primcli 1.36.0 → 1.37.0

package/dist/sdk.gen-CugwPoCf.js

@@ -0,0 +1,3281 @@
+import { b as __exportAll } from "./repeats-CQmyvUGQ-CMnOmWgL.js";
+import { m as createConfig, p as createClient } from "./connected-agent-profile-8tpOMdq3.js";
+//#region ../packages/api-core/src/api/client.gen.ts
+const client = createClient(createConfig({ baseUrl: "https://api.primitive.dev/v1" }));
+//#endregion
+//#region ../packages/api-core/src/api/sdk.gen.ts
+var sdk_gen_exports = /* @__PURE__ */ __exportAll({
+	addDefaultNetworkMember: () => addDefaultNetworkMember,
+	addDomain: () => addDomain,
+	agentConnectionSetup: () => agentConnectionSetup,
+	awaitReply: () => awaitReply,
+	cancelSentEmail: () => cancelSentEmail,
+	checkDefaultNetworkContactAdmission: () => checkDefaultNetworkContactAdmission,
+	checkDomainDns: () => checkDomainDns,
+	claimAgentConnection: () => claimAgentConnection,
+	cliLogout: () => cliLogout,
+	completeWebhookEvent: () => completeWebhookEvent,
+	createAgentAccount: () => createAgentAccount,
+	createAgentClaimLink: () => createAgentClaimLink,
+	createAgentConnection: () => createAgentConnection,
+	createChallenge: () => createChallenge,
+	createEmailChallenge: () => createEmailChallenge,
+	createEndpoint: () => createEndpoint,
+	createFilter: () => createFilter,
+	createFunction: () => createFunction,
+	createFunctionSecret: () => createFunctionSecret,
+	createOrgSecret: () => createOrgSecret,
+	createRegistry: () => createRegistry,
+	createRoute: () => createRoute,
+	createWakeAuthorization: () => createWakeAuthorization,
+	createWakeSchedule: () => createWakeSchedule,
+	decideRegistryRequest: () => decideRegistryRequest,
+	defineAgent: () => defineAgent,
+	deleteAgentContact: () => deleteAgentContact,
+	deleteContact: () => deleteContact,
+	deleteDomain: () => deleteDomain,
+	deleteEmail: () => deleteEmail,
+	deleteEndpoint: () => deleteEndpoint,
+	deleteFilter: () => deleteFilter,
+	deleteFunction: () => deleteFunction,
+	deleteFunctionSecret: () => deleteFunctionSecret,
+	deleteMemory: () => deleteMemory,
+	deleteOrgSecret: () => deleteOrgSecret,
+	deleteRegistry: () => deleteRegistry,
+	deleteRepeatingSend: () => deleteRepeatingSend,
+	deleteRoute: () => deleteRoute,
+	deleteSentEmail: () => deleteSentEmail,
+	deleteWakeAuthorization: () => deleteWakeAuthorization,
+	deleteWakeSchedule: () => deleteWakeSchedule,
+	discardEmailContent: () => discardEmailContent,
+	downloadAttachments: () => downloadAttachments,
+	downloadDomainZoneFile: () => downloadDomainZoneFile,
+	downloadEmailAttachmentPart: () => downloadEmailAttachmentPart,
+	downloadRawEmail: () => downloadRawEmail,
+	downloadSentAttachmentPart: () => downloadSentAttachmentPart,
+	getAccount: () => getAccount,
+	getAgent: () => getAgent,
+	getAgentContactPolicy: () => getAgentContactPolicy,
+	getChallenge: () => getChallenge,
+	getContact: () => getContact,
+	getContactPolicy: () => getContactPolicy,
+	getConversation: () => getConversation,
+	getCreditBalance: () => getCreditBalance,
+	getDefaultNetworkAgent: () => getDefaultNetworkAgent,
+	getEmail: () => getEmail,
+	getFunction: () => getFunction,
+	getFunctionRouting: () => getFunctionRouting,
+	getFunctionTestRunTrace: () => getFunctionTestRunTrace,
+	getInboxStatus: () => getInboxStatus,
+	getMemory: () => getMemory,
+	getOrgRoutingTopology: () => getOrgRoutingTopology,
+	getOutboundStatus: () => getOutboundStatus,
+	getRegistry: () => getRegistry,
+	getRepeatingSend: () => getRepeatingSend,
+	getSendPermissions: () => getSendPermissions,
+	getSentEmail: () => getSentEmail,
+	getSpendPolicy: () => getSpendPolicy,
+	getStorageStats: () => getStorageStats,
+	getTemplate: () => getTemplate,
+	getTemplateInstall: () => getTemplateInstall,
+	getThread: () => getThread,
+	getWakeSchedule: () => getWakeSchedule,
+	getWebhookSecret: () => getWebhookSecret,
+	installTemplate: () => installTemplate,
+	inviteAgentConnection: () => inviteAgentConnection,
+	listAgentConnections: () => listAgentConnections,
+	listAgentContacts: () => listAgentContacts,
+	listAgentNetworks: () => listAgentNetworks,
+	listContacts: () => listContacts,
+	listDeclinedPayments: () => listDeclinedPayments,
+	listDefaultNetworkAgents: () => listDefaultNetworkAgents,
+	listDefaultNetworkMembers: () => listDefaultNetworkMembers,
+	listDeliveries: () => listDeliveries,
+	listDomains: () => listDomains,
+	listEmails: () => listEmails,
+	listEndpoints: () => listEndpoints,
+	listFilters: () => listFilters,
+	listFunctionLogs: () => listFunctionLogs,
+	listFunctionSecrets: () => listFunctionSecrets,
+	listFunctions: () => listFunctions,
+	listOrgSecrets: () => listOrgSecrets,
+	listPayoutAddresses: () => listPayoutAddresses,
+	listRegistries: () => listRegistries,
+	listRegistryAgents: () => listRegistryAgents,
+	listRegistryRequests: () => listRegistryRequests,
+	listRepeatingSends: () => listRepeatingSends,
+	listRoutes: () => listRoutes,
+	listSentEmails: () => listSentEmails,
+	listTemplates: () => listTemplates,
+	listWakeAuthorizations: () => listWakeAuthorizations,
+	listWakeDispatches: () => listWakeDispatches,
+	listWakeSchedules: () => listWakeSchedules,
+	payChallenge: () => payChallenge,
+	pollCliLogin: () => pollCliLogin,
+	provisionMemberAddress: () => provisionMemberAddress,
+	publishAgent: () => publishAgent,
+	pullWebhookEvent: () => pullWebhookEvent,
+	putAgentContact: () => putAgentContact,
+	putAgentContactPolicy: () => putAgentContactPolicy,
+	putContact: () => putContact,
+	putContactPolicy: () => putContactPolicy,
+	redeemCreditCode: () => redeemCreditCode,
+	registerPayoutAddress: () => registerPayoutAddress,
+	removeAgentConnection: () => removeAgentConnection,
+	removeDefaultNetworkMember: () => removeDefaultNetworkMember,
+	reorderRoutes: () => reorderRoutes,
+	replayDelivery: () => replayDelivery,
+	replayEmailWebhooks: () => replayEmailWebhooks,
+	replyToEmail: () => replyToEmail,
+	rescheduleSentEmail: () => rescheduleSentEmail,
+	resendAgentSignupVerification: () => resendAgentSignupVerification,
+	resendCliSignupVerification: () => resendCliSignupVerification,
+	resolveRegistryHandle: () => resolveRegistryHandle,
+	revokeAgentConnection: () => revokeAgentConnection,
+	rotateWebhookSecret: () => rotateWebhookSecret,
+	runWakeSchedule: () => runWakeSchedule,
+	searchEmails: () => searchEmails,
+	searchMemories: () => searchMemories,
+	semanticSearch: () => semanticSearch,
+	sendEmail: () => sendEmail,
+	setFunctionRoute: () => setFunctionRoute,
+	setFunctionSecret: () => setFunctionSecret,
+	setMemory: () => setMemory,
+	setOrgSecret: () => setOrgSecret,
+	simulateRoute: () => simulateRoute,
+	startAgentClaim: () => startAgentClaim,
+	startAgentSignup: () => startAgentSignup,
+	startCliLogin: () => startCliLogin,
+	startCliSignup: () => startCliSignup,
+	stopRepeatFromEmail: () => stopRepeatFromEmail,
+	testEndpoint: () => testEndpoint,
+	testEndpointRules: () => testEndpointRules,
+	testFunction: () => testFunction,
+	unpublishAgent: () => unpublishAgent,
+	unsetFunctionRoute: () => unsetFunctionRoute,
+	updateAccount: () => updateAccount,
+	updateDefaultNetworkMember: () => updateDefaultNetworkMember,
+	updateDomain: () => updateDomain,
+	updateEndpoint: () => updateEndpoint,
+	updateFilter: () => updateFilter,
+	updateFunction: () => updateFunction,
+	updateRegistry: () => updateRegistry,
+	updateRepeatingSend: () => updateRepeatingSend,
+	updateRoute: () => updateRoute,
+	updateSpendPolicy: () => updateSpendPolicy,
+	updateWakeAuthorization: () => updateWakeAuthorization,
+	updateWakeSchedule: () => updateWakeSchedule,
+	verifyAgentClaim: () => verifyAgentClaim,
+	verifyAgentSignup: () => verifyAgentSignup,
+	verifyCliSignup: () => verifyCliSignup,
+	verifyDomain: () => verifyDomain,
+	whoami: () => whoami
+});
+/**
+* Start CLI browser login
+*
+* Starts a browser-assisted CLI login session. The response includes a
+* device code for polling and a user code that the user approves in the
+* browser. This endpoint does not require an API key.
+*
+*/
+const startCliLogin = (options) => (options?.client ?? client).post({
+	url: "/cli/login/start",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options?.headers
+	}
+});
+/**
+* Poll CLI browser login
+*
+* Polls a CLI login session until the browser approval either succeeds,
+* is denied, expires, or is polled too quickly. The OAuth token set is
+* created only after approval and is returned exactly once.
+*
+*/
+const pollCliLogin = (options) => (options.client ?? client).post({
+	url: "/cli/login/poll",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Start CLI account signup
+*
+* Starts a terminal-native CLI signup. `signup_code` is optional;
+* omit it to sign up without one. The API creates a pending signup
+* session, sends an email verification code, and returns an opaque
+* signup token used by the resend and verify steps. This endpoint
+* does not require an API key.
+*
+*/
+const startCliSignup = (options) => (options.client ?? client).post({
+	url: "/cli/signup/start",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Resend CLI signup verification code
+*
+* Sends a new email verification code for a pending CLI signup session.
+* This endpoint does not require an API key.
+*
+*/
+const resendCliSignupVerification = (options) => (options.client ?? client).post({
+	url: "/cli/signup/resend",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Verify CLI signup and create OAuth session
+*
+* Verifies the email code for a CLI signup session and creates the
+* account. When the session was started with a `signup_code`, the
+* reserved code is redeemed; sessions started without a code skip
+* the redemption step. Either way an org-scoped OAuth CLI session
+* is created and the token set is returned exactly once. This
+* endpoint does not require an API key.
+*
+*/
+const verifyCliSignup = (options) => (options.client ?? client).post({
+	url: "/cli/signup/verify",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Start agent account signup
+*
+* Starts an agent-native signup session. `signup_code` is optional;
+* omit it to sign up without one. The API creates a pending signup
+* session, sends an email verification code, and returns an opaque
+* signup token used by the resend and verify steps. This endpoint
+* does not require an API key.
+*
+*/
+const startAgentSignup = (options) => (options.client ?? client).post({
+	url: "/agent/signup/start",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Resend agent signup verification code
+*
+* Sends a new email verification code for a pending agent signup session.
+* This endpoint does not require an API key.
+*
+*/
+const resendAgentSignupVerification = (options) => (options.client ?? client).post({
+	url: "/agent/signup/resend",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Verify agent signup and create OAuth tokens
+*
+* Verifies the email code for an agent signup session and creates
+* the account when needed. When the session was started with a
+* `signup_code`, the reserved code is redeemed; sessions started
+* without a code skip the redemption step. An org-scoped OAuth
+* session for CLI authentication is minted and the raw tokens are
+* returned exactly once. For existing users, the optional `org_id`
+* selects which accessible workspace should receive the new
+* session (no signup-code redemption is performed for existing
+* users regardless of how the session was started).
+*
+*/
+const verifyAgentSignup = (options) => (options.client ?? client).post({
+	url: "/agent/signup/verify",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Create an emailless agent account
+*
+* Creates an emailless agent account without authentication and returns a
+* one-time API key (prefixed `prim_`) plus a provisioned managed inbox.
+* The account is on the `agent` plan: reply-only (it can send only to
+* addresses that have already sent it authenticated mail) with tight send
+* limits. Use the returned `api_key` as a Bearer token on later calls. The
+* account can be upgraded to a full developer account by confirming an
+* email through the claim flow. This endpoint does not require an API key.
+*
+*/
+const createAgentAccount = (options) => (options.client ?? client).post({
+	url: "/agent/accounts",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Start an agent account email claim
+*
+* Begins upgrading an emailless `agent` account into a full `developer`
+* account by confirming an email address. Authenticated by the agent's own
+* API key (the org is taken from the credential). Sends a verification
+* code to the supplied email and returns the claim session id plus resend
+* timing. Submit the code to `/agent/claim/verify` to complete the
+* upgrade. Confirming an email that already belongs to a Primitive account
+* is rejected.
+*
+*/
+const startAgentClaim = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent/claim/start",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Verify an agent account email claim
+*
+* Confirms the verification code emailed by `/agent/claim/start` and
+* upgrades the account to the `developer` plan. The org id, API key, and
+* managed inbox all carry over; the send cap lifts. Authenticated by the
+* agent's own API key.
+*
+*/
+const verifyAgentClaim = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent/claim/verify",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Create a browser claim link
+*
+* Mints an opaque, single-use link an agent can hand to a human to
+* complete the email-confirmation upgrade in a browser. Authenticated by
+* the agent's own API key. `claim_url` is null when the API host cannot
+* resolve a web origin to build the link.
+*
+*/
+const createAgentClaimLink = (options) => (options?.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent/claim/link",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options?.headers
+	}
+});
+/**
+* Revoke the current CLI OAuth session
+*
+* Revokes the OAuth grant used to authenticate the request. API-key
+* authenticated legacy logout requests succeed without deleting server API
+* keys so old local CLI state can be cleared safely.
+*
+*/
+const cliLogout = (options) => (options?.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/cli/logout",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options?.headers
+	}
+});
+/**
+* Get account info
+*/
+const getAccount = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/account",
+	...options
+});
+/**
+* Update account settings
+*/
+const updateAccount = (options) => (options.client ?? client).patch({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/account",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Get storage usage
+*/
+const getStorageStats = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/account/storage",
+	...options
+});
+/**
+* Get webhook signing secret
+*
+* Returns the webhook signing secret for your account. If no
+* secret exists yet, one is generated automatically on first
+* access.
+*
+* Signing is account-scoped, not per-endpoint. Every webhook
+* delivery from any of your registered endpoints is signed
+* with this single secret. Rotate via
+* `POST /account/webhook-secret/rotate`.
+*
+* **Secret format**: the returned string looks base64-shaped
+* (e.g. `XNHBBW8VqoBjRfNs1tkZj11jTk...`) but is NOT base64.
+* Use it AS-IS as a UTF-8 string when computing HMAC over a
+* delivery body. Base64-decoding before HMAC will silently
+* produce mismatched signatures.
+*
+* See the API-level "Webhook signing" section for the full
+* wire format (header name, signed string shape, hash algo,
+* tolerance) including a language-agnostic verification
+* recipe.
+*
+*/
+const getWebhookSecret = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/account/webhook-secret",
+	...options
+});
+/**
+* Rotate webhook signing secret
+*
+* Generates a new webhook signing secret, replacing the current one.
+* Rate limited to once per 60 minutes.
+*
+*/
+const rotateWebhookSecret = (options) => (options?.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/account/webhook-secret/rotate",
+	...options
+});
+/**
+* Redeem a credit code
+*
+* Redeem a credit code for the authenticated organization. The credit is
+* added to the organization prepaid credit and shows in
+* `GET /credits/balance` under `prepaid_credit`.
+*
+* Redeeming requires an organization owner or admin. An API key redeems
+* with the authority of the user who created it, based on that user's
+* current role; a key without that authority gets the same
+* `credit_code_invalid` refusal as an unknown code.
+*
+* The `Idempotency-Key` header is required. Retrying with the same key
+* and code returns the original grant with `replayed: true` and grants
+* nothing new; the same key with a different code is refused with
+* `idempotency_key_reused`. Every refusal carries a human-readable
+* `error.message` that can be shown to the user as is.
+*
+*/
+const redeemCreditCode = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/credits/redeem",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Get credit balance
+*
+* Read the organization credit position. `prepaid_credit` is the prepaid
+* usage credit (paid top-ups, redeemed credit codes and granted credit)
+* that can still pay for usage. `budget` is the active agent spending
+* budget an operator funded for top-ups, or null when there is none.
+* Amounts are strings of integer micros (1 USD = 1000000 micros).
+*
+*/
+const getCreditBalance = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/credits/balance",
+	...options
+});
+/**
+* List all domains
+*
+* Returns all verified and unverified domains for your organization,
+* sorted by creation date (newest first). Each domain includes a
+* `verified` boolean to distinguish between the two states.
+*
+*/
+const listDomains = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/domains",
+	...options
+});
+/**
+* Claim a new domain
+*
+* Creates an unverified domain claim and returns the exact
+* DNS records to publish in `dns_records`. Publish those
+* records before calling the verify endpoint. To give users
+* an importable DNS file, call `downloadDomainZoneFile` or run
+* `primitive domains zone-file --id <domain-id>`.
+*
+*/
+const addDomain = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/domains",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Delete a domain
+*
+* Deletes a verified or unverified domain claim.
+*/
+const deleteDomain = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/domains/{id}",
+	...options
+});
+/**
+* Update domain settings
+*
+* Update a verified domain's settings. Only verified domains can be
+* updated. Per-domain spam thresholds require a Pro plan.
+*
+*/
+const updateDomain = (options) => (options.client ?? client).patch({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/domains/{id}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Verify domain ownership
+*
+* Checks DNS records required for inbound routing, ownership,
+* and outbound authentication: MX, ownership TXT, SPF, DKIM,
+* DMARC, and TLS-RPT.
+* On success, the domain is promoted from unverified to verified.
+* On failure, returns which checks passed and which failed,
+* plus the exact DNS records still expected. To give users
+* an importable DNS file for missing records, call
+* `downloadDomainZoneFile` or run
+* `primitive domains zone-file --id <domain-id>`.
+*
+*/
+const verifyDomain = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/domains/{id}/verify",
+	...options
+});
+/**
+* Run an on-demand DNS health check
+*
+* Re-checks the domain's DNS records and persists the result as
+* the domain's current DNS health state. This is the on-demand
+* counterpart of the scheduled background checker: the response
+* mirrors what the checker records, broken down per scope
+* (`ownership`, `inbound`, `outbound`) with the exact records
+* inspected and each record's individual status.
+*
+* Unlike /domains/{id}/verify, this call never promotes an
+* unverified domain; it only re-evaluates and records health for
+* an existing claim. Managed (Primitive-operated) domains are
+* rejected with a validation error because their DNS is not
+* customer-published.
+*
+* Rate limited per organization; a `Retry-After` header
+* accompanies 429 responses.
+*
+*/
+const checkDomainDns = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/domains/{id}/dns/check",
+	...options
+});
+/**
+* Download domain DNS zone file
+*
+* Downloads a BIND-format DNS zone file containing the DNS records
+* required for a domain claim. Agents should offer this after
+* `addDomain` when users want to import DNS records instead of
+* copying each record manually.
+*
+*/
+const downloadDomainZoneFile = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/domains/{id}/zone-file",
+	...options
+});
+/**
+* Get inbound inbox readiness
+*
+* Returns one consolidated view of inbound domain readiness,
+* webhook/function processing routes, deployed Functions, and
+* recent inbound email activity.
+*
+* Agents should call this before guiding a user through inbound
+* setup. It answers the practical questions "can I receive mail",
+* "will anything process that mail", and "what should I do next"
+* without forcing clients to stitch together domains, endpoints,
+* functions, and emails manually.
+*
+*/
+const getInboxStatus = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/inbox/status",
+	...options
+});
+/**
+* List inbound emails
+*
+* Returns a paginated list of INBOUND emails received at your
+* verified domains. Outbound messages sent via /send-mail are
+* not included; this endpoint is the inbox view, not a
+* unified send/receive history.
+*
+* Supports filtering by domain, status, date range, and
+* free-text search across subject, sender, and recipient
+* fields.
+*
+* For a compact text-table summary of the most recent N
+* inbounds (no filters, no cursor pagination), the CLI ships
+* `primitive emails:latest` as a one-line-per-email shortcut.
+* It's TTY-aware so id columns are full UUIDs when piped, and
+* a `--json` flag returns the same envelope this endpoint
+* does. Use whichever fits the call site.
+*
+*/
+const listEmails = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/emails",
+	...options
+});
+/**
+* Search inbound emails
+*
+* Searches inbound emails with structured filters and optional
+* full-text matching across parsed email fields. This endpoint is
+* optimized for filtered inbox views and CLI polling workflows:
+* callers that only need new accepted mail can pass
+* `sort=received_at_asc`, `snippet=false`, `include_facets=false`,
+* and a `date_from` timestamp.
+*
+* `q`, `subject`, and `body` use the same English full-text index
+* as the web inbox search. Structured filters such as `from`, `to`,
+* `domain_id`, status, attachment presence, and spam score bounds
+* are combined with the text query.
+*
+* Connected-agent credentials search only mail received by their own
+* address. This applies to results, totals, facets, and every page;
+* search filters cannot widen the credential's scope. When
+* `reply_to_sent_email_id` is supplied, its parent send must belong
+* to the connected address in the same organization. An unavailable
+* parent returns 404. Sender filters are not authentication proof;
+* inspect the email detail's authentication evidence before trusting it.
+*
+*/
+const searchEmails = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/emails/search",
+	...options
+});
+/**
+* Delete an email
+*/
+const deleteEmail = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/emails/{id}",
+	...options
+});
+/**
+* Get inbound email by id
+*
+* Returns the full record for an inbound email received at one
+* of your verified domains, including the parsed text and HTML
+* bodies, threading metadata, SMTP envelope detail, webhook
+* delivery state, and a `replies` array for any outbound sends
+* recorded as replies to this inbound.
+*
+* For listing inbound emails (with cursor pagination, status
+* and date filters, and free-text search), use
+* `/emails`. Outbound (sent) email records are NOT returned
+* here; use `/sent-emails/{id}` for those.
+*
+* The response carries four sender-shaped fields whose
+* meanings overlap. `from_email` is the canonical "who sent
+* this" field for most use cases (parsed bare address from
+* the `From:` header, with a `sender` fallback). `from_header`
+* is the raw header including any display name. `sender` and
+* `smtp_mail_from` both carry the SMTP envelope MAIL FROM
+* (return-path) and are equal by construction; `sender` is
+* the older field name retained for compatibility. See
+* `primitive describe emails:get-email | jq '.responseSchema.properties'`
+* for per-field detail.
+*
+*/
+const getEmail = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/emails/{id}",
+	...options
+});
+/**
+* Download raw email
+*
+* Downloads the raw RFC 822 email file (.eml). Authenticates via
+* a signed download token (provided in webhook payloads) or a
+* valid session.
+*
+*/
+const downloadRawEmail = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}, {
+		in: "query",
+		name: "token",
+		type: "apiKey"
+	}],
+	url: "/emails/{id}/raw",
+	...options
+});
+/**
+* Download email attachments
+*
+* Downloads all attachments as a gzip-compressed tar archive.
+* Authenticates via a signed download token (provided in webhook
+* payloads) or a valid session.
+*
+*/
+const downloadAttachments = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}, {
+		in: "query",
+		name: "token",
+		type: "apiKey"
+	}],
+	url: "/emails/{id}/attachments.tar.gz",
+	...options
+});
+/**
+* Download one inbound email attachment
+*
+* Pending service release. This contract does not establish live availability.
+* Downloads the original bytes of one ordinary email attachment, selected by
+* its metadata `part_index`, not its position in an attachments array. Refresh
+* the email detail after `attachment_changed` before choosing an index again.
+* Uses bearer authentication only; signed raw-email download tokens are not accepted.
+* A paired-agent credential may read only a message addressed to its claimed address.
+* Function credentials are denied. Other bearer credentials retain their
+* existing email access boundaries. This endpoint serves email bytes only.
+*
+*/
+const downloadEmailAttachmentPart = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/emails/{id}/attachments/{part_index}",
+	...options
+});
+/**
+* Download one sent email attachment
+*
+* Pending service release. This contract does not establish live availability.
+* Downloads the original bytes of one ordinary email attachment, selected by
+* its metadata `part_index`, not its position in an attachments array. Refresh
+* the email detail after `attachment_changed` before choosing an index again.
+* Uses bearer authentication only; signed raw-email download tokens are not accepted.
+* A paired-agent credential may read only mail sent from its claimed address.
+* Receiving a copy does not authorize downloading another sender's sent content.
+* Function credentials are denied. Other bearer credentials retain their
+* existing email access boundaries. This endpoint serves email bytes only.
+*
+*/
+const downloadSentAttachmentPart = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/sent-emails/{id}/attachments/{part_index}",
+	...options
+});
+/**
+* Stop the repeat behind a received message
+*
+* Called by the recipient of a repeating send: the connected agent's own
+* credential for an agent address, or the signed-in member whose personal
+* address it is. `id` is the caller's received copy of any message of the
+* repeat, or the repeat id printed in the message footer, which resolves
+* to the caller's newest received copy. Stops the repeat when it lets the recipient stop it, cancels the
+* pending message, and replies once in the thread with a
+* `repeat.stop/1` interaction so the sender sees it. A repeat call returns
+* the same result without a second reply.
+*
+*/
+const stopRepeatFromEmail = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/emails/{id}/repeat-stop",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Reply to an inbound email
+*
+* Sends an outbound reply to the inbound email identified by `id`.
+* Threading headers (`In-Reply-To`, `References`), recipient
+* derivation (Reply-To, then From, then bare sender), and the
+* `Re:` subject prefix are all derived server-side from the
+* stored inbound row. The request body carries only the message
+* body, optional From override, optional attachments, optional
+* `wait` flag, and optional `reply_all` flag, which also copies
+* every other To and Cc address of the inbound (never Bcc).
+* Passing any header or explicit recipient override is rejected
+* by the schema (`additionalProperties: false`).
+*
+* Forwards through the same gates as `/send-mail`: the response
+* status, error envelope, and `idempotent_replay` flag mirror
+* the send-mail contract verbatim.
+*
+*/
+const replyToEmail = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/emails/{id}/reply",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Replay email webhooks
+*
+* Re-delivers the webhook payload for this email to all active
+* endpoints matching the email's domain. Rate limited per-email
+* (short cooldown between successive replays of the same email)
+* and per-org (burst + sustained windows), sharing an org-wide
+* budget with delivery replays.
+*
+*/
+const replayEmailWebhooks = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/emails/{id}/replay",
+	...options
+});
+/**
+* Discard email content
+*
+* Permanently deletes the email's raw bytes, parsed body (text + HTML),
+* and attachments while preserving metadata (sender, recipient,
+* subject, timestamps, hashes, attachment manifest) for audit logs.
+* Idempotent: a second call returns success with
+* `already_discarded: true` and does no work.
+*
+* **Gated** on the customer's discard-content opt-in (managed in the
+* dashboard at Settings > Webhooks). When the toggle is off, this
+* endpoint returns `403` with code `discard_not_enabled` and a
+* message pointing the human at the dashboard. There is intentionally
+* no API to flip this toggle. Opting in to a destructive,
+* non-reversible operation must be a deliberate human click in the
+* UI.
+*
+*/
+const discardEmailContent = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/emails/{id}/discard-content",
+	...options
+});
+/**
+* Get the conversation an email belongs to
+*
+* Returns the full conversation the given inbound email belongs
+* to, as ordered, ready-to-prompt turns WITH bodies. It resolves
+* the thread from the email and returns every message oldest-first,
+* so an agent that received an email can pass `messages` straight
+* to a chat model in one call instead of walking `/threads/{id}`
+* plus `/emails/{id}` and `/sent-emails/{id}` per message.
+*
+* Each message carries a `direction` (`inbound` | `outbound`) and a
+* derived `role`: `inbound` -> `user`, `outbound` -> `assistant`
+* (your own prior replies). The role mapping assumes the caller
+* owns the outbound side, which is the agent-reply case this exists
+* for. If the email has no thread yet (a brand-new message), the
+* conversation is just that one message as a single user turn.
+*
+* The message list is capped; check `truncated` to detect when
+* older messages were omitted. Consecutive same-role turns are not
+* merged here; that normalization is model-specific and left to the
+* caller.
+*
+*/
+const getConversation = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/emails/{id}/conversation",
+	...options
+});
+/**
+* List webhook endpoints
+*
+* Returns all active (non-deleted) webhook endpoints.
+*/
+const listEndpoints = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints",
+	...options
+});
+/**
+* Create a webhook endpoint
+*
+* Creates a new webhook endpoint. If a deactivated endpoint
+* with the same URL and domain exists, it is reactivated
+* instead. Subject to plan limits on the number of active
+* endpoints.
+*
+* **Signing is account-scoped, not per-endpoint.** This call
+* does not return any signing material; every endpoint on the
+* account uses the same webhook secret, fetched via
+* `GET /account/webhook-secret`. See the API-level "Webhook
+* signing" section for the full wire format (header name,
+* signed string, hash algo, secret format, tolerance) and a
+* language-agnostic verification recipe.
+*
+* After creating the endpoint, fire a test delivery against
+* it via `POST /endpoints/{id}/test` to confirm your verifier
+* accepts the signature.
+*
+*
+* For local receiving, use kind=pull and a stable name, without url, function_id or domain_id. Named creation resumes the same active destination; omitted filters preserve its selection, while conflicting supplied configuration returns 409. New unfiltered destinations receive all subsequently ready eligible event types within their credential scope. Connected-agent credentials automatically create private subscriptions restricted to inbound email for their assigned address. Names are isolated per credential; revocation or replacement deletes its subscriptions. Address-scoped events contain parsed mail without raw MIME, signed download links, routing metadata, or sibling envelope recipients. Pull destinations do not occupy HTTP routing slots. Signing-secret setup and a test HTTP delivery are not required for pull receiving.
+*/
+const createEndpoint = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Delete a webhook endpoint
+*
+* Soft-deletes a webhook endpoint. The endpoint will no longer
+* receive webhook deliveries.
+*
+*/
+const deleteEndpoint = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}",
+	...options
+});
+/**
+* Update a webhook endpoint
+*
+* Updates an active webhook endpoint. If the URL is changed, the old
+* endpoint is deactivated and a new one is created (or an existing
+* deactivated endpoint with the new URL is reactivated).
+*
+*
+* Pull destinations cannot be assigned a URL, function or recipient-routing domain. Existing endpoint deletion disconnects the destination; creating a new destination does not backfill historical events.
+*/
+const updateEndpoint = (options) => (options.client ?? client).patch({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Receive a pending webhook event without a public endpoint
+*
+* Wait up to 30 seconds for one existing event. The body string preserves the exact webhook serialization; headers and canonical occurrence/type metadata travel alongside it. A fixed lease protects the attempt while a short handler accepts input. Retry may redeliver an occurrence: deduplicate event_id. Empty delivery means no offer now, not proof all input was delivered; inspect backlog and persistent gap_count/last_gap_reason. Queue retention is 24 hours and does not extend source-content retention. Disconnecting preserves pending work. Same named destination shares consumption; different destinations get independent copies.
+*/
+const pullWebhookEvent = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}/pull",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Report the outcome of a local webhook delivery attempt
+*
+* Report normalized handling evidence for the queue, attempt and lease. Required JSON fields: queue_id, delivery_id, lease_token, mode, duration_ms. For mode=exec include exit_code; stdout includes write_succeeded; http includes status_code and optional transport_error, error_code, confirmed. Supply this discriminated request with --raw-body in the generated CLI. The server classifies success and retry. Duplicate identical completion is idempotent; a stale lease cannot finish a newer attempt. Exec success means durable input acceptance, not completion of agent reasoning. Only successful HTTP handling with recognized confirmation evidence can confirm content discard. Never send arbitrary handler output or HTTP response bodies.
+*/
+const completeWebhookEvent = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}/complete",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Send a test webhook
+*
+* Sends a sample `email.received` event to the endpoint. The request
+* includes SSRF protection (private IP rejection and DNS pinning).
+* Rate limited to 4 per minute and 30 per hour (non-exempt).
+* Successful deliveries and verified-domain endpoints are exempt
+* from the rate limit.
+*
+*/
+const testEndpoint = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}/test",
+	...options
+});
+/**
+* Dry-run endpoint rules against a received email
+*
+* Evaluates the endpoint's filtering rules against an
+* already-received email WITHOUT delivering anything. The same
+* shared matcher the live delivery paths use produces the
+* verdict, so the response explains exactly why a webhook fired
+* or was suppressed for that message.
+*
+* When delivery would be suppressed, `rule` names the failing
+* rule and `reason` carries a human-readable explanation; both
+* are null when the message matches. `evaluated` echoes the
+* message metadata the matcher compared (size, attachments, and
+* the authenticated From identity versus the raw envelope
+* sender), so a surprising verdict can be traced to its inputs.
+*
+* Two independent gates are surfaced separately:
+* `subscribed_to_event` reports the endpoint's event-type
+* subscription (checked before message matching), and
+* `rules_valid` reports whether the stored rules blob parsed at
+* all. Delivery fails OPEN on an invalid blob (the message is
+* delivered as if unfiltered), so `rules_valid: false` exposes a
+* misconfiguration that is otherwise silent.
+*
+*/
+const testEndpointRules = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}/rules/test",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* List filter rules
+*
+* Returns all whitelist and blocklist filter rules.
+*/
+const listFilters = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/filters",
+	...options
+});
+/**
+* Create a filter rule
+*
+* Creates a new whitelist or blocklist filter. Per-domain filters
+* require a Pro plan. Patterns are stored as lowercase.
+*
+*/
+const createFilter = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/filters",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Delete a filter rule
+*/
+const deleteFilter = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/filters/{id}",
+	...options
+});
+/**
+* Update a filter rule
+*
+* Toggle a filter's enabled state.
+*/
+const updateFilter = (options) => (options.client ?? client).patch({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/filters/{id}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* List wake schedules
+*
+* Returns the org's wake.dispatch schedules.
+*/
+const listWakeSchedules = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/wake/schedules",
+	...options
+});
+/**
+* Create a wake schedule
+*
+* Create a cron schedule that sends a wake.dispatch command to one of your
+* own function addresses. `from` and `to` must differ (no self-dispatch);
+* the cron expression and IANA timezone are validated and the first fire
+* time is computed without firing immediately.
+*
+*/
+const createWakeSchedule = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/wake/schedules",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Delete a wake schedule
+*/
+const deleteWakeSchedule = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/wake/schedules/{id}",
+	...options
+});
+/**
+* Get a wake schedule
+*/
+const getWakeSchedule = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/wake/schedules/{id}",
+	...options
+});
+/**
+* Update a wake schedule
+*
+* Update a schedule's command, args, cadence, addresses, note, or enabled
+* state. Changing the cadence (or re-enabling) recomputes the next fire time.
+*
+*/
+const updateWakeSchedule = (options) => (options.client ?? client).patch({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/wake/schedules/{id}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Run a wake schedule now
+*
+* Fire the schedule immediately, sending one wake.dispatch via the same
+* signed-send path as a scheduled fire. Does not change the schedule's next
+* fire time.
+*
+*/
+const runWakeSchedule = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/wake/schedules/{id}/run",
+	...options
+});
+/**
+* List wake authorizations
+*
+* Returns the per-target allowlist grants that authorize which senders may
+* wake a function. Optionally filter by the target endpoint.
+*
+*/
+const listWakeAuthorizations = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/wake/authorizations",
+	...options
+});
+/**
+* Create a wake authorization
+*
+* Grant a sender domain (and optionally a specific address and command set)
+* permission to wake a target function. The domain must be fully-qualified.
+*
+*/
+const createWakeAuthorization = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/wake/authorizations",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Delete a wake authorization
+*/
+const deleteWakeAuthorization = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/wake/authorizations/{id}",
+	...options
+});
+/**
+* Update a wake authorization
+*
+* Toggle a wake authorization's enabled state.
+*/
+const updateWakeAuthorization = (options) => (options.client ?? client).patch({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/wake/authorizations/{id}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* List recent wake dispatches
+*
+* Read-only audit of recent wake.dispatch interactions for the org.
+*/
+const listWakeDispatches = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/wake/dispatches",
+	...options
+});
+/**
+* List recipient routes
+*
+* Returns the org's recipient routing rules in evaluation order. Each rule
+* binds a recipient address pattern to one endpoint; inbound mail resolves
+* to a single destination at delivery time.
+*
+*/
+const listRoutes = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes",
+	...options
+});
+/**
+* Create a recipient route
+*
+* Binds a recipient pattern to a destination. Provide exactly one of
+* `endpoint_id` (an existing endpoint) or `function_id`. With `function_id`,
+* a dedicated route-target endpoint is minted for that function in the same
+* transaction, enabling per-address function routing (e.g.
+* `alice@acme.com -> functionA`).
+*
+*/
+const createRoute = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Reorder recipient routes
+*
+* Update the priority of one or more routes in a single call.
+*/
+const reorderRoutes = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes/reorder",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Simulate routing for a recipient
+*
+* Resolves where an inbound email to `recipient` would be delivered, with a
+* trace of every rule evaluated and why. Read-only; creates nothing.
+*
+*/
+const simulateRoute = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes/simulate",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Delete a recipient route
+*/
+const deleteRoute = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes/{id}",
+	...options
+});
+/**
+* Update a recipient route
+*/
+const updateRoute = (options) => (options.client ?? client).patch({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/routes/{id}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* List webhook deliveries
+*
+* Returns a paginated list of webhook delivery attempts. Each delivery
+* includes a nested `email` object with sender, recipient, and subject.
+*
+*/
+const listDeliveries = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/webhooks/deliveries",
+	...options
+});
+/**
+* Replay a webhook delivery
+*
+* Re-sends the stored webhook payload from a previous delivery attempt.
+* If the original endpoint is still active, it is targeted. If the
+* original endpoint was deleted, the oldest active endpoint is used.
+* Deactivated endpoints cannot be replayed to. Rate limited per-org,
+* sharing an org-wide budget with email replays.
+*
+*/
+const replayDelivery = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/webhooks/deliveries/{id}/replay",
+	...options
+});
+/**
+* List send-permission rules
+*
+* Returns a flat list of rules describing every recipient the
+* caller may send to. Each rule has a `type`, a kind-specific
+* payload, and a human-readable `description`. If any rule
+* matches the recipient, /send-mail will accept the send under
+* the recipient-scope check.
+*
+* The endpoint is the answer to "where can I send" without
+* exposing internal entitlement names. Agents that don't
+* recognize a `type` can still read the `description` prose
+* and act on it.
+*
+* Rule kinds, ordered broadest-first so an agent can stop
+* scanning at the first match:
+*
+* 1. `any_recipient` (one entry, only when the org can send
+* anywhere): every other rule below it is redundant.
+* 2. `managed_zone` (always emitted, one per Primitive-managed
+* zone): sends to any address at *.primitive.email or
+* *.email.works always succeed; no entitlement required.
+* 3. `your_domain` (one per active verified outbound domain
+* owned by the org): sends to that domain are approved.
+* 4. `address` (one per address that has authenticated
+* inbound mail to the org, capped at `meta.address_cap`):
+* sends to that exact address are approved.
+*
+* The list is informational, not an authorization check.
+* /send-mail remains the source of truth on whether an
+* individual send will succeed (it also enforces the
+* from-address and the `send_mail` entitlement, which are
+* not recipient-scope concerns and are not represented here).
+*
+*/
+const getSendPermissions = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/send-permissions",
+	...options
+});
+/**
+* Send outbound email
+*
+* Sends an outbound email through Primitive's outbound relay. By default
+* the request returns once the relay accepts the message for delivery.
+* Set `wait: true` to wait for the first downstream SMTP delivery outcome.
+*
+* **Host routing.** /send-mail is served by the canonical API host
+* (`https://api.primitive.dev/v1`) so the request body can carry
+* inline attachments up to ~30 MiB raw. The legacy dashboard
+* compatibility host (`https://www.primitive.dev/api/v1`) also accepts
+* /send-mail, but Vercel request body limits apply before proxying.
+* The typed SDKs route /send-mail to the canonical API host
+* automatically.
+*
+*/
+const sendEmail = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/send-mail",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Semantic search across received and sent mail
+*
+* Ranked search across both received and sent mail. The `mode`
+* field selects the ranking strategy:
+*
+* - `keyword`: lexical full-text matching only (no embeddings).
+* - `semantic`: meaning-based matching using vector embeddings.
+* - `hybrid` (default): blends the semantic and keyword signals.
+*
+* Results are ordered by a relevance `score`. Every row reports the
+* fields it matched (`matched_fields`), a match-centered excerpt per
+* field (`snippets`), and a `score_breakdown` whose components account
+* for the `score`. Page through results by passing the prior
+* response's `meta.cursor` back as `cursor`.
+*
+* Requires the Pro plan and the `semantic_search_enabled`
+* entitlement; callers without them receive `403`.
+*
+*/
+const semanticSearch = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/semantic-search",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Get outbound sending readiness
+*
+* The "what can I send From?" bootstrap, the outbound mirror of
+* /inbox/status. Returns per-domain sending readiness for every
+* domain in the caller's org, plus the flat `sendable_domains`
+* list of From-domains the org may send from right now. That
+* list is the same set echoed in a `cannot_send_from_domain`
+* error's details, so orienting here before a send and
+* recovering from that error use identical data.
+*
+* Each domain's `status` collapses the sending prerequisites
+* into one actionable state: `sendable`, `pending_ownership`
+* (ownership TXT not verified), `pending_outbound_dns`
+* (SPF/DKIM/DMARC not verified), or `inactive` (domain
+* deactivated). `next_actions` lists concrete remediation steps,
+* each with a suggested CLI command where one exists.
+*
+*/
+const getOutboundStatus = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/outbound/status",
+	...options
+});
+/**
+* List repeating sends
+*
+* Repeating sends you created, newest first. A repeat is visible to the
+* member who created it, or to any organization API key or member for
+* repeats created with an organization API key. Agent credentials get
+* 403.
+*
+*/
+const listRepeatingSends = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/repeating-sends",
+	...options
+});
+/**
+* Delete a repeating send
+*
+* Deletes the repeat and cancels its pending message. Messages already sent are not affected.
+*/
+const deleteRepeatingSend = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/repeating-sends/{id}",
+	...options
+});
+/**
+* Get a repeating send
+*/
+const getRepeatingSend = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/repeating-sends/{id}",
+	...options
+});
+/**
+* Update a repeating send
+*
+* Pause, resume or cancel a repeat, or change its cadence, limits,
+* message or whether the recipient may stop it. `active` resumes a paused
+* repeat or one the recipient stopped; the next message goes out within
+* about a minute. A null `only_if_recipient_idle_minutes`, `max_sends`
+* or `until` clears that limit.
+*
+*/
+const updateRepeatingSend = (options) => (options.client ?? client).patch({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/repeating-sends/{id}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* List outbound sent emails
+*
+* Returns a paginated list of OUTBOUND emails the caller's
+* org has sent via /send-mail (and /emails/{id}/reply, which
+* forwards through /send-mail). Includes every recorded
+* attempt, including gate-denied attempts that the agent
+* never called and rows still in `queued` state.
+*
+* For inbound mail received at your verified domains, see
+* /emails. There is no unified send/receive history endpoint;
+* the two surfaces are intentionally separate because the
+* underlying tables, statuses, and lifecycle differ.
+*
+* Email bodies (`body_text`, `body_html`) are NOT included on
+* list rows so a 50-row page can't balloon into a multi-MB
+* response when sends are near the 5MB body cap. Use
+* /sent-emails/{id} to fetch a single row with bodies, or
+* cross-reference by `client_idempotency_key` if the caller
+* already has the body locally.
+*
+*/
+const listSentEmails = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/sent-emails",
+	...options
+});
+/**
+* Delete a sent email
+*
+* Permanently deletes sender mailbox history and its owned attachment archive
+* and transient payload. Allows delivered, bounced, agent_failed, gate_denied,
+* canceled, deferred and wait_timeout; other states return 409. Cancel scheduled
+* sends first. This does not recall or cancel delivery already admitted.
+* Recipient copies, received replies and independent audit records are preserved.
+* Occupied idempotency keys and delivered-reply deduplication remain reserved.
+* Keys already released by cancellation, gate denial or a never-attempted failure
+* remain reusable. Repeating a completed deletion succeeds; unknown or foreign
+* IDs return 404. Organization API keys, sessions and OAuth are supported;
+* Function and connected-agent credentials are denied.
+*
+*/
+const deleteSentEmail = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/sent-emails/{id}",
+	...options
+});
+/**
+* Get a sent email by id
+*
+* Returns the full sent-email record by id, including
+* `body_text` and `body_html` (omitted from the listing
+* endpoint to keep paginated responses small). Use this when
+* diagnosing a specific send, e.g. inspecting the receiver's
+* SMTP response on a `bounced` row or pulling the gate
+* denial detail on a `gate_denied` row.
+*
+*/
+const getSentEmail = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/sent-emails/{id}",
+	...options
+});
+/**
+* Reschedule a scheduled send
+*
+* Moves a STILL-SCHEDULED send (status `scheduled`) to a new
+* execution time. The new `scheduled_at` must be in the future
+* and at most 30 days out, the same bounds as the create-time
+* field on /send-mail.
+*
+* The update is a compare-and-swap on `status = 'scheduled'`:
+* once the scheduler has claimed the row for execution, or it
+* was already canceled or executed, the update loses and the
+* call returns a 409 `not_scheduled` conflict naming the row's
+* current status. A due send can therefore never be moved out
+* from under an in-progress execution.
+*
+* Returns the full updated sent-email record on success.
+*
+*/
+const rescheduleSentEmail = (options) => (options.client ?? client).patch({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/sent-emails/{id}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* list Agent Connections
+*
+* Address-bound external runtime pairing. Any current human organization member may create and manage their personal agent connections. Organization owners and admins may manage all connections and explicitly create shared ones. An owner removed from the organization loses personal agent access, and rejoining does not revive the old connection. Organization API keys cannot manage connections. A current connected credential may disconnect only its own exact address. Claim is authorized only by its one-use invitation. Connected means a real challenge was received and a reply sent by the current bound credential was received back. Invitations expire after 15 minutes. Reconnection preserves the address and revokes previous credentials. Status responses contain no credentials. Runtime credentials allow address-scoped mail operations, organization note reads, own-address note writes, exact-address self-disconnect, network discovery when can_view is enabled, and recipient-bound network contact admission.
+*/
+const listAgentConnections = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-connections",
+	...options
+});
+/**
+* create Agent Connection
+*
+* Address-bound external runtime pairing. Any current human organization member may create and manage their personal agent connections. Organization owners and admins may manage all connections and explicitly create shared ones. An owner removed from the organization loses personal agent access, and rejoining does not revive the old connection. Organization API keys cannot manage connections. A current connected credential may disconnect only its own exact address. Claim is authorized only by its one-use invitation. Connected means a real challenge was received and a reply sent by the current bound credential was received back. Invitations expire after 15 minutes. Reconnection preserves the address and revokes previous credentials. Status responses contain no credentials. Runtime credentials allow address-scoped mail operations, organization note reads, own-address note writes, exact-address self-disconnect, network discovery when can_view is enabled, and recipient-bound network contact admission. Save create_request_id before dispatch to recover an interrupted creation. Recovery returns the original current connection with recovered:true and invitation:null; it never replays a secret or rotates credentials.
+*/
+const createAgentConnection = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-connections",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* invite Agent Connection
+*
+* Address-bound external runtime pairing. Any current human organization member may create and manage their personal agent connections. Organization owners and admins may manage all connections and explicitly create shared ones. An owner removed from the organization loses personal agent access, and rejoining does not revive the old connection. Organization API keys cannot manage connections. A current connected credential may disconnect only its own exact address. Claim is authorized only by its one-use invitation. Connected means a real challenge was received and a reply sent by the current bound credential was received back. Invitations expire after 15 minutes. Reconnection preserves the address and revokes previous credentials. Status responses contain no credentials. Runtime credentials allow address-scoped mail operations, organization note reads, own-address note writes, exact-address self-disconnect, network discovery when can_view is enabled, and recipient-bound network contact admission. pending_only protects an already claimed credential. An ambiguous invitation response must not be retried automatically; invitation secrets are never replayed.
+*/
+const inviteAgentConnection = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-connections/{address}/invitation",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* revoke Agent Connection
+*
+* Disconnect an agent and invalidate its bound credential. A current personal owner may disconnect their own agent; organization owners and admins may disconnect any connection. A connected agent may disconnect only its own exact address using its current bound credential. This preserves the connection record, mail, notes and domain. A current personal owner may permanently remove their own revoked record.
+*/
+const revokeAgentConnection = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-connections/{address}",
+	...options
+});
+/**
+* remove Agent Connection
+*
+* Permanently remove a revoked connection record. A current personal owner may permanently remove their own record; organization owners and admins may remove any record. Disconnect first using revokeAgentConnection; an active connection returns 409 connection_not_revoked. Missing or already removed records return 404. Mail, address notes, domains and external runtimes are preserved. The same address can be paired again with a new invitation; old credentials and invitations remain invalid.
+*/
+const removeAgentConnection = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-connections/{address}/remove",
+	...options
+});
+/**
+* claim Agent Connection
+*
+* Address-bound external runtime pairing. Any current human organization member may create and manage their personal agent connections. Organization owners and admins may manage all connections and explicitly create shared ones. An owner removed from the organization loses personal agent access, and rejoining does not revive the old connection. Organization API keys cannot manage connections. A current connected credential may disconnect only its own exact address. Claim is authorized only by its one-use invitation. Connected means a real challenge was received and a reply sent by the current bound credential was received back. Invitations expire after 15 minutes. Reconnection preserves the address and revokes previous credentials. Status responses contain no credentials. Runtime credentials allow address-scoped mail operations, organization note reads, own-address note writes, exact-address self-disconnect, network discovery when can_view is enabled, and recipient-bound network contact admission.
+*/
+const claimAgentConnection = (options) => (options.client ?? client).post({
+	url: "/agent-connections/claim",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* agent Connection Setup
+*
+* Instructions for pairing an external runtime. GET never consumes an invitation. The invitation token stays in the URL fragment and is submitted only in the claim POST body.
+*/
+const agentConnectionSetup = (options) => (options?.client ?? client).get({
+	url: "/agent-connections/setup",
+	...options
+});
+/**
+* Cancel a scheduled send
+*
+* Cancels a STILL-SCHEDULED send (status `scheduled`), moving it
+* to the terminal `canceled` status. Nothing is dispatched and
+* the row is kept for historical lookup with `canceled_at` set.
+*
+* Uses the same compare-and-swap guard as reschedule: once the
+* scheduler has claimed the row for execution, or it was already
+* canceled or executed, the call returns a 409 `not_scheduled`
+* conflict naming the row's current status. Canceling can
+* therefore never race an in-progress execution; a send that
+* reports `canceled` was never handed to the delivery path.
+*
+* Returns the full updated sent-email record on success.
+*
+*/
+const cancelSentEmail = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/sent-emails/{id}/cancel",
+	...options
+});
+/**
+* Get (or wait for) the reply to a sent email
+*
+* Returns the first threaded inbound reply to a send, keyed by
+* the inbound email's `reply_to_sent_email_id`. This is the
+* canonical "did a reply arrive for this send?" call: after
+* /send-mail, poll (or long-poll) here instead of hand-rolling
+* an /emails/search loop.
+*
+* By default the call returns immediately with `reply: null`
+* when nothing has arrived yet. Set `wait=true` to long-poll:
+* the server holds the request up to `wait_timeout_ms`
+* (default 10000, max 30000), returning as soon as the first
+* reply lands. On a wait that elapses with no reply, the
+* response has `reply: null` and `timed_out: true`.
+*
+* The reply object is compact (headers plus bodies); fetch
+* `/emails/{id}` with `reply.id` for the fully parsed record,
+* or `/threads/{thread_id}` for the whole back-and-forth.
+*
+*/
+const awaitReply = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/sent-emails/{id}/reply",
+	...options
+});
+/**
+* Get a conversation thread by id
+*
+* Returns a conversation thread: its metadata plus the inbound
+* and outbound messages that belong to it, interleaved in time
+* order (oldest first). A thread spans both received emails and
+* your sends, so an agent can reconstruct an entire back-and-forth
+* from one call instead of walking reply headers.
+*
+* Each message carries a `direction` (`inbound` | `outbound`) and
+* an `id`; fetch the full message via `/emails/{id}` or
+* `/sent-emails/{id}` accordingly. Bodies are omitted here to keep
+* the thread view lightweight.
+*
+* Discover a thread id from the `thread_id` field on any email or
+* sent-email (list or detail). The message list is capped; compare
+* `message_count` against `messages.length` to detect truncation.
+*
+*/
+const getThread = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/threads/{id}",
+	...options
+});
+/**
+* List functions
+*
+* Returns every active (non-deleted) function in the org, newest
+* first. Each entry carries deploy status and timestamps. To
+* inspect the source code or deploy errors, use `GET /functions/{id}`.
+*
+*/
+const listFunctions = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/functions",
+	...options
+});
+/**
+* Deploy a function
+*
+* Creates and deploys a new function. The handler must be a single
+* ESM module whose default export is an object with an async
+* `fetch(request, env)` method (Workers-style). Primitive signs
+* each delivery and forwards the `Primitive-Signature` header to
+* the handler. Verify the raw request body with
+* `PRIMITIVE_WEBHOOK_SECRET` before parsing JSON; after verification
+* the request body parses to a webhook event whose `event` field is
+* `email.received` for normal inbound mail, or a machine-mail type
+* (`email.bounced`, `email.tls_report`, `email.dmarc_report`,
+* `email.dmarc_failure`) for bounces and reports. Code is bundled
+* before being uploaded; ship a single self-contained file rather
+* than relying on external imports.
+*
+* **Code limits.** `code` is capped at 1 MiB UTF-8. `sourceMap`
+* (optional) is capped at 5 MiB UTF-8, stored with each deployment
+* attempt, and sent to the runtime so stack traces can resolve to
+* original source files.
+*
+* **Routing.** On successful deploy, the function code is live
+* in the runtime, but inbound mail will not reach it until at
+* least one route is bound. Routes are managed from the Primitive
+* dashboard. A `deploy_status` of `deployed` means the script is
+* installed, not that the function is receiving mail. The
+* internal runtime URL is not returned by the API and is not a
+* customer-facing integration surface.
+*
+* **Secrets.** New functions ship with the managed secrets
+* (`PRIMITIVE_WEBHOOK_SECRET`, `PRIMITIVE_API_KEY`,
+* `PRIMITIVE_API_BASE_URL`) already bound. Add user-set secrets via
+* `POST /functions/{id}/secrets`; secret writes only land in the
+* running handler on the next redeploy.
+*
+*/
+const createFunction = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/functions",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Delete a function
+*
+* Soft-deletes the function row, removes the script from the edge
+* runtime, and deactivates any route bound to this function so no
+* further inbound mail is delivered. Past deploy history,
+* invocations, and logs are retained.
+*
+* Returns 502 if the runtime delete fails partway; the function
+* row stays in place and the call is safe to retry until it
+* succeeds.
+*
+*/
+const deleteFunction = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/functions/{id}",
+	...options
+});
+/**
+* Get a function
+*
+* Returns the full record for a function, including its current
+* source code and the deploy status / error from the most recent
+* deploy attempt.
+*
+*/
+const getFunction = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/functions/{id}",
+	...options
+});
+/**
+* Update and redeploy a function
+*
+* Replaces the function's source code with the body's `code` and
+* triggers a redeploy. Same size limits as `POST /functions`.
+* Use this verb to push secret writes into the running handler:
+* passing the same `code` re-runs the deploy and refreshes the
+* binding set with the latest values from the secrets table.
+*
+* On deploy failure, the previously-deployed code stays live; the
+* runtime never serves a half-built bundle. The response uses
+* `error.code` `deploy_failed`, and the function's `deploy_error`
+* field carries the latest deploy error for dashboard/API reads.
+*
+*/
+const updateFunction = (options) => (options.client ?? client).put({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/functions/{id}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Send a test invocation
+*
+* Sends a real test email from a Primitive-controlled sender to a
+* local-part on one of the org's verified inbound domains. By
+* default the recipient is a synthetic
+* `__primitive_function_test+<random>@<domain>` address on a
+* domain selected to route to the function. Scoped functions use
+* their scoped domain; fallback functions use a domain that has
+* no enabled domain-scoped endpoint. Pass `local_part` to
+* override and exercise routing logic that branches on a specific
+* recipient (the common pattern when one function handles multiple
+* inboxes like `summarize@` and `action@`). The function fires
+* through the normal MX delivery path, so reply / send-mail calls
+* from inside the handler against the inbound's `email.id` work
+* the same as in production. Returns immediately after the send is
+* queued; the invocation appears on the function's invocations
+* list within a few seconds.
+*
+* Requires that the function is currently `deployed`. Returns 422
+* if the function is in `pending` or `failed` state, or if the
+* org has no verified inbound domain to receive the test mail.
+* Returns 400 if `local_part` is set to a value that does not
+* match the local-part character set.
+*
+*/
+const testFunction = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/functions/{id}/test",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Get a function test run trace
+*
+* Returns the current end-to-end trace for a function test run.
+* The trace is intentionally partial while the test is still in
+* flight: callers can poll this endpoint and watch it fill in
+* from send -> inbound -> webhook deliveries -> outbound
+* requests, logs, and replies.
+*
+*/
+const getFunctionTestRunTrace = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/functions/{id}/test-runs/{run_id}/trace",
+	...options
+});
+/**
+* Get the org's function routing topology
+*
+* Returns a single snapshot of how inbound mail is routed across
+* this org's active domains and functions: which active domain has
+* which function bound, the org's fallback function (if any), and
+* every deployed function with no route bound. Use this to answer
+* "which of my functions actually receive mail?" diagnostically.
+*
+*/
+const getOrgRoutingTopology = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/functions/routing-topology",
+	...options
+});
+/**
+* Get a function's current route binding
+*
+* Returns the endpoint binding for the function, or null when no
+* route is currently bound. The binding identifies whether the
+* function receives mail for a specific domain (scoped) or for any
+* active domain that has no scoped binding (fallback).
+*
+*/
+const getFunctionRouting = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/functions/{id}/routing",
+	...options
+});
+/**
+* Unbind any route from a function
+*
+* Deactivates every active endpoint bound to this function. The
+* function stays deployed but stops receiving inbound mail. Safe
+* to call when no route is currently bound (no-op).
+*
+*/
+const unsetFunctionRoute = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/functions/{id}/route",
+	...options
+});
+/**
+* Bind a route to a function
+*
+* Binds inbound mail to this function. The route target is either
+* a specific verified domain (scoped) or the org's fallback (any
+* active domain with no scoped binding). If another function is
+* already bound at the target, returns a `conflict` envelope
+* describing the holder; re-issue with `takeover: true` to
+* deactivate that prior binding and install this one.
+*
+*/
+const setFunctionRoute = (options) => (options.client ?? client).put({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/functions/{id}/route",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* List a function's secrets
+*
+* Returns metadata for every secret bound to the function, with
+* managed entries (provisioned by Primitive) listed first and
+* user-set entries listed alphabetically after. **Values are
+* never returned.** Secret writes are write-only.
+*
+* Managed entries (e.g. `PRIMITIVE_WEBHOOK_SECRET`,
+* `PRIMITIVE_API_KEY`, `PRIMITIVE_API_BASE_URL`) carry a
+* `description` instead of `created_at` / `updated_at`. They
+* cannot be created, updated, or deleted via this API.
+*
+*/
+const listFunctionSecrets = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/functions/{id}/secrets",
+	...options
+});
+/**
+* Create or update a secret
+*
+* Idempotent insert-or-update keyed on `(function_id, key)`.
+* Returns 201 the first time the key is set, 200 on subsequent
+* updates. Values are encrypted at rest and only become visible
+* to the running handler on the next deploy (`PUT /functions/{id}`
+* with the existing code is sufficient to refresh bindings).
+*
+* Keys must match `^[A-Z_][A-Z0-9_]*$` (uppercase letters,
+* digits, underscores; first character is a letter or
+* underscore). Values are at most 4096 UTF-8 bytes. System-
+* managed keys are reserved and rejected.
+*
+*/
+const createFunctionSecret = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/functions/{id}/secrets",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Delete a secret
+*
+* Removes the secret. The binding stays live in the running
+* handler until the next deploy refreshes the binding set
+* (`PUT /functions/{id}` with the existing code is sufficient).
+* Returns 404 if the key did not exist. Managed system keys
+* cannot be deleted.
+*
+*/
+const deleteFunctionSecret = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/functions/{id}/secrets/{key}",
+	...options
+});
+/**
+* Set a secret by key
+*
+* Path-keyed companion to `POST /functions/{id}/secrets`.
+* Idempotent: returns 201 the first time the key is set, 200 on
+* subsequent updates. Same validation rules and same write-only
+* guarantees as the POST verb; the new value lands in the running
+* handler on the next deploy.
+*
+*/
+const setFunctionSecret = (options) => (options.client ?? client).put({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/functions/{id}/secrets/{key}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* List org-level (global) secrets
+*
+* Returns metadata for every org-level secret. Org secrets apply
+* to every function in the org and are read as `env.<KEY>` in
+* handlers. **Values are never returned.** Secret writes are
+* write-only. A function-level secret of the same name overrides
+* the org-level value for that function.
+*
+*/
+const listOrgSecrets = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/org/secrets",
+	...options
+});
+/**
+* Create or update an org secret
+*
+* Idempotent insert-or-update keyed on `(org_id, key)`. Returns
+* 201 the first time the key is set, 200 on subsequent updates.
+* Values are encrypted at rest. A changed value lands in a
+* function only on that function's next deploy.
+*
+* Keys must match `^[A-Z_][A-Z0-9_]*$` (uppercase letters,
+* digits, underscores; first character is a letter or
+* underscore). Values are at most 4096 UTF-8 bytes. System-
+* managed keys are reserved and rejected.
+*
+*/
+const createOrgSecret = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/org/secrets",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Delete an org secret
+*
+* Removes the org secret. Functions keep the previous value until
+* each is redeployed. Returns 404 if the key did not exist.
+*
+*/
+const deleteOrgSecret = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/org/secrets/{key}",
+	...options
+});
+/**
+* Set an org secret by key
+*
+* Path-keyed companion to `POST /org/secrets`. Idempotent:
+* returns 201 the first time the key is set, 200 on subsequent
+* updates. Same validation and write-only guarantees as POST.
+*
+*/
+const setOrgSecret = (options) => (options.client ?? client).put({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/org/secrets/{key}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* List a function's execution logs
+*
+* Returns the most recent `function_logs` rows for the function,
+* newest first. Each row is a single `console.log` / `console.error`
+* invocation captured from the running handler.
+*
+* Page through history with the opaque `cursor` returned as
+* `next_cursor`; pass it back as the `cursor` query param on the
+* next call. `next_cursor` is `null` when there are no further
+* rows. The cursor format is an implementation detail and should
+* not be parsed by callers.
+*
+*/
+const listFunctionLogs = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/functions/{id}/logs",
+	...options
+});
+/**
+* Delete a memory
+*
+* Delete one active memory by key and scope. Deletes are idempotent when
+* `if_version` is omitted: deleting a missing key returns `deleted:
+* false`. With `if_version`, a missing key still returns `deleted: false`,
+* but a stale version returns `memory_conflict`.
+*
+* A successful delete records memory write usage.
+*
+*/
+const deleteMemory = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/memories",
+	...options
+});
+/**
+* Get a memory
+*
+* Fetch one active memory by key and scope. Omit scope parameters to use
+* the automatic default: function-authenticated context, then the
+* `x-primitive-function-id` header, then org scope. Function scope uses a
+* function id UUID in `scope_id`.
+*
+* A successful read records memory read usage and updates the memory's
+* read stats asynchronously.
+*
+*/
+const getMemory = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/memories",
+	...options
+});
+/**
+* Set a memory
+*
+* Create or update a durable JSON memory under an org or function scope.
+* When no explicit scope is provided, function-authenticated requests
+* use that function's id automatically; requests with
+* `x-primitive-function-id` use that function id; all other requests
+* default to org scope.
+*
+* `scope.type = function` requires the function id UUID in `scope.id`.
+* Function names are not accepted as scope identifiers. Values must be
+* valid JSON and serialize to at most 65536 UTF-8 bytes. Keys must be at
+* most 512 UTF-8 bytes. `version`, `read_count`, and `write_count` are
+* bigint counters serialized as strings.
+*
+* Passing `if_absent` turns the write into create-only. Passing
+* `if_version` turns the write into compare-and-set. These options are
+* mutually exclusive and return `memory_conflict` on a stale version or
+* existing key.
+*
+*/
+const setMemory = (options) => (options.client ?? client).put({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/memories",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Search memories
+*
+* List active memories in a scope by lexicographic key prefix. Results
+* are ordered by key ascending. The `meta.cursor` value is the next key
+* cursor; pass it back as `cursor` to continue after that key.
+*
+* Search records one memory read usage event for the operation. Pass
+* `include_value=false` to return metadata only.
+*
+*/
+const searchMemories = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/memories/search",
+	...options
+});
+/**
+* List function templates
+*
+* List approved Function templates available for browsing and
+* installation. Results are cacheable and paginated with
+* `data.next_cursor`.
+*
+*/
+const listTemplates = (options) => (options?.client ?? client).get({
+	url: "/templates",
+	...options
+});
+/**
+* Get a function template
+*
+* Fetch one approved Function template by slug, including its manifest
+* snapshot and README. The stored source files used for install are not
+* returned.
+*
+*/
+const getTemplate = (options) => (options.client ?? client).get({
+	url: "/templates/{id}",
+	...options
+});
+/**
+* Install a function template
+*
+* Start a one-shot deploy of an approved deploy-mode Function template.
+* The response returns an install record immediately; poll
+* `GET /templates/installs/{id}` for progress.
+*
+*/
+const installTemplate = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/templates/{id}/install",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Get template install status
+*
+* Fetch the current state of a template install. Reads may advance the
+* self-test phase when a reply effect has been observed.
+*
+*/
+const getTemplateInstall = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/templates/installs/{id}",
+	...options
+});
+/**
+* List payout addresses
+*
+* List your org's registered payout addresses, newest first.
+*/
+const listPayoutAddresses = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/payout-addresses",
+	...options
+});
+/**
+* Register a payout address
+*
+* Register (or update) the default payout address your org receives x402
+* payments at, for a given network. You prove control of the address with
+* an org-bound `personal_sign` signature over the message produced by the
+* SDK helper `buildPayoutRegistrationMessage`. The org id is taken from your
+* authenticated key, never the body, so a captured signature can't register
+* an address under another org. Exactly one default address exists per
+* (org, network); registering again replaces it. A payee MUST register a
+* payout address before calling `createChallenge`, because the challenge's
+* `pay_to` is resolved from this directory.
+*
+*/
+const registerPayoutAddress = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/payout-addresses",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Create an email-native payment challenge
+*
+* Issue an x402 payment challenge over a real email thread (the payee
+* side). Unlike `createChallenge` (which mints a synthetic challenge id),
+* this sends the challenge as an email from `from` to `to` and binds the
+* payment to that DKIM-authenticated thread. The `pay_to` address and the
+* token asset are resolved server-side from your registered default payout
+* address for the network, never from the request. The response carries
+* the thread's `interaction_id` plus the `challenge` (the
+* `payment_requirements`, the `nonce_binding`, and `expires_at`) the payer
+* needs to sign; the payer replies with a signed `payment` interaction
+* step. Amounts are in token base units (USDC has 6 decimals, so `"10000"`
+* is 0.01 USDC).
+*
+*/
+const createEmailChallenge = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/email-challenges",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Create a payment challenge
+*
+* Create an x402 payment challenge (the payee side of a payment). The
+* `pay_to` address is resolved server-side from your registered default
+* payout address for the network, never from the request. The response
+* carries the `nonce_binding` and `payment_requirements` the payer needs to
+* sign; hand the whole challenge object to the payer (for example in an
+* email reply). Amounts are in token base units (USDC has 6 decimals, so
+* `"10000"` is 0.01 USDC).
+*
+*/
+const createChallenge = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/challenges",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Get a payment challenge
+*
+* Fetch a challenge you created, to poll its `status` and settlement
+* receipt (`settle_tx`). Scoped to the challenger org that created it.
+*
+*/
+const getChallenge = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/challenges/{id}",
+	...options
+});
+/**
+* Pay a payment challenge
+*
+* Settle a challenge addressed to your org as payer. The request body
+* carries a signed x402 `PaymentPayload`: an EIP-3009
+* `transferWithAuthorization` signed locally with your own key, whose nonce
+* is bound to the challenge via the SDK's `deriveEip3009Nonce`. The platform
+* verifies every signed field against its own record of the challenge,
+* applies your spend policy, and settles on-chain through a facilitator.
+* Settlement is non-custodial; Primitive never holds funds. Idempotent:
+* paying an already-settled challenge returns the original receipt. Most
+* callers use the SDK `pay()` helper rather than building the payload by
+* hand.
+*
+*/
+const payChallenge = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/challenges/{id}/pay",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Get your spend policy
+*
+* Read your org's outbound spend policy: the kill-switch, per-payment and
+* per-day caps, and the payee allowlist. Returns the defaults (no limits,
+* not paused) when no policy has been set.
+*
+*/
+const getSpendPolicy = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/spend-policy",
+	...options
+});
+/**
+* Update your spend policy
+*
+* Update your org's spend policy. Applied as a merge: only the fields you
+* include change, and omitted fields keep their current value, so a partial
+* update can't silently reset the kill-switch. Send an explicit `null` to
+* clear a cap. Caps are in token base units.
+*
+*/
+const updateSpendPolicy = (options) => (options.client ?? client).put({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/spend-policy",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* List declined payments
+*
+* The 50 most recent payments your org's spend policy declined, newest
+* first. Use this to see why an outbound payment was refused (a cap, the
+* payee allowlist, or the kill-switch) instead of only reading the
+* dashboard.
+*
+*/
+const listDeclinedPayments = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/x402/declined-payments",
+	...options
+});
+/**
+* List your organization's agent networks
+*
+* An organization member login or an active connected agent allowed to see the network can read networks. The default organization network is always present. can_manage_all is true only for a current owner or admin; a connected credential receives false.
+*/
+const listAgentNetworks = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-networks",
+	...options
+});
+/**
+* List default network memberships available to your login
+*
+* An owner or admin sees all connected addresses, including hidden and excluded members. Other human members see only personal addresses owned by their current membership. Filtering happens before pagination. Connected-agent credentials cannot read this roster. Each row includes whether the requester can manage it.
+*/
+const listDefaultNetworkMembers = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-networks/default/members",
+	...options
+});
+/**
+* Remove an agent from the default network
+*
+* Owner or admin login required. The explicit exclusion persists across synchronization.
+*/
+const removeDefaultNetworkMember = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-networks/default/members/{address}",
+	...options
+});
+/**
+* Change whether an agent can see or be seen in the network
+*
+* An owner or admin may update any active address. Other human members may update only their own current, non-excluded personal address. Connected-agent credentials cannot update visibility. Omitted settings keep their current value.
+*/
+const updateDefaultNetworkMember = (options) => (options.client ?? client).patch({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-networks/default/members/{address}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Add an agent to the default network
+*
+* Owner or admin login required. Restores an explicitly excluded member.
+*/
+const addDefaultNetworkMember = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-networks/default/members/{address}",
+	...options
+});
+/**
+* Discover listed agents in your organization network
+*
+* Requires a connected-agent credential for an active member allowed to see the network, or an organization member login.
+*/
+const listDefaultNetworkAgents = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-networks/default/agents",
+	...options
+});
+/**
+* Get a listed agent by email address
+*
+* Requires a connected-agent credential allowed to see the network, or an organization member login. Unlisted agents look absent.
+*/
+const getDefaultNetworkAgent = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-networks/default/agents/{address}",
+	...options
+});
+/**
+* Check whether network mail may wake this connected agent
+*
+* Requires the recipient's connected-agent credential. The recipient
+* address is derived from that credential. The email ID must identify
+* accepted or completed inbound mail for that exact recipient, with
+* matching stored sender and delivery evidence. Returns no sender profile
+* or existence detail. Clients must also verify the email detail's sender
+* provenance and respect explicit contact silence before using the result.
+* Network wake requires the sender to be connected and able to view the
+* network, and the recipient to be connected and listed. The sender need
+* not be listed and the recipient need not view the network. Ordinary
+* known-address email remains independent. Mail received before
+* allowed_since cannot be newly admitted.
+*
+*/
+const checkDefaultNetworkContactAdmission = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-networks/default/contact-admission",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* List the registries you own
+*/
+const listRegistries = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/registries",
+	...options
+});
+/**
+* Create a registry
+*/
+const createRegistry = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/registries",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Delete a registry you own
+*
+* Removes the registry from discovery and frees its slug for re-creation.
+*/
+const deleteRegistry = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/registries/{slug}",
+	...options
+});
+/**
+* Get a public registry's metadata
+*/
+const getRegistry = (options) => (options.client ?? client).get({
+	url: "/registries/{slug}",
+	...options
+});
+/**
+* Update a registry you own
+*/
+const updateRegistry = (options) => (options.client ?? client).patch({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/registries/{slug}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* List agents in a registry
+*/
+const listRegistryAgents = (options) => (options.client ?? client).get({
+	url: "/registries/{slug}/agents",
+	...options
+});
+/**
+* Publish an agent into a registry
+*/
+const publishAgent = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/registries/{slug}/agents",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Unpublish an agent from a registry
+*/
+const unpublishAgent = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/registries/{slug}/agents/{handle}",
+	...options
+});
+/**
+* Resolve a registry handle to its agent
+*/
+const resolveRegistryHandle = (options) => (options.client ?? client).get({
+	url: "/registries/{slug}/agents/{handle}",
+	...options
+});
+/**
+* List pending publication requests
+*/
+const listRegistryRequests = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/registries/{slug}/requests",
+	...options
+});
+/**
+* Approve or reject a publication request
+*/
+const decideRegistryRequest = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/registries/{slug}/requests/{id}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Define an agent identity
+*/
+const defineAgent = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agents",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Get an agent's public profile by address
+*/
+const getAgent = (options) => (options.client ?? client).get({
+	url: "/agents/{address}",
+	...options
+});
+/**
+* list Contacts
+*
+* Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.
+*/
+const listContacts = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/contacts",
+	...options
+});
+/**
+* delete Contact
+*
+* Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.
+*/
+const deleteContact = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/contacts/{address}",
+	...options
+});
+/**
+* get Contact
+*
+* Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.
+*/
+const getContact = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/contacts/{address}",
+	...options
+});
+/**
+* put Contact
+*
+* Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.
+*/
+const putContact = (options) => (options.client ?? client).put({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/contacts/{address}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* list Agent Contacts
+*
+* Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.
+*/
+const listAgentContacts = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-contacts/{agent_address}",
+	...options
+});
+/**
+* delete Agent Contact
+*
+* Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.
+*/
+const deleteAgentContact = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-contacts/{agent_address}/{contact_address}",
+	...options
+});
+/**
+* put Agent Contact
+*
+* Organization directory and agent preferences; no profiles, message history or runtime presence. Existing organization credentials use tenant permissions. Connected keys may read the directory, create address-only missing contacts using if_absent:true, and access only their own agent memberships; they cannot edit shared labels or delete directory entries. Function credentials are not granted access. Memberships require an existing local agent connection (including revoked connections) and an existing contact. PUT requires exactly one precondition. if_absent returns an existing row unchanged when supplied fields agree; otherwise 409. notify defaults false. Off-to-on generates a new server timestamp and generation; on-to-on and purpose-only edits preserve them. Disable clears activation metadata. Deletion atomically removes membership eligibility. Receivers must recheck generation/preferences before dispatch and pause admission when their policy cache is older than 30 seconds; explicit reply waits are independent. DELETE requires if_version, returns deleted:false for an absent row, and rejects stale versions of recreated rows. Pages use ascending canonical address, with meta.cursor null on the last page. Lists are live pages, not snapshots.
+*/
+const putAgentContact = (options) => (options.client ?? client).put({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-contacts/{agent_address}/{contact_address}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Read organization contact policy
+*
+* Receiver-side email notification admission preferences; never task, tool, code execution or account authority. Rules take effect only in receivers implementing this current contact-policy contract. Older receivers may continue their previous exact-contact notifications until updated. Ordinary email delivery, storage, webhooks and explicit reply waits remain independent of these preferences. Organization owners/admins using session, OAuth or signed dashboard credentials may read/write policies. Connected credentials may only GET their own agent composite; they cannot write either policy. Function and signed capability credentials are not granted access. Rules are unordered. Exact membership notify:false always silences. Next use matching agent rules, otherwise matching organization rules; silence wins ties within that scope. If neither scope matches, existing exact membership notify:true allows using its own activation metadata; otherwise only enabled contact-request intake is allowed. Owner policy silence therefore cannot be bypassed by a connected agent adding a notify:true membership. Patterns are canonical lowercase bare mailboxes, *@example.com, research-*@example.com or *@*.example.com. Only a terminal local-part * and a leading whole domain-label *. are supported; subdomain patterns exclude the apex and require a literal multi-label suffix. No regular expressions, question marks, universal domains or wildcard TLDs. Domain-only UI input must be converted to *@domain. PUT fully replaces up to 100 rules and the request-intake option using exactly one CAS precondition. Duplicate pattern/effect pairs are rejected. if_absent returns an identical existing document, otherwise 409. A missing document reads as empty rules, null version/timestamps, false request intake for the organization and null (inherit) for the agent. Reset overrides with empty rules and null request intake. Allow rules preserve server activation metadata while retained unchanged; removing/recreating or changing a rule to allow resets it. Request intake defaults off; agent null inherits the organization. No-op writes preserve versions. Agent composite effective_version changes with either policy document, connection identity, generation or successful claim; effective_since is the latest policy mutation, connection creation or successful claim. Reclaiming a connection invalidates prior admission snapshots and starts a fresh rule/request cutoff; routine heartbeats do not. Rule/request admissions require received_at >= both the selected activation time and effective_since. Consequently even unrelated policy edits suppress queued older rule/request admissions, without deleting email history or affecting explicit reply waits. Exact membership fallback retains its own notify_since and generation but must still recheck current policy denies and effective_version. Before dispatch, receivers must recheck the current composite version and applicable activation generation and membership; stop new admissions when policy is unavailable or older than 30 seconds. Snapshot fields explain scope and matched rules locally; the API does not execute tasks or dispatch notifications.
+*/
+const getContactPolicy = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/contact-policy",
+	...options
+});
+/**
+* Replace organization contact policy
+*
+* Receiver-side email notification admission preferences; never task, tool, code execution or account authority. Rules take effect only in receivers implementing this current contact-policy contract. Older receivers may continue their previous exact-contact notifications until updated. Ordinary email delivery, storage, webhooks and explicit reply waits remain independent of these preferences. Organization owners/admins using session, OAuth or signed dashboard credentials may read/write policies. Connected credentials may only GET their own agent composite; they cannot write either policy. Function and signed capability credentials are not granted access. Rules are unordered. Exact membership notify:false always silences. Next use matching agent rules, otherwise matching organization rules; silence wins ties within that scope. If neither scope matches, existing exact membership notify:true allows using its own activation metadata; otherwise only enabled contact-request intake is allowed. Owner policy silence therefore cannot be bypassed by a connected agent adding a notify:true membership. Patterns are canonical lowercase bare mailboxes, *@example.com, research-*@example.com or *@*.example.com. Only a terminal local-part * and a leading whole domain-label *. are supported; subdomain patterns exclude the apex and require a literal multi-label suffix. No regular expressions, question marks, universal domains or wildcard TLDs. Domain-only UI input must be converted to *@domain. PUT fully replaces up to 100 rules and the request-intake option using exactly one CAS precondition. Duplicate pattern/effect pairs are rejected. if_absent returns an identical existing document, otherwise 409. A missing document reads as empty rules, null version/timestamps, false request intake for the organization and null (inherit) for the agent. Reset overrides with empty rules and null request intake. Allow rules preserve server activation metadata while retained unchanged; removing/recreating or changing a rule to allow resets it. Request intake defaults off; agent null inherits the organization. No-op writes preserve versions. Agent composite effective_version changes with either policy document, connection identity, generation or successful claim; effective_since is the latest policy mutation, connection creation or successful claim. Reclaiming a connection invalidates prior admission snapshots and starts a fresh rule/request cutoff; routine heartbeats do not. Rule/request admissions require received_at >= both the selected activation time and effective_since. Consequently even unrelated policy edits suppress queued older rule/request admissions, without deleting email history or affecting explicit reply waits. Exact membership fallback retains its own notify_since and generation but must still recheck current policy denies and effective_version. Before dispatch, receivers must recheck the current composite version and applicable activation generation and membership; stop new admissions when policy is unavailable or older than 30 seconds. Snapshot fields explain scope and matched rules locally; the API does not execute tasks or dispatch notifications.
+*/
+const putContactPolicy = (options) => (options.client ?? client).put({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/contact-policy",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Read agent contact policy
+*
+* Receiver-side email notification admission preferences; never task, tool, code execution or account authority. Rules take effect only in receivers implementing this current contact-policy contract. Older receivers may continue their previous exact-contact notifications until updated. Ordinary email delivery, storage, webhooks and explicit reply waits remain independent of these preferences. Organization owners/admins using session, OAuth or signed dashboard credentials may read/write policies. Connected credentials may only GET their own agent composite; they cannot write either policy. Function and signed capability credentials are not granted access. Rules are unordered. Exact membership notify:false always silences. Next use matching agent rules, otherwise matching organization rules; silence wins ties within that scope. If neither scope matches, existing exact membership notify:true allows using its own activation metadata; otherwise only enabled contact-request intake is allowed. Owner policy silence therefore cannot be bypassed by a connected agent adding a notify:true membership. Patterns are canonical lowercase bare mailboxes, *@example.com, research-*@example.com or *@*.example.com. Only a terminal local-part * and a leading whole domain-label *. are supported; subdomain patterns exclude the apex and require a literal multi-label suffix. No regular expressions, question marks, universal domains or wildcard TLDs. Domain-only UI input must be converted to *@domain. PUT fully replaces up to 100 rules and the request-intake option using exactly one CAS precondition. Duplicate pattern/effect pairs are rejected. if_absent returns an identical existing document, otherwise 409. A missing document reads as empty rules, null version/timestamps, false request intake for the organization and null (inherit) for the agent. Reset overrides with empty rules and null request intake. Allow rules preserve server activation metadata while retained unchanged; removing/recreating or changing a rule to allow resets it. Request intake defaults off; agent null inherits the organization. No-op writes preserve versions. Agent composite effective_version changes with either policy document, connection identity, generation or successful claim; effective_since is the latest policy mutation, connection creation or successful claim. Reclaiming a connection invalidates prior admission snapshots and starts a fresh rule/request cutoff; routine heartbeats do not. Rule/request admissions require received_at >= both the selected activation time and effective_since. Consequently even unrelated policy edits suppress queued older rule/request admissions, without deleting email history or affecting explicit reply waits. Exact membership fallback retains its own notify_since and generation but must still recheck current policy denies and effective_version. Before dispatch, receivers must recheck the current composite version and applicable activation generation and membership; stop new admissions when policy is unavailable or older than 30 seconds. Snapshot fields explain scope and matched rules locally; the API does not execute tasks or dispatch notifications.
+*/
+const getAgentContactPolicy = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-contact-policy/{agent_address}",
+	...options
+});
+/**
+* Replace agent contact policy
+*
+* Receiver-side email notification admission preferences; never task, tool, code execution or account authority. Rules take effect only in receivers implementing this current contact-policy contract. Older receivers may continue their previous exact-contact notifications until updated. Ordinary email delivery, storage, webhooks and explicit reply waits remain independent of these preferences. Organization owners/admins using session, OAuth or signed dashboard credentials may read/write policies. Connected credentials may only GET their own agent composite; they cannot write either policy. Function and signed capability credentials are not granted access. Rules are unordered. Exact membership notify:false always silences. Next use matching agent rules, otherwise matching organization rules; silence wins ties within that scope. If neither scope matches, existing exact membership notify:true allows using its own activation metadata; otherwise only enabled contact-request intake is allowed. Owner policy silence therefore cannot be bypassed by a connected agent adding a notify:true membership. Patterns are canonical lowercase bare mailboxes, *@example.com, research-*@example.com or *@*.example.com. Only a terminal local-part * and a leading whole domain-label *. are supported; subdomain patterns exclude the apex and require a literal multi-label suffix. No regular expressions, question marks, universal domains or wildcard TLDs. Domain-only UI input must be converted to *@domain. PUT fully replaces up to 100 rules and the request-intake option using exactly one CAS precondition. Duplicate pattern/effect pairs are rejected. if_absent returns an identical existing document, otherwise 409. A missing document reads as empty rules, null version/timestamps, false request intake for the organization and null (inherit) for the agent. Reset overrides with empty rules and null request intake. Allow rules preserve server activation metadata while retained unchanged; removing/recreating or changing a rule to allow resets it. Request intake defaults off; agent null inherits the organization. No-op writes preserve versions. Agent composite effective_version changes with either policy document, connection identity, generation or successful claim; effective_since is the latest policy mutation, connection creation or successful claim. Reclaiming a connection invalidates prior admission snapshots and starts a fresh rule/request cutoff; routine heartbeats do not. Rule/request admissions require received_at >= both the selected activation time and effective_since. Consequently even unrelated policy edits suppress queued older rule/request admissions, without deleting email history or affecting explicit reply waits. Exact membership fallback retains its own notify_since and generation but must still recheck current policy denies and effective_version. Before dispatch, receivers must recheck the current composite version and applicable activation generation and membership; stop new admissions when policy is unavailable or older than 30 seconds. Snapshot fields explain scope and matched rules locally; the API does not execute tasks or dispatch notifications.
+*/
+const putAgentContactPolicy = (options) => (options.client ?? client).put({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/agent-contact-policy/{agent_address}",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Get current caller identity
+*
+* Current authenticated identity. member_address is null for machine credentials or an unavailable member address.
+*/
+const whoami = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/whoami",
+	...options
+});
+/**
+* Provision your member email address
+*
+* Provision or return this authenticated human member's stable managed address in this organization. API keys, connected agents and Functions cannot provision or impersonate humans. The owner explicitly chooses the address. Existing retained mail requires confirmation; reserved identities cannot be overridden. There is no target user input. An unavailable domain never silently changes the address.
+*/
+const provisionMemberAddress = (options) => (options.client ?? client).put({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/account/member-address",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+//#endregion
+export { putAgentContactPolicy as $, getRepeatingSend as A, listEmails as B, getEmail as C, updateFunction as Ct, getInboxStatus as D, updateWakeSchedule as Dt, getFunctionTestRunTrace as E, updateWakeAuthorization as Et, listAgentNetworks as F, listRoutes as G, listFunctionLogs as H, listContacts as I, listWakeDispatches as J, listSentEmails as K, listDefaultNetworkAgents as L, getThread as M, getWakeSchedule as N, getMemory as O, verifyAgentClaim as Ot, listAgentContacts as P, putAgentContact as Q, listDefaultNetworkMembers as R, getDefaultNetworkAgent as S, updateDefaultNetworkMember as St, getFunctionRouting as T, updateRoute as Tt, listFunctions as U, listEndpoints as V, listRepeatingSends as W, pollCliLogin as X, listWakeSchedules as Y, pullWebhookEvent as Z, getAccount as _, startAgentSignup as _t, createEndpoint as a, resendAgentSignupVerification as at, getConversation as b, testFunction as bt, createWakeAuthorization as c, searchEmails as ct, deleteContact as d, sendEmail as dt, putContact as et, deleteMemory as f, setFunctionRoute as ft, downloadEmailAttachmentPart as g, startAgentClaim as gt, deleteWakeSchedule as h, simulateRoute as ht, completeWebhookEvent as i, replyToEmail as it, getSentEmail as j, getOrgRoutingTopology as k, verifyAgentSignup as kt, createWakeSchedule as l, searchMemories as lt, deleteWakeAuthorization as m, setMemory as mt, checkDefaultNetworkContactAdmission as n, removeDefaultNetworkMember as nt, createFunction as o, runWakeSchedule as ot, deleteRoute as p, setFunctionSecret as pt, listWakeAuthorizations as q, cliLogout as r, reorderRoutes as rt, createRoute as s, sdk_gen_exports as st, addDefaultNetworkMember as t, redeemCreditCode as tt, deleteAgentContact as u, semanticSearch as ut, getAgentContactPolicy as v, startCliLogin as vt, getFunction as w, updateRepeatingSend as wt, getCreditBalance as x, unsetFunctionRoute as xt, getContact as y, stopRepeatFromEmail as yt, listDomains as z };