groundmail-cli 0.19.0 → 0.22.0

package/dist/cli.js

@@ -43,6 +43,7 @@ function parseSendCommandArgs(args) {
     scheduledAt: readFlag(args, "--schedule"),
     category,
     unsubscribe: args.includes("--unsubscribe") ? true : void 0,
+    tenant: readFlag(args, "--tenant"),
     apiKey: readFlag(args, "--api-key"),
     baseUrl: readFlag(args, "--base-url")
   };
@@ -66,9 +67,13 @@ async function runSendCommand(args, deps) {
       tags: options.tags,
       scheduledAt: options.scheduledAt,
       category: options.category,
-      unsubscribe: options.unsubscribe
+      unsubscribe: options.unsubscribe,
+      ...options.tenant ? { tenant: options.tenant } : {}
     });
     stdout(JSON.stringify(result));
+    if (result.test) {
+      stderr("Test send: simulated, nothing was delivered. Its status and webhooks are marked test.");
+    }
     return 0;
   } catch (error) {
     stderr(error instanceof Error ? error.message : String(error));
@@ -101,6 +106,7 @@ function parseSendCommandOptions(args, env) {
     scheduledAt: parsed.scheduledAt,
     category: parsed.category,
     unsubscribe: parsed.unsubscribe,
+    tenant: parsed.tenant,
     apiKey,
     baseUrl: parsed.baseUrl
   };
@@ -135,7 +141,7 @@ function readFirstPositional(args) {
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
     if (arg.startsWith("--")) {
-      if (arg === "--api-key" || arg === "--base-url" || arg === "--file") index += 1;
+      if (arg === "--api-key" || arg === "--base-url" || arg === "--file" || arg === "--tenant") index += 1;
       continue;
     }
     return arg;
@@ -164,7 +170,9 @@ async function runBatchCommand(args, deps) {
       stderr(payload.error);
       return { exitCode: 1, error: payload.error };
     }
-    const result = await deps.sendBatch(payload.emails);
+    const tenant = readFlag2(args, "--tenant");
+    const emails = tenant ? payload.emails.map((email) => email.tenant ? email : { ...email, tenant }) : payload.emails;
+    const result = await deps.sendBatch(emails);
     stdout(JSON.stringify(result));
     return { exitCode: 0 };
   } catch (error) {
@@ -389,10 +397,18 @@ async function runListCommand(args, deps) {
   const limitRaw = readFlag7(args, "--limit");
   const cursor = readFlag7(args, "--cursor");
   const limit = limitRaw ? Number(limitRaw) : void 0;
+  if (args.includes("--test") && args.includes("--live")) {
+    stderr("Pass --test or --live, not both.");
+    return { exitCode: 1, error: "conflicting flags" };
+  }
+  const test = args.includes("--test") ? true : args.includes("--live") ? false : void 0;
+  const tenant = readFlag7(args, "--tenant");
   try {
     const result = await deps.listEmails({
       ...limit != null && Number.isFinite(limit) ? { limit } : {},
-      ...cursor ? { cursor } : {}
+      ...cursor ? { cursor } : {},
+      ...test !== void 0 ? { test } : {},
+      ...tenant ? { tenant } : {}
     });
     stdout(JSON.stringify(result));
     return { exitCode: 0 };
@@ -699,7 +715,8 @@ function parseDomainsCommonArgs(args) {
     apiKey: readFlag10(args, "--api-key"),
     baseUrl: readFlag10(args, "--base-url"),
     name: readFlag10(args, "--name") || readFlag10(args, "--domain"),
-    id: readFlag10(args, "--id")
+    id: readFlag10(args, "--id"),
+    tenant: readFlag10(args, "--tenant")
   };
 }
 function resolveApiKey3(options, env) {
@@ -732,7 +749,7 @@ async function runAddCommand(args, env = process.env) {
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const name = options.name || args.find((arg) => !arg.startsWith("--") && arg.includes("."));
+  const name = options.name || args.find((arg, i) => !arg.startsWith("--") && arg.includes(".") && args[i - 1] !== "--tenant");
   if (!name) {
     return {
       exitCode: 1,
@@ -744,11 +761,14 @@ async function runAddCommand(args, env = process.env) {
     const inbound = readFlag10(args, "--inbound");
     const result = await client2.domains.create({
       name,
-      ...inbound === "true" || inbound === "1" ? { inbound_enabled: true } : {}
+      ...inbound === "true" || inbound === "1" ? { inbound_enabled: true } : {},
+      ...options.tenant ? { tenant: options.tenant } : {}
     });
     console.log(JSON.stringify(result));
     console.error("");
-    console.error(`Domain ${result.domain.name} added (${result.domain.status}).`);
+    console.error(
+      `Domain ${result.domain.name} added (${result.domain.status})${options.tenant ? ` for tenant ${options.tenant}` : ""}.`
+    );
     console.error(formatDnsRecords(result.records));
     console.error("");
     console.error(`Then: groundmail domains verify ${result.domain.name}`);
@@ -883,7 +903,7 @@ async function runListCommand3(args, env = process.env) {
   }
   try {
     const client2 = await createDomainsClient(apiKey, options.baseUrl);
-    const result = await client2.domains.list();
+    const result = await client2.domains.list(options.tenant ? { tenant: options.tenant } : {});
     console.log(JSON.stringify(result));
     return { exitCode: 0 };
   } catch (error) {
@@ -1066,13 +1086,46 @@ async function runListCommand4(args, env = process.env) {
   }
 }
 
-// src/commands/webhooks/shared.ts
+// src/commands/tenants/shared.ts
+var TENANT_VALUE_FLAGS = [
+  "--api-key",
+  "--base-url",
+  "--tenant",
+  "--id",
+  "--external-id",
+  "--name",
+  "--default-from-domain",
+  "--stream-policy",
+  "--daily-limit",
+  "--metadata",
+  "--status",
+  "--reason",
+  "--limit",
+  "--cursor",
+  "--days",
+  "--domain"
+];
 function readFlag12(args, flag) {
   const index = args.indexOf(flag);
   if (index === -1) return void 0;
   return args[index + 1];
 }
-function parseWebhooksCommonArgs(args) {
+function hasFlag(args, flag) {
+  return args.includes(flag);
+}
+function positionals(args, valueFlags = TENANT_VALUE_FLAGS) {
+  const out = [];
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg.startsWith("--")) {
+      if (valueFlags.includes(arg)) i += 1;
+      continue;
+    }
+    out.push(arg);
+  }
+  return out;
+}
+function parseTenantsCommonArgs(args) {
   return {
     apiKey: readFlag12(args, "--api-key"),
     baseUrl: readFlag12(args, "--base-url")
@@ -1081,6 +1134,82 @@ function parseWebhooksCommonArgs(args) {
 function resolveApiKey5(options, env) {
   return options.apiKey || env.GROUNDMAIL_API_KEY || null;
 }
+async function createTenantsClient(apiKey, baseUrl) {
+  const { Groundmail } = await import("groundmail");
+  return new Groundmail(apiKey, baseUrl ? { baseUrl } : void 0);
+}
+var MISSING_KEY = "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key.";
+function failure(error) {
+  return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
+}
+function parseDailyLimit(value) {
+  if (value === void 0) return {};
+  if (value === "none" || value === "null") return { value: null };
+  const n2 = Number(value);
+  if (!Number.isInteger(n2) || n2 < 0) return { error: "--daily-limit must be a whole number, or none" };
+  return { value: n2 };
+}
+function parseMetadata(value) {
+  if (value === void 0) return {};
+  if (value === "null") return { value: null };
+  try {
+    const parsed = JSON.parse(value);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return { error: "--metadata must be a JSON object" };
+    }
+    return { value: parsed };
+  } catch {
+    return { error: "--metadata must be valid JSON" };
+  }
+}
+function parseStreamPolicy(value) {
+  if (value === void 0) return {};
+  if (value === "all" || value === "transactional_only") return { value };
+  return { error: "--stream-policy must be all or transactional_only" };
+}
+function parseTenantSettings(args) {
+  const dailyLimit = parseDailyLimit(readFlag12(args, "--daily-limit"));
+  if ("error" in dailyLimit) return dailyLimit;
+  const metadata = parseMetadata(readFlag12(args, "--metadata"));
+  if ("error" in metadata) return metadata;
+  const streamPolicy = parseStreamPolicy(readFlag12(args, "--stream-policy"));
+  if ("error" in streamPolicy) return streamPolicy;
+  const name = readFlag12(args, "--name");
+  const fromDomain = readFlag12(args, "--default-from-domain");
+  return {
+    value: {
+      ...name !== void 0 ? { name } : {},
+      ...fromDomain !== void 0 ? { default_from_domain: fromDomain === "none" ? null : fromDomain } : {},
+      ...streamPolicy.value !== void 0 ? { stream_policy: streamPolicy.value } : {},
+      ..."value" in dailyLimit ? { daily_limit: dailyLimit.value } : {},
+      ..."value" in metadata ? { metadata: metadata.value } : {}
+    }
+  };
+}
+function tenantRef(args) {
+  return readFlag12(args, "--tenant") || readFlag12(args, "--id") || positionals(args)[0];
+}
+function parseTenantsList(value) {
+  if (value === void 0) return void 0;
+  if (value === "all" || value === "none" || value === "") return null;
+  return value.split(/[\s,]+/).map((v) => v.trim()).filter(Boolean);
+}
+
+// src/commands/webhooks/shared.ts
+function readFlag13(args, flag) {
+  const index = args.indexOf(flag);
+  if (index === -1) return void 0;
+  return args[index + 1];
+}
+function parseWebhooksCommonArgs(args) {
+  return {
+    apiKey: readFlag13(args, "--api-key"),
+    baseUrl: readFlag13(args, "--base-url")
+  };
+}
+function resolveApiKey6(options, env) {
+  return options.apiKey || env.GROUNDMAIL_API_KEY || null;
+}
 async function createWebhooksClient(apiKey, baseUrl) {
   const { Groundmail } = await import("groundmail");
   return new Groundmail(apiKey, baseUrl ? { baseUrl } : void 0);
@@ -1089,17 +1218,18 @@ async function createWebhooksClient(apiKey, baseUrl) {
 // src/commands/webhooks/create.ts
 async function runCreateCommand2(args, env = process.env) {
   const options = parseWebhooksCommonArgs(args);
-  const apiKey = resolveApiKey5(options, env);
+  const apiKey = resolveApiKey6(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const url = readFlag12(args, "--url");
+  const url = readFlag13(args, "--url");
   if (!url) {
     return { exitCode: 1, error: "Required flag: --url" };
   }
   try {
     const client2 = await createWebhooksClient(apiKey, options.baseUrl);
-    const result = await client2.webhooks.create({ url });
+    const tenants = parseTenantsList(readFlag13(args, "--tenants"));
+    const result = await client2.webhooks.create({ url, ...tenants?.length ? { tenants } : {} });
     console.log(JSON.stringify(result));
     return { exitCode: 0 };
   } catch (error) {
@@ -1111,9 +1241,9 @@ async function runCreateCommand2(args, env = process.env) {
 var POSITIONAL_FLAGS5 = ["--api-key", "--base-url", "--id"];
 async function runGetCommand5(args, env = process.env) {
   const options = parseWebhooksCommonArgs(args);
-  const apiKey = resolveApiKey5(options, env);
+  const apiKey = resolveApiKey6(options, env);
   if (!apiKey) return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
-  const id = readFlag13(args, "--id") || readFirstPositional6(args);
+  const id = readFlag14(args, "--id") || readFirstPositional6(args);
   if (!id) return { exitCode: 1, error: "Missing webhook id. Pass --id wh_\u2026" };
   try {
     const client2 = await createWebhooksClient(apiKey, options.baseUrl);
@@ -1123,7 +1253,7 @@ async function runGetCommand5(args, env = process.env) {
     return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
   }
 }
-function readFlag13(args, flag) {
+function readFlag14(args, flag) {
   const index = args.indexOf(flag);
   return index === -1 ? void 0 : args[index + 1];
 }
@@ -1142,11 +1272,11 @@ function readFirstPositional6(args) {
 // src/commands/webhooks/delete.ts
 async function runDeleteCommand3(args, env = process.env) {
   const options = parseWebhooksCommonArgs(args);
-  const apiKey = resolveApiKey5(options, env);
+  const apiKey = resolveApiKey6(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const id = readFlag12(args, "--id");
+  const id = readFlag13(args, "--id");
   if (!id) {
     return { exitCode: 1, error: "Required flag: --id" };
   }
@@ -1163,7 +1293,7 @@ async function runDeleteCommand3(args, env = process.env) {
 // src/commands/webhooks/list.ts
 async function runListCommand5(args, env = process.env) {
   const options = parseWebhooksCommonArgs(args);
-  const apiKey = resolveApiKey5(options, env);
+  const apiKey = resolveApiKey6(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
@@ -1178,24 +1308,26 @@ async function runListCommand5(args, env = process.env) {
 }
 
 // src/commands/webhooks/update.ts
-var POSITIONAL_FLAGS6 = ["--api-key", "--base-url", "--id", "--url", "--event", "--enabled"];
+var POSITIONAL_FLAGS6 = ["--api-key", "--base-url", "--id", "--url", "--event", "--enabled", "--tenants"];
 async function runUpdateCommand3(args, env = process.env) {
   const options = parseWebhooksCommonArgs(args);
-  const apiKey = resolveApiKey5(options, env);
+  const apiKey = resolveApiKey6(options, env);
   if (!apiKey) return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
-  const id = readFlag14(args, "--id") || readFirstPositional7(args);
+  const id = readFlag15(args, "--id") || readFirstPositional7(args);
   if (!id) return { exitCode: 1, error: "Missing webhook id. Pass --id wh_\u2026" };
-  const url = readFlag14(args, "--url");
+  const url = readFlag15(args, "--url");
   const events = readFlags2(args, "--event");
-  const enabled = parseEnabledFlag(readFlag14(args, "--enabled"));
+  const enabled = parseEnabledFlag(readFlag15(args, "--enabled"));
   if ("error" in enabled) return { exitCode: 1, error: enabled.error };
-  if (!url && events.length === 0 && enabled.value === void 0) {
-    return { exitCode: 1, error: "Nothing to update. Pass --url, --event, or --enabled true|false." };
+  const tenants = parseTenantsList(readFlag15(args, "--tenants"));
+  if (!url && events.length === 0 && enabled.value === void 0 && tenants === void 0) {
+    return { exitCode: 1, error: "Nothing to update. Pass --url, --event, --enabled true|false, or --tenants." };
   }
   const payload = {
     ...url ? { url } : {},
     ...events.length > 0 ? { events } : {},
-    ...enabled.value !== void 0 ? { enabled: enabled.value } : {}
+    ...enabled.value !== void 0 ? { enabled: enabled.value } : {},
+    ...tenants !== void 0 ? { tenants } : {}
   };
   try {
     const client2 = await createWebhooksClient(apiKey, options.baseUrl);
@@ -1205,7 +1337,7 @@ async function runUpdateCommand3(args, env = process.env) {
     return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
   }
 }
-function readFlag14(args, flag) {
+function readFlag15(args, flag) {
   const index = args.indexOf(flag);
   return index === -1 ? void 0 : args[index + 1];
 }
@@ -1235,22 +1367,22 @@ function parseEnabledFlag(value) {
 }
 
 // src/commands/keys/list.ts
-function readFlag15(args, flag) {
+function readFlag16(args, flag) {
   const index = args.indexOf(flag);
   if (index === -1) return void 0;
   return args[index + 1];
 }
 async function runListKeysCommandWithClient(args, env = process.env) {
-  const apiKey = readFlag15(args, "--api-key") || env.GROUNDMAIL_API_KEY;
-  const baseUrl = readFlag15(args, "--base-url");
+  const apiKey = readFlag16(args, "--api-key") || env.GROUNDMAIL_API_KEY;
+  const baseUrl = readFlag16(args, "--base-url");
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
   const { Groundmail } = await import("groundmail");
   const client2 = new Groundmail(apiKey, baseUrl ? { baseUrl } : void 0);
   try {
-    const limitRaw = readFlag15(args, "--limit");
-    const cursor = readFlag15(args, "--cursor");
+    const limitRaw = readFlag16(args, "--limit");
+    const cursor = readFlag16(args, "--cursor");
     const result = await client2.apiKeys.list({
       ...limitRaw ? { limit: Number(limitRaw) } : {},
       ...cursor ? { cursor } : {}
@@ -1288,7 +1420,7 @@ function trimUrl(value) {
 }
 
 // package.json
-var version = "0.19.0";
+var version = "0.22.0";
 
 // src/user-agent.ts
 function buildUserAgent(own) {
@@ -1372,15 +1504,15 @@ function parseArgs(argv, spec) {
   const booleanFlags = new Set(spec.booleans ?? []);
   const values = {};
   const booleans = {};
-  const positionals = [];
+  const positionals2 = [];
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     if (arg === "--") {
-      positionals.push(...argv.slice(i + 1));
+      positionals2.push(...argv.slice(i + 1));
       break;
     }
     if (!arg.startsWith("--") || arg === "-") {
-      positionals.push(arg);
+      positionals2.push(arg);
       continue;
     }
     const eq = arg.indexOf("=");
@@ -1406,7 +1538,7 @@ function parseArgs(argv, spec) {
     const known = [...valueFlags, ...booleanFlags].sort().join(", ");
     return { ok: false, error: `Unknown flag ${name}.${known ? ` This command takes: ${known}.` : ""}` };
   }
-  return { ok: true, args: { values, booleans, positionals } };
+  return { ok: true, args: { values, booleans, positionals: positionals2 } };
 }
 function wantsJson(args, stdout = process.stdout) {
   if (args.booleans["--json"] !== void 0) return args.booleans["--json"];
@@ -1714,10 +1846,10 @@ async function resolveAuth(flags, env = process.env, config = loadConfig(env)) {
   return fromSaved(current.workspace);
 }
 async function applySavedSession(argv, env = process.env, config) {
-  const hasFlag = (flag) => argv.some((arg) => arg === flag || arg.startsWith(`${flag}=`));
+  const hasFlag2 = (flag) => argv.some((arg) => arg === flag || arg.startsWith(`${flag}=`));
   let workspace = null;
   let notice;
-  if (!hasFlag("--api-key") && !envApiKey(env)) {
+  if (!hasFlag2("--api-key") && !envApiKey(env)) {
     const current = currentSavedWorkspace(config ?? loadConfig(env), env);
     if (current.ok) {
       workspace = current.workspace;
@@ -1728,7 +1860,7 @@ async function applySavedSession(argv, env = process.env, config) {
       notice = current.error;
     }
   }
-  if (hasFlag("--base-url")) return { argv, notice };
+  if (hasFlag2("--base-url")) return { argv, notice };
   const url = explicitApiUrl(env) || trimUrl(workspace?.apiUrl) || trimUrl(env.GROUNDMAIL_DEFAULT_API_URL);
   return { argv: url ? [...argv, "--base-url", url] : argv, notice };
 }
@@ -2125,27 +2257,29 @@ Usage: ${brand.bin} whoami [--workspace <name>] [--json]` };
 }
 
 // src/commands/keys/create.ts
-function readFlag16(args, flag) {
+function readFlag17(args, flag) {
   const index = args.indexOf(flag);
   if (index === -1) return void 0;
   return args[index + 1];
 }
 async function runCreateKeyCommandWithClient(args, env = process.env) {
-  const apiKey = readFlag16(args, "--api-key") || env.GROUNDMAIL_API_KEY;
-  const baseUrl = readFlag16(args, "--base-url") || defaultApiUrl(env);
+  const apiKey = readFlag17(args, "--api-key") || env.GROUNDMAIL_API_KEY;
+  const baseUrl = readFlag17(args, "--base-url") || defaultApiUrl(env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const name = readFlag16(args, "--name");
-  const scope = readFlag16(args, "--scope");
+  const name = readFlag17(args, "--name");
+  const scope = readFlag17(args, "--scope");
   if (scope && scope !== "full" && scope !== "sending") {
     return { exitCode: 1, error: "--scope must be full or sending (or use --scopes for fine-grained scopes)" };
   }
-  const scopesFlag = readFlag16(args, "--scopes");
+  const scopesFlag = readFlag17(args, "--scopes");
   const scopes = scopesFlag !== void 0 ? parseScopeFlag(scopesFlag) : null;
   if (scopes && !scopes.ok) return { exitCode: 1, error: scopes.error };
-  const domainsFlag = readFlag16(args, "--allowed-domains");
+  const domainsFlag = readFlag17(args, "--allowed-domains");
   const allowedDomains = domainsFlag?.split(/[\s,]+/).map((domain) => domain.trim()).filter(Boolean);
+  const test = args.includes("--test");
+  const tenant = readFlag17(args, "--tenant");
   try {
     const response = await apiRequest(baseUrl, "/api-keys", {
       apiKey,
@@ -2154,13 +2288,18 @@ async function runCreateKeyCommandWithClient(args, env = process.env) {
         ...name ? { name } : {},
         ...scope && !scopes ? { scope } : {},
         ...scopes?.ok ? { scopes: scopes.scope.split(" ") } : {},
-        ...allowedDomains?.length ? { allowed_domains: allowedDomains } : {}
+        ...allowedDomains?.length ? { allowed_domains: allowedDomains } : {},
+        ...test ? { test: true } : {},
+        ...tenant ? { tenant } : {}
       }
     });
     if (!response.ok) {
       return { exitCode: 1, error: errorMessage(response, "Could not create the key") };
     }
     console.log(JSON.stringify(response.body));
+    if (test) {
+      console.error("Test key: sends with it run every check and fire webhooks, but nothing is delivered. https://docs.groundmail.dev/testing");
+    }
     return { exitCode: 0 };
   } catch (error) {
     return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
@@ -2168,15 +2307,15 @@ async function runCreateKeyCommandWithClient(args, env = process.env) {
 }
 
 // src/commands/keys/delete.ts
-function readFlag17(args, flag) {
+function readFlag18(args, flag) {
   const index = args.indexOf(flag);
   if (index === -1) return void 0;
   return args[index + 1];
 }
 async function runDeleteKeyCommandWithClient(args, env = process.env) {
-  const apiKey = readFlag17(args, "--api-key") || env.GROUNDMAIL_API_KEY;
-  const baseUrl = readFlag17(args, "--base-url");
-  const id = readFlag17(args, "--id");
+  const apiKey = readFlag18(args, "--api-key") || env.GROUNDMAIL_API_KEY;
+  const baseUrl = readFlag18(args, "--base-url");
+  const id = readFlag18(args, "--id");
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
@@ -2197,18 +2336,18 @@ async function runDeleteKeyCommandWithClient(args, env = process.env) {
 }
 
 // src/commands/suppressions/shared.ts
-function readFlag18(args, flag) {
+function readFlag19(args, flag) {
   const index = args.indexOf(flag);
   if (index === -1) return void 0;
   return args[index + 1];
 }
 function parseSuppressionsCommonArgs(args) {
   return {
-    apiKey: readFlag18(args, "--api-key"),
-    baseUrl: readFlag18(args, "--base-url")
+    apiKey: readFlag19(args, "--api-key"),
+    baseUrl: readFlag19(args, "--base-url")
   };
 }
-function resolveApiKey6(options, env) {
+function resolveApiKey7(options, env) {
   return options.apiKey || env.GROUNDMAIL_API_KEY || null;
 }
 async function createSuppressionsClient(apiKey, baseUrl) {
@@ -2219,19 +2358,21 @@ async function createSuppressionsClient(apiKey, baseUrl) {
 // src/commands/suppressions/list.ts
 async function runListCommand6(args, env = process.env) {
   const options = parseSuppressionsCommonArgs(args);
-  const apiKey = resolveApiKey6(options, env);
+  const apiKey = resolveApiKey7(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
   try {
     const client2 = await createSuppressionsClient(apiKey, options.baseUrl);
-    const limitRaw = readFlag18(args, "--limit");
-    const cursor = readFlag18(args, "--cursor");
-    const email = readFlag18(args, "--email");
+    const limitRaw = readFlag19(args, "--limit");
+    const cursor = readFlag19(args, "--cursor");
+    const email = readFlag19(args, "--email");
+    const tenant = readFlag19(args, "--tenant");
     const result = await client2.suppressions.list({
       ...limitRaw ? { limit: Number(limitRaw) } : {},
       ...cursor ? { cursor } : {},
-      ...email ? { email } : {}
+      ...email ? { email } : {},
+      ...tenant ? { tenant } : {}
     });
     console.log(JSON.stringify(result));
     return { exitCode: 0 };
@@ -2243,20 +2384,22 @@ async function runListCommand6(args, env = process.env) {
 // src/commands/suppressions/add.ts
 async function runAddCommand2(args, env = process.env) {
   const options = parseSuppressionsCommonArgs(args);
-  const apiKey = resolveApiKey6(options, env);
+  const apiKey = resolveApiKey7(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const email = readFlag18(args, "--email") || args.find((a) => a.includes("@") && !a.startsWith("-"));
+  const tenant = readFlag19(args, "--tenant");
+  const email = readFlag19(args, "--email") || args.find((a, i) => a.includes("@") && !a.startsWith("-") && args[i - 1] !== "--tenant");
   if (!email) {
     return { exitCode: 1, error: "Missing email. Pass --email user@example.com" };
   }
   try {
     const client2 = await createSuppressionsClient(apiKey, options.baseUrl);
-    const reason = readFlag18(args, "--reason");
+    const reason = readFlag19(args, "--reason");
     const result = await client2.suppressions.create({
       email,
-      ...reason ? { reason } : {}
+      ...reason ? { reason } : {},
+      ...tenant ? { tenant } : {}
     });
     console.log(JSON.stringify(result));
     return { exitCode: 0 };
@@ -2268,17 +2411,20 @@ async function runAddCommand2(args, env = process.env) {
 // src/commands/suppressions/remove.ts
 async function runRemoveCommand(args, env = process.env) {
   const options = parseSuppressionsCommonArgs(args);
-  const apiKey = resolveApiKey6(options, env);
+  const apiKey = resolveApiKey7(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const idOrEmail = readFlag18(args, "--id") || readFlag18(args, "--email") || args.find((a) => !a.startsWith("-") && a !== "remove" && a !== "delete");
+  const tenant = readFlag19(args, "--tenant");
+  const idOrEmail = readFlag19(args, "--id") || readFlag19(args, "--email") || args.find(
+    (a, i) => !a.startsWith("-") && a !== "remove" && a !== "delete" && !["--tenant", "--api-key", "--base-url"].includes(args[i - 1] ?? "")
+  );
   if (!idOrEmail) {
     return { exitCode: 1, error: "Missing id or email. Pass --id <uuid> or --email user@example.com" };
   }
   try {
     const client2 = await createSuppressionsClient(apiKey, options.baseUrl);
-    const result = await client2.suppressions.remove(idOrEmail);
+    const result = tenant ? await client2.suppressions.remove(idOrEmail, { tenant }) : await client2.suppressions.remove(idOrEmail);
     console.log(JSON.stringify(result));
     return { exitCode: 0 };
   } catch (error) {
@@ -2287,18 +2433,18 @@ async function runRemoveCommand(args, env = process.env) {
 }
 
 // src/commands/templates/shared.ts
-function readFlag19(args, flag) {
+function readFlag20(args, flag) {
   const index = args.indexOf(flag);
   if (index === -1) return void 0;
   return args[index + 1];
 }
 function parseTemplatesCommonArgs(args) {
   return {
-    apiKey: readFlag19(args, "--api-key"),
-    baseUrl: readFlag19(args, "--base-url")
+    apiKey: readFlag20(args, "--api-key"),
+    baseUrl: readFlag20(args, "--base-url")
   };
 }
-function resolveApiKey7(options, env) {
+function resolveApiKey8(options, env) {
   return options.apiKey || env.GROUNDMAIL_API_KEY || null;
 }
 async function createTemplatesClient(apiKey, baseUrl) {
@@ -2310,9 +2456,9 @@ async function createTemplatesClient(apiKey, baseUrl) {
 var POSITIONAL_FLAGS7 = ["--api-key", "--base-url", "--id", "--alias"];
 async function runDeleteCommand4(args, env = process.env) {
   const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
+  const apiKey = resolveApiKey8(options, env);
   if (!apiKey) return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
-  const idOrAlias = readFlag19(args, "--id") || readFlag19(args, "--alias") || readFirstPositional8(args);
+  const idOrAlias = readFlag20(args, "--id") || readFlag20(args, "--alias") || readFirstPositional8(args);
   if (!idOrAlias) return { exitCode: 1, error: "Missing template id or alias. Pass --id tpl_\u2026 or --alias welcome" };
   try {
     const client2 = await createTemplatesClient(apiKey, options.baseUrl);
@@ -2338,11 +2484,11 @@ function readFirstPositional8(args) {
 var POSITIONAL_FLAGS8 = ["--api-key", "--base-url", "--id", "--alias", "--name"];
 async function runDuplicateCommand(args, env = process.env) {
   const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
+  const apiKey = resolveApiKey8(options, env);
   if (!apiKey) return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
-  const idOrAlias = readFlag19(args, "--id") || readFlag19(args, "--alias") || readFirstPositional9(args);
+  const idOrAlias = readFlag20(args, "--id") || readFlag20(args, "--alias") || readFirstPositional9(args);
   if (!idOrAlias) return { exitCode: 1, error: "Missing template id or alias. Pass --id tpl_\u2026 or --alias welcome" };
-  const name = readFlag19(args, "--name");
+  const name = readFlag20(args, "--name");
   try {
     const client2 = await createTemplatesClient(apiKey, options.baseUrl);
     console.log(JSON.stringify(await client2.templates.duplicate(idOrAlias, name ? { name } : {})));
@@ -2367,9 +2513,9 @@ function readFirstPositional9(args) {
 var POSITIONAL_FLAGS9 = ["--api-key", "--base-url", "--id", "--alias"];
 async function runGetCommand6(args, env = process.env) {
   const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
+  const apiKey = resolveApiKey8(options, env);
   if (!apiKey) return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
-  const idOrAlias = readFlag19(args, "--id") || readFlag19(args, "--alias") || readFirstPositional10(args);
+  const idOrAlias = readFlag20(args, "--id") || readFlag20(args, "--alias") || readFirstPositional10(args);
   if (!idOrAlias) return { exitCode: 1, error: "Missing template id or alias. Pass --id tpl_\u2026 or --alias welcome" };
   try {
     const client2 = await createTemplatesClient(apiKey, options.baseUrl);
@@ -2394,15 +2540,15 @@ function readFirstPositional10(args) {
 // src/commands/templates/list.ts
 async function runListCommand7(args, env = process.env) {
   const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
+  const apiKey = resolveApiKey8(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
   try {
     const client2 = await createTemplatesClient(apiKey, options.baseUrl);
-    const limitRaw = readFlag19(args, "--limit");
-    const cursor = readFlag19(args, "--cursor");
-    const status = readFlag19(args, "--status");
+    const limitRaw = readFlag20(args, "--limit");
+    const cursor = readFlag20(args, "--cursor");
+    const status = readFlag20(args, "--status");
     const result = await client2.templates.list({
       ...limitRaw ? { limit: Number(limitRaw) } : {},
       ...cursor ? { cursor } : {},
@@ -2419,9 +2565,9 @@ async function runListCommand7(args, env = process.env) {
 var POSITIONAL_FLAGS10 = ["--api-key", "--base-url", "--id", "--alias"];
 async function runPublishCommand(args, env = process.env) {
   const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
+  const apiKey = resolveApiKey8(options, env);
   if (!apiKey) return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
-  const idOrAlias = readFlag19(args, "--id") || readFlag19(args, "--alias") || readFirstPositional11(args);
+  const idOrAlias = readFlag20(args, "--id") || readFlag20(args, "--alias") || readFirstPositional11(args);
   if (!idOrAlias) return { exitCode: 1, error: "Missing template id or alias. Pass --id tpl_\u2026 or --alias welcome" };
   try {
     const client2 = await createTemplatesClient(apiKey, options.baseUrl);
@@ -2560,23 +2706,23 @@ function statusOf(error) {
 }
 async function runPushCommand(args, env = process.env, deps = {}) {
   const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
+  const apiKey = resolveApiKey8(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const file = readFlag19(args, "--file") ?? readPositional(args);
+  const file = readFlag20(args, "--file") ?? readPositional(args);
   if (!file) {
     return { exitCode: 1, error: "Missing template file. Usage: templates push <file> --alias <alias>" };
   }
-  const alias = readFlag19(args, "--alias");
+  const alias = readFlag20(args, "--alias");
   if (!alias) {
     return { exitCode: 1, error: "Missing --alias. The alias identifies which template to update." };
   }
-  const subject = readFlag19(args, "--subject");
-  const name = readFlag19(args, "--name");
-  const preheader = readFlag19(args, "--preheader");
-  const textFile = readFlag19(args, "--text");
-  const propsRaw = readFlag19(args, "--props");
+  const subject = readFlag20(args, "--subject");
+  const name = readFlag20(args, "--name");
+  const preheader = readFlag20(args, "--preheader");
+  const textFile = readFlag20(args, "--text");
+  const propsRaw = readFlag20(args, "--props");
   const shouldPublish = args.includes("--publish");
   let props = {};
   if (propsRaw) {
@@ -2646,16 +2792,16 @@ async function runPushCommand(args, env = process.env, deps = {}) {
 // src/commands/templates/create.ts
 async function runCreateCommand3(args, env = process.env) {
   const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
+  const apiKey = resolveApiKey8(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const name = readFlag19(args, "--name");
-  const subject = readFlag19(args, "--subject");
-  const html = readFlag19(args, "--html");
-  const text = readFlag19(args, "--text");
-  const alias = readFlag19(args, "--alias");
-  const category = readFlag19(args, "--category");
+  const name = readFlag20(args, "--name");
+  const subject = readFlag20(args, "--subject");
+  const html = readFlag20(args, "--html");
+  const text = readFlag20(args, "--text");
+  const alias = readFlag20(args, "--alias");
+  const category = readFlag20(args, "--category");
   const unsubscribeEnabled = args.includes("--unsubscribe-enabled");
   if (!name) {
     return { exitCode: 1, error: 'Missing name. Pass --name "Welcome"' };
@@ -2699,21 +2845,21 @@ var POSITIONAL_FLAGS11 = [
 ];
 async function runUpdateCommand4(args, env = process.env) {
   const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
+  const apiKey = resolveApiKey8(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const idOrAlias = readFlag19(args, "--id") || readFlag19(args, "--alias") || readFirstPositional12(args);
+  const idOrAlias = readFlag20(args, "--id") || readFlag20(args, "--alias") || readFirstPositional12(args);
   if (!idOrAlias) {
     return { exitCode: 1, error: "Missing template id or alias. Pass --id tpl_\u2026 or --alias welcome" };
   }
-  const name = readFlag19(args, "--name");
-  const subject = readFlag19(args, "--subject");
-  const html = readFlag19(args, "--html");
-  const text = readFlag19(args, "--text");
-  const alias = readFlag19(args, "--set-alias");
+  const name = readFlag20(args, "--name");
+  const subject = readFlag20(args, "--subject");
+  const html = readFlag20(args, "--html");
+  const text = readFlag20(args, "--text");
+  const alias = readFlag20(args, "--set-alias");
   const variables = readFlags3(args, "--variable");
-  const category = readFlag19(args, "--category");
+  const category = readFlag20(args, "--category");
   const unsubscribeEnabled = args.includes("--unsubscribe-enabled");
   const unsubscribeDisabled = args.includes("--no-unsubscribe-enabled");
   if (!name && !subject && !html && !text && !alias && variables.length === 0 && !category && !unsubscribeEnabled && !unsubscribeDisabled) {
@@ -2775,11 +2921,11 @@ function readFirstPositional13(args) {
 }
 async function runFromStarterCommand(args, env = process.env) {
   const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
+  const apiKey = resolveApiKey8(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const alias = readFlag19(args, "--alias") || readFirstPositional13(args);
+  const alias = readFlag20(args, "--alias") || readFirstPositional13(args);
   if (!alias) {
     return {
       exitCode: 1,
@@ -2796,7 +2942,7 @@ async function runFromStarterCommand(args, env = process.env) {
 }
 async function runListStartersCommand(args, env = process.env) {
   const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
+  const apiKey = resolveApiKey8(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
@@ -2824,11 +2970,11 @@ function readFirstPositional14(args) {
 }
 async function runVersionsCommand(args, env = process.env) {
   const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
+  const apiKey = resolveApiKey8(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const idOrAlias = readFlag19(args, "--id") || readFlag19(args, "--alias") || readFirstPositional14(args);
+  const idOrAlias = readFlag20(args, "--id") || readFlag20(args, "--alias") || readFirstPositional14(args);
   if (!idOrAlias) {
     return { exitCode: 1, error: "Missing template id or alias. Pass --id tpl_\u2026 or --alias welcome" };
   }
@@ -2842,12 +2988,12 @@ async function runVersionsCommand(args, env = process.env) {
 }
 async function runRestoreCommand(args, env = process.env) {
   const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
+  const apiKey = resolveApiKey8(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const idOrAlias = readFlag19(args, "--id") || readFlag19(args, "--alias") || readFirstPositional14(args);
-  const versionRaw = readFlag19(args, "--version");
+  const idOrAlias = readFlag20(args, "--id") || readFlag20(args, "--alias") || readFirstPositional14(args);
+  const versionRaw = readFlag20(args, "--version");
   const version2 = versionRaw ? Number.parseInt(versionRaw, 10) : NaN;
   if (!idOrAlias || !Number.isFinite(version2) || version2 < 1) {
     return {
@@ -2865,13 +3011,13 @@ async function runRestoreCommand(args, env = process.env) {
 }
 async function runTestSendCommand(args, env = process.env) {
   const options = parseTemplatesCommonArgs(args);
-  const apiKey = resolveApiKey7(options, env);
+  const apiKey = resolveApiKey8(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const idOrAlias = readFlag19(args, "--id") || readFlag19(args, "--alias") || readFirstPositional14(args);
-  const from = readFlag19(args, "--from");
-  const to = readFlag19(args, "--to");
+  const idOrAlias = readFlag20(args, "--id") || readFlag20(args, "--alias") || readFirstPositional14(args);
+  const from = readFlag20(args, "--from");
+  const to = readFlag20(args, "--to");
   if (!idOrAlias || !from || !to) {
     return {
       exitCode: 1,
@@ -2888,18 +3034,18 @@ async function runTestSendCommand(args, env = process.env) {
 }
 
 // src/commands/integrations/shared.ts
-function readFlag20(args, flag) {
+function readFlag21(args, flag) {
   const index = args.indexOf(flag);
   if (index === -1) return void 0;
   return args[index + 1];
 }
 function parseIntegrationsCommonArgs(args) {
   return {
-    apiKey: readFlag20(args, "--api-key"),
-    baseUrl: readFlag20(args, "--base-url")
+    apiKey: readFlag21(args, "--api-key"),
+    baseUrl: readFlag21(args, "--base-url")
   };
 }
-function resolveApiKey8(options, env) {
+function resolveApiKey9(options, env) {
   return options.apiKey || env.GROUNDMAIL_API_KEY || null;
 }
 async function createIntegrationsClient(apiKey, baseUrl) {
@@ -2910,7 +3056,7 @@ async function createIntegrationsClient(apiKey, baseUrl) {
 // src/commands/integrations/twilio.ts
 async function runTwilioStatusCommand(args, env = process.env) {
   const options = parseIntegrationsCommonArgs(args);
-  const apiKey = resolveApiKey8(options, env);
+  const apiKey = resolveApiKey9(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
@@ -2925,14 +3071,14 @@ async function runTwilioStatusCommand(args, env = process.env) {
 }
 async function runTwilioConnectCommand(args, env = process.env) {
   const options = parseIntegrationsCommonArgs(args);
-  const apiKey = resolveApiKey8(options, env);
+  const apiKey = resolveApiKey9(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
-  const accountSid = readFlag20(args, "--account-sid") || env.TWILIO_ACCOUNT_SID || env.TWILIO_SID || "";
-  const authToken = readFlag20(args, "--auth-token") || env.TWILIO_AUTH_TOKEN || env.TWILIO_TOKEN || "";
-  const defaultFrom = readFlag20(args, "--from") || readFlag20(args, "--default-from") || env.TWILIO_DEFAULT_FROM || "";
-  const messagingServiceSid = readFlag20(args, "--messaging-service-sid") || readFlag20(args, "--messaging-sid") || env.TWILIO_MESSAGING_SERVICE_SID || "";
+  const accountSid = readFlag21(args, "--account-sid") || env.TWILIO_ACCOUNT_SID || env.TWILIO_SID || "";
+  const authToken = readFlag21(args, "--auth-token") || env.TWILIO_AUTH_TOKEN || env.TWILIO_TOKEN || "";
+  const defaultFrom = readFlag21(args, "--from") || readFlag21(args, "--default-from") || env.TWILIO_DEFAULT_FROM || "";
+  const messagingServiceSid = readFlag21(args, "--messaging-service-sid") || readFlag21(args, "--messaging-sid") || env.TWILIO_MESSAGING_SERVICE_SID || "";
   if (!accountSid.trim() || !authToken.trim()) {
     return {
       exitCode: 1,
@@ -2961,7 +3107,7 @@ async function runTwilioConnectCommand(args, env = process.env) {
 }
 async function runTwilioDisconnectCommand(args, env = process.env) {
   const options = parseIntegrationsCommonArgs(args);
-  const apiKey = resolveApiKey8(options, env);
+  const apiKey = resolveApiKey9(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY or pass --api-key." };
   }
@@ -2975,6 +3121,125 @@ async function runTwilioDisconnectCommand(args, env = process.env) {
   }
 }
 
+// src/commands/tenants/commands.ts
+async function withClient(args, env, run) {
+  const options = parseTenantsCommonArgs(args);
+  const apiKey = resolveApiKey5(options, env);
+  if (!apiKey) return { exitCode: 1, error: MISSING_KEY };
+  try {
+    const client2 = await createTenantsClient(apiKey, options.baseUrl);
+    console.log(JSON.stringify(await run(client2)));
+    return { exitCode: 0 };
+  } catch (error) {
+    return failure(error);
+  }
+}
+function missingTenant(usage) {
+  return { exitCode: 1, error: `Missing tenant. Usage: ${usage}` };
+}
+async function runListCommand8(args, env = process.env) {
+  const status = readFlag12(args, "--status");
+  if (status !== void 0 && status !== "active" && status !== "paused") {
+    return { exitCode: 1, error: "--status must be active or paused" };
+  }
+  const limitRaw = readFlag12(args, "--limit");
+  const cursor = readFlag12(args, "--cursor");
+  return withClient(
+    args,
+    env,
+    (client2) => client2.tenants.list({
+      ...limitRaw ? { limit: Number(limitRaw) } : {},
+      ...cursor ? { cursor } : {},
+      ...status ? { status } : {}
+    })
+  );
+}
+async function runCreateCommand4(args, env = process.env) {
+  const externalId = readFlag12(args, "--external-id") || positionals(args)[0];
+  if (!externalId) {
+    return { exitCode: 1, error: "Missing external id. Usage: groundmail tenants create <external-id> [--name \u2026]" };
+  }
+  const settings = parseTenantSettings(args);
+  if ("error" in settings) return { exitCode: 1, error: settings.error };
+  return withClient(args, env, (client2) => client2.tenants.create({ external_id: externalId, ...settings.value }));
+}
+async function runGetCommand7(args, env = process.env) {
+  const tenant = tenantRef(args);
+  if (!tenant) return missingTenant("groundmail tenants get <tenant>");
+  return withClient(args, env, (client2) => client2.tenants.get(tenant));
+}
+async function runUpdateCommand5(args, env = process.env) {
+  const tenant = tenantRef(args);
+  if (!tenant) return missingTenant("groundmail tenants update <tenant> [--name \u2026] [--daily-limit N|none]");
+  const settings = parseTenantSettings(args);
+  if ("error" in settings) return { exitCode: 1, error: settings.error };
+  if (Object.keys(settings.value).length === 0) {
+    return {
+      exitCode: 1,
+      error: "Nothing to update. Pass --name, --default-from-domain, --stream-policy, --daily-limit or --metadata (or use tenants pause / resume)."
+    };
+  }
+  return withClient(args, env, (client2) => client2.tenants.update(tenant, settings.value));
+}
+async function runPauseCommand2(args, env = process.env) {
+  const tenant = tenantRef(args);
+  if (!tenant) return missingTenant("groundmail tenants pause <tenant> [--reason \u2026]");
+  const reason = readFlag12(args, "--reason");
+  return withClient(args, env, (client2) => client2.tenants.pause(tenant, reason));
+}
+async function runResumeCommand(args, env = process.env) {
+  const tenant = tenantRef(args);
+  if (!tenant) return missingTenant("groundmail tenants resume <tenant>");
+  return withClient(args, env, (client2) => client2.tenants.resume(tenant));
+}
+async function runDeleteCommand5(args, env = process.env) {
+  const tenant = tenantRef(args);
+  if (!tenant) return missingTenant("groundmail tenants delete <tenant> --yes");
+  if (!hasFlag(args, "--yes")) {
+    return {
+      exitCode: 1,
+      error: `This deletes tenant ${tenant} and its suppression list; its domains go back to the account and keys limited to it stop working. Run again with --yes to confirm.`
+    };
+  }
+  return withClient(args, env, (client2) => client2.tenants.delete(tenant));
+}
+async function runStatsCommand(args, env = process.env) {
+  const tenant = tenantRef(args);
+  if (!tenant) return missingTenant("groundmail tenants stats <tenant> [--days 7]");
+  const daysRaw = readFlag12(args, "--days");
+  const days = daysRaw !== void 0 ? Number(daysRaw) : void 0;
+  if (days !== void 0 && (!Number.isInteger(days) || days < 1 || days > 90)) {
+    return { exitCode: 1, error: "--days must be a whole number from 1 to 90" };
+  }
+  return withClient(args, env, (client2) => client2.tenants.stats(tenant, days !== void 0 ? { days } : {}));
+}
+async function runDomainsCommand(args, env = process.env) {
+  const [action, ...rest] = args;
+  const pos = positionals(rest);
+  const tenant = readFlag12(rest, "--tenant") || readFlag12(rest, "--id") || pos.shift();
+  const domain = readFlag12(rest, "--domain") || pos.shift();
+  if (action === "list") {
+    if (!tenant) return missingTenant("groundmail tenants domains list <tenant>");
+    return withClient(rest, env, (client2) => client2.tenants.domains.list(tenant));
+  }
+  if (action === "add" || action === "assign") {
+    if (!tenant || !domain) {
+      return { exitCode: 1, error: "Usage: groundmail tenants domains add <tenant> <domain>" };
+    }
+    return withClient(rest, env, (client2) => client2.tenants.domains.assign(tenant, domain));
+  }
+  if (action === "remove" || action === "unassign" || action === "delete") {
+    if (!tenant || !domain) {
+      return { exitCode: 1, error: "Usage: groundmail tenants domains remove <tenant> <domain>" };
+    }
+    return withClient(rest, env, (client2) => client2.tenants.domains.unassign(tenant, domain));
+  }
+  return {
+    exitCode: 1,
+    error: "Usage: groundmail tenants domains list|add|remove <tenant> [<domain>]"
+  };
+}
+
 // src/commands/auth.ts
 async function runAuthCommand(subcommand, argv, deps = {}) {
   const env = deps.env ?? process.env;
@@ -3121,7 +3386,7 @@ var KEY_ENV = {
 };
 var LABELS = { sendgrid: "SendGrid", postmark: "Postmark", mailgun: "Mailgun" };
 var VALUE_FLAGS2 = /* @__PURE__ */ new Set(["--api-key", "--base-url"]);
-function readFlag21(args, flag) {
+function readFlag22(args, flag) {
   const index = args.indexOf(flag);
   if (index === -1) return void 0;
   return args[index + 1];
@@ -3190,10 +3455,10 @@ function formatMigrationSummary(m) {
   return lines.join("\n");
 }
 async function client(args, env) {
-  const apiKey = readFlag21(args, "--api-key") || env.GROUNDMAIL_API_KEY;
+  const apiKey = readFlag22(args, "--api-key") || env.GROUNDMAIL_API_KEY;
   if (!apiKey) return null;
   const { Groundmail } = await import("groundmail");
-  const baseUrl = readFlag21(args, "--base-url");
+  const baseUrl = readFlag22(args, "--base-url");
   return new Groundmail(apiKey, baseUrl ? { baseUrl } : void 0);
 }
 async function runStoredCommand(sub, args, env) {
@@ -3230,11 +3495,11 @@ async function runMigrateCommand(provider, args, env = process.env) {
     };
   }
   const id = provider;
-  const apiKey = readFlag21(args, "--api-key") || env.GROUNDMAIL_API_KEY;
+  const apiKey = readFlag22(args, "--api-key") || env.GROUNDMAIL_API_KEY;
   if (!apiKey) {
     return { exitCode: 1, error: "Not signed in. Run `groundmail login`, or set GROUNDMAIL_API_KEY." };
   }
-  const providerKey = readFlag21(args, "--key") || env[KEY_ENV[id]];
+  const providerKey = readFlag22(args, "--key") || env[KEY_ENV[id]];
   if (!providerKey) {
     return {
       exitCode: 1,
@@ -3243,14 +3508,14 @@ async function runMigrateCommand(provider, args, env = process.env) {
   }
   const params = { provider: id, api_key: providerKey };
   if (id === "postmark") {
-    const accountToken = readFlag21(args, "--account-token") || env.POSTMARK_ACCOUNT_TOKEN;
+    const accountToken = readFlag22(args, "--account-token") || env.POSTMARK_ACCOUNT_TOKEN;
     if (accountToken) params.account_api_key = accountToken;
   } else {
-    const region = readFlag21(args, "--region");
+    const region = readFlag22(args, "--region");
     if (region === "us" || region === "eu") params.region = region;
     else if (region) return { exitCode: 1, error: "--region must be us or eu" };
   }
-  const only = readFlag21(args, "--only");
+  const only = readFlag22(args, "--only");
   if (only) {
     const list = only.split(",").map((s) => s.trim()).filter(Boolean);
     const bad = list.filter((r) => !RESOURCES.includes(r));
@@ -3262,7 +3527,7 @@ async function runMigrateCommand(provider, args, env = process.env) {
   if (args.includes("--dry-run")) params.dry_run = true;
   try {
     const { Groundmail } = await import("groundmail");
-    const baseUrl = readFlag21(args, "--base-url");
+    const baseUrl = readFlag22(args, "--base-url");
     const client2 = new Groundmail(apiKey, baseUrl ? { baseUrl } : void 0);
     console.error(`${params.dry_run ? "Previewing" : "Importing"} from ${LABELS[id]} (Beta)\u2026`);
     const report = await client2.migrations.run(params, {
@@ -3285,12 +3550,12 @@ async function runMigrateCommand(provider, args, env = process.env) {
 // src/commands/validate.ts
 async function runValidateCommand(args, env = process.env) {
   const options = parseSuppressionsCommonArgs(args);
-  const apiKey = resolveApiKey6(options, env);
+  const apiKey = resolveApiKey7(options, env);
   if (!apiKey) {
     return { exitCode: 1, error: "Missing API key. Set GROUNDMAIL_API_KEY, pass --api-key, or run `groundmail login`." };
   }
   const flagValues = new Set([options.apiKey, options.baseUrl].filter(Boolean));
-  const email = readFlag18(args, "--email") || args.find((arg) => arg.includes("@") && !arg.startsWith("-") && !flagValues.has(arg));
+  const email = readFlag19(args, "--email") || args.find((arg) => arg.includes("@") && !arg.startsWith("-") && !flagValues.has(arg));
   if (!email) {
     return { exitCode: 1, error: "Missing email. Usage: groundmail validate user@example.com" };
   }
@@ -3304,6 +3569,109 @@ async function runValidateCommand(args, env = process.env) {
   }
 }
 
+// src/commands/dmarc/dmarc.ts
+function readFlag23(args, flag) {
+  const index = args.indexOf(flag);
+  if (index === -1) return void 0;
+  return args[index + 1];
+}
+var VALUE_FLAGS3 = ["--api-key", "--base-url", "--domain", "--apply"];
+function readFirstPositional15(args) {
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg.startsWith("--")) {
+      if (VALUE_FLAGS3.includes(arg)) i += 1;
+      continue;
+    }
+    return arg;
+  }
+  return void 0;
+}
+async function createDmarcClient(apiKey, baseUrl) {
+  const { Groundmail } = await import("groundmail");
+  return new Groundmail(apiKey, baseUrl ? { baseUrl } : void 0);
+}
+function pct(rate) {
+  const value = rate * 100;
+  return value === 100 ? "100%" : `${value.toFixed(1).replace(/\.0$/, "")}%`;
+}
+function formatDmarcStatus(dmarc) {
+  if (!dmarc.enabled) {
+    return [
+      `DMARC monitoring for ${dmarc.domain}: off`,
+      `  Current record (${dmarc.dns.host}): ${dmarc.dns.record ?? "none"}`,
+      "",
+      `Turn it on: groundmail dmarc enable ${dmarc.domain}`
+    ].join("\n");
+  }
+  const lines = [
+    `DMARC monitoring for ${dmarc.domain}: ${dmarc.status === "waiting" ? "waiting for the first report" : "receiving reports"}`,
+    `  Report address: ${dmarc.report_address}`
+  ];
+  if (!dmarc.dns.rua_present) {
+    lines.push("", `  Add the address to your DMARC record. TXT ${dmarc.dns.host}:`, `    ${dmarc.dns.suggested_record}`);
+  }
+  lines.push(
+    "",
+    `  Last ${dmarc.window_days} days: ${dmarc.summary.messages.toLocaleString("en-US")} messages, ${pct(dmarc.summary.pass_rate)} passed DMARC, ${dmarc.summary.reports} reports`,
+    `  Readiness: ${dmarc.readiness.label}. ${dmarc.readiness.detail}`
+  );
+  if (dmarc.sources.length) {
+    lines.push("", "  Sources:");
+    for (const source of dmarc.sources.slice(0, 15)) {
+      lines.push(
+        `    ${source.name.padEnd(26)} ${source.status.padEnd(8)} ${String(source.messages).padStart(9)} msgs  ${pct(source.pass_rate).padStart(6)} pass`
+      );
+    }
+  }
+  return lines.join("\n");
+}
+async function runDmarcCommand(subcommand, args, env = process.env) {
+  const apiKey = readFlag23(args, "--api-key") || env.GROUNDMAIL_API_KEY;
+  if (!apiKey) return { exitCode: 1, error: "Missing API key. Run groundmail login, set GROUNDMAIL_API_KEY or pass --api-key." };
+  const domain = readFlag23(args, "--domain") || readFirstPositional15(args);
+  if (!subcommand || !["status", "enable", "disable", "digest"].includes(subcommand)) {
+    return { exitCode: 1, error: "Usage: groundmail dmarc status|enable|disable|digest <domain>" };
+  }
+  if (!domain) return { exitCode: 1, error: `Missing domain. Usage: groundmail dmarc ${subcommand} example.com` };
+  const json = args.includes("--json");
+  try {
+    const client2 = await createDmarcClient(apiKey, readFlag23(args, "--base-url"));
+    if (subcommand === "status") {
+      const result2 = await client2.dmarc.get(domain);
+      console.log(json ? JSON.stringify(result2) : formatDmarcStatus(result2.dmarc));
+      return { exitCode: 0 };
+    }
+    if (subcommand === "enable") {
+      const apply = readFlag23(args, "--apply");
+      if (apply && apply !== "cloudflare" && apply !== "vercel" && apply !== "godaddy") {
+        return { exitCode: 1, error: "--apply must be cloudflare, vercel or godaddy" };
+      }
+      const result2 = await client2.dmarc.enable(domain, apply ? { apply } : {});
+      if (json) console.log(JSON.stringify(result2));
+      else {
+        console.log(formatDmarcStatus(result2.dmarc));
+        if (result2.applied) console.log(`
+Updated the DMARC record with ${result2.applied.provider}.`);
+      }
+      if (result2.apply_error) return { exitCode: 1, error: result2.apply_error };
+      return { exitCode: 0 };
+    }
+    if (subcommand === "disable") {
+      const result2 = await client2.dmarc.disable(domain);
+      console.log(json ? JSON.stringify(result2) : `DMARC monitoring for ${domain} is off. Remove the report address from your DMARC record's rua= tag too.`);
+      return { exitCode: 0 };
+    }
+    const value = args.includes("--off") ? false : args.includes("--on") ? true : void 0;
+    if (value === void 0) return { exitCode: 1, error: "Usage: groundmail dmarc digest example.com --on|--off" };
+    const result = await client2.dmarc.update(domain, { digest_enabled: value });
+    console.log(json ? JSON.stringify(result) : `Weekly DMARC digest for ${domain} is ${value ? "on" : "off"}.`);
+    return { exitCode: 0 };
+  } catch (error) {
+    return { exitCode: 1, error: error instanceof Error ? error.message : String(error) };
+  }
+}
+
 // src/help.ts
 var USAGE_LINES = [
   "  groundmail login [--scope <scopes>] [--workspace <name>]   sign in through the browser (OAuth; no key to copy)",
@@ -3312,20 +3680,24 @@ var USAGE_LINES = [
   "  groundmail auth token [--scope <scopes>]   print a short-lived access token (for agents and scripts)",
   "  groundmail workspaces list",
   "  groundmail workspaces use <name|id>",
-  "  groundmail domains add example.com",
+  "  groundmail domains add example.com [--tenant <tenant>]",
   "  groundmail domains apply example.com --provider cloudflare",
   "  groundmail domains apply example.com --provider vercel",
   "  groundmail domains apply example.com --provider godaddy",
-  "  groundmail domains list",
+  "  groundmail domains list [--tenant <tenant>]",
   "  groundmail domains get example.com",
   "  groundmail domains update example.com --inbound true",
   "  groundmail domains verify example.com",
   "  groundmail domains delete example.com",
+  "  groundmail dmarc status example.com [--json]   DMARC monitoring: sources, pass rates, readiness",
+  "  groundmail dmarc enable example.com [--apply cloudflare|vercel|godaddy]   report address and the record to publish",
+  "  groundmail dmarc digest example.com --on|--off   weekly digest email",
+  "  groundmail dmarc disable example.com",
   "  groundmail received-emails list [--domain inbound.example.com]",
   "  groundmail received-emails get inb_...",
-  '  groundmail emails send --from you@domain.com --to user@example.com --subject "Hello" --html "<p>Hi</p>" [--category transactional|product] [--unsubscribe]',
-  "  groundmail emails batch --file ./emails.json",
-  "  groundmail emails list [--limit 25] [--cursor \u2026]",
+  '  groundmail emails send --from you@domain.com --to user@example.com --subject "Hello" --html "<p>Hi</p>" [--category transactional|product] [--unsubscribe] [--tenant <tenant>]',
+  "  groundmail emails batch --file ./emails.json [--tenant <tenant>]",
+  "  groundmail emails list [--limit 25] [--cursor \u2026] [--test | --live] [--tenant <tenant>]",
   "  groundmail emails insights [--window 7d|30d]",
   "  groundmail emails get --id msg_\u2026",
   "  groundmail emails cancel --id msg_\u2026",
@@ -3341,14 +3713,14 @@ var USAGE_LINES = [
   "  groundmail automations pause --id <automation-id>",
   "  groundmail automations delete --id <automation-id>",
   "  groundmail webhooks list",
-  "  groundmail webhooks create --url https://yourapp.com/hooks",
+  "  groundmail webhooks create --url https://yourapp.com/hooks [--tenants a,b]   --tenants: only these tenants' email events",
   "  groundmail webhooks get --id wh_\u2026",
-  "  groundmail webhooks update --id wh_\u2026 [--url \u2026] [--event email.sent] [--enabled true|false]",
+  "  groundmail webhooks update --id wh_\u2026 [--url \u2026] [--event email.sent] [--enabled true|false] [--tenants a,b|all]",
   "  groundmail webhooks delete --id <webhook-id>",
   "  groundmail validate user@example.com   Groundmail validation: verdict, reasons, typo suggestion (exit 2 when invalid)",
-  "  groundmail suppressions list",
-  "  groundmail suppressions add --email user@example.com [--reason \u2026]",
-  "  groundmail suppressions remove --id <id> | --email user@example.com",
+  "  groundmail suppressions list [--tenant <tenant>]",
+  "  groundmail suppressions add --email user@example.com [--reason \u2026] [--tenant <tenant>]",
+  "  groundmail suppressions remove --id <id> | --email user@example.com [--tenant <tenant>]",
   "  groundmail templates list [--status draft|published]",
   "  groundmail templates starters",
   "  groundmail templates from-starter password-reset",
@@ -3362,8 +3734,19 @@ var USAGE_LINES = [
   "  groundmail templates test-send --id tpl_\u2026 --from you@domain.com --to you@domain.com",
   '  groundmail templates duplicate --id tpl_\u2026 [--name "Copy"]',
   "  groundmail templates delete --id tpl_\u2026",
+  "  groundmail tenants list [--status active|paused] [--limit 25] [--cursor \u2026]   your customers, each with its own domains, suppressions and limits",
+  `  groundmail tenants create <external-id> [--name \u2026] [--default-from-domain \u2026] [--stream-policy all|transactional_only] [--daily-limit N] [--metadata '{"plan":"pro"}']`,
+  "  groundmail tenants get <tenant>",
+  "  groundmail tenants update <tenant> [--name \u2026] [--default-from-domain \u2026|none] [--stream-policy \u2026] [--daily-limit N|none] [--metadata JSON|null]",
+  "  groundmail tenants pause <tenant> [--reason \u2026]   stops the tenant's new sends",
+  "  groundmail tenants resume <tenant>",
+  "  groundmail tenants delete <tenant> --yes",
+  "  groundmail tenants stats <tenant> [--days 7]",
+  "  groundmail tenants domains list <tenant>",
+  "  groundmail tenants domains add <tenant> example.com   only this tenant can then send from it",
+  "  groundmail tenants domains remove <tenant> example.com   gives the domain back to the account",
   "  groundmail keys list",
-  "  groundmail keys create [--name Default] [--scopes emails:send,domains:read] [--allowed-domains example.com]",
+  "  groundmail keys create [--name Default] [--scopes emails:send,domains:read] [--allowed-domains example.com] [--test] [--tenant <tenant>]   --test: a gm_test_ key, sends are simulated; --tenant: a key limited to one tenant",
   "  groundmail keys delete --id <api-key-id>",
   "  groundmail migrate sendgrid [--dry-run] [--only templates,suppressions,domains,webhooks] [--region eu]   import from SendGrid (Beta)",
   "  groundmail migrate postmark [--dry-run] [--only \u2026]   import from Postmark (Beta)",
@@ -3387,6 +3770,8 @@ var FOOTER_LINES = [
   "Scopes: full, emails:send, emails:read, domains:read, domains:write, webhooks:write, templates:write,",
   "        suppressions:write, account:read",
   "",
+  "<tenant>: the tenant's external id (your id for that customer) or its Groundmail id.",
+  "",
   "Add --help to any command for just its usage. --version prints the CLI version."
 ];
 var CLI_VERSION = version;
@@ -3396,7 +3781,8 @@ var ALIASES = {
   events: { trigger: "send" },
   automations: { add: "create", remove: "delete" },
   suppressions: { create: "add", delete: "remove" },
-  templates: { add: "create", remove: "delete" }
+  templates: { add: "create", remove: "delete" },
+  tenants: { add: "create", remove: "delete" }
 };
 function words(line) {
   return line.trim().split(/\s+/);
@@ -3460,6 +3846,7 @@ async function main() {
   const rest = session.argv;
   if (command === "migrate") await finish(await runMigrateCommand(subcommand, rest));
   if (command === "validate") await finish(await runValidateCommand([...subcommand ? [subcommand] : [], ...rest]));
+  if (command === "dmarc") await finish(await runDmarcCommand(subcommand, rest));
   if (command === "domains") {
     if (subcommand === "add" || subcommand === "create") {
       const result = await runAddCommand(rest);
@@ -3721,6 +4108,17 @@ async function main() {
       }
     }
   }
+  if (command === "tenants") {
+    if (subcommand === "list") await finish(await runListCommand8(rest));
+    if (subcommand === "create" || subcommand === "add") await finish(await runCreateCommand4(rest));
+    if (subcommand === "get") await finish(await runGetCommand7(rest));
+    if (subcommand === "update") await finish(await runUpdateCommand5(rest));
+    if (subcommand === "pause") await finish(await runPauseCommand2(rest));
+    if (subcommand === "resume") await finish(await runResumeCommand(rest));
+    if (subcommand === "delete" || subcommand === "remove") await finish(await runDeleteCommand5(rest));
+    if (subcommand === "stats") await finish(await runStatsCommand(rest));
+    if (subcommand === "domains") await finish(await runDomainsCommand(rest));
+  }
   if (command === "keys") {
     if (subcommand === "list") {
       const result = await runListKeysCommandWithClient(rest);