmailRecheckCustomTracking502.pipe(status(502)),
+    EmailRecheckCustomTracking504.pipe(status(504))
+  ]
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.recheckCustomTracking").annotate(Summary, "Recheck a custom tracking domain's certificate").annotate(Description, "Checks the hostname's certificate now instead of waiting for the next scheduled check, and returns the refreshed state. Samva checks a hostname at most once every 30 seconds; a recheck inside that window returns the state from the last check. Returns a conflict when custom tracking is disabled or being torn down."), post("emailSetDefaultDomain", "/v1/email/domains/:id/default", {
   params: EmailSetDefaultDomainPathParams,
   success: EmailSetDefaultDomain200,
   error: [
@@ -56661,7 +56980,7 @@ var EmailGroup = class extends make38("Email").add(get5("emailListBlocks", "/v1/
     EmailBuildDomainConnectApplyUrl502.pipe(status(502)),
     EmailBuildDomainConnectApplyUrl504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.buildDomainConnectApplyUrl").annotate(Summary, "Build a one-click DNS apply URL").annotate(Description, "Builds the signed Domain Connect apply URL for the selected sending-only or sending-and-receiving service. Manual DNS remains available for either mode."), post("emailCompleteDomainConnect", "/v1/email/domains/:id/domain-connect/complete", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.buildDomainConnectApplyUrl").annotate(Summary, "Build a one-click DNS apply URL").annotate(Description, "Builds the signed Domain Connect apply URL for the selected sending-only or sending-and-receiving service. The sending-and-receiving service writes the apex inbound MX, so it is refused until the domain's receiving is enabled. Manual DNS remains available for either mode."), post("emailCompleteDomainConnect", "/v1/email/domains/:id/domain-connect/complete", {
   params: EmailCompleteDomainConnectPathParams,
   payload: EmailCompleteDomainConnectRequestJson,
   success: EmailCompleteDomainConnect200,
@@ -56687,7 +57006,7 @@ var EmailGroup = class extends make38("Email").add(get5("emailListBlocks", "/v1/
     EmailEnableCatchAll502.pipe(status(502)),
     EmailEnableCatchAll504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.enableCatchAll").annotate(Summary, "Enable catch-all receiving").annotate(Description, "Enables catch-all inbound receiving for a domain. `endpointId` is one of the organization's webhook endpoints; every address on the domain delivers `message.received` to it. Responds with 201."), post("emailEnableReceiving", "/v1/email/domains/:id/enable-receiving", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.enableCatchAll").annotate(Summary, "Enable catch-all receiving").annotate(Description, "Enables catch-all inbound receiving for a verified domain. `endpointId` is one of the organization's webhook endpoints; every address on the domain delivers `message.received` to it. Omit it to deliver through forwarding rules alone, which needs at least one active forwarding rule covering the domain. Mail that matches neither a rule nor an endpoint is rejected as an unknown recipient. Responds with 201."), post("emailEnableReceiving", "/v1/email/domains/:id/enable-receiving", {
   params: EmailEnableReceivingPathParams,
   payload: EmailEnableReceivingRequestJson,
   success: EmailEnableReceiving200,
@@ -56699,7 +57018,18 @@ var EmailGroup = class extends make38("Email").add(get5("emailListBlocks", "/v1/
     EmailEnableReceiving500,
     EmailEnableReceiving504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.enableReceiving").annotate(Summary, "Enable inbound email for a domain").annotate(Description, "Enables inbound receiving for a verified domain and returns the recipient addresses it accepts. Set `catchAll` to route every address on the domain; that requires a webhook endpoint, supplied as `endpointId` or already configured on the domain."), post("emailDetectRegistrar", "/v1/email/domains/:id/registrar", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.enableReceiving").annotate(Summary, "Enable inbound email for a domain").annotate(Description, "Enables inbound receiving for a verified domain and returns the recipient addresses it accepts. Set `catchAll` to route every address on the domain; that needs a destination: a webhook endpoint, supplied as `endpointId` or already configured on the domain, or at least one active forwarding rule that covers the domain. Mail that matches neither is rejected, never accepted and dropped."), get5("emailGetReceivingStatus", "/v1/email/domains/:id/receiving-status", {
+  params: EmailGetReceivingStatusPathParams,
+  success: EmailGetReceivingStatus200,
+  error: [
+    EmailGetReceivingStatus401.pipe(status(401)),
+    EmailGetReceivingStatus403.pipe(status(403)),
+    EmailGetReceivingStatus404.pipe(status(404)),
+    EmailGetReceivingStatus422.pipe(status(422)),
+    EmailGetReceivingStatus500,
+    EmailGetReceivingStatus504.pipe(status(504))
+  ]
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.getReceivingStatus").annotate(Summary, "Get receiving setup status").annotate(Description, "Reports each prerequisite for receiving a domain's mail at Samva, in order: sending verified, a destination (a webhook endpoint or an active forwarding rule), receiving enabled, and the inbound MX record. The MX answer is a live DNS lookup that names the current target when mail is routed elsewhere."), post("emailDetectRegistrar", "/v1/email/domains/:id/registrar", {
   params: EmailDetectRegistrarPathParams,
   payload: EmailDetectRegistrarRequestJson,
   success: EmailDetectRegistrar200,
@@ -56847,7 +57177,7 @@ var EmailGroup = class extends make38("Email").add(get5("emailListBlocks", "/v1/
     EmailListForwardingRules500,
     EmailListForwardingRules504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.listForwardingRules").annotate(Summary, "List forwarding rules").annotate(Description, "Returns every inbound email forwarding rule, highest priority first, optionally filtered by domain and active state. An organization holds at most 100, so the list is never paged."), post("emailCreateForwardingRule", "/v1/email/forwarding", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.listForwardingRules").annotate(Summary, "List forwarding rules").annotate(Description, "Returns every inbound email forwarding rule in the order inbound mail is matched against them: highest priority first, then an exact address before a wildcard pattern at equal priority, then oldest first. The first rule that matches is the one that forwards. Filtering by domain returns that domain's rules and the rules that apply to every domain (domainId null). An organization holds at most 100, so the list is never paged."), post("emailCreateForwardingRule", "/v1/email/forwarding", {
   payload: EmailCreateForwardingRuleRequestJson,
   success: EmailCreateForwardingRule201.pipe(status(201)),
   error: [
@@ -56859,7 +57189,7 @@ var EmailGroup = class extends make38("Email").add(get5("emailListBlocks", "/v1/
     EmailCreateForwardingRule500,
     EmailCreateForwardingRule504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.createForwardingRule").annotate(Summary, "Create a forwarding rule").annotate(Description, "Creates an inbound email forwarding rule and returns it. Responds with 201. An organization holds at most 100 forwarding rules."), del("emailDeleteForwardingRule", "/v1/email/forwarding/:id", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "email.createForwardingRule").annotate(Summary, "Create a forwarding rule").annotate(Description, "Creates an inbound email forwarding rule and returns it. Responds with 201. Priority is a non-negative integer, default 0; higher priority rules are tried first, and at equal priority an exact address outranks a wildcard pattern. An organization holds at most 100 forwarding rules."), del("emailDeleteForwardingRule", "/v1/email/forwarding/:id", {
   params: EmailDeleteForwardingRulePathParams,
   success: EmailDeleteForwardingRule200,
   error: [
@@ -57167,7 +57497,20 @@ var ExtensionInstallationsGroup = class extends make38("Extension installations"
     ExtensionInstallationsGetRun500,
     ExtensionInstallationsGetRun504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "extensionInstallations.getRun").annotate(Summary, "Get a hosted run").annotate(Description, "Returns one retained run with the lines its handler logged: at most 50 lines of 500 characters.")).annotate(Description, "Extension versions installed into the organization, each acting as its own principal") {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "extensionInstallations.getRun").annotate(Summary, "Get a hosted run").annotate(Description, "Returns one retained run with the lines its handler logged: at most 50 lines of 500 characters."), post("extensionInstallationsUpgrade", "/v1/extension-installations/:id/upgrade", {
+  params: ExtensionInstallationsUpgradePathParams,
+  payload: ExtensionInstallationsUpgradeRequestJson,
+  success: ExtensionInstallationsUpgrade200,
+  error: [
+    ExtensionInstallationsUpgrade401.pipe(status(401)),
+    ExtensionInstallationsUpgrade403.pipe(status(403)),
+    ExtensionInstallationsUpgrade404.pipe(status(404)),
+    ExtensionInstallationsUpgrade409.pipe(status(409)),
+    ExtensionInstallationsUpgrade422.pipe(status(422)),
+    ExtensionInstallationsUpgrade500,
+    ExtensionInstallationsUpgrade504.pipe(status(504))
+  ]
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "extensionInstallations.upgrade").annotate(Summary, "Upgrade or roll back an installation").annotate(Description, "Changes the pinned version in place. Omit version for the latest publication, or name a version string or id, including an older version to roll back. Preview with dryRun; changing requires acceptPermissions to list exactly the added permission: and event: grants. Only a person can upgrade. Credentials, owner, scope, send mode, and status stay attached to the installation.")).annotate(Description, "Extension versions installed into the organization, each acting as its own principal") {
 };
 var ExtensionsGroup = class extends make38("Extensions").add(get5("extensionsList", "/v1/extensions", {
   query: ExtensionsListQuery,
@@ -57321,8 +57664,10 @@ var MailboxesGroup = class extends make38("Mailboxes").add(get5("mailboxesList",
     MailboxesApproveAction404.pipe(status(404)),
     MailboxesApproveAction409.pipe(status(409)),
     MailboxesApproveAction422.pipe(status(422)),
+    MailboxesApproveAction429.pipe(status(429)),
     MailboxesApproveAction500,
     MailboxesApproveAction502.pipe(status(502)),
+    MailboxesApproveAction503.pipe(status(503)),
     MailboxesApproveAction504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.approveAction").annotate(Summary, "Approve a mailbox action").annotate(Description, "Approves an action waiting for approval, executes it, and returns the executed action. Only a person signed in or through OAuth may approve, and never the one who proposed it."), post("mailboxesDenyAction", "/v1/mailboxes/:id/actions/:actionId/deny", {
@@ -57420,8 +57765,10 @@ var MailboxesGroup = class extends make38("Mailboxes").add(get5("mailboxesList",
     MailboxesSendDraft404.pipe(status(404)),
     MailboxesSendDraft409.pipe(status(409)),
     MailboxesSendDraft422.pipe(status(422)),
+    MailboxesSendDraft429.pipe(status(429)),
     MailboxesSendDraft500,
     MailboxesSendDraft502.pipe(status(502)),
+    MailboxesSendDraft503.pipe(status(503)),
     MailboxesSendDraft504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.sendDraft").annotate(Summary, "Send a draft").annotate(Description, "Sends one of the caller's drafts: a reply draft in its thread, any other draft as a new conversation. A draft needs recipients, a subject, and a body."), get5("mailboxesListEvents", "/v1/mailboxes/:id/events", {
@@ -57556,8 +57903,10 @@ var MailboxesGroup = class extends make38("Mailboxes").add(get5("mailboxesList",
     MailboxesSendMessage404.pipe(status(404)),
     MailboxesSendMessage409.pipe(status(409)),
     MailboxesSendMessage422.pipe(status(422)),
+    MailboxesSendMessage429.pipe(status(429)),
     MailboxesSendMessage500,
     MailboxesSendMessage502.pipe(status(502)),
+    MailboxesSendMessage503.pipe(status(503)),
     MailboxesSendMessage504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.sendMessage").annotate(Summary, "Send a new message").annotate(Description, "Starts a new conversation from the mailbox's default From address. `status` is `sent`, or `pending_approval` when the caller's grant or a mailbox policy holds sends for a person's approval; a policy that denies sends refuses it with 403."), get5("mailboxesGetMessage", "/v1/mailboxes/:id/messages/:messageId", {
@@ -57607,8 +57956,10 @@ var MailboxesGroup = class extends make38("Mailboxes").add(get5("mailboxesList",
     MailboxesForward404.pipe(status(404)),
     MailboxesForward409.pipe(status(409)),
     MailboxesForward422.pipe(status(422)),
+    MailboxesForward429.pipe(status(429)),
     MailboxesForward500,
     MailboxesForward502.pipe(status(502)),
+    MailboxesForward503.pipe(status(503)),
     MailboxesForward504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.forward").annotate(Summary, "Forward a message").annotate(Description, "Forwards the message to new recipients as a new conversation, with the original quoted below the caller's text and its attachments attached ahead of any the caller adds. The combined attachments must fit the email attachment limits."), get5("mailboxesGetMessageRaw", "/v1/mailboxes/:id/messages/:messageId/raw", {
@@ -57646,8 +57997,10 @@ var MailboxesGroup = class extends make38("Mailboxes").add(get5("mailboxesList",
     MailboxesReply404.pipe(status(404)),
     MailboxesReply409.pipe(status(409)),
     MailboxesReply422.pipe(status(422)),
+    MailboxesReply429.pipe(status(429)),
     MailboxesReply500,
     MailboxesReply502.pipe(status(502)),
+    MailboxesReply503.pipe(status(503)),
     MailboxesReply504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.reply").annotate(Summary, "Reply to a message").annotate(Description, "Replies to the message's Reply-To address, or its sender, in the same thread. The server sets the recipients, subject, and threading headers."), post("mailboxesReplyAll", "/v1/mailboxes/:id/messages/:messageId/reply-all", {
@@ -57662,8 +58015,10 @@ var MailboxesGroup = class extends make38("Mailboxes").add(get5("mailboxesList",
     MailboxesReplyAll404.pipe(status(404)),
     MailboxesReplyAll409.pipe(status(409)),
     MailboxesReplyAll422.pipe(status(422)),
+    MailboxesReplyAll429.pipe(status(429)),
     MailboxesReplyAll500,
     MailboxesReplyAll502.pipe(status(502)),
+    MailboxesReplyAll503.pipe(status(503)),
     MailboxesReplyAll504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.replyAll").annotate(Summary, "Reply to all recipients of a message").annotate(Description, "Replies to the sender and every other recipient of the message except the mailbox itself, in the same thread."), post("mailboxesPause", "/v1/mailboxes/:id/pause", {
@@ -57900,7 +58255,7 @@ var MediaGroup = class extends make38("Media").add(post("mediaCreate", "/v1/medi
     MediaCreate500,
     MediaCreate504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "media.create").annotate(Summary, "Create a media object").annotate(Description, "Creates the media object in the pending state and returns it with the upload instruction \u2014 URL, method, and headers \u2014 for putting its bytes into storage."), get5("mediaGetById", "/v1/media/:id", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "media.create").annotate(Summary, "Create a media object").annotate(Description, "Creates the media object in the pending state and returns it with the upload instruction \u2014 URL, method, and headers \u2014 for putting its bytes into storage. Requires `messages:create`, or `email:send` for `attachment` media."), get5("mediaGetById", "/v1/media/:id", {
   params: MediaGetByIdPathParams,
   success: MediaGetById200,
   error: [
@@ -57933,7 +58288,7 @@ var MediaGroup = class extends make38("Media").add(post("mediaCreate", "/v1/medi
     MediaComplete500,
     MediaComplete504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "media.complete").annotate(Summary, "Complete a media upload").annotate(Description, "Verifies the uploaded object exists in storage, marks the media object ready, and returns it with a download URL."), get5("mediaDownloadUrl", "/v1/media/:id/url", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "media.complete").annotate(Summary, "Complete a media upload").annotate(Description, "Verifies the uploaded object exists in storage, marks the media object ready, and returns it with a download URL. Requires the permission that creating the media object did."), get5("mediaDownloadUrl", "/v1/media/:id/url", {
   params: MediaDownloadUrlPathParams,
   success: MediaDownloadUrl200,
   error: [
@@ -58062,6 +58417,7 @@ var MessagesGroup = class extends make38("Messages").add(get5("messagesList", "/
     MessagesValidateEmail404.pipe(status(404)),
     MessagesValidateEmail422.pipe(status(422)),
     MessagesValidateEmail500,
+    MessagesValidateEmail503.pipe(status(503)),
     MessagesValidateEmail504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "messages.validateEmail").annotate(Summary, "Validate an email message").annotate(Description, "Resolves recipients, sender, and inline or published-template content without sending anything, creating contacts or messages, or counting toward your quota.")).annotate(Description, "Send messages and read their delivery state and timeline.") {
@@ -58123,6 +58479,7 @@ var ScheduledMessagesGroup = class extends make38("Scheduled Messages").add(get5
     ScheduledMessagesResume422.pipe(status(422)),
     ScheduledMessagesResume500,
     ScheduledMessagesResume502.pipe(status(502)),
+    ScheduledMessagesResume503.pipe(status(503)),
     ScheduledMessagesResume504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "scheduledMessages.resume").annotate(Summary, "Resume a review-paused scheduled message").annotate(Description, "Explicitly resumes a scheduled message after onboarding review clearance. An overdue message requires either send_now or a new future scheduledFor value.")).annotate(Description, "One-off scheduled message timers") {
@@ -58171,7 +58528,7 @@ var NamespacesGroup = class extends make38("Namespaces").add(get5("namespacesLis
     NamespacesRemove500,
     NamespacesRemove504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "namespaces.remove").annotate(Summary, "Delete a namespace").annotate(Description, "Deletes an empty namespace. A namespace that still holds mailboxes or API keys conflicts: remove or move them first."), patch("namespacesUpdate", "/v1/namespaces/:id", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "namespaces.remove").annotate(Summary, "Delete a namespace").annotate(Description, "Deletes an empty namespace. A namespace that still holds mailboxes, API keys, or webhook endpoints conflicts: remove them first."), patch("namespacesUpdate", "/v1/namespaces/:id", {
   params: NamespacesUpdatePathParams,
   payload: NamespacesUpdateRequestJson,
   success: NamespacesUpdate200,
@@ -58933,7 +59290,18 @@ var make39 = (config) => gen2(function* () {
   for (const [name, value] of Object.entries(config.headers ?? {}))
     if (value !== undefined)
       headers[name] = value;
+  const storage = yield* HttpClient;
+  const putUpload = (input) => storage.execute(make33(input.method)(input.url).pipe(bodyUint8Array(input.bytes, uploadContentType(input.headers)), setHeaders(input.headers))).pipe(mapError2((cause) => new MediaUploadError({
+    filename: input.filename,
+    mediaId: input.mediaId,
+    cause
+  })), flatMap3((response) => response.status >= 200 && response.status < 300 ? void_3 : fail6(new MediaUploadError({
+    filename: input.filename,
+    mediaId: input.mediaId,
+    status: response.status
+  }))));
   return Service3.of({
+    putUpload,
     raw,
     operation: (name) => flat[name],
     connection: {
@@ -58949,7 +59317,7 @@ var layer16 = (config) => effect(Service3, make39(config));
 var layerFetch = (config) => layer16(config).pipe(provide2(layer15));
 var raw2 = map7(Service3, (client) => client.raw);
 
-// ../sdk/dist/categories-DvsHUJtX.js
+// ../sdk/dist/categories-Bcwq5jPV.js
 var SamvaErrorMetadata = {
   AnalyticsQueryError: {
     categories: [],
@@ -59015,6 +59383,10 @@ var SamvaErrorMetadata = {
     categories: ["notFound"],
     retryable: false
   },
+  SenderNotReadyError: {
+    categories: ["transient"],
+    retryable: true
+  },
   UnauthorizedError: {
     categories: ["auth"],
     retryable: false
@@ -59110,7 +59482,7 @@ var generateIdempotencyKey = gen2(function* () {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 });
 
-// ../sdk/dist/operation-BuyvAsZ1.js
+// ../sdk/dist/operation-B_Ty1LG-.js
 var SDK_OPERATION_CALLS = {
   brandsList: { kind: "none" },
   brandsCreate: { kind: "payload" },
@@ -59308,6 +59680,10 @@ var SDK_OPERATION_CALLS = {
     kind: "pathPayload",
     paths: ["id"]
   },
+  emailGetReceivingStatus: {
+    kind: "path",
+    paths: ["id"]
+  },
   emailEnableCustomTracking: {
     kind: "pathPayload",
     paths: ["id"]
@@ -59316,6 +59692,10 @@ var SDK_OPERATION_CALLS = {
     kind: "path",
     paths: ["id"]
   },
+  emailRecheckCustomTracking: {
+    kind: "path",
+    paths: ["id"]
+  },
   emailGetCustomTrackingDomainConnect: {
     kind: "path",
     paths: ["id"]
@@ -60032,6 +60412,10 @@ var SDK_OPERATION_CALLS = {
   },
   extensionInstallationsList: { kind: "params" },
   extensionInstallationsInstall: { kind: "payload" },
+  extensionInstallationsUpgrade: {
+    kind: "pathPayload",
+    paths: ["id"]
+  },
   extensionInstallationsGet: {
     kind: "path",
     paths: ["id"]
@@ -60208,11 +60592,35 @@ var make40 = (operationName) => {
   }
   return operation;
 };
+var uploadOversizedAttachments = (client, payload) => gen2(function* () {
+  const plan = planInlineUploads(payload);
+  if (plan.length === 0)
+    return payload;
+  const uploaded = /* @__PURE__ */ new Map;
+  for (const upload of plan) {
+    const created = yield* rawOperation(client, "mediaCreate")({ payload: mediaCreateBody(upload) });
+    yield* client.putUpload({
+      filename: upload.filename,
+      mediaId: created.id,
+      url: created.upload.url,
+      method: created.upload.method,
+      headers: created.upload.headers,
+      bytes: upload.bytes
+    });
+    yield* rawOperation(client, "mediaComplete")({ params: { id: created.id } });
+    uploaded.set(upload.index, {
+      mediaId: created.id,
+      upload
+    });
+  }
+  return withUploadedAttachments(payload, uploaded);
+});
 var sendPayload = (payload, options) => gen2(function* () {
   const client = yield* Service3;
   const idempotencyKey = options?.idempotencyKey ?? (yield* generateIdempotencyKey);
+  const prepared = yield* uploadOversizedAttachments(client, payload);
   return yield* withRetry(rawOperation(client, "messagesSend")({
-    payload: stripUndefined(payload),
+    payload: stripUndefined(prepared),
     headers: { "idempotency-key": idempotencyKey }
   }));
 });
@@ -60357,8 +60765,10 @@ var getDomainConnect = make40("emailGetDomainConnect");
 var buildDomainConnectApplyUrl = make40("emailBuildDomainConnectApplyUrl");
 var completeDomainConnect = make40("emailCompleteDomainConnect");
 var enableReceiving = make40("emailEnableReceiving");
+var getReceivingStatus = make40("emailGetReceivingStatus");
 var enableCustomTracking = make40("emailEnableCustomTracking");
 var getCustomTracking = make40("emailGetCustomTracking");
+var recheckCustomTracking = make40("emailRecheckCustomTracking");
 var getCustomTrackingDomainConnect = make40("emailGetCustomTrackingDomainConnect");
 var buildCustomTrackingDomainConnectApplyUrl = make40("emailBuildCustomTrackingDomainConnectApplyUrl");
 var completeCustomTrackingDomainConnect = make40("emailCompleteCustomTrackingDomainConnect");
@@ -60403,6 +60813,7 @@ var getForwardingLog = make40("emailGetForwardingLog");
 // ../sdk/dist/effect/extension-installations.js
 var list9 = make40("extensionInstallationsList");
 var install = make40("extensionInstallationsInstall");
+var upgrade = make40("extensionInstallationsUpgrade");
 var get11 = make40("extensionInstallationsGet");
 var uninstall = make40("extensionInstallationsUninstall");
 var disable = make40("extensionInstallationsDisable");
@@ -60420,7 +60831,7 @@ var getVersion = make40("extensionsGetVersion");
 // ../sdk/dist/effect/feedback.js
 var send2 = make40("feedbackSend");
 
-// ../sdk/dist/mailbox-events-CcWm8lO4.js
+// ../sdk/dist/mailbox-events-CsbF35vH.js
 var MAILBOX_EVENT_STREAM_PATH = "/v1/mailboxes/events";
 var MailboxEventStreamCloseCode = {
   invalidFrame: 4400,
@@ -60470,8 +60881,10 @@ var RETRY_MAX_MILLIS = 30000;
 var RETRY_AFTER_MAX_MILLIS = 300000;
 var REFUSAL_BODY_LIMIT = 65536;
 var DIAGNOSE_TIMEOUT_MILLIS = 1e4;
-var MAILBOX_EVENT_STREAM_IDLE_MILLIS = 90000;
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var MAILBOX_EVENT_STREAM_PING_FRAME = '{"kind":"ping"}';
+var MAILBOX_EVENT_STREAM_PING_MILLIS = 30000;
+var MAILBOX_EVENT_STREAM_IDLE_MILLIS = 3 * MAILBOX_EVENT_STREAM_PING_MILLIS;
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var frameText = (raw) => {
   if (typeof raw === "string")
     return raw;
@@ -60488,14 +60901,16 @@ var decodeFrame = (raw) => {
   } catch {
     return;
   }
-  if (!isRecord(parsed) || typeof parsed.cursor !== "string")
+  if (isRecord2(parsed) && parsed.kind === "pong")
+    return { kind: "pong" };
+  if (!isRecord2(parsed) || typeof parsed.cursor !== "string")
     return;
-  if (parsed.kind === "live" || parsed.kind === "heartbeat")
+  if (parsed.kind === "live" || parsed.kind === "progress")
     return {
       kind: parsed.kind,
       cursor: parsed.cursor
     };
-  if (parsed.kind !== "event" || typeof parsed.id !== "string" || !isRecord(parsed.event))
+  if (parsed.kind !== "event" || typeof parsed.id !== "string" || !isRecord2(parsed.event))
     return;
   const { type, timestamp, data } = parsed.event;
   if (typeof type !== "string" || typeof timestamp !== "string")
@@ -60593,7 +61008,7 @@ var closeOutcome = (closeCode) => {
   }
 };
 var fieldsOf = (value) => {
-  if (!isRecord(value))
+  if (!isRecord2(value))
     return;
   const fields = {};
   for (const [path, messages] of Object.entries(value))
@@ -60602,7 +61017,7 @@ var fieldsOf = (value) => {
   return fields;
 };
 var refusalOutcome = (refusal) => {
-  const body = isRecord(refusal.body) ? refusal.body : {};
+  const body = isRecord2(refusal.body) ? refusal.body : {};
   const serverTag = typeof body._tag === "string" ? body._tag : undefined;
   const known = serverTag !== undefined && REFUSAL_TAGS.has(serverTag);
   const _tag = known ? serverTag : REFUSAL_TAG_BY_STATUS[refusal.status] ?? "StreamRefusedError";
@@ -60831,6 +61246,7 @@ var MailboxEventStream = class {
       let opened = false;
       let settled = false;
       let idleTimer;
+      let pingTimer;
       const armIdle = () => {
         clearTimeout(idleTimer);
         idleTimer = setTimeout(() => {
@@ -60846,6 +61262,7 @@ var MailboxEventStream = class {
           return;
         settled = true;
         clearTimeout(idleTimer);
+        clearInterval(pingTimer);
         this.#stop.signal.removeEventListener("abort", onStop);
         if (this.#socket === socket)
           this.#socket = undefined;
@@ -60868,6 +61285,10 @@ var MailboxEventStream = class {
       armIdle();
       socket.addEventListener("open", () => {
         opened = true;
+        pingTimer = setInterval(() => {
+          if (socket.readyState === OPEN)
+            socket.send(MAILBOX_EVENT_STREAM_PING_FRAME);
+        }, MAILBOX_EVENT_STREAM_PING_MILLIS);
       });
       socket.addEventListener("message", (message) => {
         if (this.#ended)
@@ -60884,13 +61305,15 @@ var MailboxEventStream = class {
           socket.close(1000);
           return;
         }
+        if (frame.kind === "pong")
+          return;
         if (frame.kind === "event") {
           this.#queue.push({
             cursor: frame.cursor,
             id: frame.id,
             type: frame.event.type,
             timestamp: frame.event.timestamp,
-            data: isRecord(frame.event.data) ? frame.event.data : {}
+            data: isRecord2(frame.event.data) ? frame.event.data : {}
           });
           this.#wake();
           return;
@@ -60994,7 +61417,7 @@ var readRefusalBody = async (response) => {
   }
 };
 
-// ../sdk/dist/mailboxes-4gJMAJh4.js
+// ../sdk/dist/mailboxes-D3Kx7elM.js
 var toStreamError = (cause) => cause instanceof MailboxEventStreamError ? cause : new MailboxEventStreamError({
   _tag: "StreamDisconnectedError",
   message: String(cause)
@@ -61279,6 +61702,7 @@ var apiStatuses = {
   BillingProviderError: 502,
   DeliveryUnavailableError: 503,
   ServiceUnavailableError: 503,
+  SenderNotReadyError: 503,
   EmailChannelError: 502,
   SmsChannelError: 502,
   WhatsAppChannelError: 502,
@@ -61316,6 +61740,9 @@ var apiErrorGuidance = (error) => {
     case "ServiceUnavailableError":
       next = typeof details.retryAfterSeconds === "number" ? `Wait ${details.retryAfterSeconds} seconds before retrying.` : "Wait a moment before retrying.";
       break;
+    case "SenderNotReadyError":
+      next = typeof details.retryAfterSeconds === "number" ? `Wait ${details.retryAfterSeconds} seconds before retrying.` : "Wait for the sending identity to be ready before retrying.";
+      break;
     case "CursorExpiredError":
       next = "Read current state from the API, then retry without the cursor.";
       break;
@@ -61412,7 +61839,7 @@ var commandTree = {
       check: {},
       remove: {},
       "rotate-dkim": {},
-      "custom-tracking": { enable: {}, status: {}, disable: {} }
+      "custom-tracking": { enable: {}, status: {}, recheck: {}, disable: {} }
     },
     senders: { list: {}, add: {}, check: {}, remove: {} }
   },
@@ -61462,10 +61889,16 @@ var commandTree = {
     events: {},
     list: {},
     create: {},
+    get: {},
+    update: {},
+    pause: {},
+    resume: {},
+    remove: {},
     threads: {},
     read: {},
     send: {},
     reply: {},
+    actions: { list: {}, approve: {}, deny: {} },
     quarantine: { list: {}, release: {}, discard: {} }
   },
   extensions: {
@@ -63282,7 +63715,10 @@ var printCustomTracking = (data) => gen2(function* () {
     ["Host", custom.hostname],
     ["Region", custom.region],
     ["Certificate", custom.sslStatus ?? "pending"],
-    ["CAA blocked", custom.caaBlocked ? "yes" : "no"]
+    ["CAA blocked", custom.caaBlocked ? "yes" : "no"],
+    ["Reason", custom.certificate?.reason.message],
+    ["Last checked", custom.certificate?.lastCheckedAt],
+    ["Next check", custom.certificate?.nextCheckAt]
   ]);
   yield* log(`
 Create these DNS records:`);
@@ -63334,6 +63770,16 @@ var customStatus = make29("status", {
     return yield* printJson(data);
   yield* printCustomTracking(data);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
+var customRecheck = make29("recheck", {
+  id: String10("id").pipe(withDescription4("Domain id to recheck")),
+  json: jsonFlag
+}).pipe(withDescription3("Check a domain's custom tracking certificate now instead of waiting for the next scheduled check"), withExamples([{ command: "samva email domains custom-tracking recheck dom_abc123" }]), withHandler(({ id, json }) => gen2(function* () {
+  const client = yield* getClientProvider;
+  const data = yield* recheckCustomTracking({ id }).pipe(client.provide, mapError2((error) => toCliApiError("Could not recheck custom tracking", error)));
+  if (json)
+    return yield* printJson(data);
+  yield* printCustomTracking(data);
+}).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var customDisable = make29("disable", {
   id: String10("id").pipe(withDescription4("Domain id to disable custom tracking for")),
   dryRun: Boolean6("dry-run").pipe(withDescription2("Print the teardown plan without calling the API"), withDefault5(false)),
@@ -63358,50 +63804,106 @@ var customDisable = make29("disable", {
     return yield* printJson(data);
   yield* log(`Disabled custom tracking for ${id}.`);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var customTracking = make29("custom-tracking").pipe(withDescription3("Manage a domain's custom tracking (custom open/click subdomain)"), withExamples([{ command: "samva email domains custom-tracking enable dom_abc123" }]), withSubcommands([customEnable, customStatus, customDisable]));
+var customTracking = make29("custom-tracking").pipe(withDescription3("Manage a domain's custom tracking (custom open/click subdomain)"), withExamples([{ command: "samva email domains custom-tracking enable dom_abc123" }]), withSubcommands([customEnable, customStatus, customRecheck, customDisable]));
 var domainsCommand = make29("domains").pipe(withDescription3("Manage email sending domains"), withExamples([
   { command: "samva email domains list", description: "List configured domains" }
 ]), withSubcommands([list21, add2, check2, rotateDkim, remove16, customTracking]));
 
 // src/commands/email/receiving.ts
+var destinationLabel = (destination) => {
+  const parts = [
+    destination.endpointId === null ? [] : [`webhook ${destination.endpointId}`],
+    destination.forwardingRules === 0 ? [] : [
+      `${destination.forwardingRules} forwarding rule${destination.forwardingRules === 1 ? "" : "s"}`
+    ],
+    destination.mailboxes === 0 ? [] : [`${destination.mailboxes} mailbox${destination.mailboxes === 1 ? "" : "es"}`]
+  ].flat();
+  return parts.length === 0 ? "none (add a webhook endpoint or a forwarding rule)" : parts.join(", ");
+};
+var mxLabel = (mx) => {
+  switch (mx.state) {
+    case "pointing-here":
+      return `points at ${mx.expected.exchange}`;
+    case "elsewhere":
+      return `routes mail to ${mx.current[0]?.exchange ?? "another provider"}; set it to ${mx.expected.exchange}`;
+    case "missing":
+      return `no MX record; add ${mx.expected.exchange}`;
+    default:
+      return "could not be looked up; try again";
+  }
+};
 var status2 = make29("status", {
   domainId: String10("domain-id").pipe(withDescription4("Sending domain id")),
   json: jsonFlag
-}).pipe(withDescription3("Get a domain's receiving prerequisite status"), withExamples([{ command: "samva email receiving status dom_abc123 --json" }]), withHandler(({ domainId, json }) => gen2(function* () {
+}).pipe(withDescription3("Report each prerequisite for receiving a domain's mail at Samva, in order, with a live MX lookup"), withExamples([{ command: "samva email receiving status dom_abc123 --json" }]), withHandler(({ domainId, json }) => gen2(function* () {
   const client = yield* getClientProvider;
-  const data = yield* getDomainVerification({ id: domainId }).pipe(client.provide, mapError2((error) => toCliApiError("Could not get receiving status", error)));
+  const data = yield* getReceivingStatus({ id: domainId }).pipe(client.provide, mapError2((error) => toCliApiError("Could not get receiving status", error)));
   if (json)
     return yield* printJson(data);
+  const mark = (satisfied) => satisfied ? "done" : "todo";
   yield* printFields([
     ["Domain", data.domain],
-    ["Phase", data.phase]
+    ["1. Sending", `${mark(data.sending.satisfied)} (${data.sending.phase})`],
+    [
+      "2. Destination",
+      `${mark(data.destination.satisfied)} ${destinationLabel(data.destination)}`
+    ],
+    [
+      "3. Receiving",
+      `${mark(data.receiving.satisfied)}${data.receiving.catchAll ? " (catch-all)" : ""}`
+    ],
+    [`4. Inbound MX`, `${mark(data.mx.satisfied)} ${data.receivingHost} ${mxLabel(data.mx)}`],
+    ["Ready", data.ready ? "yes" : "no"]
   ]);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var enable2 = make29("enable", {
   domainId: String10("domain-id").pipe(withDescription4("Sending domain id")),
   domain: String9("domain").pipe(withDescription2("Verified domain name")),
-  address: String9("address").pipe(withDescription2("Recipient address to receive (repeatable)"), atLeast2(1)),
-  catchAll: Boolean6("catch-all").pipe(withDescription2("Also receive unmatched addresses"), withDefault5(false)),
+  address: String9("address").pipe(withDescription2("Exact recipient address to receive (repeatable)"), atLeast2(0)),
+  catchAll: Boolean6("catch-all").pipe(withDescription2("Receive every address on the domain. Needs --endpoint or an active forwarding rule that covers the domain"), withDefault5(false)),
+  endpoint: String9("endpoint").pipe(withDescription2("Webhook endpoint id that receives message.received for a catch-all domain"), optional4),
   dryRun: Boolean6("dry-run").pipe(withDescription2("Print the provider setup request without calling the API"), withDefault5(false)),
   json: jsonFlag
-}).pipe(withDescription3("Enable inbound receiving for a verified domain"), withExamples([
+}).pipe(withDescription3("Enable inbound receiving for a verified domain. Receiving needs somewhere to deliver: exact addresses are accepted, and a catch-all needs a webhook endpoint or a forwarding rule"), withExamples([
+  {
+    command: "samva email receiving enable dom_abc123 --domain example.com --catch-all --endpoint wep_abc123"
+  },
+  {
+    command: "samva email receiving enable dom_abc123 --domain example.com --catch-all"
+  },
   {
     command: "samva email receiving enable dom_abc123 --domain example.com --address replies@example.com --dry-run"
   },
   {
     command: "samva email receiving enable dom_abc123 --domain example.com --address replies@example.com"
   }
-]), withHandler(({ domainId, domain, address, catchAll, dryRun, json }) => gen2(function* () {
-  const request = { domain, catchAll, addresses: [...address] };
+]), withHandler(({ domainId, domain, address, catchAll, endpoint, dryRun, json }) => gen2(function* () {
+  if (address.length === 0 && !catchAll) {
+    return yield* new SamvaCliError({
+      message: "Pass --address for each exact recipient, or --catch-all for the whole domain."
+    });
+  }
+  const endpointId = getOrUndefined(endpoint);
+  if (endpointId !== undefined && !catchAll) {
+    return yield* new SamvaCliError({
+      message: "--endpoint names the catch-all webhook, so it needs --catch-all."
+    });
+  }
+  const request = {
+    domain,
+    catchAll,
+    addresses: [...address],
+    ...endpointId === undefined ? {} : { endpointId }
+  };
   if (dryRun)
-    return yield* json ? printJson({ dryRun: true, action: "email.receiving.enable", domainId, request }) : log(`[dry-run] Would enable receiving for ${domain} (${address.join(", ")}).`);
+    return yield* json ? printJson({ dryRun: true, action: "email.receiving.enable", domainId, request }) : log(`[dry-run] Would enable receiving for ${domain} (${catchAll ? "catch-all" : address.join(", ")}).`);
   const client = yield* getClientProvider;
   const data = yield* enableReceiving({ id: domainId, ...request }).pipe(client.provide, mapError2((error) => toCliApiError("Could not enable receiving", error)));
   if (json)
     return yield* printJson(data);
   yield* printFields([["Recipients", data.recipients.join(", ")]]);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var receivingCommand = make29("receiving").pipe(withDescription3("Configure inbound email receiving"), withExamples([{ command: "samva email receiving status dom_abc123" }]), withSubcommands([status2, enable2]));
+var receivingCommand = make29("receiving").pipe(withDescription3("Move a domain's inbound email to Samva and check what is left to do"), withExamples([{ command: "samva email receiving status dom_abc123" }]), withSubcommands([status2, enable2]));
 
 // src/commands/email/review.ts
 var readStatus = gen2(function* () {
@@ -63446,8 +63948,117 @@ var reapply = make29("reapply", { json: jsonFlag }).pipe(withDescription3("Resub
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var reviewCommand = make29("review").pipe(withDescription3("Inspect or resubmit email onboarding review"), withSubcommands([status3, reapply]));
 
+// src/lib/attachments.ts
+import { readFile as readFile3, stat as stat3 } from "fs/promises";
+import { basename, extname } from "path";
+
+// ../core/src/messages/attachment-budget.ts
+var EMAIL_ATTACHMENT_BUDGET = {
+  maxCount: 10,
+  maxItemBytes: 25 * 1024 * 1024,
+  maxAggregateBytes: 25 * 1024 * 1024,
+  maxInlineBytes: 4 * 1024 * 1024
+};
+var emailAttachmentBudgetViolation = (attachments) => {
+  if (attachments.length > EMAIL_ATTACHMENT_BUDGET.maxCount)
+    return "count";
+  let aggregateBytes = 0;
+  for (const attachment of attachments) {
+    if (!Number.isSafeInteger(attachment.size) || attachment.size <= 0 || attachment.size > EMAIL_ATTACHMENT_BUDGET.maxItemBytes) {
+      return "itemBytes";
+    }
+    aggregateBytes += attachment.size;
+    if (aggregateBytes > EMAIL_ATTACHMENT_BUDGET.maxAggregateBytes)
+      return "aggregateBytes";
+  }
+  return null;
+};
+var emailAttachmentBudgetMessage = (violation) => {
+  switch (violation) {
+    case "count":
+      return `Email supports at most ${EMAIL_ATTACHMENT_BUDGET.maxCount} attachments`;
+    case "itemBytes":
+      return `Each email attachment must be between 1 byte and ${EMAIL_ATTACHMENT_BUDGET.maxItemBytes} bytes`;
+    case "aggregateBytes":
+      return `Email attachments must total at most ${EMAIL_ATTACHMENT_BUDGET.maxAggregateBytes} bytes`;
+  }
+};
+var emailInlineAttachmentBytes = (attachments) => attachments.reduce((total, attachment) => attachment.content === undefined ? total : total + attachment.size, 0);
+var EMAIL_INLINE_ATTACHMENT_MESSAGE = `Inline attachment content must total at most ${EMAIL_ATTACHMENT_BUDGET.maxInlineBytes} bytes. Upload larger files with POST /v1/media and send their mediaId instead of content.`;
+
+// src/lib/attachments.ts
+var CONTENT_TYPE_BY_EXTENSION = {
+  ".csv": "text/csv",
+  ".doc": "application/msword",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".gif": "image/gif",
+  ".htm": "text/html",
+  ".html": "text/html",
+  ".ics": "text/calendar",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".json": "application/json",
+  ".md": "text/markdown",
+  ".mp3": "audio/mpeg",
+  ".mp4": "video/mp4",
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".ppt": "application/vnd.ms-powerpoint",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".svg": "image/svg+xml",
+  ".txt": "text/plain",
+  ".webp": "image/webp",
+  ".xls": "application/vnd.ms-excel",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".xml": "application/xml",
+  ".zip": "application/zip"
+};
+var contentTypeForPath = (path) => CONTENT_TYPE_BY_EXTENSION[extname(path).toLowerCase()] ?? "application/octet-stream";
+var attachmentError = (code, message) => new CliUsageError({ code, message });
+var describeCause = (cause) => cause instanceof Error ? cause.message : String(cause);
+var unreadable = (path) => (cause) => attachmentError("attachment_unreadable", `Cannot read --attach ${path}: ${describeCause(cause)}`);
+var checkAttachmentBudget = (files) => gen2(function* () {
+  for (const file of files) {
+    if (file.size === 0) {
+      return yield* attachmentError("attachment_empty", `--attach ${file.path} is empty; an attachment must be at least 1 byte.`);
+    }
+    if (file.size > EMAIL_ATTACHMENT_BUDGET.maxItemBytes) {
+      return yield* attachmentError("attachment_too_large", `--attach ${file.path} is ${file.size} bytes; each attachment must be at most ${EMAIL_ATTACHMENT_BUDGET.maxItemBytes} bytes.`);
+    }
+  }
+  const violation = emailAttachmentBudgetViolation(files);
+  if (violation !== null) {
+    const total = files.reduce((sum, file) => sum + file.size, 0);
+    return yield* attachmentError(`attachment_budget_${violation}`, `${emailAttachmentBudgetMessage(violation)} (got ${files.length} files, ${total} bytes).`);
+  }
+});
+var readAttachments = (paths) => gen2(function* () {
+  const sizes = yield* forEach2(paths, (path) => tryPromise2({
+    try: async () => ({ path, size: (await stat3(path)).size }),
+    catch: unreadable(path)
+  }));
+  yield* checkAttachmentBudget(sizes);
+  const files = yield* forEach2(paths, (path) => tryPromise2({
+    try: async () => ({
+      path,
+      filename: basename(path),
+      contentType: contentTypeForPath(path),
+      bytes: await readFile3(path)
+    }),
+    catch: unreadable(path)
+  }));
+  yield* checkAttachmentBudget(files.map((file) => ({ path: file.path, size: file.bytes.length })));
+  return files;
+});
+var toSendAttachments = (files) => files.map((file) => ({
+  filename: file.filename,
+  contentType: file.contentType,
+  size: file.bytes.length,
+  content: Buffer.from(file.bytes).toString("base64")
+}));
+
 // src/lib/stdin.ts
-import { readFile as readFile3 } from "fs";
+import { readFile as readFile4 } from "fs";
 import { isatty as isatty2 } from "tty";
 import { promisify } from "util";
 var readStdinUtf8 = gen2(function* () {
@@ -63457,7 +64068,7 @@ var readStdinUtf8 = gen2(function* () {
     });
   }
   return yield* tryPromise2({
-    try: () => promisify(readFile3)(0, "utf8"),
+    try: () => promisify(readFile4)(0, "utf8"),
     catch: () => new SamvaCliError({ message: "Could not read stdin." })
   });
 });
@@ -63768,6 +64379,7 @@ var replyToAddressFlag = String9("reply-to").pipe(withDescription2("Reply-To hea
 var idempotencyKeyFlag2 = String9("idempotency-key").pipe(withDescription2("Key (1-255 characters) so identical retries return the original email"), optional4);
 var trackOpensFlag2 = Literals3("track-opens", ["on", "off"]).pipe(withDescription2("Override open tracking for this send; recipient opt-out still wins"), optional4);
 var trackClicksFlag2 = Literals3("track-clicks", ["on", "off"]).pipe(withDescription2("Override click tracking for this send; recipient opt-out still wins"), optional4);
+var attachFlag = String9("attach").pipe(withDescription2("File to attach (repeatable); small files travel inline, larger ones upload through media first"), atLeast2(0));
 var dryRunFlag2 = Boolean6("dry-run").pipe(withDescription2("Validate inputs and print the request payload without calling the API"), withDefault5(false));
 var bodySourceName = (input) => {
   if (input.templateRefValue)
@@ -63804,6 +64416,7 @@ var send3 = make29("send", {
   idempotencyKey: idempotencyKeyFlag2,
   trackOpens: trackOpensFlag2,
   trackClicks: trackClicksFlag2,
+  attach: attachFlag,
   dryRun: dryRunFlag2,
   wait: Boolean6("wait").pipe(withDescription2("Wait for delivered/read or a terminal delivery failure"), withDefault5(false)),
   timeout: timeoutFlag,
@@ -63832,6 +64445,10 @@ var send3 = make29("send", {
   {
     command: "samva email send --to you@example.com --subject Hi --text Hello --idempotency-key welcome-email-ada",
     description: "Retry a send safely with an idempotency key"
+  },
+  {
+    command: "samva email send --to you@example.com --subject Report --text Attached --attach ./report.pdf --attach ./data.csv",
+    description: "Attach files; those past the 4 MiB inline limit upload through media automatically"
   }
 ]), withHandler(({
   to,
@@ -63852,6 +64469,7 @@ var send3 = make29("send", {
   idempotencyKey,
   trackOpens,
   trackClicks,
+  attach,
   dryRun,
   wait,
   timeout,
@@ -63923,6 +64541,7 @@ var send3 = make29("send", {
       message: "Choose exactly one body source: --html, --text, or a template (--template-id/--template-slug)."
     });
   }
+  const attachmentFiles = yield* readAttachments(attach);
   const request = {
     to: [...to],
     ...ccValue ? { cc: [{ email: ccValue }] } : {},
@@ -63969,7 +64588,16 @@ var send3 = make29("send", {
       return yield* printJson({
         dryRun: true,
         bodySource: source,
-        request,
+        request: {
+          ...request,
+          ...attachmentFiles.length === 0 ? {} : {
+            attachments: attachmentFiles.map((file) => ({
+              filename: file.filename,
+              contentType: file.contentType,
+              size: file.bytes.length
+            }))
+          }
+        },
         idempotencyKey: idempotencyKeyValue
       });
     }
@@ -63985,6 +64613,10 @@ var send3 = make29("send", {
       ...request.inReplyToMessageId ? [["Reply to", request.inReplyToMessageId]] : [],
       ...request.replyTo ? [["Reply-To", request.replyTo]] : [],
       ...idempotencyKeyValue ? [["Idempotency key", idempotencyKeyValue]] : [],
+      ...attachmentFiles.map((file) => [
+        "Attachment",
+        `${file.filename} (${file.contentType}, ${file.bytes.length} bytes)`
+      ]),
       ...request.tracking ? [
         ["Track opens", request.tracking.opens],
         ["Track clicks", request.tracking.clicks]
@@ -64008,7 +64640,8 @@ ${truncateForDisplay(JSON.stringify(request.templateData, null, 2))}`);
     return;
   }
   const client = yield* getClientProvider;
-  const data = yield* send(request, sendOptions).pipe(client.provide, mapError2((error) => toCliApiError("Failed to send email", error)));
+  const attachments = toSendAttachments(attachmentFiles);
+  const data = yield* send({ ...request, ...attachments.length === 0 ? {} : { attachments } }, sendOptions).pipe(client.provide, mapError2((error) => toCliApiError("Failed to send email", error)));
   const finalMessage = waitDuration === undefined ? data : yield* waitForMessage(data, waitDuration);
   const projection = projectMessage(finalMessage);
   const outcome = wait ? lifecycleOf(finalMessage) : undefined;
@@ -64783,8 +65416,6 @@ var CONTACT_STATUS_VALUES = ["active", "paused", "blocked", "archived"];
 var contactStatusSchema = Literals(CONTACT_STATUS_VALUES);
 var ACTOR_STATUS_VALUES = ["active", "disabled", "archived"];
 var actorStatusSchema = Literals(ACTOR_STATUS_VALUES);
-var ACCESS_LEVEL_VALUES = ["public", "authenticated", "vip", "internal"];
-var accessLevelSchema = Literals(ACCESS_LEVEL_VALUES);
 var CONTACT_GROUP_TYPE_VALUES = ["static", "dynamic", "smart"];
 var contactGroupTypeSchema = Literals(CONTACT_GROUP_TYPE_VALUES);
 var CUSTOM_FIELD_TYPE_VALUES = ["text", "number", "boolean", "date", "select"];
@@ -65240,6 +65871,33 @@ var IanaTimezone2 = String4.check(makeFilter2(isIanaTimezone, {
 })).annotate({ identifier: "IanaTimezone" });
 
 // ../core/src/mailboxes/mailbox.ts
+var mailboxEventTypes = [
+  "mailbox.created",
+  "address.attached",
+  "email.received",
+  "email.released",
+  "email.sent",
+  "thread.created",
+  "thread.updated",
+  "draft.created",
+  "draft.updated",
+  "action.proposed",
+  "action.policy_decided",
+  "action.approval_requested",
+  "action.approval_resolved",
+  "action.executed",
+  "action.failed"
+];
+var mailboxActionScopes = [
+  "sendMessage",
+  "reply",
+  "updateDraft",
+  "createNote",
+  "assignThread",
+  "changeThreadState",
+  "call",
+  "extensionRequest"
+];
 var mailboxActorKinds = [
   "user",
   "apiKey",
@@ -65248,6 +65906,27 @@ var mailboxActorKinds = [
   "samvaAgent",
   "system"
 ];
+var mailboxActionSources = [
+  "humanUi",
+  "externalApi",
+  "aiSdkTool",
+  "extension",
+  "externalAgent",
+  "samvaManagedAgent",
+  "system"
+];
+var mailboxActionStates = [
+  "proposed",
+  "allowed",
+  "approvalRequired",
+  "policyDenied",
+  "approved",
+  "approvalDenied",
+  "executing",
+  "executed",
+  "failed"
+];
+var mailboxApproverKinds = ["user", "samvaAgent", "system"];
 var mailboxPermissions = [
   "mailbox:read",
   "mailbox:configure",
@@ -65277,7 +65956,6 @@ var extensionRuntimes = ["hosted", "webhook"];
 var ExtensionRuntime = Literals(extensionRuntimes);
 var ExtensionPermission = Literals(mailboxKeyActions);
 var EXTENSION_BUNDLE_MAX_BYTES = 1024 * 1024;
-var EXTENSION_TOOL_REQUEST_MAX_BYTES = 6 * 1024 * 1024;
 var uniqueValues = (values) => new Set(values).size === values.length;
 var ExtensionName = String4.check(isPattern2(/^[a-z][a-z0-9-]{1,62}[a-z0-9]$/u, {
   message: "An extension name is 3-64 lowercase letters, digits, and hyphens"
@@ -65380,6 +66058,38 @@ var InstallExtensionResponse2 = Struct({
     webhookSecret: SensitiveString2
   }))
 }).annotate({ identifier: "InstallExtensionResponse" });
+var ExtensionUpgradeGrant = Literals([
+  ...mailboxKeyActions.map((permission) => `permission:${permission}`),
+  ...MAILBOX_WEBHOOK_EVENT_TYPE_VALUES.map((event) => `event:${event}`)
+]);
+var ExtensionPermissionDiff2 = Struct({
+  added: ArraySchema(ExtensionUpgradeGrant),
+  removed: ArraySchema(ExtensionUpgradeGrant)
+}).annotate({ identifier: "ExtensionPermissionDiff" });
+var ExtensionVersionChange2 = Struct({
+  id: String4,
+  organizationId: OrganizationId2,
+  installationId: ExtensionInstallationId2,
+  extensionId: ExtensionId2,
+  fromVersion: ExtensionVersionRef2,
+  toVersion: ExtensionVersionRef2,
+  permissionDiff: ExtensionPermissionDiff2,
+  changedBy: UserId2,
+  changedAt: DateFromString
+}).annotate({ identifier: "ExtensionVersionChange" });
+var UpgradeExtensionPayload = Struct({
+  version: optional2(Union2([ExtensionVersionString, ExtensionVersionId2])),
+  acceptPermissions: optional2(ArraySchema(ExtensionUpgradeGrant).check(makeFilter2(uniqueValues, { message: "Each accepted grant is listed once" }))),
+  dryRun: optional2(Boolean3)
+}).annotate({ identifier: "UpgradeExtensionPayload" });
+var UpgradeExtensionResponse2 = Struct({
+  installation: ExtensionInstallation2,
+  fromVersion: ExtensionVersionRef2,
+  toVersion: ExtensionVersionRef2,
+  permissionDiff: ExtensionPermissionDiff2,
+  dryRun: Boolean3,
+  versionChange: NullOr(ExtensionVersionChange2)
+}).annotate({ identifier: "UpgradeExtensionResponse" });
 var ExtensionRunOutcome = Literals([
   "succeeded",
   "failed",
@@ -65640,10 +66350,14 @@ var initExtension = (dir, manifest) => gen2(function* () {
     "src/extension.ts": `import { defineExtension } from "@samva/mailbox";
 
 export default defineExtension({
-  manifest: ${JSON.stringify(manifest, null, 2)},
+  manifest: ${JSON.stringify(manifest, null, 2).replaceAll(`
+`, `
+  `)},
   on: {
     "mailbox.message.received": async (event, { samva, log }) => {
-      await samva.messages.reply(event.data.mailboxId, event.data.message.id, { text: "Thanks for your message. We received it." });
+      await samva.messages.reply(event.data.mailboxId, event.data.message.id, {
+        text: "Thanks for your message. We received it.",
+      });
       log("Acknowledged", event.data.message.id);
     },
   },
@@ -65672,6 +66386,10 @@ var undecodedStatus = (error) => isHttpClientError(error) ? error.response?.stat
 var GATED_NEXT = "Mailboxes are not enabled for this organization (the `mailbox` launch flag is off). Mailbox commands work once it is enabled.";
 var personOnlyNext = (action) => {
   switch (action) {
+    case "approve":
+      return "Approving an action needs a person signed in with `samva login`, different from its proposer; an API key cannot approve.";
+    case "deny":
+      return "Denying an action needs a person signed in with `samva login`, different from its proposer; an API key cannot deny.";
     case "release":
       return "Releasing a held message needs a person signed in with `samva login`; an API key cannot release.";
     case "discard":
@@ -65691,7 +66409,7 @@ var mailboxApiError = (prefix, error, options = {}) => {
       api: { reason: "FlagDisabledError", status: 404, details: {}, next: GATED_NEXT }
     });
   const failure = toCliApiError(prefix, error);
-  if (options.personOnly !== undefined && failure.api?.status === 403)
+  if (options.personOnly !== undefined && failure.api?.reason === "ForbiddenError")
     return new SamvaCliError({
       message: failure.message,
       api: { ...failure.api, next: personOnlyNext(options.personOnly) }
@@ -65739,26 +66457,98 @@ var ActivityRangeQuery = {
   }))
 };
 
-// src/commands/extensions-api.ts
-var printInstallationSummary = (item) => printFields([
-  ["Installation", item.id],
-  ["Extension", item.name],
-  ["Version", item.version.version],
+// src/commands/extensions-output.ts
+var printManifest = (item) => printFields([
+  ["Extension", `${item.name}@${item.version}`],
+  ["Display name", item.displayName],
+  ["Description", item.description === null ? "None" : item.description],
   ["Runtime", item.runtime],
-  ["Status", item.status]
+  ["Events", item.events.join(", ")],
+  ["Permissions", item.permissions.join(", ")]
 ]);
-var printInstallation = (item) => printFields([
-  ["Installation", item.id],
-  ["Extension", item.name],
-  ["Version", item.version.version],
+var printExtension = (item) => gen2(function* () {
+  yield* log(`${item.displayName} (${item.name})`);
+  yield* printFields([
+    ["Extension ID", item.id],
+    ["Description", item.description ?? "None"],
+    ["Runtime", item.runtime],
+    ["Latest version", `${item.latestVersion.version} (${item.latestVersion.id})`],
+    ["Created", item.createdAt],
+    ["Updated", item.updatedAt]
+  ]);
+});
+var printVersionSummary = (item) => printFields([
+  ["Version", `${item.version} (${item.id})`],
   ["Runtime", item.runtime],
-  ["Status", item.status],
-  ["Permissions", item.permissions.join(", ")],
-  ["Send mode", item.sendMode],
-  ["Mailboxes", item.scope.mailboxIds?.join(", ") ?? "All accessible mailboxes"],
-  ["Namespace", item.scope.namespaceId],
-  ["Webhook", item.webhook?.url]
+  ["Published", item.publishedAt],
+  ["Bundle", item.bundle === null ? "None" : `${item.bundle.sizeBytes} bytes`],
+  ["SHA256", item.bundle?.sha256]
 ]);
+var printVersion = (item) => gen2(function* () {
+  yield* printVersionSummary(item);
+  yield* log("Manifest");
+  yield* printManifest(item.manifest);
+});
+var printInstallationSummary = (item) => gen2(function* () {
+  yield* log(`${item.displayName} (${item.name}) \u2014 ${item.status}`);
+  yield* printFields([
+    ["Installation", item.id],
+    ["Extension ID", item.extensionId],
+    ["Version", `${item.version.version} (${item.version.id})`],
+    ["Runtime", item.runtime],
+    ["Created", item.createdAt]
+  ]);
+});
+var printInstallation = (item) => gen2(function* () {
+  yield* printInstallationSummary(item);
+  yield* log("Access and delivery");
+  yield* printFields([
+    ["Events", item.events.join(", ") || "None"],
+    ["Permissions", item.permissions.join(", ") || "None"],
+    ["Send mode", item.sendMode],
+    [
+      "Mailboxes",
+      item.scope.mailboxIds === null ? "All accessible mailboxes" : item.scope.mailboxIds.join(", ") || "None"
+    ],
+    ["Namespace", item.scope.namespaceId ?? "All namespaces"],
+    ["Webhook", item.webhook?.url ?? "None"],
+    ["Webhook endpoint", item.webhook?.endpointId],
+    ["Updated", item.updatedAt],
+    ["Disabled", item.disabledAt ?? "No"]
+  ]);
+});
+var printRunSummary = (item) => gen2(function* () {
+  yield* log(`${item.id}: ${item.outcome}`);
+  yield* printFields([
+    ["Event", item.eventId],
+    ["Type", item.eventType],
+    ["Attempt", item.attempt],
+    ["Started", item.startedAt],
+    ["Duration (ms)", item.durationMs],
+    ["Error", item.error ?? "None"]
+  ]);
+});
+var printUpgrade = (result) => gen2(function* () {
+  yield* log(result.dryRun ? "Upgrade preview; no changes made. Installation details below show its current state." : result.versionChange === null ? "Installation already uses the selected version; no changes made." : "Installation upgraded.");
+  yield* printFields([
+    ["From version", `${result.fromVersion.version} (${result.fromVersion.id})`],
+    ["To version", `${result.toVersion.version} (${result.toVersion.id})`],
+    ["Added grants", result.permissionDiff.added.join(", ") || "None"],
+    ["Removed grants", result.permissionDiff.removed.join(", ") || "None"]
+  ]);
+  yield* printInstallation(result.installation);
+  if (result.versionChange !== null) {
+    yield* log("Version change");
+    yield* printFields([
+      ["Change ID", result.versionChange.id],
+      ["Organization", result.versionChange.organizationId],
+      ["Changed by", result.versionChange.changedBy],
+      ["Changed at", result.versionChange.changedAt]
+    ]);
+  }
+});
+
+// src/commands/extensions-api.ts
 var pageFlags = {
   limit: Int5("limit").pipe(withDescription2("Items per page"), optional4),
   cursor: String9("cursor").pipe(withDescription2("Resume after this nextCursor from a previous page"), optional4),
@@ -65818,13 +66608,7 @@ var list24 = make29("list", { ...pageFlags, json: jsonFlag }).pipe(withDescripti
     flags,
     empty: "No extensions found.",
     fetch: (query) => list10(query).pipe(client.provide, mapError2((e) => mailboxApiError("Could not list extensions", e))),
-    print: (item) => printFields([
-      ["ID", item.id],
-      ["Name", item.name],
-      ["Display name", item.displayName],
-      ["Runtime", item.runtime],
-      ["Version", item.latestVersion.version]
-    ])
+    print: printExtension
   });
 })));
 var versions = make29("versions", {
@@ -65837,35 +66621,19 @@ var versions = make29("versions", {
     flags,
     empty: "No versions found.",
     fetch: (query) => listVersions({ id: extension, ...query }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not list versions", e))),
-    print: (item) => printFields([
-      ["ID", item.id],
-      ["Version", item.version],
-      ["Runtime", item.runtime],
-      ["Published", item.publishedAt],
-      ["Size", item.bundle?.sizeBytes],
-      ["SHA256", item.bundle?.sha256]
-    ])
+    print: printVersionSummary
   });
 })));
 var version2 = make29("version", {
   extension: extensionArgument,
   version: String10("version"),
   json: jsonFlag
-}).pipe(withDescription3("Show one published version with its manifest, by version or id"), withExamples([{ command: "samva extensions version auto-reply 1.0.0 --json" }]), withHandler(({ extension, version, json }) => gen2(function* () {
+}).pipe(withDescription3("Show one published version with its manifest, by version or id"), withExamples([{ command: "samva extensions version auto-reply 1.0.0 --json" }]), withHandler(({ extension, version: selectedVersion, json }) => gen2(function* () {
   const client = yield* getClientProvider;
-  const data = yield* getVersion({ id: extension, versionId: version }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not read version", e)));
+  const data = yield* getVersion({ id: extension, versionId: selectedVersion }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not read version", e)));
   if (json)
     return yield* printJson(data);
-  yield* printFields([
-    ["ID", data.id],
-    ["Version", data.version],
-    ["Runtime", data.runtime],
-    ["Published", data.publishedAt],
-    ["Events", data.manifest.events.join(", ")],
-    ["Permissions", data.manifest.permissions.join(", ")],
-    ["Size", data.bundle?.sizeBytes],
-    ["SHA256", data.bundle?.sha256]
-  ]);
+  yield* printVersion(data);
 })));
 var install2 = make29("install", {
   extension: extensionArgument,
@@ -65880,11 +66648,20 @@ var install2 = make29("install", {
   {
     command: "samva extensions install auto-reply --mailbox mbx_1234567890123456 --permission read --permission send --send-mode approval"
   }
-]), withHandler(({ extension, version, mailbox, namespace, permission, sendMode, webhookUrl, json }) => gen2(function* () {
+]), withHandler(({
+  extension,
+  version: selectedVersion,
+  mailbox,
+  namespace,
+  permission,
+  sendMode,
+  webhookUrl,
+  json
+}) => gen2(function* () {
   const client = yield* getClientProvider;
   const data = yield* install({
     extension,
-    ...isSome2(version) ? { version: version.value } : {},
+    ...isSome2(selectedVersion) ? { version: selectedVersion.value } : {},
     ...mailbox.length ? { mailboxIds: mailbox } : {},
     ...isSome2(namespace) ? { namespaceId: namespace.value } : {},
     ...permission.length ? { permissions: permission } : {},
@@ -65925,6 +66702,37 @@ var installation = make29("installation", {
     return yield* printJson(data);
   yield* printInstallation(data);
 })));
+var upgrade2 = make29("upgrade", {
+  id: installationArgument,
+  version: String9("version").pipe(withSchema2(Union2([ExtensionVersionString, ExtensionVersionId2])), withDescription2("Published version or version ID; defaults to the latest published version"), optional4),
+  acceptPermissions: Literals3("accept-permissions", ExtensionUpgradeGrant.literals).pipe(withDescription2("Acknowledge one added permission:<name> or event:<type> grant; repeat for each"), atLeast2(0)),
+  dryRun: Boolean6("dry-run").pipe(withDescription2("Ask the API for a preview without changing the installation"), withDefault5(false)),
+  yes: Boolean6("yes").pipe(withDescription2("Skip confirmation"), withDefault5(false)),
+  json: jsonFlag
+}).pipe(withDescription3("Upgrade an installation using a person signed in with samva login"), withExamples([
+  { command: "samva extensions upgrade exti_1234567890123456 --dry-run --json" },
+  {
+    command: "samva extensions upgrade exti_1234567890123456 --version 2.0.0 --accept-permissions permission:send --accept-permissions event:mailbox.message.sent --yes"
+  }
+]), withHandler(({ id, version: selectedVersion, acceptPermissions, dryRun, yes, json }) => gen2(function* () {
+  if (!dryRun)
+    yield* confirmDestructive({
+      yes,
+      json,
+      message: `Upgrade ${id} to ${getOrElse(selectedVersion, () => "the latest published version")}?`,
+      nonInteractiveMessage: "Upgrade changes the installation's version and grants. Preview with --dry-run, then pass --yes to confirm and --accept-permissions for every added grant."
+    });
+  const client = yield* getClientProvider;
+  const data = yield* upgrade({
+    id,
+    ...isSome2(selectedVersion) ? { version: selectedVersion.value } : {},
+    ...acceptPermissions.length ? { acceptPermissions } : {},
+    ...dryRun ? { dryRun: true } : {}
+  }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not upgrade extension", e, { personOnly: "manage" })));
+  if (json)
+    return yield* printJson(data);
+  yield* printUpgrade(data);
+})));
 var uninstall2 = make29("uninstall", {
   id: installationArgument,
   yes: Boolean6("yes").pipe(withDefault5(false)),
@@ -65960,15 +66768,7 @@ var runs = make29("runs", { id: installationArgument, json: jsonFlag }).pipe(wit
   if (!data.items.length)
     return yield* log("No runs found.");
   for (const item of data.items)
-    yield* printFields([
-      ["Run", item.id],
-      ["Event", item.eventId],
-      ["Type", item.eventType],
-      ["Attempt", item.attempt],
-      ["Outcome", item.outcome],
-      ["Duration (ms)", item.durationMs],
-      ["Error", item.error]
-    ]);
+    yield* printRunSummary(item);
 })));
 var run6 = make29("run", {
   id: installationArgument,
@@ -65976,23 +66776,15 @@ var run6 = make29("run", {
   json: jsonFlag
 }).pipe(withDescription3("Show one hosted run with the lines its handler logged"), withExamples([
   { command: "samva extensions run exti_1234567890123456 0b6c1e1a-run-id --json" }
-]), withHandler(({ id, run, json }) => gen2(function* () {
+]), withHandler(({ id, run: runId, json }) => gen2(function* () {
   const client = yield* getClientProvider;
-  const data = yield* getRun2({ id, runId: run }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not read run", e)));
+  const data = yield* getRun2({ id, runId }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not read run", e)));
   if (json)
     return yield* printJson(data);
-  yield* printFields([
-    ["Run", data.id],
-    ["Event", data.eventId],
-    ["Type", data.eventType],
-    ["Attempt", data.attempt],
-    ["Outcome", data.outcome],
-    ["Duration (ms)", data.durationMs],
-    ["Error", data.error]
-  ]);
-  if (data.logs.length)
-    yield* log(truncateForDisplay(data.logs.join(`
-`)));
+  yield* printRunSummary(data);
+  yield* log("Logs");
+  yield* log(data.logs.length ? data.logs.join(`
+`) : "None");
 })));
 var extensionApiCommands = [
   list24,
@@ -66001,6 +66793,7 @@ var extensionApiCommands = [
   install2,
   installations,
   installation,
+  upgrade2,
   uninstall2,
   setStatus("disable"),
   setStatus("enable"),
@@ -66008,6 +66801,66 @@ var extensionApiCommands = [
   run6
 ];
 
+// ../sdk/dist/effect/mailboxes.js
+var exports_mailboxes = {};
+__export(exports_mailboxes, {
+  MailboxEventStreamError: () => MailboxEventStreamError,
+  addThreadLabels: () => addThreadLabels,
+  approveAction: () => approveAction,
+  create: () => create8,
+  createDraft: () => createDraft,
+  createGrant: () => createGrant,
+  createLabel: () => createLabel,
+  createNote: () => createNote,
+  createPolicy: () => createPolicy,
+  deleteDraft: () => deleteDraft,
+  deleteLabel: () => deleteLabel,
+  deleteNote: () => deleteNote,
+  deletePolicy: () => deletePolicy,
+  denyAction: () => denyAction,
+  discardMessage: () => discardMessage,
+  events: () => events,
+  forward: () => forward,
+  get: () => get13,
+  getAgentActivity: () => getAgentActivity,
+  getDraft: () => getDraft,
+  getMessage: () => getMessage,
+  getMessageAttachment: () => getMessageAttachment,
+  getMessageRaw: () => getMessageRaw,
+  getPolicy: () => getPolicy,
+  getThread: () => getThread,
+  getThreadContent: () => getThreadContent,
+  list: () => list11,
+  listActions: () => listActions,
+  listDrafts: () => listDrafts,
+  listEvents: () => listEvents,
+  listFolders: () => listFolders,
+  listGrants: () => listGrants,
+  listLabels: () => listLabels,
+  listPolicies: () => listPolicies,
+  listQuarantine: () => listQuarantine,
+  listThreadMessages: () => listThreadMessages,
+  listThreadNotes: () => listThreadNotes,
+  listThreads: () => listThreads,
+  pause: () => pause,
+  releaseMessage: () => releaseMessage,
+  remove: () => remove9,
+  removeThreadLabels: () => removeThreadLabels,
+  reply: () => reply,
+  replyAll: () => replyAll,
+  resume: () => resume,
+  revokeGrant: () => revokeGrant,
+  sendDraft: () => sendDraft,
+  sendMessage: () => sendMessage2,
+  update: () => update9,
+  updateDraft: () => updateDraft,
+  updateGrant: () => updateGrant,
+  updateLabel: () => updateLabel,
+  updateNote: () => updateNote,
+  updatePolicy: () => updatePolicy,
+  updateThread: () => updateThread
+});
+
 // src/commands/mailboxes-events.ts
 var NORMAL_CLOSE = 1000;
 var refusalNext = (failure) => {
@@ -66163,8 +67016,12 @@ var init = make29("init", {
   const data = yield* initExtension(dir, manifest);
   if (json)
     yield* printJson(data);
-  else
-    yield* log(`Created ${name} in ${data.directory}. Run bun install, then samva extensions dev.`);
+  else {
+    yield* log(`Created ${name} in ${data.directory}.`);
+    yield* printManifest(data.manifest);
+    yield* printFields([["Files", data.files.join(", ")]]);
+    yield* log("Run bun install in that directory, then samva extensions dev.");
+  }
 })));
 var build2 = make29("build", {
   ...projectFlags,
@@ -66173,14 +67030,14 @@ var build2 = make29("build", {
   const { bundle: _bundle, ...data } = yield* buildExtension(dir, entry, out);
   if (json)
     yield* printJson(data);
-  else
+  else {
+    yield* printManifest(data.manifest);
     yield* printFields([
-      ["Extension", `${data.manifest.name}@${data.manifest.version}`],
-      ["Runtime", data.manifest.runtime],
       ["Size", `${data.sizeBytes} bytes`],
       ["SHA256", data.sha256],
       ["Output", data.output]
     ]);
+  }
 })));
 var publish3 = make29("publish", projectFlags).pipe(withDescription3("Build and publish an immutable extension version as a person signed in with samva login"), withExamples([{ command: "samva extensions publish . --json" }]), withHandler(({ dir, entry, json }) => gen2(function* () {
   const built = yield* buildExtension(dir, entry);
@@ -66191,8 +67048,11 @@ var publish3 = make29("publish", projectFlags).pipe(withDescription3("Build and
   }).pipe(client.provide, mapError2((error) => mailboxApiError("Could not publish extension", error, { personOnly: "publish" })));
   if (json)
     yield* printJson(data);
-  else
-    yield* log(`Published ${data.extension.name}@${data.version.version} (${data.version.id}).`);
+  else {
+    yield* log(`Published ${data.extension.name}@${data.version.version}.`);
+    yield* printExtension(data.extension);
+    yield* printVersion(data.version);
+  }
 })));
 var dev = make29("dev", {
   ...projectFlags,
@@ -66217,9 +67077,9 @@ var dev = make29("dev", {
   };
   const stopped = new AbortController;
   const client = createSamvaClient({
-    fetch: (input, init) => globalThis.fetch(input, {
-      ...init,
-      signal: init?.signal === undefined || init.signal === null ? stopped.signal : AbortSignal.any([init.signal, stopped.signal])
+    fetch: (input, requestInit) => globalThis.fetch(input, {
+      ...requestInit,
+      signal: requestInit?.signal === undefined || requestInit.signal === null ? stopped.signal : AbortSignal.any([requestInit.signal, stopped.signal])
     }),
     baseUrl: config.baseUrl,
     headers
@@ -66244,7 +67104,8 @@ var dev = make29("dev", {
       const data = { eventId: event.id, cursor: event.cursor, ...result };
       const text = mode === "jsonl" ? JSON.stringify(resultEnvelope("extensions.dev", data)) : [
         ...result.logs,
-        `${event.id}: ${result.ok ? "succeeded" : `failed: ${result.error}`}`
+        `${event.id}: ${result.ok ? "succeeded" : `failed: ${result.error}`}`,
+        `Cursor  ${event.cursor}`
       ].join(`
 `);
       yield* writeOutput(process.stdout, `${text}
@@ -68952,67 +69813,6 @@ var logoutCommand = make29("logout").pipe(withDescription3("Sign out and remove
   yield* clearCredentials;
   yield* printResult({ action: "logout" }, "Logged out.");
 })));
-// ../core/src/shared/excess-properties.ts
-var rejectExcessProperties = (schema) => {
-  const declared = new Set(Object.keys(schema.fields));
-  return flip3(flip3(schema).check(makeFilter2((input, ast) => {
-    if (!isObject(input))
-      return;
-    const issues = [];
-    for (const key of Reflect.ownKeys(input)) {
-      if (declared.has(key))
-        continue;
-      issues.push({ path: [key], issue: new UnexpectedKey(ast, input[key]) });
-    }
-    return issues;
-  })));
-};
-
-// ../core/src/messages/attachment-budget.ts
-var EMAIL_ATTACHMENT_BUDGET = {
-  maxCount: 10,
-  maxItemBytes: 25 * 1024 * 1024,
-  maxAggregateBytes: 25 * 1024 * 1024
-};
-var emailAttachmentBudgetViolation = (attachments) => {
-  if (attachments.length > EMAIL_ATTACHMENT_BUDGET.maxCount)
-    return "count";
-  let aggregateBytes = 0;
-  for (const attachment of attachments) {
-    if (!Number.isSafeInteger(attachment.size) || attachment.size <= 0 || attachment.size > EMAIL_ATTACHMENT_BUDGET.maxItemBytes) {
-      return "itemBytes";
-    }
-    aggregateBytes += attachment.size;
-    if (aggregateBytes > EMAIL_ATTACHMENT_BUDGET.maxAggregateBytes)
-      return "aggregateBytes";
-  }
-  return null;
-};
-
-// ../core/src/messages/email-attachment.ts
-var EmailAttachment2 = Struct({
-  filename: String4,
-  content: optional2(String4.check(isBase64())),
-  mediaId: optional2(MediaId2),
-  contentType: String4,
-  size: Finite.check(isInt(), isGreaterThan2(0), isLessThanOrEqualTo3(EMAIL_ATTACHMENT_BUDGET.maxItemBytes))
-}).check(makeFilter2((attachment) => {
-  const hasInlineContent = attachment.content !== undefined;
-  const hasOwnedMedia = attachment.mediaId !== undefined;
-  if (hasInlineContent === hasOwnedMedia)
-    return false;
-  if (!hasInlineContent)
-    return true;
-  const decoded = decode(attachment.content);
-  return isSuccess2(decoded) && decoded.success.byteLength === attachment.size;
-}, {
-  message: "Email attachment requires exactly one of content or mediaId, and inline content must match its declared size"
-})).annotate({
-  identifier: "EmailAttachment"
-}).pipe(rejectExcessProperties);
-var EmailAttachments2 = ArraySchema(EmailAttachment2).check(isMaxLength(EMAIL_ATTACHMENT_BUDGET.maxCount), makeFilter2((attachments) => emailAttachmentBudgetViolation(attachments) === null, {
-  message: `Email attachments must total at most ${EMAIL_ATTACHMENT_BUDGET.maxAggregateBytes} bytes`
-}));
 
 // ../core/src/mailboxes/resource.ts
 var MailboxActorKind = Literals(mailboxActorKinds);
@@ -69133,6 +69933,116 @@ var UpdateMailboxPayload = Struct({
   }))
 }).annotate({ identifier: "UpdateMailboxPayload" });
 
+// ../core/src/mailboxes/action-event-policy.ts
+var MailboxActionType = Literals(mailboxActionScopes);
+var MailboxActionSource = Literals(mailboxActionSources);
+var MailboxActionState = Literals(mailboxActionStates);
+var MailboxPolicyOutcome = Union2([
+  Struct({ outcome: Literal2("allow") }),
+  Struct({
+    outcome: Literal2("requireApproval"),
+    approverKinds: ArraySchema(Literals(mailboxApproverKinds)),
+    reason: String4
+  }),
+  Struct({ outcome: Literal2("deny"), reason: String4 })
+]);
+var MailboxPolicyDecisionSchema = Struct({
+  policyId: NullOr(MailboxPolicyId2),
+  actionId: MailboxActionId2,
+  outcome: MailboxPolicyOutcome,
+  decidedAt: DateFromString
+});
+var MailboxActionRecord = Struct({
+  id: MailboxActionId2,
+  mailboxId: MailboxId2,
+  threadId: optional2(MailboxThreadId2),
+  conversationId: optional2(ConversationId2),
+  draftId: optional2(MailboxDraftId2),
+  type: MailboxActionType,
+  source: MailboxActionSource,
+  state: MailboxActionState,
+  proposedBy: MailboxActorRef,
+  policyDecision: optional2(MailboxPolicyDecisionSchema),
+  payload: Record(String4, Unknown2),
+  createdAt: DateFromString,
+  updatedAt: DateFromString
+});
+var MailboxEventType = Literals(mailboxEventTypes);
+var MailboxActionProposalResponse = Union2([
+  Struct({ status: Literal2("accepted"), action: MailboxActionRecord }),
+  Struct({
+    status: Literal2("approvalRequired"),
+    action: MailboxActionRecord,
+    reason: String4
+  }),
+  Struct({
+    status: Literal2("denied"),
+    action: MailboxActionRecord,
+    reason: String4
+  })
+]);
+var MailboxActionDecision2 = Struct({
+  outcome: Literals(["allow", "requireApproval", "deny"]),
+  reason: NullOr(String4),
+  policyId: NullOr(MailboxPolicyId2),
+  decidedAt: DateFromString
+}).annotate({ identifier: "MailboxActionDecision" });
+var MailboxAction2 = Struct({
+  id: MailboxActionId2,
+  type: MailboxActionType,
+  state: MailboxActionState,
+  source: MailboxActionSource,
+  proposedBy: MailboxActorRef,
+  threadId: NullOr(MailboxThreadId2),
+  draftId: NullOr(MailboxDraftId2),
+  decision: NullOr(MailboxActionDecision2),
+  createdAt: DateFromString,
+  updatedAt: DateFromString
+}).annotate({ identifier: "MailboxAction" });
+var MailboxEvent2 = Struct({
+  id: MailboxEventId2,
+  type: MailboxEventType,
+  threadId: NullOr(MailboxThreadId2),
+  actionId: NullOr(MailboxActionId2),
+  actor: MailboxActorRef,
+  payload: Record(String4, Unknown2),
+  occurredAt: DateFromString
+}).annotate({ identifier: "MailboxEvent" });
+// ../core/src/shared/excess-properties.ts
+var rejectExcessProperties = (schema) => {
+  const declared = new Set(Object.keys(schema.fields));
+  return flip3(flip3(schema).check(makeFilter2((input, ast) => {
+    if (!isObject(input))
+      return;
+    const issues = [];
+    for (const key of Reflect.ownKeys(input)) {
+      if (declared.has(key))
+        continue;
+      issues.push({ path: [key], issue: new UnexpectedKey(ast, input[key]) });
+    }
+    return issues;
+  })));
+};
+
+// ../core/src/messages/email-attachment.ts
+var EmailAttachment2 = Struct({
+  filename: String4,
+  content: optional2(String4),
+  mediaId: optional2(MediaId2),
+  contentType: String4,
+  size: Finite.check(isInt(), isGreaterThan2(0), isLessThanOrEqualTo3(EMAIL_ATTACHMENT_BUDGET.maxItemBytes))
+}).check(makeFilter2((attachment) => attachment.content === undefined !== (attachment.mediaId === undefined), { message: "Email attachment requires exactly one of content or mediaId" }), makeFilter2((attachment) => {
+  if (attachment.content === undefined)
+    return true;
+  const decoded = decode(attachment.content);
+  return isSuccess2(decoded) && decoded.success.byteLength === attachment.size;
+}, { message: "Inline content must be Base64 that decodes to exactly its declared size" })).annotate({
+  identifier: "EmailAttachment"
+}).pipe(rejectExcessProperties);
+var EmailAttachments2 = ArraySchema(EmailAttachment2).check(isMaxLength(EMAIL_ATTACHMENT_BUDGET.maxCount), makeFilter2((attachments) => emailAttachmentBudgetViolation(attachments) === null, {
+  message: `Email attachments must total at most ${EMAIL_ATTACHMENT_BUDGET.maxAggregateBytes} bytes`
+}), makeFilter2((attachments) => emailInlineAttachmentBytes(attachments) <= EMAIL_ATTACHMENT_BUDGET.maxInlineBytes, { message: EMAIL_INLINE_ATTACHMENT_MESSAGE }));
+
 // ../core/src/mailboxes/thread.ts
 var CssTrustedEmailBody = String4.pipe(brand("CssTrustedEmailBody"));
 var MailboxMessageAttachmentSchema = Struct({
@@ -69324,6 +70234,143 @@ var MailboxThreadLabels = Struct({
   labels: NonEmptyArray(MailboxLabelId2)
 }).annotate({ identifier: "MailboxThreadLabels" });
 
+// src/lib/mailbox-output.ts
+var present = (value) => value === null ? "none" : value === "" ? '""' : value;
+var actor = (value) => `${value.displayName == null ? "" : `${value.displayName} \u2014 `}${value.kind} ${value.id}`;
+var identity2 = (address, name, attributed) => `${name === undefined || name === null ? "" : `${name} <`}${address}${name === undefined || name === null ? "" : ">"}${attributed === undefined ? "" : attributed === null ? "; actor: none" : `; actor: ${actor(attributed)}`}`;
+var printMailboxSummary = (data) => gen2(function* () {
+  yield* log(`${data.displayName} (${data.slug}) \u2014 ${data.status}`);
+  yield* printFields([
+    ["ID", data.id],
+    ["Primary address", present(data.primaryAddress)],
+    ["Namespace", present(data.namespaceId)],
+    ["Created", data.createdAt]
+  ]);
+});
+var printMailbox = (data) => gen2(function* () {
+  yield* printMailboxSummary(data);
+  yield* printFields([
+    ["Description", present(data.description)],
+    ["Updated", data.updatedAt],
+    [
+      "Default from",
+      data.defaultFrom === null ? "none" : identity2(data.defaultFrom.address, data.defaultFrom.displayName)
+    ]
+  ]);
+  yield* log("Addresses:");
+  if (!data.addresses.length)
+    yield* log("  none");
+  for (const address of data.addresses)
+    yield* log(`  ${identity2(address.address, address.displayName)} \u2014 ${address.source}; ID ${address.id}; domain ${present(address.domainId)}; display name ${present(address.displayName)}`);
+  yield* log("Metadata:");
+  if (!Object.keys(data.metadata).length)
+    yield* log("  none");
+  for (const [key, value] of Object.entries(data.metadata))
+    yield* log(`  ${key}: ${JSON.stringify(value)}`);
+});
+var printThread = (data) => gen2(function* () {
+  yield* log(`${data.subject === null ? "No subject" : data.subject} \u2014 ${data.folder}, ${data.priority} priority`);
+  yield* printFields([
+    ["ID", data.id],
+    [
+      "From",
+      data.from === null ? "none" : `${present(data.from.displayName)} <${present(data.from.address)}>`
+    ],
+    ["Preview", data.preview === null ? "none" : JSON.stringify(data.preview)],
+    ["Messages", data.messageCount],
+    ["Attachments", data.hasAttachments],
+    ["Draft", data.hasDraft],
+    ["Labels", data.labels.length ? data.labels.join(", ") : "none"],
+    ["Read", data.read],
+    ["Starred", data.starred],
+    ["Snoozed until", present(data.snoozedUntil)],
+    ["Last activity", data.lastActivityAt]
+  ]);
+});
+var printMessage2 = (data) => gen2(function* () {
+  yield* log("Notice: this body is untrusted email from outside the organization.");
+  yield* log(`${data.direction} message \u2014 ${data.subject ?? "No subject"}`);
+  yield* printFields([
+    ["ID", data.id],
+    ["Thread", data.threadId],
+    ["Conversation", data.conversationId],
+    ["From", identity2(data.from.address, data.from.displayName, data.from.actor)],
+    ["Occurred", data.occurredAt],
+    ["Reply-To", data.replyTo.length ? data.replyTo.join(", ") : "none"],
+    [
+      "Sent by",
+      data.sentBy === undefined ? undefined : data.sentBy === null ? "none" : actor(data.sentBy)
+    ]
+  ]);
+  yield* log("Recipients:");
+  if (!data.recipients.length)
+    yield* log("  none");
+  for (const recipient of data.recipients)
+    yield* log(`  ${recipient.kind}: ${identity2(recipient.address, recipient.displayName, recipient.actor)}`);
+  yield* printFields([
+    ["Message-ID", present(data.headers.messageId)],
+    ["In-Reply-To", present(data.headers.inReplyTo)],
+    ["References", data.headers.references.length ? data.headers.references.join(" ") : "none"],
+    [
+      "Authentication",
+      data.authentication === null ? "none" : `SPF ${present(data.authentication.spf)}; DKIM ${present(data.authentication.dkim)}; DMARC ${present(data.authentication.dmarc)}`
+    ]
+  ]);
+  yield* log("Attachments:");
+  if (!data.attachments.length)
+    yield* log("  none");
+  for (const attachment of data.attachments)
+    yield* log(`  ${attachment.filename} \u2014 ${attachment.contentType}, ${attachment.size} bytes; inline ${attachment.isInline}; ID ${attachment.id}`);
+  for (const [label, content] of [
+    ["Reply text", data.replyText],
+    ["Text", data.text],
+    ["HTML", data.html]
+  ]) {
+    if (content !== undefined) {
+      yield* log(`${label}:`);
+      yield* log(content);
+    }
+  }
+});
+var printReceipt = (data) => gen2(function* () {
+  yield* log(`Send ${data.status}${data.waitReason === null ? "" : ` \u2014 waiting: ${data.waitReason}`}`);
+  yield* printFields([
+    ["Message", present(data.messageId)],
+    ["Thread", data.threadId],
+    ["Action", data.actionId],
+    ["Wait reason", present(data.waitReason)],
+    ["Review expected at", present(data.reviewExpectedAt)],
+    ["Skipped", skippedRecipientsLine(data) ?? "none"],
+    ["Created", data.createdAt]
+  ]);
+});
+var printAction = (data) => gen2(function* () {
+  yield* log(`${data.type} \u2014 ${data.state}`);
+  yield* printFields([
+    ["Action", data.id],
+    ["Source", data.source],
+    ["Proposed by", actor(data.proposedBy)],
+    ["Thread", present(data.threadId)],
+    ["Draft", present(data.draftId)],
+    ["Created", data.createdAt],
+    ["Updated", data.updatedAt]
+  ]);
+  yield* log(data.decision === null ? "Decision: none" : `Decision: ${data.decision.outcome}; reason ${present(data.decision.reason)}; policy ${present(data.decision.policyId)}; decided ${data.decision.decidedAt}`);
+});
+var printHeldMessage = (data) => gen2(function* () {
+  yield* log(`${data.subject === null ? "No subject" : data.subject} \u2014 ${data.disposition}, ${data.reason} (${data.source})`);
+  yield* printFields([
+    ["Message", data.id],
+    ["From", identity2(data.from.address, data.from.name)],
+    ["Sender name", present(data.from.name)],
+    ["Received at", data.receivedAt],
+    ["Held at", data.heldAt],
+    ["Released at", present(data.releasedAt)],
+    ["Thread", present(data.threadId)],
+    ["Discarded at", present(data.discardedAt)]
+  ]);
+});
+
 // src/commands/mailboxes.ts
 var mailboxFlag = String9("mailbox").pipe(withDescription2("Mailbox ID"), withSchema2(MailboxId2));
 var messageIdArgument = String10("message-id").pipe(withSchema3(MessageId2));
@@ -69410,11 +70457,7 @@ var list25 = make29("list", {
       before: getOrUndefined(before)
     }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not list mailboxes", e))),
     empty: "No mailboxes found.",
-    human: (item) => printFields([
-      ["ID", item.id],
-      ["Slug", item.slug],
-      ["Name", item.displayName]
-    ])
+    human: printMailboxSummary
   });
 })));
 var create17 = make29("create", {
@@ -69446,13 +70489,164 @@ var create17 = make29("create", {
   }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not create mailbox", e)));
   if (json)
     return yield* printJson(data);
-  yield* printFields([
-    ["ID", data.id],
-    ["Name", data.displayName],
-    ["Address", data.primaryAddress],
-    ["Status", data.status]
-  ]);
+  yield* printMailbox(data);
+})));
+var mailboxIdArgument = String10("mailbox-id").pipe(withSchema3(MailboxId2));
+var get23 = make29("get", { id: mailboxIdArgument, json: jsonFlag }).pipe(withDescription3("Inspect a mailbox's addresses, sending identity, and settings"), withHandler(({ id, json }) => gen2(function* () {
+  const client = yield* getClientProvider;
+  const result = yield* get13({ id }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not read mailbox", e)));
+  yield* json ? printJson(result) : printMailbox(result);
 })));
+var update16 = make29("update", {
+  id: mailboxIdArgument,
+  data: String9("data").pipe(withDescription2("JSON patch or @file: displayName, defaultFrom, metadata (null deletes a metadata key)")),
+  dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
+  json: jsonFlag
+}).pipe(withDescription3("Update mailbox settings from JSON"), withExamples([
+  {
+    command: `samva mailboxes update mbx_1234567890123456 --data '{"displayName":"Support","defaultFrom":{"address":"support@example.com"}}'`
+  }
+]), withHandler(({ id, data, dryRun, json }) => gen2(function* () {
+  let source = data;
+  if (data.startsWith("@")) {
+    const path = data.slice(1);
+    if (!path)
+      return yield* new CliUsageError({
+        code: "missing_data_file",
+        message: "--data @ requires a file path."
+      });
+    const fs = yield* FileSystem;
+    source = yield* fs.readFileString(path).pipe(mapError2(() => new CliUsageError({
+      code: "data_file_unreadable",
+      message: `Could not read mailbox update data from ${path}.`
+    })));
+  }
+  const raw = yield* try_3({
+    try: () => JSON.parse(source),
+    catch: () => new CliUsageError({
+      code: "mailbox_update_invalid",
+      message: "--data must be valid JSON."
+    })
+  });
+  const payload = yield* decodeUnknownEffect2(UpdateMailboxPayload)(raw, {
+    onExcessProperty: "error"
+  }).pipe(mapError2((e) => new CliUsageError({
+    code: "mailbox_update_invalid",
+    message: `--data must match the mailbox update schema: ${String(e)}`
+  })));
+  if (!Object.keys(payload).length)
+    return yield* new CliUsageError({
+      code: "mailbox_update_empty",
+      message: "--data must name at least one of displayName, defaultFrom, or metadata."
+    });
+  if (dryRun)
+    return yield* json ? printJson({ dryRun: true, action: "mailboxes.update", id, request: payload }) : printFields([
+      ["Dry run", true],
+      ["Mailbox", id],
+      ["Patch", JSON.stringify(payload)]
+    ]);
+  const client = yield* getClientProvider;
+  const result = yield* update9({ id, ...payload }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not update mailbox", e)));
+  yield* json ? printJson(result) : printMailbox(result);
+})));
+var lifecycle = (verb) => make29(verb, {
+  id: mailboxIdArgument,
+  dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
+  json: jsonFlag
+}).pipe(withDescription3(verb === "pause" ? "Pause sending and inbound delivery; mail arriving while paused is not backfilled" : "Resume mailbox delivery"), withHandler(({ id, dryRun, json }) => gen2(function* () {
+  if (dryRun)
+    return yield* json ? printJson({ dryRun: true, action: `mailboxes.${verb}`, id }) : log(`[dry-run] Would ${verb} mailbox ${id}.`);
+  const client = yield* getClientProvider;
+  const result = yield* exports_mailboxes[verb]({ id }).pipe(client.provide, mapError2((e) => mailboxApiError(`Could not ${verb} mailbox`, e)));
+  yield* json ? printJson(result) : printMailbox(result);
+})));
+var actionsList = make29("list", {
+  mailbox: mailboxFlag,
+  ...pageFlags2,
+  state: Literals3("state", MailboxActionState.literals).pipe(optional4),
+  after: instantFlag("after", "Only actions created after this ISO 8601 instant"),
+  before: instantFlag("before", "Only actions created before this ISO 8601 instant"),
+  json: jsonFlag
+}).pipe(withDescription3("List mailbox actions and their policy decisions"), withHandler(({ mailbox, limit, cursor, all, state, after, before, json }) => gen2(function* () {
+  const client = yield* getClientProvider;
+  yield* followPages({
+    all,
+    json,
+    cursor,
+    page: (pageCursor) => listActions({
+      id: mailbox,
+      limit: pageLimit(limit),
+      cursor: pageCursor,
+      state: getOrUndefined(state),
+      after: getOrUndefined(after),
+      before: getOrUndefined(before)
+    }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not list actions", e))),
+    empty: "No mailbox actions found.",
+    human: printAction
+  });
+})));
+var actionDecision = (verb) => make29(verb, {
+  actionId: String10("action-id").pipe(withSchema3(MailboxActionId2)),
+  mailbox: mailboxFlag,
+  ...verb === "deny" ? {
+    reason: optional6("reason").pipe(withDescription2("Denial reason; defaults to Denied by reviewer."))
+  } : {},
+  dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
+  yes: Boolean6("yes").pipe(withDefault5(false)),
+  json: jsonFlag
+}).pipe(withDescription3(`${verb === "approve" ? "Approve and execute" : "Deny"} an action as a signed-in person other than its proposer`), withHandler(({ actionId, mailbox, reason, dryRun, yes, json }) => gen2(function* () {
+  const denialReason = reason === undefined ? undefined : getOrElse(reason, () => "Denied by reviewer.");
+  if (dryRun)
+    return yield* json ? printJson({
+      dryRun: true,
+      action: `mailboxes.actions.${verb}`,
+      id: mailbox,
+      actionId,
+      ...verb === "deny" ? { reason: denialReason } : {}
+    }) : printJson({
+      dryRun: true,
+      action: verb,
+      mailbox,
+      actionId,
+      ...verb === "deny" ? { reason: denialReason } : {}
+    });
+  yield* confirmDestructive({
+    yes,
+    json,
+    message: `${verb === "approve" ? "Approve and execute" : "Deny"} mailbox action ${actionId}?`,
+    nonInteractiveMessage: `Action ${verb} requires --yes in non-interactive mode. Preview with --dry-run.`
+  });
+  const client = yield* getClientProvider;
+  const result = yield* (verb === "approve" ? approveAction({ id: mailbox, actionId }) : denyAction({
+    id: mailbox,
+    actionId,
+    reason: denialReason ?? "Denied by reviewer."
+  })).pipe(client.provide, mapError2((e) => mailboxApiError(`Could not ${verb} action`, e, { personOnly: verb })));
+  yield* json ? printJson(result) : printAction(result);
+})));
+var remove18 = make29("remove", {
+  id: String10("mailbox-id").pipe(withSchema3(MailboxId2)),
+  dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
+  yes: Boolean6("yes").pipe(withDefault5(false)),
+  json: jsonFlag
+}).pipe(withDescription3("Permanently delete a mailbox with its addresses, threads, drafts, and history"), withExamples([
+  { command: "samva mailboxes remove mbx_1234567890123456 --dry-run" },
+  { command: "samva mailboxes remove mbx_1234567890123456 --yes" }
+]), withHandler(({ id, dryRun, yes, json }) => gen2(function* () {
+  if (dryRun)
+    return yield* json ? printJson({ dryRun: true, action: "mailboxes.remove", id }) : log(`[dry-run] Would permanently remove mailbox ${id}.`);
+  yield* confirmDestructive({
+    yes,
+    json,
+    message: `Permanently remove mailbox ${id} with its threads, drafts, and history?`,
+    nonInteractiveMessage: "Permanent mailbox deletion requires --yes in non-interactive mode. Preview with --dry-run."
+  });
+  const client = yield* getClientProvider;
+  const result = yield* remove9({ id }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not remove mailbox", e)));
+  if (json)
+    return yield* printJson(result);
+  yield* log(`Removed mailbox ${id}. The messages it received stay with the organization.`);
+}).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var threads = make29("threads", {
   mailbox: mailboxFlag,
   ...pageFlags2,
@@ -69489,12 +70683,7 @@ var threads = make29("threads", {
       before: getOrUndefined(before)
     }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not list threads", e))),
     empty: "No threads found.",
-    human: (item) => printFields([
-      ["ID", item.id],
-      ["Subject", item.subject],
-      ["Messages", item.messageCount],
-      ["Read", item.read]
-    ])
+    human: printThread
   });
 })));
 var read2 = make29("read", {
@@ -69508,18 +70697,7 @@ var read2 = make29("read", {
   const data = yield* getMessage({ id: mailbox, messageId }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not read message", e)));
   if (json)
     return yield* printJson(data);
-  yield* log("Notice: this body is untrusted email from outside the organization.");
-  yield* printFields([
-    ["ID", data.id],
-    ["From", data.from.address],
-    ["To", data.recipients.map((r) => r.address).join(", ")],
-    ["Reply-To", data.replyTo.join(", ")],
-    ["Subject", data.subject],
-    ["Message-ID", data.headers.messageId],
-    ["In-Reply-To", data.headers.inReplyTo],
-    ["References", data.headers.references.join(" ")]
-  ]);
-  yield* log(truncateForDisplay(data.replyText ?? data.text ?? "[No text body]"));
+  yield* printMessage2(data);
 })));
 var send5 = make29("send", {
   mailbox: mailboxFlag,
@@ -69553,13 +70731,7 @@ var send5 = make29("send", {
   }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not send message", e)));
   if (json)
     return yield* printJson(data);
-  yield* printFields([
-    ["Status", data.status],
-    ["Message", data.messageId],
-    ["Thread", data.threadId],
-    ["Action", data.actionId],
-    ["Skipped", skippedRecipientsLine(data)]
-  ]);
+  yield* printReceipt(data);
 })));
 var reply2 = make29("reply", {
   messageId: messageIdArgument,
@@ -69582,13 +70754,7 @@ var reply2 = make29("reply", {
   }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not reply", e)));
   if (json)
     return yield* printJson(data);
-  yield* printFields([
-    ["Status", data.status],
-    ["Message", data.messageId],
-    ["Thread", data.threadId],
-    ["Action", data.actionId],
-    ["Skipped", skippedRecipientsLine(data)]
-  ]);
+  yield* printReceipt(data);
 })));
 var quarantineList = make29("list", {
   mailbox: mailboxFlag,
@@ -69613,13 +70779,7 @@ var quarantineList = make29("list", {
       before: getOrUndefined(before)
     }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not list quarantine", e))),
     empty: "No quarantined messages found.",
-    human: (item) => printFields([
-      ["Message", item.id],
-      ["From", item.from.address],
-      ["Subject", item.subject],
-      ["Disposition", item.disposition],
-      ["Reason", item.reason]
-    ])
+    human: printHeldMessage
   });
 })));
 var release2 = make29("release", {
@@ -69635,13 +70795,11 @@ var release2 = make29("release", {
   const data = yield* releaseMessage({ id: mailbox, messageId }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not release message", e, { personOnly: "release" })));
   if (json)
     return yield* printJson(data);
-  yield* printFields([
-    ["Message", data.id],
-    ["Released", data.releasedAt],
-    ["Thread", data.threadId]
-  ]);
+  yield* printHeldMessage(data);
 })));
 var discard = make29("discard", {
+  dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
+  yes: Boolean6("yes").pipe(withDefault5(false)),
   messageId: messageIdArgument,
   mailbox: mailboxFlag,
   json: jsonFlag
@@ -69649,20 +70807,36 @@ var discard = make29("discard", {
   {
     command: "samva mailboxes quarantine discard msg_1234567890123456 --mailbox mbx_1234567890123456"
   }
-]), withHandler(({ messageId, mailbox, json }) => gen2(function* () {
+]), withHandler(({ messageId, mailbox, dryRun, yes, json }) => gen2(function* () {
+  if (dryRun)
+    return yield* json ? printJson({
+      dryRun: true,
+      action: "mailboxes.quarantine.discard",
+      id: mailbox,
+      messageId
+    }) : log(`[dry-run] Would permanently discard held message ${messageId}.`);
+  yield* confirmDestructive({
+    yes,
+    json,
+    message: `Permanently discard held message ${messageId}?`,
+    nonInteractiveMessage: "Discarding held mail requires --yes in non-interactive mode. Preview with --dry-run."
+  });
   const client = yield* getClientProvider;
   const data = yield* discardMessage({ id: mailbox, messageId }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not discard message", e, { personOnly: "discard" })));
   if (json)
     return yield* printJson(data);
-  yield* printFields([
-    ["Message", data.id],
-    ["Discarded", data.discardedAt]
-  ]);
+  yield* printHeldMessage(data);
 })));
 var mailboxesCommand = make29("mailboxes").pipe(withDescription3("Mailbox reading and governed sending"), withSubcommands([
   mailboxesEventsCommand,
   list25,
   create17,
+  get23,
+  update16,
+  lifecycle("pause"),
+  lifecycle("resume"),
+  make29("actions").pipe(withSubcommands([actionsList, actionDecision("approve"), actionDecision("deny")])),
+  remove18,
   threads,
   read2,
   send5,
@@ -69857,7 +71031,7 @@ var use2 = make29("use", { name: String10("name") }).pipe(withDescription3("Sele
   yield* writeConfig({ ...config, activeProfile: name });
   yield* printResult({ action: "profile.use", name }, `Active profile set to ${name}.`);
 })));
-var remove18 = make29("delete", {
+var remove19 = make29("delete", {
   name: String10("name"),
   yes: Boolean6("yes").pipe(withDefault5(false))
 }).pipe(withDescription3("Delete a profile and its OS-keyring credential"), withHandler(fnUntraced2(function* ({ name, yes }) {
@@ -69882,7 +71056,7 @@ var remove18 = make29("delete", {
     yield* (yield* Service5).clear(name);
   yield* printResult({ action: "profile.delete", name }, `Deleted profile ${name}.`);
 })));
-var profileCommand = make29("profile").pipe(withDescription3("Manage user-level credential identity and organization contexts"), withSubcommands([list27, show, create18, use2, remove18]));
+var profileCommand = make29("profile").pipe(withDescription3("Manage user-level credential identity and organization contexts"), withSubcommands([list27, show, create18, use2, remove19]));
 
 // src/commands/scheduled.ts
 var SCHEDULED_STATUSES = [
@@ -70162,7 +71336,7 @@ var list28 = make29("list", {
   if (data.nextCursor !== null)
     yield* printFields([["Next cursor", data.nextCursor]]);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var get23 = make29("get", { id: String10("id"), json: jsonFlag }).pipe(withDescription3("Show a scheduled message by id"), withExamples([{ command: "samva scheduled-messages get sched_abc123" }]), withHandler(({ id, json }) => gen2(function* () {
+var get24 = make29("get", { id: String10("id"), json: jsonFlag }).pipe(withDescription3("Show a scheduled message by id"), withExamples([{ command: "samva scheduled-messages get sched_abc123" }]), withHandler(({ id, json }) => gen2(function* () {
   const client = yield* getClientProvider;
   const data = yield* get18({ id }).pipe(client.provide, mapError2((error) => toCliApiError("Could not fetch scheduled message", error)));
   if (json)
@@ -70245,11 +71419,11 @@ var scheduledMessagesCommand = make29("scheduled-messages").pipe(withDescription
     description: "Schedule an email"
   },
   { command: "samva scheduled-messages list", description: "List scheduled messages" }
-]), withSubcommands([create19, list28, get23, cancel2, resume3]));
+]), withSubcommands([create19, list28, get24, cancel2, resume3]));
 
 // src/commands/templates.ts
 import { constants as constants2 } from "fs";
-import { access as access3, stat as stat4 } from "fs/promises";
+import { access as access3, stat as stat5 } from "fs/promises";
 import { dirname as dirname5, resolve as resolve16 } from "path";
 import { pathToFileURL as pathToFileURL5 } from "url";
 
@@ -71539,7 +72713,7 @@ import { resolve as resolve13 } from "path";
 
 // src/commands/templates/snapshot-browser.ts
 import { existsSync } from "fs";
-import { copyFile as copyFile3, mkdir as mkdir4, mkdtemp as mkdtemp2, readFile as readFile4, rm as rm2, stat as stat3, writeFile as writeFile5 } from "fs/promises";
+import { copyFile as copyFile3, mkdir as mkdir4, mkdtemp as mkdtemp2, readFile as readFile5, rm as rm2, stat as stat4, writeFile as writeFile5 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
 import { join as join4 } from "path";
 import { pathToFileURL as pathToFileURL4 } from "url";
@@ -71653,7 +72827,7 @@ var runProcess = async (command, args, until) => {
     stderr += text;
   });
   const deadline = Date.now() + RUN_TIMEOUT_MS;
-  const produced = async () => until.stdoutIncludes !== undefined && stdout.includes(until.stdoutIncludes) || until.file !== undefined && existsSync(until.file) && (await stat3(until.file)).size > 0;
+  const produced = async () => until.stdoutIncludes !== undefined && stdout.includes(until.stdoutIncludes) || until.file !== undefined && existsSync(until.file) && (await stat4(until.file)).size > 0;
   const state = { exited: false };
   child.exited.then(() => {
     state.exited = true;
@@ -71679,7 +72853,7 @@ var chromeLauncher = (binary, run = runProcess) => ({
     const profile = await mkdtemp2(join4(tmpdir2(), "samva-chrome-"));
     try {
       for (const request of requests) {
-        const source = await readFile4(request.htmlPath, "utf8");
+        const source = await readFile5(request.htmlPath, "utf8");
         const measured = request.htmlPath.replace(/\.html$/, `.${request.viewport}.${request.scheme}.html`);
         await writeFile5(measured, withMeasurement(source));
         const measure = await run(binary, chromeMeasureArgs({
@@ -72397,7 +73571,7 @@ var typesCommand = make29("types", {
 })));
 
 // src/commands/templates/workspace.ts
-import { basename, resolve as resolve15 } from "path";
+import { basename as basename2, resolve as resolve15 } from "path";
 var templateIdArgument = String10("template-id").pipe(withDescription4("Template whose project workspace to act on"));
 var revisionFlag = String9("revision").pipe(withDescription2("Workspace revision this call is fenced to; a workspace that moved refuses the call"));
 var idempotencyKeyFlag4 = String9("idempotency-key").pipe(withDescription2("Key so an identical retry returns the original result rather than repeating it"));
@@ -72490,7 +73664,7 @@ var addAsset = make29("add-asset", {
   const view = yield* putWorkspaceAsset({
     id,
     expectedRevision: revision,
-    path: getOrElse(path, () => `assets/${basename(source)}`),
+    path: getOrElse(path, () => `assets/${basename2(source)}`),
     contentBase64: Buffer.from(bytes).toString("base64"),
     replace,
     idempotencyKey
@@ -72663,7 +73837,7 @@ var typecheckProject = (tsconfig) => tryPromise2({
 });
 var validateTemplatesDir = (dir) => tryPromise2({
   try: async () => {
-    const info = await stat4(dir);
+    const info = await stat5(dir);
     if (!info.isDirectory()) {
       return Promise.reject(new SamvaCliError({ message: `${dir} is not a directory.` }));
     }
@@ -73251,7 +74425,7 @@ var list29 = make29("list", {
   if (data.nextCursor !== null)
     yield* printFields([["Next cursor", data.nextCursor]]);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var get24 = make29("get", { id: idArgument, json: jsonFlag }).pipe(withDescription3("Get a customer webhook"), withExamples([{ command: "samva webhooks get wep_abc123 --json" }]), withHandler(({ id, json }) => gen2(function* () {
+var get25 = make29("get", { id: idArgument, json: jsonFlag }).pipe(withDescription3("Get a customer webhook"), withExamples([{ command: "samva webhooks get wep_abc123 --json" }]), withHandler(({ id, json }) => gen2(function* () {
   const client = yield* getClientProvider;
   const data = yield* get19({ id }).pipe(client.provide, mapError2((error) => toCliApiError("Could not get webhook", error)));
   if (json)
@@ -73375,12 +74549,12 @@ var rotate2 = make29("rotate-secret", {
   yield* log(secret);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var create20 = make29("create", {
-  data: String9("data").pipe(withDescription2("Webhook JSON: name, url, events, and optional retry settings")),
+  data: String9("data").pipe(withDescription2("Webhook JSON: name, url, eventTypes, and optional retry settings")),
   dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
   json: jsonFlag
 }).pipe(withDescription3("Create a customer webhook from JSON"), withExamples([
   {
-    command: `samva webhooks create --data '{"name":"delivery","url":"https://example.com/hook","events":["message.delivered"]}' --dry-run`
+    command: `samva webhooks create --data '{"name":"delivery","url":"https://example.com/hook","eventTypes":["message.delivered"]}' --dry-run`
   }
 ]), withHandler(({ data, dryRun, json }) => gen2(function* () {
   const payload = yield* decodePayload2(data, "--data", CreateWebhookPayload);
@@ -73392,7 +74566,7 @@ var create20 = make29("create", {
     return yield* printJson(result);
   yield* printJson(result);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var update16 = make29("update", {
+var update17 = make29("update", {
   id: idArgument,
   data: String9("data").pipe(withDescription2("JSON object of webhook fields to update")),
   dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
@@ -73411,7 +74585,7 @@ var update16 = make29("update", {
     return yield* printJson(result);
   yield* printJson(result);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var remove19 = make29("remove", {
+var remove20 = make29("remove", {
   id: idArgument,
   dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
   yes: Boolean6("yes").pipe(withDefault5(false)),
@@ -73434,7 +74608,7 @@ var remove19 = make29("remove", {
     return yield* printJson(result);
   yield* log(`Removed webhook ${id}.`);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var webhooksCommand = make29("webhooks").pipe(withDescription3("Inspect, test, and recover customer webhooks"), withExamples([{ command: "samva webhooks list --json" }]), withSubcommands([list29, get24, create20, update16, test2, logs, stats, retry5, rotate2, remove19]));
+var webhooksCommand = make29("webhooks").pipe(withDescription3("Inspect, test, and recover customer webhooks"), withExamples([{ command: "samva webhooks list --json" }]), withSubcommands([list29, get25, create20, update17, test2, logs, stats, retry5, rotate2, remove20]));
 
 // src/lib/root-commands.ts
 var rootCommands = [