@samva/cli 0.9.0 → 0.10.0

package/dist/bin.mjs

@@ -13982,7 +13982,7 @@ var layer12 = /* @__PURE__ */ layer.pipe(/* @__PURE__ */ provideMerge(/* @__PURE
 // package.json
 var package_default = {
   name: "@samva/cli",
-  version: "0.9.0",
+  version: "0.10.0",
   description: "Samva CLI \u2014 email and platform operations from your terminal",
   keywords: [
     "cli",
@@ -14037,16 +14037,16 @@ var package_default = {
     "@types/node": "catalog:",
     "better-auth": "catalog:",
     effect: "catalog:effect",
-    samva: "workspace:0.12.0",
+    samva: "workspace:0.13.0",
     typescript: "catalog:",
     vite: "~8.3.0",
     vitest: "catalog:"
   },
   optionalDependencies: {
-    "@samva/cli-darwin-arm64": "workspace:0.9.0",
-    "@samva/cli-darwin-x64": "workspace:0.9.0",
-    "@samva/cli-linux-arm64": "workspace:0.9.0",
-    "@samva/cli-linux-x64": "workspace:0.9.0"
+    "@samva/cli-darwin-arm64": "workspace:0.10.0",
+    "@samva/cli-darwin-x64": "workspace:0.10.0",
+    "@samva/cli-linux-arm64": "workspace:0.10.0",
+    "@samva/cli-linux-x64": "workspace:0.10.0"
   },
   engines: {
     node: ">=18"
@@ -43621,6 +43621,121 @@ var DIAGNOSTIC_CODES = codes2({
     channelOnly: true
   }
 });
+// ../sdk/dist/inline-attachments-B56eS0MF.js
+var SDK_VERSION = "0.13.0";
+var CLIENT_ATTRIBUTION_HEADER = "x-samva-client";
+var clientAttribution = (surface) => `${surface}/${SDK_VERSION}`;
+var MediaUploadError = class extends Error {
+  _tag = "MediaUploadError";
+  filename;
+  mediaId;
+  status;
+  cause;
+  constructor(input) {
+    super(input.status === undefined ? `Uploading attachment "${input.filename}" (${input.mediaId}) failed before storage answered` : `Uploading attachment "${input.filename}" (${input.mediaId}) failed with storage status ${input.status}`, { cause: input.cause });
+    this.name = "MediaUploadError";
+    this.filename = input.filename;
+    this.mediaId = input.mediaId;
+    this.status = input.status;
+    this.cause = input.cause;
+  }
+};
+var isRecord = (value) => typeof value === "object" && value !== null;
+var attachmentsOf = (payload) => {
+  const email = payload.email;
+  if (!isRecord(email))
+    return [];
+  const attachments = email.attachments;
+  return Array.isArray(attachments) ? attachments : [];
+};
+var decodedBase64Bytes = (content) => {
+  const length = content.length;
+  if (length === 0)
+    return 0;
+  let padding = 0;
+  if (content.endsWith("=="))
+    padding = 2;
+  else if (content.endsWith("="))
+    padding = 1;
+  return Math.floor(length * 3 / 4) - padding;
+};
+var base64ToBytes = (content) => {
+  let binary;
+  try {
+    binary = atob(content);
+  } catch {
+    return;
+  }
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0;index < binary.length; index += 1)
+    bytes[index] = binary.charCodeAt(index);
+  return bytes;
+};
+var planInlineUploads = (payload) => {
+  const inline = [];
+  for (const [index, entry] of attachmentsOf(payload).entries()) {
+    if (!isRecord(entry))
+      continue;
+    const attachment = entry;
+    if (typeof attachment.content !== "string")
+      continue;
+    if (attachment.mediaId !== undefined)
+      return [];
+    inline.push({
+      index,
+      filename: typeof attachment.filename === "string" ? attachment.filename : "attachment",
+      contentType: typeof attachment.contentType === "string" ? attachment.contentType : "application/octet-stream",
+      content: attachment.content,
+      sizeBytes: typeof attachment.size === "number" ? attachment.size : decodedBase64Bytes(attachment.content)
+    });
+  }
+  let remaining = inline.reduce((total, upload) => total + upload.sizeBytes, 0);
+  if (remaining <= 4194304)
+    return [];
+  const chosen = [];
+  const largestFirst = [...inline].sort((left, right) => right.sizeBytes - left.sizeBytes || left.index - right.index);
+  for (const { content, ...upload } of largestFirst) {
+    if (remaining <= 4194304)
+      break;
+    const bytes = base64ToBytes(content);
+    if (bytes === undefined)
+      return [];
+    chosen.push({
+      ...upload,
+      bytes
+    });
+    remaining -= upload.sizeBytes;
+  }
+  return chosen;
+};
+var mediaCreateBody = (upload) => ({
+  filename: upload.filename,
+  contentType: upload.contentType,
+  sizeBytes: upload.sizeBytes,
+  purpose: "attachment"
+});
+var uploadContentType = (headers) => Object.entries(headers).find(([name]) => name.toLowerCase() === "content-type")?.[1];
+var withUploadedAttachments = (payload, uploaded) => {
+  const email = payload.email;
+  const attachments = email.attachments.map((entry, index) => {
+    const replacement = uploaded.get(index);
+    if (replacement === undefined)
+      return entry;
+    const { content: _content, ...rest } = entry;
+    return {
+      ...rest,
+      mediaId: replacement.mediaId
+    };
+  });
+  return {
+    ...payload,
+    email: {
+      ...email,
+      attachments
+    }
+  };
+};
+
 // ../sdk/dist/normalize-B79uJIeb.js
 function toRecipientArray(recipient) {
   return Array.isArray(recipient) ? recipient : [recipient];
@@ -43690,11 +43805,6 @@ function buildMessagesSendPayload(input) {
   };
 }
 
-// ../sdk/dist/client-attribution-BTWYSXxo.js
-var SDK_VERSION = "0.12.0";
-var CLIENT_ATTRIBUTION_HEADER = "x-samva-client";
-var clientAttribution = (surface) => `${surface}/${SDK_VERSION}`;
-
 // ../../node_modules/.bun/effect@4.0.0/node_modules/effect/dist/Random.js
 var Random2 = Random;
 var randomWith = (f) => withFiber2((fiber) => succeed6(f(fiber.getRef(Random2))));
@@ -43946,6 +44056,7 @@ var baseUrl = () => {
 
 // ../../node_modules/.bun/effect@4.0.0/node_modules/effect/dist/http/HttpClientRequest.js
 var TypeId40 = "~effect/http/HttpClientRequest";
+var isHttpClientRequest = (u) => hasProperty(u, TypeId40);
 var Proto13 = {
   [TypeId40]: TypeId40,
   ...BaseProto,
@@ -44044,6 +44155,7 @@ var setHash = /* @__PURE__ */ dual(2, (self, hash) => makeWith(self.method, self
 var setBody = /* @__PURE__ */ dual(2, (self, body) => {
   return makeWith(self.method, self.url, self.urlParams, self.hash, updateHeaders(self.headers, body), body);
 });
+var bodyUint8Array = /* @__PURE__ */ dual((args) => isHttpClientRequest(args[0]), (self, body, contentType) => setBody(self, uint8Array(body, contentType)));
 var bodyFormData = /* @__PURE__ */ dual(2, (self, body) => setBody(self, formData(body)));
 function toUrl(self) {
   const r = make32(self.url, self.urlParams, getOrUndefined(self.hash));
@@ -46053,7 +46165,7 @@ var fetch2 = /* @__PURE__ */ make34((request, url, signal, fiber) => {
 });
 var layer15 = /* @__PURE__ */ layerMergedContext(/* @__PURE__ */ succeed6(fetch2));
 
-// ../sdk/dist/client-Cj1bqIEe.js
+// ../sdk/dist/client-DYPNDvVU.js
 var Sensitive = (schema) => RedactedFromValue(schema);
 var SensitiveString = Sensitive(String4);
 var ABSOLUTE_ISO_INSTANT_PATTERN = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?(Z|([+-])(\d{2}):(\d{2}))$/;
@@ -46290,6 +46402,12 @@ var CampaignFooterRequiredError = class extends TaggedError3()("CampaignFooterRe
 };
 var ExternalServiceError = class extends TaggedError3()("ExternalServiceError", Struct({ message: String4 })) {
 };
+var SenderNotReadyError = class extends TaggedError3()("SenderNotReadyError", Struct({
+  message: String4,
+  sender: String4,
+  retryAfterSeconds: optionalKey2(Union2([Finite.check(isFinite4().annotate({ expected: "a finite number" })), Null2]))
+})) {
+};
 var CampaignRecipientId = String4.check(isPattern2(/* @__PURE__ */ new RegExp("^crcpt_[0-9a-hjkmnp-tv-z]{16,24}$", "u")).annotate({
   expected: "a string matching the RegExp ^crcpt_[0-9a-hjkmnp-tv-z]{16,24}$",
   identifier: "CampaignRecipientId"
@@ -46327,11 +46445,11 @@ var ContactPreferences = Struct({
     }), Null2]))
   }), Null2]))
 }).annotate({ identifier: "ContactPreferences" });
-var UnknownRecord = Record(String4, JsonValue).annotate({ identifier: "UnknownRecord" });
 var BulkUpdateResult = Struct({
   updated: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" })),
   failed: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" }))
 }).annotate({ identifier: "BulkUpdateResult" });
+var UnknownRecord = Record(String4, JsonValue).annotate({ identifier: "UnknownRecord" });
 var CustomFieldDefinitionId = String4.check(isPattern2(/* @__PURE__ */ new RegExp("^cfield_[0-9a-hjkmnp-tv-z]{16,24}$", "u")).annotate({
   expected: "a string matching the RegExp ^cfield_[0-9a-hjkmnp-tv-z]{16,24}$",
   identifier: "CustomFieldDefinitionId"
@@ -46586,6 +46704,36 @@ var ExtensionRun = Struct({
   error: Union2([String4, Null2]),
   logs: ArraySchema(String4)
 }).annotate({ identifier: "ExtensionRun" });
+var ExtensionPermissionDiff = Struct({
+  added: ArraySchema(Union2([
+    Literal2("permission:read"),
+    Literal2("permission:update"),
+    Literal2("permission:send"),
+    Literal2("permission:quarantine.read"),
+    Literal2("event:mailbox.message.received"),
+    Literal2("event:mailbox.message.sent"),
+    Literal2("event:mailbox.action.pending_approval"),
+    Literal2("event:mailbox.message.quarantined"),
+    Literal2("event:mailbox.message.released"),
+    Literal2("event:mailbox.message.discarded")
+  ])),
+  removed: ArraySchema(Union2([
+    Literal2("permission:read"),
+    Literal2("permission:update"),
+    Literal2("permission:send"),
+    Literal2("permission:quarantine.read"),
+    Literal2("event:mailbox.message.received"),
+    Literal2("event:mailbox.message.sent"),
+    Literal2("event:mailbox.action.pending_approval"),
+    Literal2("event:mailbox.message.quarantined"),
+    Literal2("event:mailbox.message.released"),
+    Literal2("event:mailbox.message.discarded")
+  ]))
+}).annotate({ identifier: "ExtensionPermissionDiff" });
+var UserId = String4.check(isPattern2(/* @__PURE__ */ new RegExp("^user_[0-9a-hjkmnp-tv-z]{16,24}$", "u")).annotate({
+  expected: "a string matching the RegExp ^user_[0-9a-hjkmnp-tv-z]{16,24}$",
+  identifier: "UserId"
+})).pipe(brand("UserId"));
 var ExtensionBundle = Struct({
   sha256: String4,
   sizeBytes: Finite.check(isInt().annotate({ expected: "an integer" }))
@@ -46636,6 +46784,39 @@ var MailboxPolicyId = String4.check(isPattern2(/* @__PURE__ */ new RegExp("^mbxp
   expected: "a string matching the RegExp ^mbxpol_[0-9a-hjkmnp-tv-z]{16,24}$",
   identifier: "MailboxPolicyId"
 })).pipe(brand("MailboxPolicyId"));
+var OnboardingReviewRequiredError = class extends TaggedError3()("OnboardingReviewRequiredError", Struct({
+  message: String4,
+  code: Union2([
+    Literal2("review_required"),
+    Literal2("review_in_progress"),
+    Literal2("information_required"),
+    Literal2("review_rejected"),
+    Literal2("identity_review_required"),
+    Literal2("identity_review_rejected"),
+    Literal2("identity_changed")
+  ]),
+  decision: Union2([
+    Literal2("undecided"),
+    Literal2("approved"),
+    Literal2("rejected")
+  ]),
+  stage: Union2([
+    Literal2("collecting"),
+    Literal2("automated_review"),
+    Literal2("manual_review"),
+    Literal2("information_requested"),
+    Literal2("complete")
+  ]),
+  nextAction: Union2([
+    Literal2("wait_for_review"),
+    Literal2("provide_information"),
+    Literal2("verify_sending_identity"),
+    Literal2("reapply"),
+    Literal2("contact_support")
+  ]),
+  identityId: optionalKey2(Union2([String4, Null2]))
+})) {
+};
 var MailboxAgentActivity = Struct({
   actions: Struct({
     byType: ArraySchema(Struct({
@@ -46709,10 +46890,6 @@ var MailboxGrantId = String4.check(isPattern2(/* @__PURE__ */ new RegExp("^mbxac
   expected: "a string matching the RegExp ^mbxacl_[0-9a-hjkmnp-tv-z]{16,24}$",
   identifier: "MailboxGrantId"
 })).pipe(brand("MailboxGrantId"));
-var UserId = String4.check(isPattern2(/* @__PURE__ */ new RegExp("^user_[0-9a-hjkmnp-tv-z]{16,24}$", "u")).annotate({
-  expected: "a string matching the RegExp ^user_[0-9a-hjkmnp-tv-z]{16,24}$",
-  identifier: "UserId"
-})).pipe(brand("UserId"));
 var MailboxGrantRole = Union2([
   Literal2("admin"),
   Literal2("collaborator"),
@@ -46819,39 +46996,6 @@ var EmailSender = Union2([Struct({
   email: String4.check(isMinLength(1).annotate({ expected: "a value with a length of at least 1" })),
   name: optionalKey2(Union2([String4, Null2]))
 }), Null2]).annotate({ identifier: "EmailSender" });
-var OnboardingReviewRequiredError = class extends TaggedError3()("OnboardingReviewRequiredError", Struct({
-  message: String4,
-  code: Union2([
-    Literal2("review_required"),
-    Literal2("review_in_progress"),
-    Literal2("information_required"),
-    Literal2("review_rejected"),
-    Literal2("identity_review_required"),
-    Literal2("identity_review_rejected"),
-    Literal2("identity_changed")
-  ]),
-  decision: Union2([
-    Literal2("undecided"),
-    Literal2("approved"),
-    Literal2("rejected")
-  ]),
-  stage: Union2([
-    Literal2("collecting"),
-    Literal2("automated_review"),
-    Literal2("manual_review"),
-    Literal2("information_requested"),
-    Literal2("complete")
-  ]),
-  nextAction: Union2([
-    Literal2("wait_for_review"),
-    Literal2("provide_information"),
-    Literal2("verify_sending_identity"),
-    Literal2("reapply"),
-    Literal2("contact_support")
-  ]),
-  identityId: optionalKey2(Union2([String4, Null2]))
-})) {
-};
 var DeliveryUnavailableError = class extends TaggedError3()("DeliveryUnavailableError", Struct({
   message: String4,
   retryAfterSeconds: Finite.check(isFinite4().annotate({ expected: "a finite number" }))
@@ -47319,7 +47463,7 @@ var BrandFooter = Struct({
 }).annotate({ identifier: "BrandFooter" });
 var EmailAttachment = Struct({
   filename: String4,
-  content: optionalKey2(Union2([String4.check(isPattern2(/* @__PURE__ */ new RegExp("^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$", "u")).annotate({ expected: "a string matching the RegExp ^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$" })), Null2])),
+  content: optionalKey2(Union2([String4, Null2])),
   mediaId: optionalKey2(Union2([MediaId, Null2])),
   contentType: String4,
   size: Finite.check(isInt().annotate({ expected: "an integer" })).check(isLessThanOrEqualTo3(26214400).annotate({ expected: "a value less than or equal to 26214400" })).check(isGreaterThan2(0).annotate({ expected: "a value greater than 0" }))
@@ -48135,6 +48279,22 @@ var ExtensionVersionRef = Struct({
   id: ExtensionVersionId,
   version: String4
 }).annotate({ identifier: "ExtensionVersionRef" });
+Struct({
+  version: optionalKey2(Union2([Union2([String4.check(isPattern2(/* @__PURE__ */ new RegExp("^\\d{1,6}\\.\\d{1,6}\\.\\d{1,6}(?:-[0-9A-Za-z.-]{1,64})?$", "u")).annotate({ expected: "a string matching the RegExp ^\\d{1,6}\\.\\d{1,6}\\.\\d{1,6}(?:-[0-9A-Za-z.-]{1,64})?$" })), ExtensionVersionId]), Null2])),
+  acceptPermissions: optionalKey2(Union2([ArraySchema(Union2([
+    Literal2("permission:read"),
+    Literal2("permission:update"),
+    Literal2("permission:send"),
+    Literal2("permission:quarantine.read"),
+    Literal2("event:mailbox.message.received"),
+    Literal2("event:mailbox.message.sent"),
+    Literal2("event:mailbox.action.pending_approval"),
+    Literal2("event:mailbox.message.quarantined"),
+    Literal2("event:mailbox.message.released"),
+    Literal2("event:mailbox.message.discarded")
+  ])), Null2])),
+  dryRun: optionalKey2(Union2([Boolean3, Null2]))
+}).annotate({ identifier: "UpgradeExtensionPayload" });
 var ExtensionRunList = Struct({ items: ArraySchema(ExtensionRunSummary) }).annotate({ identifier: "ExtensionRunList" });
 var ExtensionVersion = Struct({
   id: ExtensionVersionId,
@@ -49398,6 +49558,17 @@ var ExtensionInstallation = Struct({
   updatedAt: String4,
   disabledAt: Union2([String4, Null2])
 }).annotate({ identifier: "ExtensionInstallation" });
+var ExtensionVersionChange = Struct({
+  id: String4,
+  organizationId: OrganizationId,
+  installationId: ExtensionInstallationId,
+  extensionId: ExtensionId,
+  fromVersion: ExtensionVersionRef,
+  toVersion: ExtensionVersionRef,
+  permissionDiff: ExtensionPermissionDiff,
+  changedBy: UserId,
+  changedAt: String4
+}).annotate({ identifier: "ExtensionVersionChange" });
 var Extension = Struct({
   id: ExtensionId,
   name: String4,
@@ -49663,6 +49834,14 @@ var InstallExtensionResponse = Struct({
     webhookSecret: SensitiveString
   }), Null2])
 }).annotate({ identifier: "InstallExtensionResponse" });
+var UpgradeExtensionResponse = Struct({
+  installation: ExtensionInstallation,
+  fromVersion: ExtensionVersionRef,
+  toVersion: ExtensionVersionRef,
+  permissionDiff: ExtensionPermissionDiff,
+  dryRun: Boolean3,
+  versionChange: Union2([ExtensionVersionChange, Null2])
+}).annotate({ identifier: "UpgradeExtensionResponse" });
 var ExtensionPage = Struct({
   items: ArraySchema(Extension),
   nextCursor: Union2([String4, Null2])
@@ -50254,6 +50433,7 @@ var CampaignsScheduleRun422 = Union2([
 ]);
 var CampaignsScheduleRun500 = InternalError;
 var CampaignsScheduleRun502 = ExternalServiceError;
+var CampaignsScheduleRun503 = SenderNotReadyError;
 var CampaignsScheduleRun504 = GatewayTimeoutError;
 var CampaignsGetRunPathParams = Struct({
   id: CampaignId,
@@ -50550,8 +50730,6 @@ var ContactGroupsRemoveMembers422 = ValidationError;
 var ContactGroupsRemoveMembers500 = InternalError;
 var ContactGroupsRemoveMembers504 = GatewayTimeoutError;
 var ContactGroupsPreviewRequestJson = Struct({ criteria: Struct({
-  contactTypes: optionalKey2(Union2([ArraySchema(String4), Null2])),
-  capabilities: optionalKey2(Union2([ArraySchema(String4), Null2])),
   tags: optionalKey2(Union2([ArraySchema(String4), Null2])),
   channels: optionalKey2(Union2([ArraySchema(String4), Null2])),
   match: optionalKey2(Union2([Union2([Literal2("all"), Literal2("any")]), Null2])),
@@ -50566,7 +50744,6 @@ var ContactGroupsPreview200 = Struct({
   sample: ArraySchema(Struct({
     id: ContactId,
     name: String4,
-    type: String4,
     status: String4
   }))
 });
@@ -50761,16 +50938,23 @@ var ContactsBulkDelete504 = GatewayTimeoutError;
 var ContactsBulkImportRequestJson = Struct({
   contacts: ArraySchema(Struct({
     name: String4,
-    email: optionalKey2(Union2([String4, Null2])),
-    phone: optionalKey2(Union2([String4, Null2])),
+    displayName: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
+    avatar: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
+    identities: optionalKey2(Union2([ArraySchema(ContactIdentityInput), Null2])),
+    profile: optionalKey2(Union2([Union2([ContactProfile, Null2]), Null2])),
+    preferences: optionalKey2(Union2([Union2([ContactPreferences, Null2]), Null2])),
     tags: optionalKey2(Union2([ArraySchema(String4), Null2])),
-    firstName: optionalKey2(Union2([String4, Null2])),
-    lastName: optionalKey2(Union2([String4, Null2])),
-    company: optionalKey2(Union2([String4, Null2])),
-    jobTitle: optionalKey2(Union2([String4, Null2])),
-    customFields: optionalKey2(Union2([UnknownRecord, Null2]))
+    status: optionalKey2(Union2([Union2([
+      Literal2("active"),
+      Literal2("paused"),
+      Literal2("blocked"),
+      Literal2("archived")
+    ]), Null2])),
+    statusReason: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
+    externalId: optionalKey2(Union2([Union2([String4, Null2]), Null2])),
+    metadata: optionalKey2(Union2([Union2([JsonObject, Null2]), Null2]))
   })),
-  upsertByEmail: optionalKey2(Union2([Boolean3, Null2]))
+  onConflict: optionalKey2(Union2([Union2([Literal2("skip"), Literal2("update")]), Null2]))
 });
 var ContactsBulkImport200 = Struct({
   total: Finite.check(isInt().annotate({ expected: "an integer" })).check(isGreaterThanOrEqualTo2(0).annotate({ expected: "a value greater than or equal to 0" })),
@@ -52080,6 +52264,31 @@ var ExtensionInstallationsGetRun404 = ResourceNotFoundError;
 var ExtensionInstallationsGetRun422 = ValidationError;
 var ExtensionInstallationsGetRun500 = InternalError;
 var ExtensionInstallationsGetRun504 = GatewayTimeoutError;
+var ExtensionInstallationsUpgradePathParams = Struct({ id: ExtensionInstallationId });
+var ExtensionInstallationsUpgradeRequestJson = Struct({
+  version: optionalKey2(Union2([Union2([String4.check(isPattern2(/* @__PURE__ */ new RegExp("^\\d{1,6}\\.\\d{1,6}\\.\\d{1,6}(?:-[0-9A-Za-z.-]{1,64})?$", "u")).annotate({ expected: "a string matching the RegExp ^\\d{1,6}\\.\\d{1,6}\\.\\d{1,6}(?:-[0-9A-Za-z.-]{1,64})?$" })), ExtensionVersionId]), Null2])),
+  acceptPermissions: optionalKey2(Union2([ArraySchema(Union2([
+    Literal2("permission:read"),
+    Literal2("permission:update"),
+    Literal2("permission:send"),
+    Literal2("permission:quarantine.read"),
+    Literal2("event:mailbox.message.received"),
+    Literal2("event:mailbox.message.sent"),
+    Literal2("event:mailbox.action.pending_approval"),
+    Literal2("event:mailbox.message.quarantined"),
+    Literal2("event:mailbox.message.released"),
+    Literal2("event:mailbox.message.discarded")
+  ])), Null2])),
+  dryRun: optionalKey2(Union2([Boolean3, Null2]))
+});
+var ExtensionInstallationsUpgrade200 = UpgradeExtensionResponse;
+var ExtensionInstallationsUpgrade401 = UnauthorizedError;
+var ExtensionInstallationsUpgrade403 = ForbiddenError;
+var ExtensionInstallationsUpgrade404 = ResourceNotFoundError;
+var ExtensionInstallationsUpgrade409 = ConflictError;
+var ExtensionInstallationsUpgrade422 = ValidationError;
+var ExtensionInstallationsUpgrade500 = InternalError;
+var ExtensionInstallationsUpgrade504 = GatewayTimeoutError;
 var ExtensionsListQuery = Struct({
   limit: optionalKey2(Union2([String4, Null2])),
   cursor: optionalKey2(Union2([Cursor, Null2])),
@@ -52270,12 +52479,14 @@ var MailboxesApproveActionPathParams = Struct({
 var MailboxesApproveAction200 = MailboxAction;
 var MailboxesApproveAction401 = UnauthorizedError;
 var MailboxesApproveAction402 = PaymentRequiredError;
-var MailboxesApproveAction403 = ForbiddenError;
+var MailboxesApproveAction403 = Union2([ForbiddenError, OnboardingReviewRequiredError]);
 var MailboxesApproveAction404 = ResourceNotFoundError;
 var MailboxesApproveAction409 = ConflictError;
 var MailboxesApproveAction422 = ValidationError;
+var MailboxesApproveAction429 = RateLimitedError;
 var MailboxesApproveAction500 = InternalError;
 var MailboxesApproveAction502 = BillingProviderError;
+var MailboxesApproveAction503 = SenderNotReadyError;
 var MailboxesApproveAction504 = GatewayTimeoutError;
 var MailboxesDenyActionPathParams = Struct({
   id: MailboxId,
@@ -52386,12 +52597,14 @@ var MailboxesSendDraftHeaders = Struct({ "idempotency-key": optionalKey2(Union2(
 var MailboxesSendDraft200 = MailboxSendReceipt;
 var MailboxesSendDraft401 = UnauthorizedError;
 var MailboxesSendDraft402 = PaymentRequiredError;
-var MailboxesSendDraft403 = ForbiddenError;
+var MailboxesSendDraft403 = Union2([ForbiddenError, OnboardingReviewRequiredError]);
 var MailboxesSendDraft404 = ResourceNotFoundError;
 var MailboxesSendDraft409 = ConflictError;
 var MailboxesSendDraft422 = ValidationError;
+var MailboxesSendDraft429 = RateLimitedError;
 var MailboxesSendDraft500 = InternalError;
 var MailboxesSendDraft502 = BillingProviderError;
+var MailboxesSendDraft503 = SenderNotReadyError;
 var MailboxesSendDraft504 = GatewayTimeoutError;
 var MailboxesListEventsPathParams = Struct({ id: MailboxId });
 var MailboxesListEventsQuery = Struct({
@@ -52546,12 +52759,14 @@ var MailboxesSendMessageRequestJson = Struct({
 var MailboxesSendMessage200 = MailboxSendReceipt;
 var MailboxesSendMessage401 = UnauthorizedError;
 var MailboxesSendMessage402 = PaymentRequiredError;
-var MailboxesSendMessage403 = ForbiddenError;
+var MailboxesSendMessage403 = Union2([ForbiddenError, OnboardingReviewRequiredError]);
 var MailboxesSendMessage404 = ResourceNotFoundError;
 var MailboxesSendMessage409 = ConflictError;
 var MailboxesSendMessage422 = ValidationError;
+var MailboxesSendMessage429 = RateLimitedError;
 var MailboxesSendMessage500 = InternalError;
 var MailboxesSendMessage502 = BillingProviderError;
+var MailboxesSendMessage503 = SenderNotReadyError;
 var MailboxesSendMessage504 = GatewayTimeoutError;
 var MailboxesGetMessagePathParams = Struct({
   id: MailboxId,
@@ -52605,12 +52820,14 @@ var MailboxesForwardRequestJson = Struct({
 var MailboxesForward200 = MailboxSendReceipt;
 var MailboxesForward401 = UnauthorizedError;
 var MailboxesForward402 = PaymentRequiredError;
-var MailboxesForward403 = ForbiddenError;
+var MailboxesForward403 = Union2([ForbiddenError, OnboardingReviewRequiredError]);
 var MailboxesForward404 = ResourceNotFoundError;
 var MailboxesForward409 = ConflictError;
 var MailboxesForward422 = ValidationError;
+var MailboxesForward429 = RateLimitedError;
 var MailboxesForward500 = InternalError;
 var MailboxesForward502 = BillingProviderError;
+var MailboxesForward503 = SenderNotReadyError;
 var MailboxesForward504 = GatewayTimeoutError;
 var MailboxesGetMessageRawPathParams = Struct({
   id: MailboxId,
@@ -52650,12 +52867,14 @@ var MailboxesReplyRequestJson = Struct({
 var MailboxesReply200 = MailboxSendReceipt;
 var MailboxesReply401 = UnauthorizedError;
 var MailboxesReply402 = PaymentRequiredError;
-var MailboxesReply403 = ForbiddenError;
+var MailboxesReply403 = Union2([ForbiddenError, OnboardingReviewRequiredError]);
 var MailboxesReply404 = ResourceNotFoundError;
 var MailboxesReply409 = ConflictError;
 var MailboxesReply422 = ValidationError;
+var MailboxesReply429 = RateLimitedError;
 var MailboxesReply500 = InternalError;
 var MailboxesReply502 = BillingProviderError;
+var MailboxesReply503 = SenderNotReadyError;
 var MailboxesReply504 = GatewayTimeoutError;
 var MailboxesReplyAllPathParams = Struct({
   id: MailboxId,
@@ -52672,12 +52891,14 @@ var MailboxesReplyAllRequestJson = Struct({
 var MailboxesReplyAll200 = MailboxSendReceipt;
 var MailboxesReplyAll401 = UnauthorizedError;
 var MailboxesReplyAll402 = PaymentRequiredError;
-var MailboxesReplyAll403 = ForbiddenError;
+var MailboxesReplyAll403 = Union2([ForbiddenError, OnboardingReviewRequiredError]);
 var MailboxesReplyAll404 = ResourceNotFoundError;
 var MailboxesReplyAll409 = ConflictError;
 var MailboxesReplyAll422 = ValidationError;
+var MailboxesReplyAll429 = RateLimitedError;
 var MailboxesReplyAll500 = InternalError;
 var MailboxesReplyAll502 = BillingProviderError;
+var MailboxesReplyAll503 = SenderNotReadyError;
 var MailboxesReplyAll504 = GatewayTimeoutError;
 var MailboxesPausePathParams = Struct({ id: MailboxId });
 var MailboxesPause200 = Mailbox;
@@ -53028,7 +53249,7 @@ var MessagesSend422 = ValidationError;
 var MessagesSend429 = RateLimitedError;
 var MessagesSend500 = InternalError;
 var MessagesSend502 = Union2([BillingProviderError, ExternalServiceError]);
-var MessagesSend503 = DeliveryUnavailableError;
+var MessagesSend503 = Union2([SenderNotReadyError, DeliveryUnavailableError]);
 var MessagesSend504 = GatewayTimeoutError;
 var MessagesGetPathParams = Struct({ id: MessageId });
 var MessagesGet200 = Message;
@@ -53330,6 +53551,7 @@ var ScheduledMessagesResume409 = ConflictError;
 var ScheduledMessagesResume422 = ValidationError;
 var ScheduledMessagesResume500 = InternalError;
 var ScheduledMessagesResume502 = ExternalServiceError;
+var ScheduledMessagesResume503 = SenderNotReadyError;
 var ScheduledMessagesResume504 = GatewayTimeoutError;
 var MessagesValidateEmailRequestJson = Struct({
   conversationId: optionalKey2(Union2([Union2([ConversationId, Null2]), Null2])),
@@ -53347,6 +53569,7 @@ var MessagesValidateEmail403 = ForbiddenError;
 var MessagesValidateEmail404 = ResourceNotFoundError;
 var MessagesValidateEmail422 = ValidationError;
 var MessagesValidateEmail500 = InternalError;
+var MessagesValidateEmail503 = SenderNotReadyError;
 var MessagesValidateEmail504 = GatewayTimeoutError;
 var NamespacesListQuery = Struct({
   limit: optionalKey2(Union2([String4, Null2])),
@@ -55846,6 +56069,7 @@ var CampaignsGroup = class extends make38("Campaigns").add(get5("campaignsList",
     CampaignsScheduleRun422.pipe(status(422)),
     CampaignsScheduleRun500,
     CampaignsScheduleRun502.pipe(status(502)),
+    CampaignsScheduleRun503.pipe(status(503)),
     CampaignsScheduleRun504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "campaigns.scheduleRun").annotate(Summary, "Schedule a campaign run").annotate(Description, "Schedules an email campaign run at the absolute ISO-8601 instant in scheduledFor, or immediately when omitted. The optional idempotencyKey is scoped to the organization and replays return the original run. An email campaign must carry the brand footer: it is refused with CampaignFooterRequiredError when its footer is off and its template renders no BrandFooter, and with BrandAddressRequiredError when a brand that signs it off has no postal address."), get5("campaignsGetRun", "/v1/campaigns/:id/runs/:runId", {
@@ -56191,7 +56415,7 @@ var ContactsGroup = class extends make38("Contacts").add(get5("contactsList", "/
     ContactsBulkImport502.pipe(status(502)),
     ContactsBulkImport504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "contacts.bulkImport").annotate(Summary, "Bulk import contacts").annotate(Description, "Creates or updates contacts in bulk from a list, returning per-entry results with created, updated, skipped, and error counts."), post("contactsBulkUpdateStatus", "/v1/contacts/bulk-update-status", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "contacts.bulkImport").annotate(Summary, "Bulk import contacts").annotate(Description, 'Creates contacts in bulk from a list of entries shaped like a create request, returning per-entry results with created, updated, skipped, and error counts. An entry whose identities match an existing contact is skipped, or updates it with `onConflict: "update"`.'), post("contactsBulkUpdateStatus", "/v1/contacts/bulk-update-status", {
   payload: ContactsBulkUpdateStatusRequestJson,
   success: ContactsBulkUpdateStatus200,
   error: [
@@ -57273,7 +57497,20 @@ var ExtensionInstallationsGroup = class extends make38("Extension installations"
     ExtensionInstallationsGetRun500,
     ExtensionInstallationsGetRun504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "extensionInstallations.getRun").annotate(Summary, "Get a hosted run").annotate(Description, "Returns one retained run with the lines its handler logged: at most 50 lines of 500 characters.")).annotate(Description, "Extension versions installed into the organization, each acting as its own principal") {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "extensionInstallations.getRun").annotate(Summary, "Get a hosted run").annotate(Description, "Returns one retained run with the lines its handler logged: at most 50 lines of 500 characters."), post("extensionInstallationsUpgrade", "/v1/extension-installations/:id/upgrade", {
+  params: ExtensionInstallationsUpgradePathParams,
+  payload: ExtensionInstallationsUpgradeRequestJson,
+  success: ExtensionInstallationsUpgrade200,
+  error: [
+    ExtensionInstallationsUpgrade401.pipe(status(401)),
+    ExtensionInstallationsUpgrade403.pipe(status(403)),
+    ExtensionInstallationsUpgrade404.pipe(status(404)),
+    ExtensionInstallationsUpgrade409.pipe(status(409)),
+    ExtensionInstallationsUpgrade422.pipe(status(422)),
+    ExtensionInstallationsUpgrade500,
+    ExtensionInstallationsUpgrade504.pipe(status(504))
+  ]
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "extensionInstallations.upgrade").annotate(Summary, "Upgrade or roll back an installation").annotate(Description, "Changes the pinned version in place. Omit version for the latest publication, or name a version string or id, including an older version to roll back. Preview with dryRun; changing requires acceptPermissions to list exactly the added permission: and event: grants. Only a person can upgrade. Credentials, owner, scope, send mode, and status stay attached to the installation.")).annotate(Description, "Extension versions installed into the organization, each acting as its own principal") {
 };
 var ExtensionsGroup = class extends make38("Extensions").add(get5("extensionsList", "/v1/extensions", {
   query: ExtensionsListQuery,
@@ -57427,8 +57664,10 @@ var MailboxesGroup = class extends make38("Mailboxes").add(get5("mailboxesList",
     MailboxesApproveAction404.pipe(status(404)),
     MailboxesApproveAction409.pipe(status(409)),
     MailboxesApproveAction422.pipe(status(422)),
+    MailboxesApproveAction429.pipe(status(429)),
     MailboxesApproveAction500,
     MailboxesApproveAction502.pipe(status(502)),
+    MailboxesApproveAction503.pipe(status(503)),
     MailboxesApproveAction504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.approveAction").annotate(Summary, "Approve a mailbox action").annotate(Description, "Approves an action waiting for approval, executes it, and returns the executed action. Only a person signed in or through OAuth may approve, and never the one who proposed it."), post("mailboxesDenyAction", "/v1/mailboxes/:id/actions/:actionId/deny", {
@@ -57526,8 +57765,10 @@ var MailboxesGroup = class extends make38("Mailboxes").add(get5("mailboxesList",
     MailboxesSendDraft404.pipe(status(404)),
     MailboxesSendDraft409.pipe(status(409)),
     MailboxesSendDraft422.pipe(status(422)),
+    MailboxesSendDraft429.pipe(status(429)),
     MailboxesSendDraft500,
     MailboxesSendDraft502.pipe(status(502)),
+    MailboxesSendDraft503.pipe(status(503)),
     MailboxesSendDraft504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.sendDraft").annotate(Summary, "Send a draft").annotate(Description, "Sends one of the caller's drafts: a reply draft in its thread, any other draft as a new conversation. A draft needs recipients, a subject, and a body."), get5("mailboxesListEvents", "/v1/mailboxes/:id/events", {
@@ -57662,8 +57903,10 @@ var MailboxesGroup = class extends make38("Mailboxes").add(get5("mailboxesList",
     MailboxesSendMessage404.pipe(status(404)),
     MailboxesSendMessage409.pipe(status(409)),
     MailboxesSendMessage422.pipe(status(422)),
+    MailboxesSendMessage429.pipe(status(429)),
     MailboxesSendMessage500,
     MailboxesSendMessage502.pipe(status(502)),
+    MailboxesSendMessage503.pipe(status(503)),
     MailboxesSendMessage504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.sendMessage").annotate(Summary, "Send a new message").annotate(Description, "Starts a new conversation from the mailbox's default From address. `status` is `sent`, or `pending_approval` when the caller's grant or a mailbox policy holds sends for a person's approval; a policy that denies sends refuses it with 403."), get5("mailboxesGetMessage", "/v1/mailboxes/:id/messages/:messageId", {
@@ -57713,8 +57956,10 @@ var MailboxesGroup = class extends make38("Mailboxes").add(get5("mailboxesList",
     MailboxesForward404.pipe(status(404)),
     MailboxesForward409.pipe(status(409)),
     MailboxesForward422.pipe(status(422)),
+    MailboxesForward429.pipe(status(429)),
     MailboxesForward500,
     MailboxesForward502.pipe(status(502)),
+    MailboxesForward503.pipe(status(503)),
     MailboxesForward504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.forward").annotate(Summary, "Forward a message").annotate(Description, "Forwards the message to new recipients as a new conversation, with the original quoted below the caller's text and its attachments attached ahead of any the caller adds. The combined attachments must fit the email attachment limits."), get5("mailboxesGetMessageRaw", "/v1/mailboxes/:id/messages/:messageId/raw", {
@@ -57752,8 +57997,10 @@ var MailboxesGroup = class extends make38("Mailboxes").add(get5("mailboxesList",
     MailboxesReply404.pipe(status(404)),
     MailboxesReply409.pipe(status(409)),
     MailboxesReply422.pipe(status(422)),
+    MailboxesReply429.pipe(status(429)),
     MailboxesReply500,
     MailboxesReply502.pipe(status(502)),
+    MailboxesReply503.pipe(status(503)),
     MailboxesReply504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.reply").annotate(Summary, "Reply to a message").annotate(Description, "Replies to the message's Reply-To address, or its sender, in the same thread. The server sets the recipients, subject, and threading headers."), post("mailboxesReplyAll", "/v1/mailboxes/:id/messages/:messageId/reply-all", {
@@ -57768,8 +58015,10 @@ var MailboxesGroup = class extends make38("Mailboxes").add(get5("mailboxesList",
     MailboxesReplyAll404.pipe(status(404)),
     MailboxesReplyAll409.pipe(status(409)),
     MailboxesReplyAll422.pipe(status(422)),
+    MailboxesReplyAll429.pipe(status(429)),
     MailboxesReplyAll500,
     MailboxesReplyAll502.pipe(status(502)),
+    MailboxesReplyAll503.pipe(status(503)),
     MailboxesReplyAll504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "mailboxes.replyAll").annotate(Summary, "Reply to all recipients of a message").annotate(Description, "Replies to the sender and every other recipient of the message except the mailbox itself, in the same thread."), post("mailboxesPause", "/v1/mailboxes/:id/pause", {
@@ -58006,7 +58255,7 @@ var MediaGroup = class extends make38("Media").add(post("mediaCreate", "/v1/medi
     MediaCreate500,
     MediaCreate504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "media.create").annotate(Summary, "Create a media object").annotate(Description, "Creates the media object in the pending state and returns it with the upload instruction \u2014 URL, method, and headers \u2014 for putting its bytes into storage."), get5("mediaGetById", "/v1/media/:id", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "media.create").annotate(Summary, "Create a media object").annotate(Description, "Creates the media object in the pending state and returns it with the upload instruction \u2014 URL, method, and headers \u2014 for putting its bytes into storage. Requires `messages:create`, or `email:send` for `attachment` media."), get5("mediaGetById", "/v1/media/:id", {
   params: MediaGetByIdPathParams,
   success: MediaGetById200,
   error: [
@@ -58039,7 +58288,7 @@ var MediaGroup = class extends make38("Media").add(post("mediaCreate", "/v1/medi
     MediaComplete500,
     MediaComplete504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "media.complete").annotate(Summary, "Complete a media upload").annotate(Description, "Verifies the uploaded object exists in storage, marks the media object ready, and returns it with a download URL."), get5("mediaDownloadUrl", "/v1/media/:id/url", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "media.complete").annotate(Summary, "Complete a media upload").annotate(Description, "Verifies the uploaded object exists in storage, marks the media object ready, and returns it with a download URL. Requires the permission that creating the media object did."), get5("mediaDownloadUrl", "/v1/media/:id/url", {
   params: MediaDownloadUrlPathParams,
   success: MediaDownloadUrl200,
   error: [
@@ -58168,6 +58417,7 @@ var MessagesGroup = class extends make38("Messages").add(get5("messagesList", "/
     MessagesValidateEmail404.pipe(status(404)),
     MessagesValidateEmail422.pipe(status(422)),
     MessagesValidateEmail500,
+    MessagesValidateEmail503.pipe(status(503)),
     MessagesValidateEmail504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "messages.validateEmail").annotate(Summary, "Validate an email message").annotate(Description, "Resolves recipients, sender, and inline or published-template content without sending anything, creating contacts or messages, or counting toward your quota.")).annotate(Description, "Send messages and read their delivery state and timeline.") {
@@ -58229,6 +58479,7 @@ var ScheduledMessagesGroup = class extends make38("Scheduled Messages").add(get5
     ScheduledMessagesResume422.pipe(status(422)),
     ScheduledMessagesResume500,
     ScheduledMessagesResume502.pipe(status(502)),
+    ScheduledMessagesResume503.pipe(status(503)),
     ScheduledMessagesResume504.pipe(status(504))
   ]
 }).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "scheduledMessages.resume").annotate(Summary, "Resume a review-paused scheduled message").annotate(Description, "Explicitly resumes a scheduled message after onboarding review clearance. An overdue message requires either send_now or a new future scheduledFor value.")).annotate(Description, "One-off scheduled message timers") {
@@ -58277,7 +58528,7 @@ var NamespacesGroup = class extends make38("Namespaces").add(get5("namespacesLis
     NamespacesRemove500,
     NamespacesRemove504.pipe(status(504))
   ]
-}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "namespaces.remove").annotate(Summary, "Delete a namespace").annotate(Description, "Deletes an empty namespace. A namespace that still holds mailboxes or API keys conflicts: remove or move them first."), patch("namespacesUpdate", "/v1/namespaces/:id", {
+}).middleware(ApiKeySecurityMiddleware).annotate(Identifier, "namespaces.remove").annotate(Summary, "Delete a namespace").annotate(Description, "Deletes an empty namespace. A namespace that still holds mailboxes, API keys, or webhook endpoints conflicts: remove them first."), patch("namespacesUpdate", "/v1/namespaces/:id", {
   params: NamespacesUpdatePathParams,
   payload: NamespacesUpdateRequestJson,
   success: NamespacesUpdate200,
@@ -59039,7 +59290,18 @@ var make39 = (config) => gen2(function* () {
   for (const [name, value] of Object.entries(config.headers ?? {}))
     if (value !== undefined)
       headers[name] = value;
+  const storage = yield* HttpClient;
+  const putUpload = (input) => storage.execute(make33(input.method)(input.url).pipe(bodyUint8Array(input.bytes, uploadContentType(input.headers)), setHeaders(input.headers))).pipe(mapError2((cause) => new MediaUploadError({
+    filename: input.filename,
+    mediaId: input.mediaId,
+    cause
+  })), flatMap3((response) => response.status >= 200 && response.status < 300 ? void_3 : fail6(new MediaUploadError({
+    filename: input.filename,
+    mediaId: input.mediaId,
+    status: response.status
+  }))));
   return Service3.of({
+    putUpload,
     raw,
     operation: (name) => flat[name],
     connection: {
@@ -59055,7 +59317,7 @@ var layer16 = (config) => effect(Service3, make39(config));
 var layerFetch = (config) => layer16(config).pipe(provide2(layer15));
 var raw2 = map7(Service3, (client) => client.raw);
 
-// ../sdk/dist/categories-DvsHUJtX.js
+// ../sdk/dist/categories-Bcwq5jPV.js
 var SamvaErrorMetadata = {
   AnalyticsQueryError: {
     categories: [],
@@ -59121,6 +59383,10 @@ var SamvaErrorMetadata = {
     categories: ["notFound"],
     retryable: false
   },
+  SenderNotReadyError: {
+    categories: ["transient"],
+    retryable: true
+  },
   UnauthorizedError: {
     categories: ["auth"],
     retryable: false
@@ -59216,7 +59482,7 @@ var generateIdempotencyKey = gen2(function* () {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 });
 
-// ../sdk/dist/operation-BEghYyLu.js
+// ../sdk/dist/operation-B_Ty1LG-.js
 var SDK_OPERATION_CALLS = {
   brandsList: { kind: "none" },
   brandsCreate: { kind: "payload" },
@@ -60146,6 +60412,10 @@ var SDK_OPERATION_CALLS = {
   },
   extensionInstallationsList: { kind: "params" },
   extensionInstallationsInstall: { kind: "payload" },
+  extensionInstallationsUpgrade: {
+    kind: "pathPayload",
+    paths: ["id"]
+  },
   extensionInstallationsGet: {
     kind: "path",
     paths: ["id"]
@@ -60322,11 +60592,35 @@ var make40 = (operationName) => {
   }
   return operation;
 };
+var uploadOversizedAttachments = (client, payload) => gen2(function* () {
+  const plan = planInlineUploads(payload);
+  if (plan.length === 0)
+    return payload;
+  const uploaded = /* @__PURE__ */ new Map;
+  for (const upload of plan) {
+    const created = yield* rawOperation(client, "mediaCreate")({ payload: mediaCreateBody(upload) });
+    yield* client.putUpload({
+      filename: upload.filename,
+      mediaId: created.id,
+      url: created.upload.url,
+      method: created.upload.method,
+      headers: created.upload.headers,
+      bytes: upload.bytes
+    });
+    yield* rawOperation(client, "mediaComplete")({ params: { id: created.id } });
+    uploaded.set(upload.index, {
+      mediaId: created.id,
+      upload
+    });
+  }
+  return withUploadedAttachments(payload, uploaded);
+});
 var sendPayload = (payload, options) => gen2(function* () {
   const client = yield* Service3;
   const idempotencyKey = options?.idempotencyKey ?? (yield* generateIdempotencyKey);
+  const prepared = yield* uploadOversizedAttachments(client, payload);
   return yield* withRetry(rawOperation(client, "messagesSend")({
-    payload: stripUndefined(payload),
+    payload: stripUndefined(prepared),
     headers: { "idempotency-key": idempotencyKey }
   }));
 });
@@ -60519,6 +60813,7 @@ var getForwardingLog = make40("emailGetForwardingLog");
 // ../sdk/dist/effect/extension-installations.js
 var list9 = make40("extensionInstallationsList");
 var install = make40("extensionInstallationsInstall");
+var upgrade = make40("extensionInstallationsUpgrade");
 var get11 = make40("extensionInstallationsGet");
 var uninstall = make40("extensionInstallationsUninstall");
 var disable = make40("extensionInstallationsDisable");
@@ -60589,7 +60884,7 @@ var DIAGNOSE_TIMEOUT_MILLIS = 1e4;
 var MAILBOX_EVENT_STREAM_PING_FRAME = '{"kind":"ping"}';
 var MAILBOX_EVENT_STREAM_PING_MILLIS = 30000;
 var MAILBOX_EVENT_STREAM_IDLE_MILLIS = 3 * MAILBOX_EVENT_STREAM_PING_MILLIS;
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var frameText = (raw) => {
   if (typeof raw === "string")
     return raw;
@@ -60606,16 +60901,16 @@ var decodeFrame = (raw) => {
   } catch {
     return;
   }
-  if (isRecord(parsed) && parsed.kind === "pong")
+  if (isRecord2(parsed) && parsed.kind === "pong")
     return { kind: "pong" };
-  if (!isRecord(parsed) || typeof parsed.cursor !== "string")
+  if (!isRecord2(parsed) || typeof parsed.cursor !== "string")
     return;
   if (parsed.kind === "live" || parsed.kind === "progress")
     return {
       kind: parsed.kind,
       cursor: parsed.cursor
     };
-  if (parsed.kind !== "event" || typeof parsed.id !== "string" || !isRecord(parsed.event))
+  if (parsed.kind !== "event" || typeof parsed.id !== "string" || !isRecord2(parsed.event))
     return;
   const { type, timestamp, data } = parsed.event;
   if (typeof type !== "string" || typeof timestamp !== "string")
@@ -60713,7 +61008,7 @@ var closeOutcome = (closeCode) => {
   }
 };
 var fieldsOf = (value) => {
-  if (!isRecord(value))
+  if (!isRecord2(value))
     return;
   const fields = {};
   for (const [path, messages] of Object.entries(value))
@@ -60722,7 +61017,7 @@ var fieldsOf = (value) => {
   return fields;
 };
 var refusalOutcome = (refusal) => {
-  const body = isRecord(refusal.body) ? refusal.body : {};
+  const body = isRecord2(refusal.body) ? refusal.body : {};
   const serverTag = typeof body._tag === "string" ? body._tag : undefined;
   const known = serverTag !== undefined && REFUSAL_TAGS.has(serverTag);
   const _tag = known ? serverTag : REFUSAL_TAG_BY_STATUS[refusal.status] ?? "StreamRefusedError";
@@ -61018,7 +61313,7 @@ var MailboxEventStream = class {
             id: frame.id,
             type: frame.event.type,
             timestamp: frame.event.timestamp,
-            data: isRecord(frame.event.data) ? frame.event.data : {}
+            data: isRecord2(frame.event.data) ? frame.event.data : {}
           });
           this.#wake();
           return;
@@ -61122,7 +61417,7 @@ var readRefusalBody = async (response) => {
   }
 };
 
-// ../sdk/dist/mailboxes-BtcktcNB.js
+// ../sdk/dist/mailboxes-D3Kx7elM.js
 var toStreamError = (cause) => cause instanceof MailboxEventStreamError ? cause : new MailboxEventStreamError({
   _tag: "StreamDisconnectedError",
   message: String(cause)
@@ -61407,6 +61702,7 @@ var apiStatuses = {
   BillingProviderError: 502,
   DeliveryUnavailableError: 503,
   ServiceUnavailableError: 503,
+  SenderNotReadyError: 503,
   EmailChannelError: 502,
   SmsChannelError: 502,
   WhatsAppChannelError: 502,
@@ -61444,6 +61740,9 @@ var apiErrorGuidance = (error) => {
     case "ServiceUnavailableError":
       next = typeof details.retryAfterSeconds === "number" ? `Wait ${details.retryAfterSeconds} seconds before retrying.` : "Wait a moment before retrying.";
       break;
+    case "SenderNotReadyError":
+      next = typeof details.retryAfterSeconds === "number" ? `Wait ${details.retryAfterSeconds} seconds before retrying.` : "Wait for the sending identity to be ready before retrying.";
+      break;
     case "CursorExpiredError":
       next = "Read current state from the API, then retry without the cursor.";
       break;
@@ -61590,10 +61889,16 @@ var commandTree = {
     events: {},
     list: {},
     create: {},
+    get: {},
+    update: {},
+    pause: {},
+    resume: {},
+    remove: {},
     threads: {},
     read: {},
     send: {},
     reply: {},
+    actions: { list: {}, approve: {}, deny: {} },
     quarantine: { list: {}, release: {}, discard: {} }
   },
   extensions: {
@@ -63643,8 +63948,117 @@ var reapply = make29("reapply", { json: jsonFlag }).pipe(withDescription3("Resub
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var reviewCommand = make29("review").pipe(withDescription3("Inspect or resubmit email onboarding review"), withSubcommands([status3, reapply]));
 
+// src/lib/attachments.ts
+import { readFile as readFile3, stat as stat3 } from "fs/promises";
+import { basename, extname } from "path";
+
+// ../core/src/messages/attachment-budget.ts
+var EMAIL_ATTACHMENT_BUDGET = {
+  maxCount: 10,
+  maxItemBytes: 25 * 1024 * 1024,
+  maxAggregateBytes: 25 * 1024 * 1024,
+  maxInlineBytes: 4 * 1024 * 1024
+};
+var emailAttachmentBudgetViolation = (attachments) => {
+  if (attachments.length > EMAIL_ATTACHMENT_BUDGET.maxCount)
+    return "count";
+  let aggregateBytes = 0;
+  for (const attachment of attachments) {
+    if (!Number.isSafeInteger(attachment.size) || attachment.size <= 0 || attachment.size > EMAIL_ATTACHMENT_BUDGET.maxItemBytes) {
+      return "itemBytes";
+    }
+    aggregateBytes += attachment.size;
+    if (aggregateBytes > EMAIL_ATTACHMENT_BUDGET.maxAggregateBytes)
+      return "aggregateBytes";
+  }
+  return null;
+};
+var emailAttachmentBudgetMessage = (violation) => {
+  switch (violation) {
+    case "count":
+      return `Email supports at most ${EMAIL_ATTACHMENT_BUDGET.maxCount} attachments`;
+    case "itemBytes":
+      return `Each email attachment must be between 1 byte and ${EMAIL_ATTACHMENT_BUDGET.maxItemBytes} bytes`;
+    case "aggregateBytes":
+      return `Email attachments must total at most ${EMAIL_ATTACHMENT_BUDGET.maxAggregateBytes} bytes`;
+  }
+};
+var emailInlineAttachmentBytes = (attachments) => attachments.reduce((total, attachment) => attachment.content === undefined ? total : total + attachment.size, 0);
+var EMAIL_INLINE_ATTACHMENT_MESSAGE = `Inline attachment content must total at most ${EMAIL_ATTACHMENT_BUDGET.maxInlineBytes} bytes. Upload larger files with POST /v1/media and send their mediaId instead of content.`;
+
+// src/lib/attachments.ts
+var CONTENT_TYPE_BY_EXTENSION = {
+  ".csv": "text/csv",
+  ".doc": "application/msword",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".gif": "image/gif",
+  ".htm": "text/html",
+  ".html": "text/html",
+  ".ics": "text/calendar",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".json": "application/json",
+  ".md": "text/markdown",
+  ".mp3": "audio/mpeg",
+  ".mp4": "video/mp4",
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".ppt": "application/vnd.ms-powerpoint",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".svg": "image/svg+xml",
+  ".txt": "text/plain",
+  ".webp": "image/webp",
+  ".xls": "application/vnd.ms-excel",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".xml": "application/xml",
+  ".zip": "application/zip"
+};
+var contentTypeForPath = (path) => CONTENT_TYPE_BY_EXTENSION[extname(path).toLowerCase()] ?? "application/octet-stream";
+var attachmentError = (code, message) => new CliUsageError({ code, message });
+var describeCause = (cause) => cause instanceof Error ? cause.message : String(cause);
+var unreadable = (path) => (cause) => attachmentError("attachment_unreadable", `Cannot read --attach ${path}: ${describeCause(cause)}`);
+var checkAttachmentBudget = (files) => gen2(function* () {
+  for (const file of files) {
+    if (file.size === 0) {
+      return yield* attachmentError("attachment_empty", `--attach ${file.path} is empty; an attachment must be at least 1 byte.`);
+    }
+    if (file.size > EMAIL_ATTACHMENT_BUDGET.maxItemBytes) {
+      return yield* attachmentError("attachment_too_large", `--attach ${file.path} is ${file.size} bytes; each attachment must be at most ${EMAIL_ATTACHMENT_BUDGET.maxItemBytes} bytes.`);
+    }
+  }
+  const violation = emailAttachmentBudgetViolation(files);
+  if (violation !== null) {
+    const total = files.reduce((sum, file) => sum + file.size, 0);
+    return yield* attachmentError(`attachment_budget_${violation}`, `${emailAttachmentBudgetMessage(violation)} (got ${files.length} files, ${total} bytes).`);
+  }
+});
+var readAttachments = (paths) => gen2(function* () {
+  const sizes = yield* forEach2(paths, (path) => tryPromise2({
+    try: async () => ({ path, size: (await stat3(path)).size }),
+    catch: unreadable(path)
+  }));
+  yield* checkAttachmentBudget(sizes);
+  const files = yield* forEach2(paths, (path) => tryPromise2({
+    try: async () => ({
+      path,
+      filename: basename(path),
+      contentType: contentTypeForPath(path),
+      bytes: await readFile3(path)
+    }),
+    catch: unreadable(path)
+  }));
+  yield* checkAttachmentBudget(files.map((file) => ({ path: file.path, size: file.bytes.length })));
+  return files;
+});
+var toSendAttachments = (files) => files.map((file) => ({
+  filename: file.filename,
+  contentType: file.contentType,
+  size: file.bytes.length,
+  content: Buffer.from(file.bytes).toString("base64")
+}));
+
 // src/lib/stdin.ts
-import { readFile as readFile3 } from "fs";
+import { readFile as readFile4 } from "fs";
 import { isatty as isatty2 } from "tty";
 import { promisify } from "util";
 var readStdinUtf8 = gen2(function* () {
@@ -63654,7 +64068,7 @@ var readStdinUtf8 = gen2(function* () {
     });
   }
   return yield* tryPromise2({
-    try: () => promisify(readFile3)(0, "utf8"),
+    try: () => promisify(readFile4)(0, "utf8"),
     catch: () => new SamvaCliError({ message: "Could not read stdin." })
   });
 });
@@ -63965,6 +64379,7 @@ var replyToAddressFlag = String9("reply-to").pipe(withDescription2("Reply-To hea
 var idempotencyKeyFlag2 = String9("idempotency-key").pipe(withDescription2("Key (1-255 characters) so identical retries return the original email"), optional4);
 var trackOpensFlag2 = Literals3("track-opens", ["on", "off"]).pipe(withDescription2("Override open tracking for this send; recipient opt-out still wins"), optional4);
 var trackClicksFlag2 = Literals3("track-clicks", ["on", "off"]).pipe(withDescription2("Override click tracking for this send; recipient opt-out still wins"), optional4);
+var attachFlag = String9("attach").pipe(withDescription2("File to attach (repeatable); small files travel inline, larger ones upload through media first"), atLeast2(0));
 var dryRunFlag2 = Boolean6("dry-run").pipe(withDescription2("Validate inputs and print the request payload without calling the API"), withDefault5(false));
 var bodySourceName = (input) => {
   if (input.templateRefValue)
@@ -64001,6 +64416,7 @@ var send3 = make29("send", {
   idempotencyKey: idempotencyKeyFlag2,
   trackOpens: trackOpensFlag2,
   trackClicks: trackClicksFlag2,
+  attach: attachFlag,
   dryRun: dryRunFlag2,
   wait: Boolean6("wait").pipe(withDescription2("Wait for delivered/read or a terminal delivery failure"), withDefault5(false)),
   timeout: timeoutFlag,
@@ -64029,6 +64445,10 @@ var send3 = make29("send", {
   {
     command: "samva email send --to you@example.com --subject Hi --text Hello --idempotency-key welcome-email-ada",
     description: "Retry a send safely with an idempotency key"
+  },
+  {
+    command: "samva email send --to you@example.com --subject Report --text Attached --attach ./report.pdf --attach ./data.csv",
+    description: "Attach files; those past the 4 MiB inline limit upload through media automatically"
   }
 ]), withHandler(({
   to,
@@ -64049,6 +64469,7 @@ var send3 = make29("send", {
   idempotencyKey,
   trackOpens,
   trackClicks,
+  attach,
   dryRun,
   wait,
   timeout,
@@ -64120,6 +64541,7 @@ var send3 = make29("send", {
       message: "Choose exactly one body source: --html, --text, or a template (--template-id/--template-slug)."
     });
   }
+  const attachmentFiles = yield* readAttachments(attach);
   const request = {
     to: [...to],
     ...ccValue ? { cc: [{ email: ccValue }] } : {},
@@ -64166,7 +64588,16 @@ var send3 = make29("send", {
       return yield* printJson({
         dryRun: true,
         bodySource: source,
-        request,
+        request: {
+          ...request,
+          ...attachmentFiles.length === 0 ? {} : {
+            attachments: attachmentFiles.map((file) => ({
+              filename: file.filename,
+              contentType: file.contentType,
+              size: file.bytes.length
+            }))
+          }
+        },
         idempotencyKey: idempotencyKeyValue
       });
     }
@@ -64182,6 +64613,10 @@ var send3 = make29("send", {
       ...request.inReplyToMessageId ? [["Reply to", request.inReplyToMessageId]] : [],
       ...request.replyTo ? [["Reply-To", request.replyTo]] : [],
       ...idempotencyKeyValue ? [["Idempotency key", idempotencyKeyValue]] : [],
+      ...attachmentFiles.map((file) => [
+        "Attachment",
+        `${file.filename} (${file.contentType}, ${file.bytes.length} bytes)`
+      ]),
       ...request.tracking ? [
         ["Track opens", request.tracking.opens],
         ["Track clicks", request.tracking.clicks]
@@ -64205,7 +64640,8 @@ ${truncateForDisplay(JSON.stringify(request.templateData, null, 2))}`);
     return;
   }
   const client = yield* getClientProvider;
-  const data = yield* send(request, sendOptions).pipe(client.provide, mapError2((error) => toCliApiError("Failed to send email", error)));
+  const attachments = toSendAttachments(attachmentFiles);
+  const data = yield* send({ ...request, ...attachments.length === 0 ? {} : { attachments } }, sendOptions).pipe(client.provide, mapError2((error) => toCliApiError("Failed to send email", error)));
   const finalMessage = waitDuration === undefined ? data : yield* waitForMessage(data, waitDuration);
   const projection = projectMessage(finalMessage);
   const outcome = wait ? lifecycleOf(finalMessage) : undefined;
@@ -64980,8 +65416,6 @@ var CONTACT_STATUS_VALUES = ["active", "paused", "blocked", "archived"];
 var contactStatusSchema = Literals(CONTACT_STATUS_VALUES);
 var ACTOR_STATUS_VALUES = ["active", "disabled", "archived"];
 var actorStatusSchema = Literals(ACTOR_STATUS_VALUES);
-var ACCESS_LEVEL_VALUES = ["public", "authenticated", "vip", "internal"];
-var accessLevelSchema = Literals(ACCESS_LEVEL_VALUES);
 var CONTACT_GROUP_TYPE_VALUES = ["static", "dynamic", "smart"];
 var contactGroupTypeSchema = Literals(CONTACT_GROUP_TYPE_VALUES);
 var CUSTOM_FIELD_TYPE_VALUES = ["text", "number", "boolean", "date", "select"];
@@ -65437,6 +65871,33 @@ var IanaTimezone2 = String4.check(makeFilter2(isIanaTimezone, {
 })).annotate({ identifier: "IanaTimezone" });
 
 // ../core/src/mailboxes/mailbox.ts
+var mailboxEventTypes = [
+  "mailbox.created",
+  "address.attached",
+  "email.received",
+  "email.released",
+  "email.sent",
+  "thread.created",
+  "thread.updated",
+  "draft.created",
+  "draft.updated",
+  "action.proposed",
+  "action.policy_decided",
+  "action.approval_requested",
+  "action.approval_resolved",
+  "action.executed",
+  "action.failed"
+];
+var mailboxActionScopes = [
+  "sendMessage",
+  "reply",
+  "updateDraft",
+  "createNote",
+  "assignThread",
+  "changeThreadState",
+  "call",
+  "extensionRequest"
+];
 var mailboxActorKinds = [
   "user",
   "apiKey",
@@ -65445,6 +65906,27 @@ var mailboxActorKinds = [
   "samvaAgent",
   "system"
 ];
+var mailboxActionSources = [
+  "humanUi",
+  "externalApi",
+  "aiSdkTool",
+  "extension",
+  "externalAgent",
+  "samvaManagedAgent",
+  "system"
+];
+var mailboxActionStates = [
+  "proposed",
+  "allowed",
+  "approvalRequired",
+  "policyDenied",
+  "approved",
+  "approvalDenied",
+  "executing",
+  "executed",
+  "failed"
+];
+var mailboxApproverKinds = ["user", "samvaAgent", "system"];
 var mailboxPermissions = [
   "mailbox:read",
   "mailbox:configure",
@@ -65474,7 +65956,6 @@ var extensionRuntimes = ["hosted", "webhook"];
 var ExtensionRuntime = Literals(extensionRuntimes);
 var ExtensionPermission = Literals(mailboxKeyActions);
 var EXTENSION_BUNDLE_MAX_BYTES = 1024 * 1024;
-var EXTENSION_TOOL_REQUEST_MAX_BYTES = 6 * 1024 * 1024;
 var uniqueValues = (values) => new Set(values).size === values.length;
 var ExtensionName = String4.check(isPattern2(/^[a-z][a-z0-9-]{1,62}[a-z0-9]$/u, {
   message: "An extension name is 3-64 lowercase letters, digits, and hyphens"
@@ -65577,6 +66058,38 @@ var InstallExtensionResponse2 = Struct({
     webhookSecret: SensitiveString2
   }))
 }).annotate({ identifier: "InstallExtensionResponse" });
+var ExtensionUpgradeGrant = Literals([
+  ...mailboxKeyActions.map((permission) => `permission:${permission}`),
+  ...MAILBOX_WEBHOOK_EVENT_TYPE_VALUES.map((event) => `event:${event}`)
+]);
+var ExtensionPermissionDiff2 = Struct({
+  added: ArraySchema(ExtensionUpgradeGrant),
+  removed: ArraySchema(ExtensionUpgradeGrant)
+}).annotate({ identifier: "ExtensionPermissionDiff" });
+var ExtensionVersionChange2 = Struct({
+  id: String4,
+  organizationId: OrganizationId2,
+  installationId: ExtensionInstallationId2,
+  extensionId: ExtensionId2,
+  fromVersion: ExtensionVersionRef2,
+  toVersion: ExtensionVersionRef2,
+  permissionDiff: ExtensionPermissionDiff2,
+  changedBy: UserId2,
+  changedAt: DateFromString
+}).annotate({ identifier: "ExtensionVersionChange" });
+var UpgradeExtensionPayload = Struct({
+  version: optional2(Union2([ExtensionVersionString, ExtensionVersionId2])),
+  acceptPermissions: optional2(ArraySchema(ExtensionUpgradeGrant).check(makeFilter2(uniqueValues, { message: "Each accepted grant is listed once" }))),
+  dryRun: optional2(Boolean3)
+}).annotate({ identifier: "UpgradeExtensionPayload" });
+var UpgradeExtensionResponse2 = Struct({
+  installation: ExtensionInstallation2,
+  fromVersion: ExtensionVersionRef2,
+  toVersion: ExtensionVersionRef2,
+  permissionDiff: ExtensionPermissionDiff2,
+  dryRun: Boolean3,
+  versionChange: NullOr(ExtensionVersionChange2)
+}).annotate({ identifier: "UpgradeExtensionResponse" });
 var ExtensionRunOutcome = Literals([
   "succeeded",
   "failed",
@@ -65837,10 +66350,14 @@ var initExtension = (dir, manifest) => gen2(function* () {
     "src/extension.ts": `import { defineExtension } from "@samva/mailbox";
 
 export default defineExtension({
-  manifest: ${JSON.stringify(manifest, null, 2)},
+  manifest: ${JSON.stringify(manifest, null, 2).replaceAll(`
+`, `
+  `)},
   on: {
     "mailbox.message.received": async (event, { samva, log }) => {
-      await samva.messages.reply(event.data.mailboxId, event.data.message.id, { text: "Thanks for your message. We received it." });
+      await samva.messages.reply(event.data.mailboxId, event.data.message.id, {
+        text: "Thanks for your message. We received it.",
+      });
       log("Acknowledged", event.data.message.id);
     },
   },
@@ -65869,6 +66386,10 @@ var undecodedStatus = (error) => isHttpClientError(error) ? error.response?.stat
 var GATED_NEXT = "Mailboxes are not enabled for this organization (the `mailbox` launch flag is off). Mailbox commands work once it is enabled.";
 var personOnlyNext = (action) => {
   switch (action) {
+    case "approve":
+      return "Approving an action needs a person signed in with `samva login`, different from its proposer; an API key cannot approve.";
+    case "deny":
+      return "Denying an action needs a person signed in with `samva login`, different from its proposer; an API key cannot deny.";
     case "release":
       return "Releasing a held message needs a person signed in with `samva login`; an API key cannot release.";
     case "discard":
@@ -65888,7 +66409,7 @@ var mailboxApiError = (prefix, error, options = {}) => {
       api: { reason: "FlagDisabledError", status: 404, details: {}, next: GATED_NEXT }
     });
   const failure = toCliApiError(prefix, error);
-  if (options.personOnly !== undefined && failure.api?.status === 403)
+  if (options.personOnly !== undefined && failure.api?.reason === "ForbiddenError")
     return new SamvaCliError({
       message: failure.message,
       api: { ...failure.api, next: personOnlyNext(options.personOnly) }
@@ -65936,26 +66457,98 @@ var ActivityRangeQuery = {
   }))
 };
 
-// src/commands/extensions-api.ts
-var printInstallationSummary = (item) => printFields([
-  ["Installation", item.id],
-  ["Extension", item.name],
-  ["Version", item.version.version],
+// src/commands/extensions-output.ts
+var printManifest = (item) => printFields([
+  ["Extension", `${item.name}@${item.version}`],
+  ["Display name", item.displayName],
+  ["Description", item.description === null ? "None" : item.description],
   ["Runtime", item.runtime],
-  ["Status", item.status]
+  ["Events", item.events.join(", ")],
+  ["Permissions", item.permissions.join(", ")]
 ]);
-var printInstallation = (item) => printFields([
-  ["Installation", item.id],
-  ["Extension", item.name],
-  ["Version", item.version.version],
+var printExtension = (item) => gen2(function* () {
+  yield* log(`${item.displayName} (${item.name})`);
+  yield* printFields([
+    ["Extension ID", item.id],
+    ["Description", item.description ?? "None"],
+    ["Runtime", item.runtime],
+    ["Latest version", `${item.latestVersion.version} (${item.latestVersion.id})`],
+    ["Created", item.createdAt],
+    ["Updated", item.updatedAt]
+  ]);
+});
+var printVersionSummary = (item) => printFields([
+  ["Version", `${item.version} (${item.id})`],
   ["Runtime", item.runtime],
-  ["Status", item.status],
-  ["Permissions", item.permissions.join(", ")],
-  ["Send mode", item.sendMode],
-  ["Mailboxes", item.scope.mailboxIds?.join(", ") ?? "All accessible mailboxes"],
-  ["Namespace", item.scope.namespaceId],
-  ["Webhook", item.webhook?.url]
+  ["Published", item.publishedAt],
+  ["Bundle", item.bundle === null ? "None" : `${item.bundle.sizeBytes} bytes`],
+  ["SHA256", item.bundle?.sha256]
 ]);
+var printVersion = (item) => gen2(function* () {
+  yield* printVersionSummary(item);
+  yield* log("Manifest");
+  yield* printManifest(item.manifest);
+});
+var printInstallationSummary = (item) => gen2(function* () {
+  yield* log(`${item.displayName} (${item.name}) \u2014 ${item.status}`);
+  yield* printFields([
+    ["Installation", item.id],
+    ["Extension ID", item.extensionId],
+    ["Version", `${item.version.version} (${item.version.id})`],
+    ["Runtime", item.runtime],
+    ["Created", item.createdAt]
+  ]);
+});
+var printInstallation = (item) => gen2(function* () {
+  yield* printInstallationSummary(item);
+  yield* log("Access and delivery");
+  yield* printFields([
+    ["Events", item.events.join(", ") || "None"],
+    ["Permissions", item.permissions.join(", ") || "None"],
+    ["Send mode", item.sendMode],
+    [
+      "Mailboxes",
+      item.scope.mailboxIds === null ? "All accessible mailboxes" : item.scope.mailboxIds.join(", ") || "None"
+    ],
+    ["Namespace", item.scope.namespaceId ?? "All namespaces"],
+    ["Webhook", item.webhook?.url ?? "None"],
+    ["Webhook endpoint", item.webhook?.endpointId],
+    ["Updated", item.updatedAt],
+    ["Disabled", item.disabledAt ?? "No"]
+  ]);
+});
+var printRunSummary = (item) => gen2(function* () {
+  yield* log(`${item.id}: ${item.outcome}`);
+  yield* printFields([
+    ["Event", item.eventId],
+    ["Type", item.eventType],
+    ["Attempt", item.attempt],
+    ["Started", item.startedAt],
+    ["Duration (ms)", item.durationMs],
+    ["Error", item.error ?? "None"]
+  ]);
+});
+var printUpgrade = (result) => gen2(function* () {
+  yield* log(result.dryRun ? "Upgrade preview; no changes made. Installation details below show its current state." : result.versionChange === null ? "Installation already uses the selected version; no changes made." : "Installation upgraded.");
+  yield* printFields([
+    ["From version", `${result.fromVersion.version} (${result.fromVersion.id})`],
+    ["To version", `${result.toVersion.version} (${result.toVersion.id})`],
+    ["Added grants", result.permissionDiff.added.join(", ") || "None"],
+    ["Removed grants", result.permissionDiff.removed.join(", ") || "None"]
+  ]);
+  yield* printInstallation(result.installation);
+  if (result.versionChange !== null) {
+    yield* log("Version change");
+    yield* printFields([
+      ["Change ID", result.versionChange.id],
+      ["Organization", result.versionChange.organizationId],
+      ["Changed by", result.versionChange.changedBy],
+      ["Changed at", result.versionChange.changedAt]
+    ]);
+  }
+});
+
+// src/commands/extensions-api.ts
 var pageFlags = {
   limit: Int5("limit").pipe(withDescription2("Items per page"), optional4),
   cursor: String9("cursor").pipe(withDescription2("Resume after this nextCursor from a previous page"), optional4),
@@ -66015,13 +66608,7 @@ var list24 = make29("list", { ...pageFlags, json: jsonFlag }).pipe(withDescripti
     flags,
     empty: "No extensions found.",
     fetch: (query) => list10(query).pipe(client.provide, mapError2((e) => mailboxApiError("Could not list extensions", e))),
-    print: (item) => printFields([
-      ["ID", item.id],
-      ["Name", item.name],
-      ["Display name", item.displayName],
-      ["Runtime", item.runtime],
-      ["Version", item.latestVersion.version]
-    ])
+    print: printExtension
   });
 })));
 var versions = make29("versions", {
@@ -66034,35 +66621,19 @@ var versions = make29("versions", {
     flags,
     empty: "No versions found.",
     fetch: (query) => listVersions({ id: extension, ...query }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not list versions", e))),
-    print: (item) => printFields([
-      ["ID", item.id],
-      ["Version", item.version],
-      ["Runtime", item.runtime],
-      ["Published", item.publishedAt],
-      ["Size", item.bundle?.sizeBytes],
-      ["SHA256", item.bundle?.sha256]
-    ])
+    print: printVersionSummary
   });
 })));
 var version2 = make29("version", {
   extension: extensionArgument,
   version: String10("version"),
   json: jsonFlag
-}).pipe(withDescription3("Show one published version with its manifest, by version or id"), withExamples([{ command: "samva extensions version auto-reply 1.0.0 --json" }]), withHandler(({ extension, version, json }) => gen2(function* () {
+}).pipe(withDescription3("Show one published version with its manifest, by version or id"), withExamples([{ command: "samva extensions version auto-reply 1.0.0 --json" }]), withHandler(({ extension, version: selectedVersion, json }) => gen2(function* () {
   const client = yield* getClientProvider;
-  const data = yield* getVersion({ id: extension, versionId: version }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not read version", e)));
+  const data = yield* getVersion({ id: extension, versionId: selectedVersion }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not read version", e)));
   if (json)
     return yield* printJson(data);
-  yield* printFields([
-    ["ID", data.id],
-    ["Version", data.version],
-    ["Runtime", data.runtime],
-    ["Published", data.publishedAt],
-    ["Events", data.manifest.events.join(", ")],
-    ["Permissions", data.manifest.permissions.join(", ")],
-    ["Size", data.bundle?.sizeBytes],
-    ["SHA256", data.bundle?.sha256]
-  ]);
+  yield* printVersion(data);
 })));
 var install2 = make29("install", {
   extension: extensionArgument,
@@ -66077,11 +66648,20 @@ var install2 = make29("install", {
   {
     command: "samva extensions install auto-reply --mailbox mbx_1234567890123456 --permission read --permission send --send-mode approval"
   }
-]), withHandler(({ extension, version, mailbox, namespace, permission, sendMode, webhookUrl, json }) => gen2(function* () {
+]), withHandler(({
+  extension,
+  version: selectedVersion,
+  mailbox,
+  namespace,
+  permission,
+  sendMode,
+  webhookUrl,
+  json
+}) => gen2(function* () {
   const client = yield* getClientProvider;
   const data = yield* install({
     extension,
-    ...isSome2(version) ? { version: version.value } : {},
+    ...isSome2(selectedVersion) ? { version: selectedVersion.value } : {},
     ...mailbox.length ? { mailboxIds: mailbox } : {},
     ...isSome2(namespace) ? { namespaceId: namespace.value } : {},
     ...permission.length ? { permissions: permission } : {},
@@ -66122,6 +66702,37 @@ var installation = make29("installation", {
     return yield* printJson(data);
   yield* printInstallation(data);
 })));
+var upgrade2 = make29("upgrade", {
+  id: installationArgument,
+  version: String9("version").pipe(withSchema2(Union2([ExtensionVersionString, ExtensionVersionId2])), withDescription2("Published version or version ID; defaults to the latest published version"), optional4),
+  acceptPermissions: Literals3("accept-permissions", ExtensionUpgradeGrant.literals).pipe(withDescription2("Acknowledge one added permission:<name> or event:<type> grant; repeat for each"), atLeast2(0)),
+  dryRun: Boolean6("dry-run").pipe(withDescription2("Ask the API for a preview without changing the installation"), withDefault5(false)),
+  yes: Boolean6("yes").pipe(withDescription2("Skip confirmation"), withDefault5(false)),
+  json: jsonFlag
+}).pipe(withDescription3("Upgrade an installation using a person signed in with samva login"), withExamples([
+  { command: "samva extensions upgrade exti_1234567890123456 --dry-run --json" },
+  {
+    command: "samva extensions upgrade exti_1234567890123456 --version 2.0.0 --accept-permissions permission:send --accept-permissions event:mailbox.message.sent --yes"
+  }
+]), withHandler(({ id, version: selectedVersion, acceptPermissions, dryRun, yes, json }) => gen2(function* () {
+  if (!dryRun)
+    yield* confirmDestructive({
+      yes,
+      json,
+      message: `Upgrade ${id} to ${getOrElse(selectedVersion, () => "the latest published version")}?`,
+      nonInteractiveMessage: "Upgrade changes the installation's version and grants. Preview with --dry-run, then pass --yes to confirm and --accept-permissions for every added grant."
+    });
+  const client = yield* getClientProvider;
+  const data = yield* upgrade({
+    id,
+    ...isSome2(selectedVersion) ? { version: selectedVersion.value } : {},
+    ...acceptPermissions.length ? { acceptPermissions } : {},
+    ...dryRun ? { dryRun: true } : {}
+  }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not upgrade extension", e, { personOnly: "manage" })));
+  if (json)
+    return yield* printJson(data);
+  yield* printUpgrade(data);
+})));
 var uninstall2 = make29("uninstall", {
   id: installationArgument,
   yes: Boolean6("yes").pipe(withDefault5(false)),
@@ -66157,15 +66768,7 @@ var runs = make29("runs", { id: installationArgument, json: jsonFlag }).pipe(wit
   if (!data.items.length)
     return yield* log("No runs found.");
   for (const item of data.items)
-    yield* printFields([
-      ["Run", item.id],
-      ["Event", item.eventId],
-      ["Type", item.eventType],
-      ["Attempt", item.attempt],
-      ["Outcome", item.outcome],
-      ["Duration (ms)", item.durationMs],
-      ["Error", item.error]
-    ]);
+    yield* printRunSummary(item);
 })));
 var run6 = make29("run", {
   id: installationArgument,
@@ -66173,23 +66776,15 @@ var run6 = make29("run", {
   json: jsonFlag
 }).pipe(withDescription3("Show one hosted run with the lines its handler logged"), withExamples([
   { command: "samva extensions run exti_1234567890123456 0b6c1e1a-run-id --json" }
-]), withHandler(({ id, run, json }) => gen2(function* () {
+]), withHandler(({ id, run: runId, json }) => gen2(function* () {
   const client = yield* getClientProvider;
-  const data = yield* getRun2({ id, runId: run }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not read run", e)));
+  const data = yield* getRun2({ id, runId }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not read run", e)));
   if (json)
     return yield* printJson(data);
-  yield* printFields([
-    ["Run", data.id],
-    ["Event", data.eventId],
-    ["Type", data.eventType],
-    ["Attempt", data.attempt],
-    ["Outcome", data.outcome],
-    ["Duration (ms)", data.durationMs],
-    ["Error", data.error]
-  ]);
-  if (data.logs.length)
-    yield* log(truncateForDisplay(data.logs.join(`
-`)));
+  yield* printRunSummary(data);
+  yield* log("Logs");
+  yield* log(data.logs.length ? data.logs.join(`
+`) : "None");
 })));
 var extensionApiCommands = [
   list24,
@@ -66198,6 +66793,7 @@ var extensionApiCommands = [
   install2,
   installations,
   installation,
+  upgrade2,
   uninstall2,
   setStatus("disable"),
   setStatus("enable"),
@@ -66205,6 +66801,66 @@ var extensionApiCommands = [
   run6
 ];
 
+// ../sdk/dist/effect/mailboxes.js
+var exports_mailboxes = {};
+__export(exports_mailboxes, {
+  MailboxEventStreamError: () => MailboxEventStreamError,
+  addThreadLabels: () => addThreadLabels,
+  approveAction: () => approveAction,
+  create: () => create8,
+  createDraft: () => createDraft,
+  createGrant: () => createGrant,
+  createLabel: () => createLabel,
+  createNote: () => createNote,
+  createPolicy: () => createPolicy,
+  deleteDraft: () => deleteDraft,
+  deleteLabel: () => deleteLabel,
+  deleteNote: () => deleteNote,
+  deletePolicy: () => deletePolicy,
+  denyAction: () => denyAction,
+  discardMessage: () => discardMessage,
+  events: () => events,
+  forward: () => forward,
+  get: () => get13,
+  getAgentActivity: () => getAgentActivity,
+  getDraft: () => getDraft,
+  getMessage: () => getMessage,
+  getMessageAttachment: () => getMessageAttachment,
+  getMessageRaw: () => getMessageRaw,
+  getPolicy: () => getPolicy,
+  getThread: () => getThread,
+  getThreadContent: () => getThreadContent,
+  list: () => list11,
+  listActions: () => listActions,
+  listDrafts: () => listDrafts,
+  listEvents: () => listEvents,
+  listFolders: () => listFolders,
+  listGrants: () => listGrants,
+  listLabels: () => listLabels,
+  listPolicies: () => listPolicies,
+  listQuarantine: () => listQuarantine,
+  listThreadMessages: () => listThreadMessages,
+  listThreadNotes: () => listThreadNotes,
+  listThreads: () => listThreads,
+  pause: () => pause,
+  releaseMessage: () => releaseMessage,
+  remove: () => remove9,
+  removeThreadLabels: () => removeThreadLabels,
+  reply: () => reply,
+  replyAll: () => replyAll,
+  resume: () => resume,
+  revokeGrant: () => revokeGrant,
+  sendDraft: () => sendDraft,
+  sendMessage: () => sendMessage2,
+  update: () => update9,
+  updateDraft: () => updateDraft,
+  updateGrant: () => updateGrant,
+  updateLabel: () => updateLabel,
+  updateNote: () => updateNote,
+  updatePolicy: () => updatePolicy,
+  updateThread: () => updateThread
+});
+
 // src/commands/mailboxes-events.ts
 var NORMAL_CLOSE = 1000;
 var refusalNext = (failure) => {
@@ -66360,8 +67016,12 @@ var init = make29("init", {
   const data = yield* initExtension(dir, manifest);
   if (json)
     yield* printJson(data);
-  else
-    yield* log(`Created ${name} in ${data.directory}. Run bun install, then samva extensions dev.`);
+  else {
+    yield* log(`Created ${name} in ${data.directory}.`);
+    yield* printManifest(data.manifest);
+    yield* printFields([["Files", data.files.join(", ")]]);
+    yield* log("Run bun install in that directory, then samva extensions dev.");
+  }
 })));
 var build2 = make29("build", {
   ...projectFlags,
@@ -66370,14 +67030,14 @@ var build2 = make29("build", {
   const { bundle: _bundle, ...data } = yield* buildExtension(dir, entry, out);
   if (json)
     yield* printJson(data);
-  else
+  else {
+    yield* printManifest(data.manifest);
     yield* printFields([
-      ["Extension", `${data.manifest.name}@${data.manifest.version}`],
-      ["Runtime", data.manifest.runtime],
       ["Size", `${data.sizeBytes} bytes`],
       ["SHA256", data.sha256],
       ["Output", data.output]
     ]);
+  }
 })));
 var publish3 = make29("publish", projectFlags).pipe(withDescription3("Build and publish an immutable extension version as a person signed in with samva login"), withExamples([{ command: "samva extensions publish . --json" }]), withHandler(({ dir, entry, json }) => gen2(function* () {
   const built = yield* buildExtension(dir, entry);
@@ -66388,8 +67048,11 @@ var publish3 = make29("publish", projectFlags).pipe(withDescription3("Build and
   }).pipe(client.provide, mapError2((error) => mailboxApiError("Could not publish extension", error, { personOnly: "publish" })));
   if (json)
     yield* printJson(data);
-  else
-    yield* log(`Published ${data.extension.name}@${data.version.version} (${data.version.id}).`);
+  else {
+    yield* log(`Published ${data.extension.name}@${data.version.version}.`);
+    yield* printExtension(data.extension);
+    yield* printVersion(data.version);
+  }
 })));
 var dev = make29("dev", {
   ...projectFlags,
@@ -66414,9 +67077,9 @@ var dev = make29("dev", {
   };
   const stopped = new AbortController;
   const client = createSamvaClient({
-    fetch: (input, init) => globalThis.fetch(input, {
-      ...init,
-      signal: init?.signal === undefined || init.signal === null ? stopped.signal : AbortSignal.any([init.signal, stopped.signal])
+    fetch: (input, requestInit) => globalThis.fetch(input, {
+      ...requestInit,
+      signal: requestInit?.signal === undefined || requestInit.signal === null ? stopped.signal : AbortSignal.any([requestInit.signal, stopped.signal])
     }),
     baseUrl: config.baseUrl,
     headers
@@ -66441,7 +67104,8 @@ var dev = make29("dev", {
       const data = { eventId: event.id, cursor: event.cursor, ...result };
       const text = mode === "jsonl" ? JSON.stringify(resultEnvelope("extensions.dev", data)) : [
         ...result.logs,
-        `${event.id}: ${result.ok ? "succeeded" : `failed: ${result.error}`}`
+        `${event.id}: ${result.ok ? "succeeded" : `failed: ${result.error}`}`,
+        `Cursor  ${event.cursor}`
       ].join(`
 `);
       yield* writeOutput(process.stdout, `${text}
@@ -69149,67 +69813,6 @@ var logoutCommand = make29("logout").pipe(withDescription3("Sign out and remove
   yield* clearCredentials;
   yield* printResult({ action: "logout" }, "Logged out.");
 })));
-// ../core/src/shared/excess-properties.ts
-var rejectExcessProperties = (schema) => {
-  const declared = new Set(Object.keys(schema.fields));
-  return flip3(flip3(schema).check(makeFilter2((input, ast) => {
-    if (!isObject(input))
-      return;
-    const issues = [];
-    for (const key of Reflect.ownKeys(input)) {
-      if (declared.has(key))
-        continue;
-      issues.push({ path: [key], issue: new UnexpectedKey(ast, input[key]) });
-    }
-    return issues;
-  })));
-};
-
-// ../core/src/messages/attachment-budget.ts
-var EMAIL_ATTACHMENT_BUDGET = {
-  maxCount: 10,
-  maxItemBytes: 25 * 1024 * 1024,
-  maxAggregateBytes: 25 * 1024 * 1024
-};
-var emailAttachmentBudgetViolation = (attachments) => {
-  if (attachments.length > EMAIL_ATTACHMENT_BUDGET.maxCount)
-    return "count";
-  let aggregateBytes = 0;
-  for (const attachment of attachments) {
-    if (!Number.isSafeInteger(attachment.size) || attachment.size <= 0 || attachment.size > EMAIL_ATTACHMENT_BUDGET.maxItemBytes) {
-      return "itemBytes";
-    }
-    aggregateBytes += attachment.size;
-    if (aggregateBytes > EMAIL_ATTACHMENT_BUDGET.maxAggregateBytes)
-      return "aggregateBytes";
-  }
-  return null;
-};
-
-// ../core/src/messages/email-attachment.ts
-var EmailAttachment2 = Struct({
-  filename: String4,
-  content: optional2(String4.check(isBase64())),
-  mediaId: optional2(MediaId2),
-  contentType: String4,
-  size: Finite.check(isInt(), isGreaterThan2(0), isLessThanOrEqualTo3(EMAIL_ATTACHMENT_BUDGET.maxItemBytes))
-}).check(makeFilter2((attachment) => {
-  const hasInlineContent = attachment.content !== undefined;
-  const hasOwnedMedia = attachment.mediaId !== undefined;
-  if (hasInlineContent === hasOwnedMedia)
-    return false;
-  if (!hasInlineContent)
-    return true;
-  const decoded = decode(attachment.content);
-  return isSuccess2(decoded) && decoded.success.byteLength === attachment.size;
-}, {
-  message: "Email attachment requires exactly one of content or mediaId, and inline content must match its declared size"
-})).annotate({
-  identifier: "EmailAttachment"
-}).pipe(rejectExcessProperties);
-var EmailAttachments2 = ArraySchema(EmailAttachment2).check(isMaxLength(EMAIL_ATTACHMENT_BUDGET.maxCount), makeFilter2((attachments) => emailAttachmentBudgetViolation(attachments) === null, {
-  message: `Email attachments must total at most ${EMAIL_ATTACHMENT_BUDGET.maxAggregateBytes} bytes`
-}));
 
 // ../core/src/mailboxes/resource.ts
 var MailboxActorKind = Literals(mailboxActorKinds);
@@ -69330,6 +69933,116 @@ var UpdateMailboxPayload = Struct({
   }))
 }).annotate({ identifier: "UpdateMailboxPayload" });
 
+// ../core/src/mailboxes/action-event-policy.ts
+var MailboxActionType = Literals(mailboxActionScopes);
+var MailboxActionSource = Literals(mailboxActionSources);
+var MailboxActionState = Literals(mailboxActionStates);
+var MailboxPolicyOutcome = Union2([
+  Struct({ outcome: Literal2("allow") }),
+  Struct({
+    outcome: Literal2("requireApproval"),
+    approverKinds: ArraySchema(Literals(mailboxApproverKinds)),
+    reason: String4
+  }),
+  Struct({ outcome: Literal2("deny"), reason: String4 })
+]);
+var MailboxPolicyDecisionSchema = Struct({
+  policyId: NullOr(MailboxPolicyId2),
+  actionId: MailboxActionId2,
+  outcome: MailboxPolicyOutcome,
+  decidedAt: DateFromString
+});
+var MailboxActionRecord = Struct({
+  id: MailboxActionId2,
+  mailboxId: MailboxId2,
+  threadId: optional2(MailboxThreadId2),
+  conversationId: optional2(ConversationId2),
+  draftId: optional2(MailboxDraftId2),
+  type: MailboxActionType,
+  source: MailboxActionSource,
+  state: MailboxActionState,
+  proposedBy: MailboxActorRef,
+  policyDecision: optional2(MailboxPolicyDecisionSchema),
+  payload: Record(String4, Unknown2),
+  createdAt: DateFromString,
+  updatedAt: DateFromString
+});
+var MailboxEventType = Literals(mailboxEventTypes);
+var MailboxActionProposalResponse = Union2([
+  Struct({ status: Literal2("accepted"), action: MailboxActionRecord }),
+  Struct({
+    status: Literal2("approvalRequired"),
+    action: MailboxActionRecord,
+    reason: String4
+  }),
+  Struct({
+    status: Literal2("denied"),
+    action: MailboxActionRecord,
+    reason: String4
+  })
+]);
+var MailboxActionDecision2 = Struct({
+  outcome: Literals(["allow", "requireApproval", "deny"]),
+  reason: NullOr(String4),
+  policyId: NullOr(MailboxPolicyId2),
+  decidedAt: DateFromString
+}).annotate({ identifier: "MailboxActionDecision" });
+var MailboxAction2 = Struct({
+  id: MailboxActionId2,
+  type: MailboxActionType,
+  state: MailboxActionState,
+  source: MailboxActionSource,
+  proposedBy: MailboxActorRef,
+  threadId: NullOr(MailboxThreadId2),
+  draftId: NullOr(MailboxDraftId2),
+  decision: NullOr(MailboxActionDecision2),
+  createdAt: DateFromString,
+  updatedAt: DateFromString
+}).annotate({ identifier: "MailboxAction" });
+var MailboxEvent2 = Struct({
+  id: MailboxEventId2,
+  type: MailboxEventType,
+  threadId: NullOr(MailboxThreadId2),
+  actionId: NullOr(MailboxActionId2),
+  actor: MailboxActorRef,
+  payload: Record(String4, Unknown2),
+  occurredAt: DateFromString
+}).annotate({ identifier: "MailboxEvent" });
+// ../core/src/shared/excess-properties.ts
+var rejectExcessProperties = (schema) => {
+  const declared = new Set(Object.keys(schema.fields));
+  return flip3(flip3(schema).check(makeFilter2((input, ast) => {
+    if (!isObject(input))
+      return;
+    const issues = [];
+    for (const key of Reflect.ownKeys(input)) {
+      if (declared.has(key))
+        continue;
+      issues.push({ path: [key], issue: new UnexpectedKey(ast, input[key]) });
+    }
+    return issues;
+  })));
+};
+
+// ../core/src/messages/email-attachment.ts
+var EmailAttachment2 = Struct({
+  filename: String4,
+  content: optional2(String4),
+  mediaId: optional2(MediaId2),
+  contentType: String4,
+  size: Finite.check(isInt(), isGreaterThan2(0), isLessThanOrEqualTo3(EMAIL_ATTACHMENT_BUDGET.maxItemBytes))
+}).check(makeFilter2((attachment) => attachment.content === undefined !== (attachment.mediaId === undefined), { message: "Email attachment requires exactly one of content or mediaId" }), makeFilter2((attachment) => {
+  if (attachment.content === undefined)
+    return true;
+  const decoded = decode(attachment.content);
+  return isSuccess2(decoded) && decoded.success.byteLength === attachment.size;
+}, { message: "Inline content must be Base64 that decodes to exactly its declared size" })).annotate({
+  identifier: "EmailAttachment"
+}).pipe(rejectExcessProperties);
+var EmailAttachments2 = ArraySchema(EmailAttachment2).check(isMaxLength(EMAIL_ATTACHMENT_BUDGET.maxCount), makeFilter2((attachments) => emailAttachmentBudgetViolation(attachments) === null, {
+  message: `Email attachments must total at most ${EMAIL_ATTACHMENT_BUDGET.maxAggregateBytes} bytes`
+}), makeFilter2((attachments) => emailInlineAttachmentBytes(attachments) <= EMAIL_ATTACHMENT_BUDGET.maxInlineBytes, { message: EMAIL_INLINE_ATTACHMENT_MESSAGE }));
+
 // ../core/src/mailboxes/thread.ts
 var CssTrustedEmailBody = String4.pipe(brand("CssTrustedEmailBody"));
 var MailboxMessageAttachmentSchema = Struct({
@@ -69521,6 +70234,143 @@ var MailboxThreadLabels = Struct({
   labels: NonEmptyArray(MailboxLabelId2)
 }).annotate({ identifier: "MailboxThreadLabels" });
 
+// src/lib/mailbox-output.ts
+var present = (value) => value === null ? "none" : value === "" ? '""' : value;
+var actor = (value) => `${value.displayName == null ? "" : `${value.displayName} \u2014 `}${value.kind} ${value.id}`;
+var identity2 = (address, name, attributed) => `${name === undefined || name === null ? "" : `${name} <`}${address}${name === undefined || name === null ? "" : ">"}${attributed === undefined ? "" : attributed === null ? "; actor: none" : `; actor: ${actor(attributed)}`}`;
+var printMailboxSummary = (data) => gen2(function* () {
+  yield* log(`${data.displayName} (${data.slug}) \u2014 ${data.status}`);
+  yield* printFields([
+    ["ID", data.id],
+    ["Primary address", present(data.primaryAddress)],
+    ["Namespace", present(data.namespaceId)],
+    ["Created", data.createdAt]
+  ]);
+});
+var printMailbox = (data) => gen2(function* () {
+  yield* printMailboxSummary(data);
+  yield* printFields([
+    ["Description", present(data.description)],
+    ["Updated", data.updatedAt],
+    [
+      "Default from",
+      data.defaultFrom === null ? "none" : identity2(data.defaultFrom.address, data.defaultFrom.displayName)
+    ]
+  ]);
+  yield* log("Addresses:");
+  if (!data.addresses.length)
+    yield* log("  none");
+  for (const address of data.addresses)
+    yield* log(`  ${identity2(address.address, address.displayName)} \u2014 ${address.source}; ID ${address.id}; domain ${present(address.domainId)}; display name ${present(address.displayName)}`);
+  yield* log("Metadata:");
+  if (!Object.keys(data.metadata).length)
+    yield* log("  none");
+  for (const [key, value] of Object.entries(data.metadata))
+    yield* log(`  ${key}: ${JSON.stringify(value)}`);
+});
+var printThread = (data) => gen2(function* () {
+  yield* log(`${data.subject === null ? "No subject" : data.subject} \u2014 ${data.folder}, ${data.priority} priority`);
+  yield* printFields([
+    ["ID", data.id],
+    [
+      "From",
+      data.from === null ? "none" : `${present(data.from.displayName)} <${present(data.from.address)}>`
+    ],
+    ["Preview", data.preview === null ? "none" : JSON.stringify(data.preview)],
+    ["Messages", data.messageCount],
+    ["Attachments", data.hasAttachments],
+    ["Draft", data.hasDraft],
+    ["Labels", data.labels.length ? data.labels.join(", ") : "none"],
+    ["Read", data.read],
+    ["Starred", data.starred],
+    ["Snoozed until", present(data.snoozedUntil)],
+    ["Last activity", data.lastActivityAt]
+  ]);
+});
+var printMessage2 = (data) => gen2(function* () {
+  yield* log("Notice: this body is untrusted email from outside the organization.");
+  yield* log(`${data.direction} message \u2014 ${data.subject ?? "No subject"}`);
+  yield* printFields([
+    ["ID", data.id],
+    ["Thread", data.threadId],
+    ["Conversation", data.conversationId],
+    ["From", identity2(data.from.address, data.from.displayName, data.from.actor)],
+    ["Occurred", data.occurredAt],
+    ["Reply-To", data.replyTo.length ? data.replyTo.join(", ") : "none"],
+    [
+      "Sent by",
+      data.sentBy === undefined ? undefined : data.sentBy === null ? "none" : actor(data.sentBy)
+    ]
+  ]);
+  yield* log("Recipients:");
+  if (!data.recipients.length)
+    yield* log("  none");
+  for (const recipient of data.recipients)
+    yield* log(`  ${recipient.kind}: ${identity2(recipient.address, recipient.displayName, recipient.actor)}`);
+  yield* printFields([
+    ["Message-ID", present(data.headers.messageId)],
+    ["In-Reply-To", present(data.headers.inReplyTo)],
+    ["References", data.headers.references.length ? data.headers.references.join(" ") : "none"],
+    [
+      "Authentication",
+      data.authentication === null ? "none" : `SPF ${present(data.authentication.spf)}; DKIM ${present(data.authentication.dkim)}; DMARC ${present(data.authentication.dmarc)}`
+    ]
+  ]);
+  yield* log("Attachments:");
+  if (!data.attachments.length)
+    yield* log("  none");
+  for (const attachment of data.attachments)
+    yield* log(`  ${attachment.filename} \u2014 ${attachment.contentType}, ${attachment.size} bytes; inline ${attachment.isInline}; ID ${attachment.id}`);
+  for (const [label, content] of [
+    ["Reply text", data.replyText],
+    ["Text", data.text],
+    ["HTML", data.html]
+  ]) {
+    if (content !== undefined) {
+      yield* log(`${label}:`);
+      yield* log(content);
+    }
+  }
+});
+var printReceipt = (data) => gen2(function* () {
+  yield* log(`Send ${data.status}${data.waitReason === null ? "" : ` \u2014 waiting: ${data.waitReason}`}`);
+  yield* printFields([
+    ["Message", present(data.messageId)],
+    ["Thread", data.threadId],
+    ["Action", data.actionId],
+    ["Wait reason", present(data.waitReason)],
+    ["Review expected at", present(data.reviewExpectedAt)],
+    ["Skipped", skippedRecipientsLine(data) ?? "none"],
+    ["Created", data.createdAt]
+  ]);
+});
+var printAction = (data) => gen2(function* () {
+  yield* log(`${data.type} \u2014 ${data.state}`);
+  yield* printFields([
+    ["Action", data.id],
+    ["Source", data.source],
+    ["Proposed by", actor(data.proposedBy)],
+    ["Thread", present(data.threadId)],
+    ["Draft", present(data.draftId)],
+    ["Created", data.createdAt],
+    ["Updated", data.updatedAt]
+  ]);
+  yield* log(data.decision === null ? "Decision: none" : `Decision: ${data.decision.outcome}; reason ${present(data.decision.reason)}; policy ${present(data.decision.policyId)}; decided ${data.decision.decidedAt}`);
+});
+var printHeldMessage = (data) => gen2(function* () {
+  yield* log(`${data.subject === null ? "No subject" : data.subject} \u2014 ${data.disposition}, ${data.reason} (${data.source})`);
+  yield* printFields([
+    ["Message", data.id],
+    ["From", identity2(data.from.address, data.from.name)],
+    ["Sender name", present(data.from.name)],
+    ["Received at", data.receivedAt],
+    ["Held at", data.heldAt],
+    ["Released at", present(data.releasedAt)],
+    ["Thread", present(data.threadId)],
+    ["Discarded at", present(data.discardedAt)]
+  ]);
+});
+
 // src/commands/mailboxes.ts
 var mailboxFlag = String9("mailbox").pipe(withDescription2("Mailbox ID"), withSchema2(MailboxId2));
 var messageIdArgument = String10("message-id").pipe(withSchema3(MessageId2));
@@ -69607,11 +70457,7 @@ var list25 = make29("list", {
       before: getOrUndefined(before)
     }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not list mailboxes", e))),
     empty: "No mailboxes found.",
-    human: (item) => printFields([
-      ["ID", item.id],
-      ["Slug", item.slug],
-      ["Name", item.displayName]
-    ])
+    human: printMailboxSummary
   });
 })));
 var create17 = make29("create", {
@@ -69643,13 +70489,164 @@ var create17 = make29("create", {
   }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not create mailbox", e)));
   if (json)
     return yield* printJson(data);
-  yield* printFields([
-    ["ID", data.id],
-    ["Name", data.displayName],
-    ["Address", data.primaryAddress],
-    ["Status", data.status]
-  ]);
+  yield* printMailbox(data);
+})));
+var mailboxIdArgument = String10("mailbox-id").pipe(withSchema3(MailboxId2));
+var get23 = make29("get", { id: mailboxIdArgument, json: jsonFlag }).pipe(withDescription3("Inspect a mailbox's addresses, sending identity, and settings"), withHandler(({ id, json }) => gen2(function* () {
+  const client = yield* getClientProvider;
+  const result = yield* get13({ id }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not read mailbox", e)));
+  yield* json ? printJson(result) : printMailbox(result);
+})));
+var update16 = make29("update", {
+  id: mailboxIdArgument,
+  data: String9("data").pipe(withDescription2("JSON patch or @file: displayName, defaultFrom, metadata (null deletes a metadata key)")),
+  dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
+  json: jsonFlag
+}).pipe(withDescription3("Update mailbox settings from JSON"), withExamples([
+  {
+    command: `samva mailboxes update mbx_1234567890123456 --data '{"displayName":"Support","defaultFrom":{"address":"support@example.com"}}'`
+  }
+]), withHandler(({ id, data, dryRun, json }) => gen2(function* () {
+  let source = data;
+  if (data.startsWith("@")) {
+    const path = data.slice(1);
+    if (!path)
+      return yield* new CliUsageError({
+        code: "missing_data_file",
+        message: "--data @ requires a file path."
+      });
+    const fs = yield* FileSystem;
+    source = yield* fs.readFileString(path).pipe(mapError2(() => new CliUsageError({
+      code: "data_file_unreadable",
+      message: `Could not read mailbox update data from ${path}.`
+    })));
+  }
+  const raw = yield* try_3({
+    try: () => JSON.parse(source),
+    catch: () => new CliUsageError({
+      code: "mailbox_update_invalid",
+      message: "--data must be valid JSON."
+    })
+  });
+  const payload = yield* decodeUnknownEffect2(UpdateMailboxPayload)(raw, {
+    onExcessProperty: "error"
+  }).pipe(mapError2((e) => new CliUsageError({
+    code: "mailbox_update_invalid",
+    message: `--data must match the mailbox update schema: ${String(e)}`
+  })));
+  if (!Object.keys(payload).length)
+    return yield* new CliUsageError({
+      code: "mailbox_update_empty",
+      message: "--data must name at least one of displayName, defaultFrom, or metadata."
+    });
+  if (dryRun)
+    return yield* json ? printJson({ dryRun: true, action: "mailboxes.update", id, request: payload }) : printFields([
+      ["Dry run", true],
+      ["Mailbox", id],
+      ["Patch", JSON.stringify(payload)]
+    ]);
+  const client = yield* getClientProvider;
+  const result = yield* update9({ id, ...payload }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not update mailbox", e)));
+  yield* json ? printJson(result) : printMailbox(result);
+})));
+var lifecycle = (verb) => make29(verb, {
+  id: mailboxIdArgument,
+  dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
+  json: jsonFlag
+}).pipe(withDescription3(verb === "pause" ? "Pause sending and inbound delivery; mail arriving while paused is not backfilled" : "Resume mailbox delivery"), withHandler(({ id, dryRun, json }) => gen2(function* () {
+  if (dryRun)
+    return yield* json ? printJson({ dryRun: true, action: `mailboxes.${verb}`, id }) : log(`[dry-run] Would ${verb} mailbox ${id}.`);
+  const client = yield* getClientProvider;
+  const result = yield* exports_mailboxes[verb]({ id }).pipe(client.provide, mapError2((e) => mailboxApiError(`Could not ${verb} mailbox`, e)));
+  yield* json ? printJson(result) : printMailbox(result);
+})));
+var actionsList = make29("list", {
+  mailbox: mailboxFlag,
+  ...pageFlags2,
+  state: Literals3("state", MailboxActionState.literals).pipe(optional4),
+  after: instantFlag("after", "Only actions created after this ISO 8601 instant"),
+  before: instantFlag("before", "Only actions created before this ISO 8601 instant"),
+  json: jsonFlag
+}).pipe(withDescription3("List mailbox actions and their policy decisions"), withHandler(({ mailbox, limit, cursor, all, state, after, before, json }) => gen2(function* () {
+  const client = yield* getClientProvider;
+  yield* followPages({
+    all,
+    json,
+    cursor,
+    page: (pageCursor) => listActions({
+      id: mailbox,
+      limit: pageLimit(limit),
+      cursor: pageCursor,
+      state: getOrUndefined(state),
+      after: getOrUndefined(after),
+      before: getOrUndefined(before)
+    }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not list actions", e))),
+    empty: "No mailbox actions found.",
+    human: printAction
+  });
+})));
+var actionDecision = (verb) => make29(verb, {
+  actionId: String10("action-id").pipe(withSchema3(MailboxActionId2)),
+  mailbox: mailboxFlag,
+  ...verb === "deny" ? {
+    reason: optional6("reason").pipe(withDescription2("Denial reason; defaults to Denied by reviewer."))
+  } : {},
+  dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
+  yes: Boolean6("yes").pipe(withDefault5(false)),
+  json: jsonFlag
+}).pipe(withDescription3(`${verb === "approve" ? "Approve and execute" : "Deny"} an action as a signed-in person other than its proposer`), withHandler(({ actionId, mailbox, reason, dryRun, yes, json }) => gen2(function* () {
+  const denialReason = reason === undefined ? undefined : getOrElse(reason, () => "Denied by reviewer.");
+  if (dryRun)
+    return yield* json ? printJson({
+      dryRun: true,
+      action: `mailboxes.actions.${verb}`,
+      id: mailbox,
+      actionId,
+      ...verb === "deny" ? { reason: denialReason } : {}
+    }) : printJson({
+      dryRun: true,
+      action: verb,
+      mailbox,
+      actionId,
+      ...verb === "deny" ? { reason: denialReason } : {}
+    });
+  yield* confirmDestructive({
+    yes,
+    json,
+    message: `${verb === "approve" ? "Approve and execute" : "Deny"} mailbox action ${actionId}?`,
+    nonInteractiveMessage: `Action ${verb} requires --yes in non-interactive mode. Preview with --dry-run.`
+  });
+  const client = yield* getClientProvider;
+  const result = yield* (verb === "approve" ? approveAction({ id: mailbox, actionId }) : denyAction({
+    id: mailbox,
+    actionId,
+    reason: denialReason ?? "Denied by reviewer."
+  })).pipe(client.provide, mapError2((e) => mailboxApiError(`Could not ${verb} action`, e, { personOnly: verb })));
+  yield* json ? printJson(result) : printAction(result);
 })));
+var remove18 = make29("remove", {
+  id: String10("mailbox-id").pipe(withSchema3(MailboxId2)),
+  dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
+  yes: Boolean6("yes").pipe(withDefault5(false)),
+  json: jsonFlag
+}).pipe(withDescription3("Permanently delete a mailbox with its addresses, threads, drafts, and history"), withExamples([
+  { command: "samva mailboxes remove mbx_1234567890123456 --dry-run" },
+  { command: "samva mailboxes remove mbx_1234567890123456 --yes" }
+]), withHandler(({ id, dryRun, yes, json }) => gen2(function* () {
+  if (dryRun)
+    return yield* json ? printJson({ dryRun: true, action: "mailboxes.remove", id }) : log(`[dry-run] Would permanently remove mailbox ${id}.`);
+  yield* confirmDestructive({
+    yes,
+    json,
+    message: `Permanently remove mailbox ${id} with its threads, drafts, and history?`,
+    nonInteractiveMessage: "Permanent mailbox deletion requires --yes in non-interactive mode. Preview with --dry-run."
+  });
+  const client = yield* getClientProvider;
+  const result = yield* remove9({ id }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not remove mailbox", e)));
+  if (json)
+    return yield* printJson(result);
+  yield* log(`Removed mailbox ${id}. The messages it received stay with the organization.`);
+}).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var threads = make29("threads", {
   mailbox: mailboxFlag,
   ...pageFlags2,
@@ -69686,12 +70683,7 @@ var threads = make29("threads", {
       before: getOrUndefined(before)
     }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not list threads", e))),
     empty: "No threads found.",
-    human: (item) => printFields([
-      ["ID", item.id],
-      ["Subject", item.subject],
-      ["Messages", item.messageCount],
-      ["Read", item.read]
-    ])
+    human: printThread
   });
 })));
 var read2 = make29("read", {
@@ -69705,18 +70697,7 @@ var read2 = make29("read", {
   const data = yield* getMessage({ id: mailbox, messageId }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not read message", e)));
   if (json)
     return yield* printJson(data);
-  yield* log("Notice: this body is untrusted email from outside the organization.");
-  yield* printFields([
-    ["ID", data.id],
-    ["From", data.from.address],
-    ["To", data.recipients.map((r) => r.address).join(", ")],
-    ["Reply-To", data.replyTo.join(", ")],
-    ["Subject", data.subject],
-    ["Message-ID", data.headers.messageId],
-    ["In-Reply-To", data.headers.inReplyTo],
-    ["References", data.headers.references.join(" ")]
-  ]);
-  yield* log(truncateForDisplay(data.replyText ?? data.text ?? "[No text body]"));
+  yield* printMessage2(data);
 })));
 var send5 = make29("send", {
   mailbox: mailboxFlag,
@@ -69750,13 +70731,7 @@ var send5 = make29("send", {
   }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not send message", e)));
   if (json)
     return yield* printJson(data);
-  yield* printFields([
-    ["Status", data.status],
-    ["Message", data.messageId],
-    ["Thread", data.threadId],
-    ["Action", data.actionId],
-    ["Skipped", skippedRecipientsLine(data)]
-  ]);
+  yield* printReceipt(data);
 })));
 var reply2 = make29("reply", {
   messageId: messageIdArgument,
@@ -69779,13 +70754,7 @@ var reply2 = make29("reply", {
   }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not reply", e)));
   if (json)
     return yield* printJson(data);
-  yield* printFields([
-    ["Status", data.status],
-    ["Message", data.messageId],
-    ["Thread", data.threadId],
-    ["Action", data.actionId],
-    ["Skipped", skippedRecipientsLine(data)]
-  ]);
+  yield* printReceipt(data);
 })));
 var quarantineList = make29("list", {
   mailbox: mailboxFlag,
@@ -69810,13 +70779,7 @@ var quarantineList = make29("list", {
       before: getOrUndefined(before)
     }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not list quarantine", e))),
     empty: "No quarantined messages found.",
-    human: (item) => printFields([
-      ["Message", item.id],
-      ["From", item.from.address],
-      ["Subject", item.subject],
-      ["Disposition", item.disposition],
-      ["Reason", item.reason]
-    ])
+    human: printHeldMessage
   });
 })));
 var release2 = make29("release", {
@@ -69832,13 +70795,11 @@ var release2 = make29("release", {
   const data = yield* releaseMessage({ id: mailbox, messageId }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not release message", e, { personOnly: "release" })));
   if (json)
     return yield* printJson(data);
-  yield* printFields([
-    ["Message", data.id],
-    ["Released", data.releasedAt],
-    ["Thread", data.threadId]
-  ]);
+  yield* printHeldMessage(data);
 })));
 var discard = make29("discard", {
+  dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
+  yes: Boolean6("yes").pipe(withDefault5(false)),
   messageId: messageIdArgument,
   mailbox: mailboxFlag,
   json: jsonFlag
@@ -69846,20 +70807,36 @@ var discard = make29("discard", {
   {
     command: "samva mailboxes quarantine discard msg_1234567890123456 --mailbox mbx_1234567890123456"
   }
-]), withHandler(({ messageId, mailbox, json }) => gen2(function* () {
+]), withHandler(({ messageId, mailbox, dryRun, yes, json }) => gen2(function* () {
+  if (dryRun)
+    return yield* json ? printJson({
+      dryRun: true,
+      action: "mailboxes.quarantine.discard",
+      id: mailbox,
+      messageId
+    }) : log(`[dry-run] Would permanently discard held message ${messageId}.`);
+  yield* confirmDestructive({
+    yes,
+    json,
+    message: `Permanently discard held message ${messageId}?`,
+    nonInteractiveMessage: "Discarding held mail requires --yes in non-interactive mode. Preview with --dry-run."
+  });
   const client = yield* getClientProvider;
   const data = yield* discardMessage({ id: mailbox, messageId }).pipe(client.provide, mapError2((e) => mailboxApiError("Could not discard message", e, { personOnly: "discard" })));
   if (json)
     return yield* printJson(data);
-  yield* printFields([
-    ["Message", data.id],
-    ["Discarded", data.discardedAt]
-  ]);
+  yield* printHeldMessage(data);
 })));
 var mailboxesCommand = make29("mailboxes").pipe(withDescription3("Mailbox reading and governed sending"), withSubcommands([
   mailboxesEventsCommand,
   list25,
   create17,
+  get23,
+  update16,
+  lifecycle("pause"),
+  lifecycle("resume"),
+  make29("actions").pipe(withSubcommands([actionsList, actionDecision("approve"), actionDecision("deny")])),
+  remove18,
   threads,
   read2,
   send5,
@@ -70054,7 +71031,7 @@ var use2 = make29("use", { name: String10("name") }).pipe(withDescription3("Sele
   yield* writeConfig({ ...config, activeProfile: name });
   yield* printResult({ action: "profile.use", name }, `Active profile set to ${name}.`);
 })));
-var remove18 = make29("delete", {
+var remove19 = make29("delete", {
   name: String10("name"),
   yes: Boolean6("yes").pipe(withDefault5(false))
 }).pipe(withDescription3("Delete a profile and its OS-keyring credential"), withHandler(fnUntraced2(function* ({ name, yes }) {
@@ -70079,7 +71056,7 @@ var remove18 = make29("delete", {
     yield* (yield* Service5).clear(name);
   yield* printResult({ action: "profile.delete", name }, `Deleted profile ${name}.`);
 })));
-var profileCommand = make29("profile").pipe(withDescription3("Manage user-level credential identity and organization contexts"), withSubcommands([list27, show, create18, use2, remove18]));
+var profileCommand = make29("profile").pipe(withDescription3("Manage user-level credential identity and organization contexts"), withSubcommands([list27, show, create18, use2, remove19]));
 
 // src/commands/scheduled.ts
 var SCHEDULED_STATUSES = [
@@ -70359,7 +71336,7 @@ var list28 = make29("list", {
   if (data.nextCursor !== null)
     yield* printFields([["Next cursor", data.nextCursor]]);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var get23 = make29("get", { id: String10("id"), json: jsonFlag }).pipe(withDescription3("Show a scheduled message by id"), withExamples([{ command: "samva scheduled-messages get sched_abc123" }]), withHandler(({ id, json }) => gen2(function* () {
+var get24 = make29("get", { id: String10("id"), json: jsonFlag }).pipe(withDescription3("Show a scheduled message by id"), withExamples([{ command: "samva scheduled-messages get sched_abc123" }]), withHandler(({ id, json }) => gen2(function* () {
   const client = yield* getClientProvider;
   const data = yield* get18({ id }).pipe(client.provide, mapError2((error) => toCliApiError("Could not fetch scheduled message", error)));
   if (json)
@@ -70442,11 +71419,11 @@ var scheduledMessagesCommand = make29("scheduled-messages").pipe(withDescription
     description: "Schedule an email"
   },
   { command: "samva scheduled-messages list", description: "List scheduled messages" }
-]), withSubcommands([create19, list28, get23, cancel2, resume3]));
+]), withSubcommands([create19, list28, get24, cancel2, resume3]));
 
 // src/commands/templates.ts
 import { constants as constants2 } from "fs";
-import { access as access3, stat as stat4 } from "fs/promises";
+import { access as access3, stat as stat5 } from "fs/promises";
 import { dirname as dirname5, resolve as resolve16 } from "path";
 import { pathToFileURL as pathToFileURL5 } from "url";
 
@@ -71736,7 +72713,7 @@ import { resolve as resolve13 } from "path";
 
 // src/commands/templates/snapshot-browser.ts
 import { existsSync } from "fs";
-import { copyFile as copyFile3, mkdir as mkdir4, mkdtemp as mkdtemp2, readFile as readFile4, rm as rm2, stat as stat3, writeFile as writeFile5 } from "fs/promises";
+import { copyFile as copyFile3, mkdir as mkdir4, mkdtemp as mkdtemp2, readFile as readFile5, rm as rm2, stat as stat4, writeFile as writeFile5 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
 import { join as join4 } from "path";
 import { pathToFileURL as pathToFileURL4 } from "url";
@@ -71850,7 +72827,7 @@ var runProcess = async (command, args, until) => {
     stderr += text;
   });
   const deadline = Date.now() + RUN_TIMEOUT_MS;
-  const produced = async () => until.stdoutIncludes !== undefined && stdout.includes(until.stdoutIncludes) || until.file !== undefined && existsSync(until.file) && (await stat3(until.file)).size > 0;
+  const produced = async () => until.stdoutIncludes !== undefined && stdout.includes(until.stdoutIncludes) || until.file !== undefined && existsSync(until.file) && (await stat4(until.file)).size > 0;
   const state = { exited: false };
   child.exited.then(() => {
     state.exited = true;
@@ -71876,7 +72853,7 @@ var chromeLauncher = (binary, run = runProcess) => ({
     const profile = await mkdtemp2(join4(tmpdir2(), "samva-chrome-"));
     try {
       for (const request of requests) {
-        const source = await readFile4(request.htmlPath, "utf8");
+        const source = await readFile5(request.htmlPath, "utf8");
         const measured = request.htmlPath.replace(/\.html$/, `.${request.viewport}.${request.scheme}.html`);
         await writeFile5(measured, withMeasurement(source));
         const measure = await run(binary, chromeMeasureArgs({
@@ -72594,7 +73571,7 @@ var typesCommand = make29("types", {
 })));
 
 // src/commands/templates/workspace.ts
-import { basename, resolve as resolve15 } from "path";
+import { basename as basename2, resolve as resolve15 } from "path";
 var templateIdArgument = String10("template-id").pipe(withDescription4("Template whose project workspace to act on"));
 var revisionFlag = String9("revision").pipe(withDescription2("Workspace revision this call is fenced to; a workspace that moved refuses the call"));
 var idempotencyKeyFlag4 = String9("idempotency-key").pipe(withDescription2("Key so an identical retry returns the original result rather than repeating it"));
@@ -72687,7 +73664,7 @@ var addAsset = make29("add-asset", {
   const view = yield* putWorkspaceAsset({
     id,
     expectedRevision: revision,
-    path: getOrElse(path, () => `assets/${basename(source)}`),
+    path: getOrElse(path, () => `assets/${basename2(source)}`),
     contentBase64: Buffer.from(bytes).toString("base64"),
     replace,
     idempotencyKey
@@ -72860,7 +73837,7 @@ var typecheckProject = (tsconfig) => tryPromise2({
 });
 var validateTemplatesDir = (dir) => tryPromise2({
   try: async () => {
-    const info = await stat4(dir);
+    const info = await stat5(dir);
     if (!info.isDirectory()) {
       return Promise.reject(new SamvaCliError({ message: `${dir} is not a directory.` }));
     }
@@ -73448,7 +74425,7 @@ var list29 = make29("list", {
   if (data.nextCursor !== null)
     yield* printFields([["Next cursor", data.nextCursor]]);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var get24 = make29("get", { id: idArgument, json: jsonFlag }).pipe(withDescription3("Get a customer webhook"), withExamples([{ command: "samva webhooks get wep_abc123 --json" }]), withHandler(({ id, json }) => gen2(function* () {
+var get25 = make29("get", { id: idArgument, json: jsonFlag }).pipe(withDescription3("Get a customer webhook"), withExamples([{ command: "samva webhooks get wep_abc123 --json" }]), withHandler(({ id, json }) => gen2(function* () {
   const client = yield* getClientProvider;
   const data = yield* get19({ id }).pipe(client.provide, mapError2((error) => toCliApiError("Could not get webhook", error)));
   if (json)
@@ -73572,12 +74549,12 @@ var rotate2 = make29("rotate-secret", {
   yield* log(secret);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
 var create20 = make29("create", {
-  data: String9("data").pipe(withDescription2("Webhook JSON: name, url, events, and optional retry settings")),
+  data: String9("data").pipe(withDescription2("Webhook JSON: name, url, eventTypes, and optional retry settings")),
   dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
   json: jsonFlag
 }).pipe(withDescription3("Create a customer webhook from JSON"), withExamples([
   {
-    command: `samva webhooks create --data '{"name":"delivery","url":"https://example.com/hook","events":["message.delivered"]}' --dry-run`
+    command: `samva webhooks create --data '{"name":"delivery","url":"https://example.com/hook","eventTypes":["message.delivered"]}' --dry-run`
   }
 ]), withHandler(({ data, dryRun, json }) => gen2(function* () {
   const payload = yield* decodePayload2(data, "--data", CreateWebhookPayload);
@@ -73589,7 +74566,7 @@ var create20 = make29("create", {
     return yield* printJson(result);
   yield* printJson(result);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var update16 = make29("update", {
+var update17 = make29("update", {
   id: idArgument,
   data: String9("data").pipe(withDescription2("JSON object of webhook fields to update")),
   dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
@@ -73608,7 +74585,7 @@ var update16 = make29("update", {
     return yield* printJson(result);
   yield* printJson(result);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var remove19 = make29("remove", {
+var remove20 = make29("remove", {
   id: idArgument,
   dryRun: Boolean6("dry-run").pipe(withDefault5(false)),
   yes: Boolean6("yes").pipe(withDefault5(false)),
@@ -73631,7 +74608,7 @@ var remove19 = make29("remove", {
     return yield* printJson(result);
   yield* log(`Removed webhook ${id}.`);
 }).pipe(json ? provideService2(MinimumLogLevel2, "None") : identity)));
-var webhooksCommand = make29("webhooks").pipe(withDescription3("Inspect, test, and recover customer webhooks"), withExamples([{ command: "samva webhooks list --json" }]), withSubcommands([list29, get24, create20, update16, test2, logs, stats, retry5, rotate2, remove19]));
+var webhooksCommand = make29("webhooks").pipe(withDescription3("Inspect, test, and recover customer webhooks"), withExamples([{ command: "samva webhooks list --json" }]), withSubcommands([list29, get25, create20, update17, test2, logs, stats, retry5, rotate2, remove20]));
 
 // src/lib/root-commands.ts
 var rootCommands = [