primcli 1.36.0 → 1.38.0

package/dist/signal-command-CKaEqXro.js

@@ -0,0 +1,4514 @@
+import { h as sendPreparedSignal, p as prepareSignalEmail } from "./repeats-CQmyvUGQ-CMnOmWgL.js";
+import { d as requireDefaultLoginProfile } from "./connected-agent-profile-8tpOMdq3.js";
+import { C as getEmail, K as listSentEmails, V as listEndpoints, a as createEndpoint, ct as searchEmails, dt as sendEmail, st as sdk_gen_exports } from "./sdk.gen-CugwPoCf.js";
+import { C as resolveCliAuth, S as normalizeApiBaseUrl, T as saveSignupCredentials, _ as deleteCliCredentials, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, i as loadCliConfig, j as PrimitiveApiClient, m as cliAccessTokenExpiresAt, p as acquireCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "./cli-config-UOlrfcPz.js";
+import { _ as acquireListenLock, a as mailLockBusy, b as listenProcessIdentity, c as mailTime, d as readMailJson, f as removeMailFile, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, n as invalidSharedMail, o as mailObject, p as syncMailDirectory, r as mailAddress, s as mailString, t as SharedMailStateError, v as compareListenProcessIdentity, y as listenIdentity } from "./shared-mail-files-CZqI1kj6.js";
+import { F as readBeforeDeadline, I as scopedChatSenderTrust, N as isPlainChatReply, S as recordSentSignal } from "./auto-signals-UPcJmV3j.js";
+import { Command, Errors, Flags } from "@oclif/core";
+import { opendirSync, readFileSync, watch, writeFileSync } from "node:fs";
+import { createHash, randomUUID, scryptSync } from "node:crypto";
+import { dirname, join } from "node:path";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+//#region src/oclif/api-client.ts
+const API_HEADERS_ENV = "PRIMITIVE_API_HEADERS";
+const OAUTH_REFRESH_SKEW_MS = 60 * 1e3;
+const SAVED_CLI_OAUTH_SESSION_EXPIRED_MESSAGE = "Saved Primitive CLI OAuth session expired or was revoked. Run `primitive signin` to authenticate again.";
+function mergeHeaders$1(...headers) {
+	const merged = {};
+	for (const headerSet of headers) {
+		if (!headerSet) continue;
+		for (const [name, value] of Object.entries(headerSet)) merged[name] = value;
+	}
+	return Object.keys(merged).length > 0 ? merged : void 0;
+}
+function parseHeadersJson(raw) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (error) {
+		const detail = error instanceof Error ? error.message : String(error);
+		throw new Errors.CLIError(`${API_HEADERS_ENV} must be valid JSON object syntax: ${detail}`, { exit: 1 });
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Errors.CLIError(`${API_HEADERS_ENV} must be a JSON object.`, { exit: 1 });
+	const headers = {};
+	for (const [rawName, rawValue] of Object.entries(parsed)) {
+		const name = validateCliHeaderName(rawName);
+		if (typeof rawValue !== "string") throw new Errors.CLIError(`${API_HEADERS_ENV}.${name} must be a string.`, { exit: 1 });
+		headers[name] = validateCliHeaderValue(rawValue, name);
+	}
+	return headers;
+}
+function cliApiHeadersFromEnv(env = process.env) {
+	const rawGenericHeaders = env[API_HEADERS_ENV]?.trim();
+	return rawGenericHeaders ? parseHeadersJson(rawGenericHeaders) : void 0;
+}
+function resolveCliApiRequestConfig(params) {
+	if ((params.env ?? process.env)["PRIMITIVE_AGENT_PROFILE"]?.trim()) {
+		const auth = resolveCliAuth(params);
+		return {
+			apiBaseUrl: auth.apiBaseUrl,
+			resolvedApiBaseUrl: auth.apiBaseUrl,
+			baseUrlOverridden: params.apiBaseUrl !== void 0,
+			environmentName: null
+		};
+	}
+	const currentEnvironment = resolveConfigEnvironment(loadCliConfig(params.configDir));
+	const configuredApiBaseUrl = currentEnvironment?.config.api_base_url;
+	if (currentEnvironment !== null && currentEnvironment.name !== "default" && params.apiBaseUrl === void 0 && configuredApiBaseUrl === void 0) throw new Errors.CLIError(`The active Primitive CLI environment \`${currentEnvironment.name}\` does not specify an api_base_url. Set one with \`primitive config set --environment ${currentEnvironment.name} --api-base-url https://...\`, or switch to a different environment with \`primitive config use <name>\`. Refusing to fall back to the production default for a non-default environment.`, { exit: 1 });
+	const apiBaseUrl = params.apiBaseUrl !== void 0 ? normalizeApiBaseUrl(params.apiBaseUrl) : configuredApiBaseUrl;
+	return {
+		apiBaseUrl,
+		baseUrlOverridden: apiBaseUrl !== void 0,
+		environmentName: currentEnvironment?.name ?? null,
+		headers: mergeHeaders$1(currentEnvironment?.config.headers, cliApiHeadersFromEnv(params.env)),
+		resolvedApiBaseUrl: normalizeApiBaseUrl(apiBaseUrl)
+	};
+}
+function createCliApiClient(params) {
+	const requestConfig = resolveCliApiRequestConfig(params);
+	return {
+		apiClient: new PrimitiveApiClient({
+			apiKey: params.apiKey,
+			apiBaseUrl: requestConfig.resolvedApiBaseUrl,
+			headers: requestConfig.headers
+		}),
+		requestConfig
+	};
+}
+function oauthTokenEndpoint(apiBaseUrl) {
+	const url = new URL(apiBaseUrl);
+	url.pathname = "/oauth/token";
+	url.search = "";
+	url.hash = "";
+	return url.toString();
+}
+function shouldRefresh(credentials, now) {
+	const expiresAt = Date.parse(credentials.expires_at);
+	if (!Number.isFinite(expiresAt)) return true;
+	return expiresAt <= now() + OAUTH_REFRESH_SKEW_MS;
+}
+function isOAuthRefreshSuccess(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const row = value;
+	return typeof row.access_token === "string" && typeof row.refresh_token === "string" && row.token_type === "Bearer" && typeof row.expires_in === "number" && Number.isFinite(row.expires_in) && row.expires_in > 0;
+}
+function oauthErrorCode(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const raw = value.error;
+	return typeof raw === "string" ? raw : null;
+}
+function oauthErrorDescription(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const raw = value.error_description;
+	return typeof raw === "string" && raw.trim() ? raw : null;
+}
+async function refreshStoredCliCredentials(params) {
+	const now = params.now ?? Date.now;
+	if (!shouldRefresh(params.credentials, now)) return params.credentials;
+	let releaseLock;
+	try {
+		if (!params.credentialsLockHeld) try {
+			releaseLock = acquireCliCredentialsLock(params.configDir);
+		} catch (error) {
+			const detail = error instanceof Error ? error.message : String(error);
+			throw new Errors.CLIError(detail, { exit: 1 });
+		}
+		const current = loadCliCredentials(params.configDir);
+		if (!current) throw new Errors.CLIError("Saved Primitive CLI OAuth session is no longer available. Run `primitive signin` to authenticate again.", { exit: 1 });
+		if (!shouldRefresh(current, now)) return current;
+		const fetchImpl = params.fetch ?? fetch;
+		const body = new URLSearchParams({
+			client_id: current.oauth_client_id,
+			grant_type: "refresh_token",
+			refresh_token: current.refresh_token
+		});
+		let response;
+		try {
+			response = await fetchImpl(oauthTokenEndpoint(params.apiBaseUrl), {
+				body,
+				headers: {
+					...params.headers ?? {},
+					"content-type": "application/x-www-form-urlencoded"
+				},
+				method: "POST"
+			});
+		} catch (error) {
+			const detail = error instanceof Error ? error.message : String(error);
+			throw new Errors.CLIError(`Could not refresh saved Primitive CLI OAuth credentials: ${detail}`, { exit: 1 });
+		}
+		const payload = await response.json().catch(() => null);
+		if (!response.ok) {
+			const code = oauthErrorCode(payload);
+			const description = oauthErrorDescription(payload);
+			if (code === "invalid_grant") {
+				deleteCliCredentials(params.configDir);
+				throw new Errors.CLIError(SAVED_CLI_OAUTH_SESSION_EXPIRED_MESSAGE, { exit: 1 });
+			}
+			throw new Errors.CLIError(`Could not refresh saved Primitive CLI OAuth credentials${description ? `: ${description}` : "."}`, { exit: 1 });
+		}
+		if (!isOAuthRefreshSuccess(payload)) throw new Errors.CLIError("Primitive OAuth token endpoint returned an unexpected refresh response.", { exit: 1 });
+		const next = {
+			...current,
+			access_token: payload.access_token,
+			expires_at: cliAccessTokenExpiresAt(payload.expires_in, now),
+			refresh_token: payload.refresh_token,
+			token_type: payload.token_type
+		};
+		saveCliCredentials(params.configDir, next);
+		return next;
+	} finally {
+		releaseLock?.();
+	}
+}
+async function createAuthenticatedCliApiClient(params) {
+	const requestConfig = resolveCliApiRequestConfig(params);
+	let auth = resolveCliAuth({
+		apiKey: params.apiKey,
+		apiBaseUrl: requestConfig.apiBaseUrl,
+		configDir: params.configDir,
+		env: params.env
+	});
+	if (auth.apiKey === void 0) {
+		const hint = detectPrimitiveKeyEnvMisname(params.env ?? process.env);
+		if (hint) process.stderr.write(`${hint}\n`);
+	}
+	if (auth.source === "stored" && auth.credentials) {
+		const refreshed = await refreshStoredCliCredentials({
+			apiBaseUrl: auth.apiBaseUrl,
+			configDir: params.configDir,
+			credentials: auth.credentials,
+			credentialsLockHeld: params.credentialsLockHeld,
+			fetch: params.fetch,
+			headers: requestConfig.headers,
+			now: params.now
+		});
+		auth = {
+			...auth,
+			apiKey: refreshed.access_token,
+			credentials: refreshed
+		};
+	}
+	return {
+		apiClient: new PrimitiveApiClient({
+			apiKey: auth.apiKey,
+			apiBaseUrl: auth.apiBaseUrl,
+			headers: auth.connectedAgent ? void 0 : requestConfig.headers
+		}),
+		auth,
+		baseUrlOverridden: requestConfig.baseUrlOverridden,
+		requestConfig
+	};
+}
+//#endregion
+//#region src/oclif/attachment-wait.ts
+/** Generated download commands that wait for attachment content by default. */
+const ATTACHMENT_WAIT_OPERATIONS = new Set([
+	"downloadAttachments",
+	"downloadEmailAttachmentPart",
+	"downloadSentAttachmentPart"
+]);
+/** Longest a download command waits for attachment content, in total. */
+const ATTACHMENT_WAIT_MAX_MS = 6e4;
+const INITIAL_DELAY_MS = 1e3;
+const MAX_DELAY_MS = 8e3;
+const ATTACHMENT_WAIT_FLAG_DESCRIPTION = `Wait and retry while the attachment content is not ready yet (attachment_not_ready), for up to ${ATTACHMENT_WAIT_MAX_MS / 1e3}s. Pass --no-wait to return the error immediately.`;
+/** Seconds from a Retry-After header, or undefined when absent or not a number of seconds. */
+function retryAfterMs(response) {
+	const header = response?.headers?.get("retry-after");
+	if (!header || !/^\d+$/.test(header.trim())) return void 0;
+	return Number(header.trim()) * 1e3;
+}
+/**
+* Delay before the next attempt: the server's Retry-After when it gives one,
+* otherwise exponential backoff from 1s, capped at 8s either way, and never
+* past the remaining budget.
+*/
+function nextAttachmentWaitDelay(attempt, remainingMs, serverHintMs) {
+	const backoff = INITIAL_DELAY_MS * 2 ** Math.min(attempt, 10);
+	return Math.max(0, Math.min(Math.min(serverHintMs ?? backoff, MAX_DELAY_MS), remainingMs));
+}
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+* Run `call` and, while it fails with attachment_not_ready, wait and run it
+* again until it succeeds, fails differently, or the budget is spent. The last
+* result is returned either way, so the caller reports it exactly as before.
+*/
+async function withAttachmentWait(call, options) {
+	const now = options.now ?? Date.now;
+	const sleep = options.sleep ?? defaultSleep;
+	const maxWaitMs = options.maxWaitMs ?? 6e4;
+	const started = now();
+	let result = await call();
+	for (let attempt = 0; options.wait; attempt++) {
+		if (!result.error || options.errorCode(result.error) !== "attachment_not_ready") break;
+		const remaining = maxWaitMs - (now() - started);
+		if (remaining <= 0) break;
+		if (attempt === 0) options.onFirstWait?.();
+		await sleep(nextAttachmentWaitDelay(attempt, remaining, retryAfterMs(result.response)));
+		result = await call();
+	}
+	return result;
+}
+//#endregion
+//#region src/oclif/automated-filter.ts
+/**
+* The server-side `automated` verdict on inbound email: `automated`
+* (boolean) and `automated_reasons` (why, in rule order), decided by
+* the API when the email arrives, and the `automated=true|false` filter
+* on GET /emails and GET /emails/search.
+*
+* A server that predates it either rejects the `automated` filter (GET
+* /emails validates its query strictly) or ignores it and returns rows
+* without the fields (GET /emails/search). Both must fail loudly: a CLI
+* that read a missing verdict as "not automated" would hand an agent
+* every bounce and newsletter as mail from a person, and one that fell
+* back to deciding it locally would re-read all unanswered automated
+* mail on every call.
+*/
+const AUTOMATED_FILTER_UNSUPPORTED_CODE = "automated_filter_unsupported";
+const AUTOMATED_VALUES = ["true", "false"];
+const AUTOMATED_FLAG_DESCRIPTION = "Only emails whose server-decided `automated` verdict is this value: `false` = sent by a person, `true` = bounces and delivery reports, auto-replies, list and newsletter mail, and mail from the address it was sent to. Fails if the server does not support the automated filter yet.";
+var AutomatedFilterUnsupportedError = class extends Error {
+	code = AUTOMATED_FILTER_UNSUPPORTED_CODE;
+	constructor(detail) {
+		super(`The server does not support the \`automated\` filter yet: ${detail} Nothing was treated as sent by a person. Upgrade to a server that returns \`automated\` and \`automated_reasons\`, or pass --include-automated.`);
+		this.name = "AutomatedFilterUnsupportedError";
+	}
+};
+/** Like AutomatedFilterUnsupportedError, for a probe that failed. */
+var AutomatedFilterUnverifiedError = class extends AutomatedFilterUnsupportedError {
+	constructor(detail) {
+		super(detail);
+		this.message = `Could not verify that the server supports the \`automated\` filter: ${detail} Nothing was treated as matching. Retry the command.`;
+		this.name = "AutomatedFilterUnverifiedError";
+		this.code = "automated_filter_unverified";
+	}
+};
+function hasAutomatedVerdict(row) {
+	if (row === null || typeof row !== "object") return false;
+	const candidate = row;
+	return typeof candidate.automated === "boolean" && Array.isArray(candidate.automated_reasons) && candidate.automated_reasons.every((reason) => typeof reason === "string");
+}
+/**
+* Throw unless every row carries the verdict, and, for each `expected`
+* value given, unless every row has that value: a server that accepted
+* the filter but did not apply it must not pass for one that did.
+*/
+function assertAutomatedVerdict(rows, surface, expected) {
+	const missing = rows.filter((row) => !hasAutomatedVerdict(row)).length;
+	if (missing > 0) throw new AutomatedFilterUnsupportedError(`${surface} returned ${missing} of ${rows.length} email${rows.length === 1 ? "" : "s"} without the \`automated\` and \`automated_reasons\` fields.`);
+	const verdicts = expected === void 0 ? [] : typeof expected === "boolean" ? [expected] : expected;
+	for (const verdict of verdicts) {
+		const wrong = rows.filter((row) => row.automated !== verdict).length;
+		if (wrong > 0) throw new AutomatedFilterUnsupportedError(`${surface} ignored \`automated=${verdict}\` and returned ${wrong} email${wrong === 1 ? "" : "s"} with \`automated=${!verdict}\`.`);
+	}
+}
+/**
+* The verdicts the `automated:` terms in a search DSL query require.
+* The DSL joins its terms with AND, so every `automated:true|false`
+* term must hold for every returned row. Quoted text is skipped, so a
+* phrase that merely contains "automated:false" does not count.
+*/
+function automatedVerdictsFromQuery(q) {
+	if (typeof q !== "string") return [];
+	const verdicts = [];
+	const tokens = q.match(/(?:[^\s"]|"(?:[^"\\]|\\.)*"?)+/g) ?? [];
+	for (const token of tokens) {
+		const match = /^automated:"?(true|false)"?$/i.exec(token);
+		if (match) verdicts.push(match[1].toLowerCase() === "true");
+	}
+	return verdicts;
+}
+/**
+* Every verdict a list or search call asked for: the `automated`
+* parameter plus any `automated:` terms in the search query.
+*/
+function expectedAutomatedVerdicts(automated, q) {
+	return [...automated === void 0 ? [] : [automated], ...automatedVerdictsFromQuery(q)];
+}
+/** True when a search DSL query uses the `automated:` term. */
+function queryUsesAutomated(q) {
+	return typeof q === "string" && /(^|[\s(])-?automated:/i.test(q);
+}
+function errorBody$1(payload) {
+	if (payload === null || typeof payload !== "object") return {};
+	const inner = payload.error;
+	return inner !== null && typeof inner === "object" ? inner : payload;
+}
+/**
+* True when an API error is an older server rejecting the `automated`
+* query parameter or the `automated:` search term as unknown.
+*/
+function isAutomatedRejectedError(payload) {
+	const body = errorBody$1(payload);
+	if (body.code !== "validation_error") return false;
+	const message = typeof body.message === "string" ? body.message : JSON.stringify(payload);
+	return /automated/i.test(message) && /unrecogni[sz]ed|unknown/i.test(message);
+}
+function automatedRejectedError(surface) {
+	return new AutomatedFilterUnsupportedError(`${surface} rejected the \`automated\` filter as unknown.`);
+}
+const AUTOMATED_SURFACES = {
+	listEmails: "GET /emails",
+	searchEmails: "GET /emails/search"
+};
+/**
+* For the generated `emails list` / `emails search` commands: the
+* surface name when this call filtered on `automated` (the parameter or
+* an `automated:` search term), else null.
+*/
+function automatedSurfaceForOperation(sdkName, query) {
+	const surface = AUTOMATED_SURFACES[sdkName];
+	if (!surface || !query) return null;
+	const q = typeof query.q === "string" ? query.q : void 0;
+	return query.automated !== void 0 || queryUsesAutomated(q) ? surface : null;
+}
+const searchSupportProbes$1 = /* @__PURE__ */ new WeakMap();
+/**
+* GET /emails/search ignores unknown parameters, so an empty page for
+* `automated=...` does not show that the server applied the filter.
+* Read one unfiltered row: if it lacks the verdict the server does not
+* support it. No rows at all means the mailbox is empty, so the empty
+* answer stands. One probe per API client per process.
+*/
+function ensureSearchReportsAutomated(apiClient) {
+	const key = apiClient;
+	let probe = searchSupportProbes$1.get(key);
+	if (!probe) {
+		probe = (async () => {
+			const result = await searchEmails({
+				client: apiClient.client,
+				query: {
+					limit: 1,
+					include_facets: "false",
+					snippet: "false"
+				},
+				responseStyle: "fields"
+			});
+			if (result.error) throw new AutomatedFilterUnverifiedError("the empty result could not be checked: reading one unfiltered row from GET /emails/search failed.");
+			const rows = result.data?.data;
+			assertAutomatedVerdict(rows ?? [], "GET /emails/search");
+		})();
+		searchSupportProbes$1.set(key, probe);
+		probe.catch(() => {
+			if (searchSupportProbes$1.get(key) === probe) searchSupportProbes$1.delete(key);
+		});
+	}
+	return probe;
+}
+//#endregion
+//#region src/oclif/endpoints-test-redirect.ts
+async function detectFunctionEndpoint(endpointId, listEndpoints) {
+	let response;
+	try {
+		response = await listEndpoints();
+	} catch {
+		return null;
+	}
+	if (response.error) return null;
+	const rows = response.data?.data;
+	if (!Array.isArray(rows)) return null;
+	for (const row of rows) {
+		if (!row || typeof row !== "object") continue;
+		if (row.id !== endpointId) continue;
+		if (row.kind !== "function") return null;
+		const functionId = row.function_id;
+		if (typeof functionId !== "string" || functionId.length === 0) return null;
+		return {
+			endpointId,
+			functionId
+		};
+	}
+	return null;
+}
+function formatFunctionEndpointRedirect(match) {
+	return [
+		"This is a function endpoint. Function endpoints are tested differently. Run:",
+		"",
+		`    primitive functions test --id ${match.functionId}`,
+		"",
+		`(pass the function id, not the endpoint id. endpoint_id=${match.endpointId} function_id=${match.functionId})`
+	].join("\n");
+}
+async function maybeWriteFunctionEndpointRedirect(inputs) {
+	if (inputs.sdkName !== "testEndpoint") return null;
+	if (inputs.errorCode !== "not_found") return null;
+	if (!inputs.endpointId) return null;
+	const match = await detectFunctionEndpoint(inputs.endpointId, inputs.listEndpoints);
+	if (!match) return null;
+	inputs.writeStderr(`${formatFunctionEndpointRedirect(match)}\n`);
+	return match;
+}
+//#endregion
+//#region src/oclif/idempotent-replay-banner.ts
+/**
+* If `data` carries `idempotent_replay: true`, write a stderr notice
+* that the message already went out and nothing new was sent.
+* Otherwise no-op.
+*
+* The notice deliberately gives no advice on how to force a fresh
+* copy. Whoever sees a replay has already sent this message; telling
+* them to vary the content is an instruction to double-send.
+*/
+function writeIdempotentReplayBannerIfReplay(data, options) {
+	if (!isReplay(data)) return;
+	options.write(`${formatAlreadySentNotice(data)}\n`);
+}
+function isReplay(data) {
+	if (data === null || typeof data !== "object") return false;
+	return data.idempotent_replay === true;
+}
+function formatAlreadySentNotice(sent) {
+	const details = [];
+	if (typeof sent.id === "string" && sent.id) details.push(`sent id ${sent.id}`);
+	const status = typeof sent.status === "string" && sent.status ? sent.status : null;
+	const deliveryStatus = typeof sent.delivery_status === "string" && sent.delivery_status ? sent.delivery_status : null;
+	if (status) details.push(`status ${status}`);
+	if (deliveryStatus && deliveryStatus !== status) details.push(`delivery status ${deliveryStatus}`);
+	return `Already sent: this exact message went out earlier${details.length > 0 ? ` (${details.join(", ")})` : ""}. Nothing new was sent.`;
+}
+//#endregion
+//#region src/oclif/reply-state.ts
+const AWAITING_VALUES = ["you", "them"];
+const AWAITING_FLAG_DESCRIPTION = "Only emails whose reply state is this value: `you` = waiting on your reply (the thread's latest message is inbound), `them` = you replied last. Queued and scheduled replies count as replied. Delivered mail only: rejected mail is never returned. Fails if the server does not report reply state yet.";
+const REPLY_STATE_UNSUPPORTED_CODE = "reply_state_unsupported";
+/** True when a search DSL query uses the `awaiting:` term. */
+function queryUsesAwaiting(q) {
+	return typeof q === "string" && /(^|[\s(])-?awaiting:/i.test(q);
+}
+var ReplyStateUnsupportedError = class extends Error {
+	code = REPLY_STATE_UNSUPPORTED_CODE;
+	constructor(detail) {
+		super(`The server does not support reply state yet: ${detail} Nothing was treated as awaiting your reply. Upgrade to a server that returns \`awaiting\` and \`reply_count\`, or run without reply-state options.`);
+		this.name = "ReplyStateUnsupportedError";
+	}
+};
+/**
+* The server's reply-state support could not be established (a probe
+* failed). Reported like ReplyStateUnsupportedError so callers never
+* read an unverified empty answer as "nothing matched".
+*/
+var ReplyStateUnverifiedError = class extends ReplyStateUnsupportedError {
+	constructor(detail) {
+		super(detail);
+		this.message = `Could not verify that the server supports reply state: ${detail} Nothing was treated as matching. Retry the command.`;
+		this.name = "ReplyStateUnverifiedError";
+		this.code = "reply_state_unverified";
+	}
+};
+function hasReplyState(row) {
+	if (row === null || typeof row !== "object") return false;
+	const candidate = row;
+	return (candidate.awaiting === "you" || candidate.awaiting === "them") && typeof candidate.reply_count === "number" && (candidate.last_replied_at === null || typeof candidate.last_replied_at === "string");
+}
+/**
+* Throw unless every row carries reply state. An empty page proves
+* nothing either way; callers that asked for reply state follow an
+* empty search page with ensureSearchReportsReplyState(). `surface` names the
+* response for the error, e.g. "GET /emails".
+*/
+function assertReplyState(rows, surface) {
+	const missing = rows.filter((row) => !hasReplyState(row)).length;
+	if (missing > 0) throw new ReplyStateUnsupportedError(`${surface} returned ${missing} of ${rows.length} email${rows.length === 1 ? "" : "s"} without the \`awaiting\` and \`reply_count\` fields.`);
+}
+const AWAITING_REJECTED_UNSUPPORTED_CODE = "awaiting_rejected_unsupported";
+/**
+* The `awaiting` filter matches delivered mail only: a rejected email
+* (for example refused over the storage limit) was never delivered, so it
+* awaits no one. A server that returns one through the filter predates
+* that, and an agent would be handed mail nobody can answer.
+*/
+var AwaitingIncludesRejectedError = class extends ReplyStateUnsupportedError {
+	constructor(detail) {
+		super(detail);
+		this.message = `The server's \`awaiting\` filter does not exclude undelivered mail yet: ${detail} Upgrade to a server whose \`awaiting\` filter matches delivered mail only.`;
+		this.name = "AwaitingIncludesRejectedError";
+		this.code = AWAITING_REJECTED_UNSUPPORTED_CODE;
+	}
+};
+/**
+* For rows returned BY an `awaiting` filter (not the unfiltered probe):
+* every row carries reply state, and none has status `rejected`.
+*/
+function assertAwaitingFilterRows(rows, surface) {
+	assertReplyState(rows, surface);
+	const rejected = rows.filter((row) => row !== null && typeof row === "object" && row.status === "rejected").length;
+	if (rejected > 0) throw new AwaitingIncludesRejectedError(`${surface} returned ${rejected} email${rejected === 1 ? "" : "s"} with status \`rejected\`.`);
+}
+function errorBody(payload) {
+	if (payload === null || typeof payload !== "object") return {};
+	const inner = payload.error;
+	return inner !== null && typeof inner === "object" ? inner : payload;
+}
+/**
+* True when an API error is an older server rejecting the `awaiting`
+* query parameter or the `awaiting:` search term as unknown. A current
+* server accepts both, and the CLI only ever sends valid values.
+*/
+function isAwaitingRejectedError(payload) {
+	const body = errorBody(payload);
+	if (body.code !== "validation_error") return false;
+	const message = typeof body.message === "string" ? body.message : JSON.stringify(payload);
+	return /awaiting/i.test(message) && /unrecogni[sz]ed|unknown/i.test(message);
+}
+function awaitingRejectedError(surface) {
+	return new ReplyStateUnsupportedError(`${surface} rejected the \`awaiting\` filter as unknown.`);
+}
+/** Short column value for tables: "you", "them", or "-" when absent. */
+function formatAwaitingCell(row) {
+	if (!hasReplyState(row)) return "-";
+	return row.awaiting;
+}
+/** Reply count for tables, or "-" when the server did not report it. */
+function formatRepliesCell(row) {
+	if (!hasReplyState(row)) return "-";
+	return String(row.reply_count);
+}
+const REPLY_STATE_SURFACES = {
+	listEmails: "GET /emails",
+	searchEmails: "GET /emails/search"
+};
+/**
+* For the generated `emails list` / `emails search` commands: the
+* surface name when this call asked for reply state (an `awaiting`
+* parameter or an `awaiting:` search term), else null.
+*/
+function replyStateSurfaceForOperation(sdkName, query) {
+	const surface = REPLY_STATE_SURFACES[sdkName];
+	if (!surface || !query) return null;
+	const q = typeof query.q === "string" ? query.q : void 0;
+	return query.awaiting !== void 0 || queryUsesAwaiting(q) ? surface : null;
+}
+const searchSupportProbes = /* @__PURE__ */ new WeakMap();
+/**
+* GET /emails/search ignores unknown parameters, so an empty page for
+* `awaiting=...` does not show that the server applied the filter.
+* Read one unfiltered row: if it lacks reply state the server does not
+* support it and this throws ReplyStateUnsupportedError. No rows at all
+* means the mailbox is empty, so the empty answer stands.
+*/
+function ensureSearchReportsReplyState(apiClient) {
+	const key = apiClient;
+	let probe = searchSupportProbes.get(key);
+	if (!probe) {
+		probe = (async () => {
+			const result = await searchEmails({
+				client: apiClient.client,
+				query: {
+					limit: 1,
+					include_facets: "false",
+					snippet: "false"
+				},
+				responseStyle: "fields"
+			});
+			if (result.error) throw new ReplyStateUnverifiedError("the empty result could not be checked: reading one unfiltered row from GET /emails/search failed.");
+			const rows = result.data?.data;
+			assertReplyState(rows ?? [], "GET /emails/search");
+		})();
+		searchSupportProbes.set(key, probe);
+		probe.catch(() => {
+			if (searchSupportProbes.get(key) === probe) searchSupportProbes.delete(key);
+		});
+	}
+	return probe;
+}
+//#endregion
+//#region src/oclif/api-command.ts
+const API_ERROR_CODES = {
+	accessDenied: "access_denied",
+	authorizationPending: "authorization_pending",
+	expiredToken: "expired_token",
+	invalidDeviceCode: "invalid_device_code",
+	notFound: "not_found",
+	slowDown: "slow_down",
+	unauthorized: "unauthorized"
+};
+function flagName(parameterName) {
+	return parameterName.replace(/_/g, "-");
+}
+function flagDescription(parameter) {
+	return parameter.description ?? parameter.name;
+}
+const numberFlag = Flags.custom({ async parse(input, _context, options) {
+	const trimmed = input.trim();
+	if (trimmed === "") throw new Errors.CLIError(`Expected a number but received: ${input}`);
+	const value = Number(trimmed);
+	if (!Number.isFinite(value)) throw new Errors.CLIError(`Expected a number but received: ${input}`);
+	if (options.min !== void 0 && value < options.min) throw new Errors.CLIError(`Expected a number greater than or equal to ${options.min} but received: ${input}`);
+	if (options.max !== void 0 && value > options.max) throw new Errors.CLIError(`Expected a number less than or equal to ${options.max} but received: ${input}`);
+	return value;
+} });
+function numericFlagOptions(parameter) {
+	return {
+		...typeof parameter.default === "number" ? { default: parameter.default } : {},
+		...typeof parameter.maximum === "number" ? { max: parameter.maximum } : {},
+		...typeof parameter.minimum === "number" ? { min: parameter.minimum } : {}
+	};
+}
+function extractBodyFields(schema) {
+	if (!schema || typeof schema !== "object") return [];
+	const properties = schema.properties;
+	if (!properties || typeof properties !== "object") return [];
+	const requiredArr = Array.isArray(schema.required) ? schema.required.filter((k) => typeof k === "string") : [];
+	const required = new Set(requiredArr);
+	const fields = [];
+	for (const [name, raw] of Object.entries(properties)) {
+		const propSchema = raw && typeof raw === "object" ? raw : {};
+		const t = propSchema.type;
+		let displayType = "any";
+		let kind = "complex";
+		if (typeof t === "string") {
+			displayType = t;
+			if (t === "string") kind = "string";
+			else if (t === "integer") kind = "integer";
+			else if (t === "number") kind = "number";
+			else if (t === "boolean") kind = "boolean";
+			else if (t === "array") {
+				const items = propSchema.items;
+				if (items && typeof items === "object") {
+					const itemType = items.type;
+					if (typeof itemType === "string") displayType = `array<${itemType}>`;
+				}
+				kind = "complex";
+			} else kind = "complex";
+		} else if (Array.isArray(t)) {
+			const nonNull = t.filter((s) => s !== "null");
+			if (nonNull.length === 1) {
+				const single = nonNull[0];
+				displayType = `${single}?`;
+				if (single === "string") kind = "string";
+				else if (single === "integer") kind = "integer";
+				else if (single === "number") kind = "number";
+				else if (single === "boolean") kind = "boolean";
+				else kind = "complex";
+			} else {
+				displayType = nonNull.join("|");
+				kind = "complex";
+			}
+		}
+		const description = typeof propSchema.description === "string" ? propSchema.description.split(/\n\s*\n/)[0].replace(/\s*\n\s*/g, " ").trim() : "";
+		const enumRaw = propSchema.enum;
+		const enumValues = kind === "string" && Array.isArray(enumRaw) ? enumRaw.filter((e) => typeof e === "string") : void 0;
+		fields.push({
+			name,
+			description,
+			required: required.has(name),
+			displayType,
+			kind,
+			...enumValues && enumValues.length > 0 ? { enumValues } : {},
+			...typeof propSchema.maximum === "number" ? { maximum: propSchema.maximum } : {},
+			...typeof propSchema.minimum === "number" ? { minimum: propSchema.minimum } : {}
+		});
+	}
+	return fields.sort((a, b) => {
+		if (a.required !== b.required) return a.required ? -1 : 1;
+		return a.name.localeCompare(b.name);
+	});
+}
+/**
+* Render a "Body fields" summary for the per-command help.
+*
+* Most scalar fields are exposed as individual `--flag` flags,
+* which oclif auto-renders in the FLAGS section above. To avoid
+* duplicating that, the summary here only documents fields that
+* MUST go through `--raw-body` (complex types: arrays, objects,
+* mixed-non-nullable). When an operation has only scalars, the
+* summary is omitted entirely and oclif's FLAGS section is the
+* full story.
+*
+* For operations with mixed scalar and complex fields, we also
+* include a short header pointing the agent at the flag form so
+* the natural reading is "use the flags above; --raw-body for
+* the leftovers below."
+*/
+function renderRequestSchemaSummary(schema) {
+	const fields = extractBodyFields(schema);
+	if (fields.length === 0) return null;
+	const complex = fields.filter((f) => f.kind === "complex");
+	if (complex.length === 0) return null;
+	const nameWidth = Math.min(24, Math.max(...complex.map((f) => f.name.length)));
+	const descMax = 78;
+	const lines = ["Body fields requiring --raw-body JSON (these are not exposed as flags):"];
+	for (const f of complex) {
+		const marker = f.required ? " *" : "  ";
+		const padName = f.name.padEnd(nameWidth);
+		const trimmedDesc = f.description.length > descMax ? `${f.description.slice(0, descMax - 3)}...` : f.description;
+		const desc = trimmedDesc ? `  ${trimmedDesc}` : "";
+		lines.push(`${marker} ${padName}  ${f.displayType}${desc}`);
+	}
+	lines.push("(* = required. Scalar body fields are exposed as individual --flag-name flags; see FLAGS above.)");
+	return lines.join("\n");
+}
+function flagForParameter(parameter) {
+	const common = {
+		description: flagDescription(parameter),
+		required: parameter.required
+	};
+	if (parameter.type === "boolean") return Flags.boolean(common);
+	if (parameter.type === "integer") return Flags.integer({
+		...common,
+		...numericFlagOptions(parameter)
+	});
+	if (parameter.type === "number") return numberFlag({
+		...common,
+		...numericFlagOptions(parameter)
+	});
+	if (parameter.enum && parameter.enum.length > 0) return Flags.string({
+		...common,
+		options: parameter.enum
+	});
+	return Flags.string(common);
+}
+function coerceParameterValue(parameter, value) {
+	if (value === void 0) return;
+	if (parameter.type === "number") {
+		if (typeof value === "number") return value;
+		const parsed = Number(value);
+		if (Number.isNaN(parsed)) throw new Errors.CLIError(`Invalid number for --${parameter.name}: ${value}`);
+		return parsed;
+	}
+	if (typeof value === "boolean" || typeof value === "number" || typeof value === "string") return value;
+	throw new Errors.CLIError(`Unsupported flag value for --${parameter.name}`);
+}
+function cliError(message) {
+	return new Errors.CLIError(message, { exit: 1 });
+}
+function parseJson(source, flagLabel) {
+	try {
+		return JSON.parse(source);
+	} catch (error) {
+		throw cliError(`${flagLabel} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+function readJsonBody(flags) {
+	const bodyFile = flags["body-file"];
+	const rawBody = flags["raw-body"];
+	if (bodyFile && rawBody) throw cliError("Use either --raw-body or --body-file, not both");
+	if (typeof bodyFile === "string") {
+		let contents;
+		try {
+			contents = readFileSync(bodyFile, "utf8");
+		} catch (error) {
+			throw cliError(`Could not read --body-file ${bodyFile}: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		return parseJson(contents, `--body-file ${bodyFile}`);
+	}
+	if (typeof rawBody === "string") return parseJson(rawBody, "--raw-body");
+}
+function readTextFileFlag(path, flagLabel) {
+	try {
+		return readFileSync(path, "utf8");
+	} catch (error) {
+		throw cliError(`Could not read ${flagLabel} ${path}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+function extractErrorPayload(raw) {
+	if (raw && typeof raw === "object" && !(raw instanceof Error) && "error" in raw) {
+		const inner = raw.error;
+		if (inner !== null && inner !== void 0) return inner;
+	}
+	return raw;
+}
+function extractCauseDetails(cause) {
+	const details = {};
+	let code;
+	if (!cause || typeof cause !== "object") return { details };
+	for (const [key, value] of Object.entries(cause)) if (typeof value === "string" || typeof value === "number") {
+		details[key] = value;
+		if (key === "code" && typeof value === "string") code = value;
+	}
+	return {
+		code,
+		details
+	};
+}
+function formatErrorPayload(payload) {
+	if (payload instanceof Error) {
+		const { code, details } = extractCauseDetails(payload.cause);
+		const body = {
+			code: code ?? "client_error",
+			message: payload.message || payload.name || String(payload)
+		};
+		if (Object.keys(details).length > 0) body.cause = details;
+		return JSON.stringify(body, null, 2);
+	}
+	return JSON.stringify(payload, null, 2);
+}
+function extractErrorCode(payload) {
+	if (payload instanceof Error) {
+		const { code } = extractCauseDetails(payload.cause);
+		return code;
+	}
+	if (payload && typeof payload === "object") {
+		const inner = payload.error;
+		if (inner && typeof inner === "object" && typeof inner.code === "string") return inner.code;
+		const direct = payload.code;
+		if (typeof direct === "string") return direct;
+	}
+}
+const ERROR_CODE_HINTS = { [API_ERROR_CODES.unauthorized]: "Hint: run `primitive signin`, pass --api-key explicitly, or set PRIMITIVE_API_KEY in your environment. `primitive whoami` is the fastest way to verify auth is live." };
+const NETWORK_ERROR_HINTS = {
+	ENETUNREACH: "Hint: the network is unreachable. If you're behind a proxy and set HTTP(S)_PROXY, re-run with NODE_USE_ENV_PROXY=1 (Node 22+ ignores those env vars by default). `primitive doctor` reports the local environment in one shot.",
+	ECONNREFUSED: "Hint: the server refused the connection. Check that your firewall allows egress to *.primitive.dev, that your PRIMITIVE_API_BASE_URL_* overrides (if any) point at a reachable host, and re-run with NODE_USE_ENV_PROXY=1 if you're behind a proxy. `primitive doctor` reports the local environment in one shot.",
+	ETIMEDOUT: "Hint: the connection timed out. Check egress rules and proxy configuration; if you're behind a proxy, re-run with NODE_USE_ENV_PROXY=1 and HTTPS_PROXY set. `primitive doctor` reports the local environment in one shot.",
+	EAI_AGAIN: "Hint: DNS lookup failed. Check /etc/resolv.conf inside containers, and try `curl -v https://api.primitive.dev/v1/account` to confirm the host resolves. `primitive doctor` reports the local environment in one shot."
+};
+function writeErrorWithHints(payload) {
+	process.stderr.write(`${formatErrorPayload(payload)}\n`);
+	const code = extractErrorCode(payload);
+	if (!code) return;
+	if (code in ERROR_CODE_HINTS) {
+		const hint = ERROR_CODE_HINTS[code];
+		process.stderr.write(`${hint}\n`);
+		return;
+	}
+	if (code in NETWORK_ERROR_HINTS) process.stderr.write(`${NETWORK_ERROR_HINTS[code]}\n`);
+}
+/**
+* Surface a user-facing hint when a request comes back unauthorized.
+*
+* Deliberately does NOT mutate the saved credentials.json. Auto-
+* deleting on any 401 made transient rejections look like permanent
+* credential failures and forced unnecessary re-login cycles; we
+* surface a hint and let the user decide whether to re-authenticate.
+*
+* The one legitimate auto-delete case lives in `primitive login`'s
+* `checkExistingLogin`: the user has explicitly asked to log in,
+* existing credentials are probed, and if they fail we clean up
+* before minting a new key. That path calls `deleteCliCredentials`
+* directly rather than going through this function.
+*/
+function surfaceUnauthorizedHint(params) {
+	if (extractErrorCode(params.payload) !== API_ERROR_CODES.unauthorized || params.auth.source !== "stored") return;
+	if (params.baseUrlOverridden && params.auth.credentials !== null && params.auth.apiBaseUrl !== params.auth.credentials.api_base_url) {
+		process.stderr.write("Saved Primitive CLI credentials were rejected by the overridden API base URL. The saved credential is preserved; unset PRIMITIVE_API_BASE_URL, run `primitive config reset` to clear configured URL overrides, or run `primitive logout` to remove the stored credential.\n");
+		return;
+	}
+	process.stderr.write("Your saved Primitive CLI OAuth session was rejected. If the command was working a moment ago, please retry; brief retries often clear transient rejections. If it keeps failing, run `primitive logout && primitive signin` to mint a fresh session.\n");
+}
+function formatElapsed(ms) {
+	const seconds = ms / 1e3;
+	if (seconds < 60) return `${seconds.toFixed(2)}s`;
+	const minutes = Math.floor(seconds / 60);
+	return `${minutes}m ${(seconds - minutes * 60).toFixed(2)}s`;
+}
+async function runWithTiming(enabled, fn) {
+	if (!enabled) return fn();
+	const start = Date.now();
+	try {
+		return await fn();
+	} finally {
+		process.stderr.write(`[time: ${formatElapsed(Date.now() - start)}]\n`);
+	}
+}
+const TIME_FLAG_DESCRIPTION = "Print the wall-clock duration of this command to stderr after it completes (e.g. `[time: 1.34s]`). Useful for measuring `--wait` send latency, comparing CLI overhead, or capturing timing in scripts.";
+const API_BASE_URL_FLAG_DESCRIPTION = "Override the API base URL. Internal testing only; not documented to customers.";
+const RESERVED_FLAG_NAMES = new Set([
+	"api-key",
+	"api-base-url",
+	"raw-body",
+	"body-file",
+	"envelope",
+	"output"
+]);
+function bodyFieldFlag(field, aliases) {
+	const common = {
+		description: field.description || field.name,
+		...aliases && aliases.length > 0 ? { aliases } : {}
+	};
+	if (field.kind === "boolean") return Flags.boolean({
+		...common,
+		allowNo: true
+	});
+	if (field.kind === "integer") return Flags.integer({
+		...common,
+		...numericFlagOptions(field)
+	});
+	if (field.kind === "number") return numberFlag({
+		...common,
+		...numericFlagOptions(field)
+	});
+	if (field.enumValues) return Flags.string({
+		...common,
+		options: field.enumValues
+	});
+	return Flags.string(common);
+}
+function buildFlags(operation) {
+	const flags = {
+		"api-key": Flags.string({
+			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
+			env: "PRIMITIVE_API_KEY"
+		}),
+		"api-base-url": Flags.string({
+			description: "Override the API base URL. Internal testing only; not documented to customers.",
+			env: "PRIMITIVE_API_BASE_URL",
+			hidden: true
+		}),
+		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
+	};
+	if (!operation.binaryResponse) {
+		flags.json = Flags.boolean({ description: "Print exactly one JSON document on stdout, on success and on failure, and nothing on stderr. Stdout keeps its usual shape: the data payload, or with --envelope the full response envelope (data plus meta, including meta.cursor, and empty-result hints in summary). The next-cursor line is not printed; use --envelope to page. A failure prints the error with exit_code. Without --json, the cursor and notices go to stderr." });
+		flags.envelope = Flags.boolean({ description: "Print the full response envelope, including pagination metadata such as meta.cursor. Defaults to printing only the data payload for backward compatibility." });
+	}
+	for (const parameter of [...operation.pathParams, ...operation.queryParams]) flags[flagName(parameter.name)] = flagForParameter(parameter);
+	const bodyFieldFlagToProperty = /* @__PURE__ */ new Map();
+	if (operation.hasJsonBody) {
+		flags["raw-body"] = Flags.string({ description: "Full request body as raw JSON. Escape hatch for nested or complex fields (e.g. arrays); prefer per-field flags (e.g. --to, --from, --body-text) when available." });
+		flags["body-file"] = Flags.string({ description: "Path to a JSON file used as the request body. Same role as --raw-body for callers passing a saved payload." });
+		const bodyFields = extractBodyFields(operation.requestSchema);
+		const aliasesForOperation = OPERATION_FLAG_ALIASES[operation.sdkName];
+		for (const field of bodyFields) {
+			if (field.kind === "complex") continue;
+			const name = flagName(field.name);
+			if (RESERVED_FLAG_NAMES.has(name)) continue;
+			if (flags[name] !== void 0) continue;
+			flags[name] = bodyFieldFlag(field, aliasesForOperation?.[field.name]);
+			bodyFieldFlagToProperty.set(name, field.name);
+		}
+	}
+	if (operation.binaryResponse) flags.output = Flags.string({ description: "Write binary response bytes to a file" });
+	if (ATTACHMENT_WAIT_OPERATIONS.has(operation.sdkName)) flags.wait = Flags.boolean({
+		allowNo: true,
+		default: true,
+		description: ATTACHMENT_WAIT_FLAG_DESCRIPTION
+	});
+	return {
+		flags,
+		bodyFieldFlagToProperty
+	};
+}
+function collectBodyFieldFlags(parsedFlags, bodyFieldFlagToProperty) {
+	const result = {};
+	for (const [flag, property] of bodyFieldFlagToProperty) {
+		const value = parsedFlags[flag];
+		if (value === void 0) continue;
+		result[property] = value;
+	}
+	return result;
+}
+function collectValues(parameters, flags) {
+	const values = {};
+	for (const parameter of parameters) {
+		const value = coerceParameterValue(parameter, flags[flagName(parameter.name)]);
+		if (value !== void 0) values[parameter.name] = value;
+	}
+	return values;
+}
+function operationOutputPayload(envelope, includeEnvelope) {
+	return includeEnvelope ? envelope ?? null : envelope?.data ?? null;
+}
+/**
+* The `--json` document for a generated command: the full response
+* envelope, so pagination metadata travels with the data, plus any
+* notes the command would otherwise print on stderr.
+*/
+function operationJsonDocument(envelope, summary = []) {
+	const document = envelope !== null && typeof envelope === "object" ? { ...envelope } : { data: null };
+	if (summary.length > 0) document.summary = summary.join("\n");
+	return document;
+}
+function isIncompleteDomainVerification(operation, envelope) {
+	if (operation.sdkName !== "verifyDomain") return false;
+	const data = envelope?.data;
+	if (!data || typeof data !== "object") return false;
+	return data.verified === false;
+}
+function writeIncompleteDomainVerificationHint() {
+	process.stderr.write("Domain verification is incomplete. Add or fix the DNS records shown above, or run `primitive domains zone-file --id <domain-id>` to download the complete zone file, then retry `primitive domains verify --id <domain-id>`.\n");
+}
+const OPERATION_HINTS = {
+	addDomain: "Tip: after this returns a domain id, run `primitive domains zone-file --id <domain-id> --output <domain>.zone` when the user wants an importable DNS zone file.",
+	verifyDomain: "Tip: if DNS is still missing, run `primitive domains zone-file --id <domain-id> --output <domain>.zone` to give the user an importable DNS zone file.",
+	downloadDomainZoneFile: "Tip: prefer `primitive domains zone-file --id <domain-id> --output <domain>.zone` for CLI-friendly file output.",
+	getInboxStatus: "Tip: prefer `primitive inbox status` for a compact readiness summary and next-step commands.",
+	getSendPermissions: "Tip: this command answers where you may send mail to. To find usable sender domains for --from, run `primitive domains list` or `primitive inbox status` and use an address at an active verified domain.",
+	sendEmail: "Tip: prefer `primitive send --to <address> --body <text> --attachment <file>` for file attachments. This raw command exists for callers passing JSON.",
+	createFunction: "Tip: prefer `primitive functions deploy --name <name> --file <bundle>` for file-input ergonomics. This raw command exists for callers passing JSON.",
+	updateFunction: "Tip: prefer `primitive functions redeploy --id <id> --file <bundle>` for file-input ergonomics. This raw command exists for callers passing JSON.",
+	createFunctionSecret: "Tip: prefer `primitive functions set-secret --id <id> --key <KEY> --value <value> [--redeploy]` for secret writes that also push the binding live. This raw command exists for callers passing JSON.",
+	setFunctionSecret: "Tip: prefer `primitive functions set-secret --id <id> --key <KEY> --value <value> [--redeploy]` for secret writes that also push the binding live. This raw command exists for callers passing JSON.",
+	setMemory: "Tip: prefer `primitive memories set <key> <json-value> [--function <function-id>]` for JSON value parsing and scope flags. This raw command exists for callers passing full request JSON.",
+	getMemory: "Tip: prefer `primitive memories get <key> [--function <function-id>]` for the common read path.",
+	deleteMemory: "Tip: prefer `primitive memories delete <key> [--function <function-id>]` for the common delete path.",
+	searchMemories: "Tip: prefer `primitive memories search [prefix] [--metadata-only] [--function <function-id>]` for the common search path.",
+	startAgentSignup: "Tip: pass --terms-accepted, and optionally --signup-code <code> if you have one. Capture the signup_token from the response and feed it to `primitive agent verify-agent-signup --signup-token <token> --verification-code <6-digit-code>` (the verify flag accepts --code as an alias). The high-level `primitive signup <email>` command walks an interactive user through both steps with friendlier prompts.",
+	verifyAgentSignup: "Tip: pass --verification-code <code> (or --code; both work). The response carries OAuth tokens but not your assigned inbox domain; run `primitive domains list` (or `primitive whoami`) after success to see the managed *.primitive.email address that routes to this account."
+};
+const OPERATION_FLAG_ALIASES = { verifyAgentSignup: { verification_code: ["code"] } };
+const OPERATION_SUCCESS_HOOKS = { verifyAgentSignup: ({ envelope, configDir, apiBaseUrl, writeStderr }) => {
+	const data = envelope?.data;
+	if (!data?.access_token || !data?.refresh_token) return;
+	saveSignupCredentials({
+		apiBaseUrl,
+		configDir,
+		signup: data
+	});
+	writeStderr("Credentials saved to the CLI config; `primitive whoami` will work on the next call.\n");
+} };
+function createOperationCommand(operation) {
+	const { flags, bodyFieldFlagToProperty } = buildFlags(operation);
+	const baseDescription = operation.description !== null && operation.description !== void 0 ? canonicalizeCliReferences(operation.description) : `${operation.method} ${operation.path}`;
+	const schemaSummary = operation.hasJsonBody ? renderRequestSchemaSummary(operation.requestSchema) : null;
+	const hint = OPERATION_HINTS[operation.sdkName];
+	const descriptionWithSchema = schemaSummary ? `${baseDescription}\n\n${schemaSummary}` : baseDescription;
+	const fullDescription = hint ? `${descriptionWithSchema}\n\n${hint}` : descriptionWithSchema;
+	class OperationCommand extends Command {
+		static description = fullDescription;
+		static flags = flags;
+		static summary = operation.summary ?? `${operation.method} ${operation.path}`;
+		async run() {
+			const { flags } = await this.parse(OperationCommand);
+			const parsedFlags = flags;
+			if ([
+				"startAgentSignup",
+				"verifyAgentSignup",
+				"resendAgentSignupVerification"
+			].includes(operation.operationId)) requireDefaultLoginProfile();
+			await runWithTiming(parsedFlags.time === true, async () => {
+				const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
+					apiKey: typeof parsedFlags["api-key"] === "string" ? parsedFlags["api-key"] : void 0,
+					apiBaseUrl: typeof parsedFlags["api-base-url"] === "string" ? parsedFlags["api-base-url"] : void 0,
+					configDir: this.config.configDir
+				});
+				let body;
+				if (operation.hasJsonBody) {
+					const explicit = readJsonBody(parsedFlags);
+					const overrides = collectBodyFieldFlags(parsedFlags, bodyFieldFlagToProperty);
+					if (Object.keys(overrides).length > 0) if (explicit === void 0) body = overrides;
+					else if (explicit !== null && typeof explicit === "object" && !Array.isArray(explicit)) body = {
+						...explicit,
+						...overrides
+					};
+					else {
+						const explicitKind = explicit === null ? "null" : Array.isArray(explicit) ? "array" : typeof explicit;
+						const overrideFlags = Object.keys(overrides).map((p) => `--${flagName(p)}`).join(", ");
+						throw new Errors.CLIError(`--raw-body must be a JSON object when also passing per-field flags (got ${explicitKind}); supplied per-field flags: ${overrideFlags}. Either drop --raw-body and rely on the per-field flags, or move every field into the JSON --raw-body and drop the flags.`);
+					}
+					else body = explicit;
+				}
+				if (operation.bodyRequired && body === void 0) throw new Errors.CLIError(`Operation ${operation.operationId} requires a body. Pass each field as a --flag (see --help) or supply JSON via --raw-body / --body-file.`);
+				const operationFn = sdk_gen_exports[operation.sdkName];
+				const query = collectValues(operation.queryParams, parsedFlags);
+				const replyStateSurface = replyStateSurfaceForOperation(operation.sdkName, query);
+				const automatedSurface = automatedSurfaceForOperation(operation.sdkName, query);
+				const callOperation = () => operationFn({
+					body,
+					client: apiClient.client,
+					parseAs: operation.binaryResponse ? "blob" : "auto",
+					path: collectValues(operation.pathParams, parsedFlags),
+					query,
+					responseStyle: "fields"
+				});
+				const result = ATTACHMENT_WAIT_OPERATIONS.has(operation.sdkName) ? await withAttachmentWait(callOperation, {
+					wait: parsedFlags.wait !== false,
+					errorCode: (error) => extractErrorCode(extractErrorPayload(error)),
+					onFirstWait: () => {
+						process.stderr.write(`Attachment content is not ready yet; waiting up to ${ATTACHMENT_WAIT_MAX_MS / 1e3}s. Pass --no-wait to return immediately.\n`);
+					}
+				}) : await callOperation();
+				if (result.error) {
+					const errorPayload = extractErrorPayload(result.error);
+					writeErrorWithHints(errorPayload);
+					if (replyStateSurface && isAwaitingRejectedError(errorPayload)) process.stderr.write(`${awaitingRejectedError(replyStateSurface).message}\n`);
+					if (automatedSurface && isAutomatedRejectedError(errorPayload)) process.stderr.write(`${automatedRejectedError(automatedSurface).message}\n`);
+					surfaceUnauthorizedHint({
+						auth,
+						baseUrlOverridden,
+						configDir: this.config.configDir,
+						payload: errorPayload
+					});
+					const listClient = apiClient.client;
+					const listEndpointsFn = () => listEndpoints({
+						client: listClient,
+						responseStyle: "fields"
+					});
+					await maybeWriteFunctionEndpointRedirect({
+						sdkName: operation.sdkName,
+						errorCode: extractErrorCode(errorPayload),
+						endpointId: typeof parsedFlags.id === "string" ? parsedFlags.id : void 0,
+						listEndpoints: listEndpointsFn,
+						writeStderr: (chunk) => {
+							process.stderr.write(chunk);
+						}
+					});
+					process.exitCode = 1;
+					return;
+				}
+				if (operation.binaryResponse) {
+					const blob = result.data;
+					const bytes = Buffer.from(await blob.arrayBuffer());
+					const output = parsedFlags.output;
+					if (typeof output === "string") {
+						writeFileSync(output, bytes);
+						return;
+					}
+					process.stdout.write(bytes);
+					return;
+				}
+				const envelope = result.data;
+				if (replyStateSurface) try {
+					const rows = Array.isArray(envelope?.data) ? envelope.data : [];
+					assertAwaitingFilterRows(rows, replyStateSurface);
+					if (rows.length === 0 && operation.sdkName === "searchEmails") await ensureSearchReportsReplyState(apiClient);
+				} catch (error) {
+					if (!(error instanceof ReplyStateUnsupportedError)) throw error;
+					process.stderr.write(`${error.message}\n`);
+					process.exitCode = 1;
+					return;
+				}
+				if (automatedSurface) try {
+					const rows = Array.isArray(envelope?.data) ? envelope.data : [];
+					assertAutomatedVerdict(rows, automatedSurface, expectedAutomatedVerdicts(query?.automated === "true" ? true : query?.automated === "false" ? false : void 0, typeof query?.q === "string" ? query.q : void 0));
+					if (rows.length === 0 && operation.sdkName === "searchEmails") await ensureSearchReportsAutomated(apiClient);
+				} catch (error) {
+					if (!(error instanceof AutomatedFilterUnsupportedError)) throw error;
+					process.stderr.write(`${error.message}\n`);
+					process.exitCode = 1;
+					return;
+				}
+				const jsonOutput = parsedFlags.json === true;
+				const withEnvelope = parsedFlags.envelope === true;
+				const cursor = envelope?.meta?.cursor;
+				if (cursor && !jsonOutput) process.stderr.write(`next cursor: ${cursor}\n`);
+				const summary = [];
+				if (Array.isArray(envelope?.data) && envelope.data.length === 0) {
+					const hint = EMPTY_RESULT_HINTS[operation.sdkName];
+					if (hint && jsonOutput) {
+						if (withEnvelope) summary.push(hint);
+					} else if (hint) process.stderr.write(`${hint}\n`);
+				}
+				writeIdempotentReplayBannerIfReplay(envelope?.data, { write: (chunk) => {
+					process.stderr.write(chunk);
+				} });
+				const successHook = OPERATION_SUCCESS_HOOKS[operation.sdkName];
+				if (successHook) try {
+					successHook({
+						envelope,
+						configDir: this.config.configDir,
+						apiBaseUrl: auth.apiBaseUrl,
+						writeStderr: (chunk) => {
+							process.stderr.write(chunk);
+						}
+					});
+				} catch (hookError) {
+					const detail = hookError instanceof Error ? hookError.message : String(hookError);
+					process.stderr.write(`Warning: ${operation.sdkName} succeeded but its post-success hook threw (${detail}). The response below is still valid; act on it manually.\n`);
+				}
+				this.log(JSON.stringify(jsonOutput && withEnvelope ? operationJsonDocument(envelope, summary) : operationOutputPayload(envelope, withEnvelope), null, 2));
+				if (isIncompleteDomainVerification(operation, envelope)) {
+					writeIncompleteDomainVerificationHint();
+					process.exitCode = 1;
+				}
+			});
+		}
+	}
+	return OperationCommand;
+}
+const EMPTY_RESULT_HINTS = {
+	listDeliveries: "(no results) No webhook deliveries logged yet. If you have an endpoint configured but expected to see test fires here: test deliveries from `primitive endpoints test` are NOT logged in this list, they're synchronous and visible only in the test-endpoint command's response. Real deliveries are logged when an inbound `email.received` event fans out to your endpoints. If you have no endpoints, run `primitive endpoints list` to check.",
+	listEndpoints: "(no results) No webhook endpoints configured. Add one with `primitive endpoints create --url <your-url>`.",
+	listEmails: "(no results) No inbound emails received yet on this account. Send one to a verified domain to populate this list. For a compact view, prefer `primitive emails latest`.",
+	listDomains: "(no results) No domains on this account. Add one with `primitive domains add --domain <yourdomain.example>`.",
+	listFilters: "(no results) No filter rules configured.",
+	listFunctions: "(no results) No Functions configured yet. Start with `primitive functions templates`, then `primitive functions init --template <template>` and `primitive functions deploy --name <name> --file <bundle>`."
+};
+function canonicalizeCliReferences(description) {
+	return description.replaceAll("`primitive emails:latest`", "`primitive emails latest`").replaceAll("`primitive describe emails:get-email | jq '.responseSchema.properties'`", "`primitive describe emails:get | jq '.responseSchema.properties'`");
+}
+//#endregion
+//#region ../sdk-node/dist/payloads-CXgCzM4Y.js
+/**
+* Load a Node builtin at call time. Exported for direct testing of the
+* unavailable-module error path; production code goes through the typed
+* wrappers below.
+*/
+async function loadBuiltin(specifier, operation) {
+	let builtin;
+	if (typeof process !== "undefined" && typeof process.getBuiltinModule === "function") try {
+		builtin = process.getBuiltinModule(specifier);
+	} catch {
+		builtin = void 0;
+	}
+	if (builtin !== void 0 && builtin !== null) return builtin;
+	try {
+		return await import(specifier);
+	} catch (cause) {
+		throw new Error(`${operation} requires file system access, which this runtime does not provide. Pass in-memory bytes instead of a file path when running outside Node.js.`, { cause });
+	}
+}
+/** `node:fs`, loaded lazily so Workers-style bundles never see the import. */
+function loadNodeFs(operation) {
+	return loadBuiltin("node:fs", operation);
+}
+/** `node:fs/promises`, loaded lazily for the same reason as {@link loadNodeFs}. */
+function loadNodeFsPromises(operation) {
+	return loadBuiltin("node:fs/promises", operation);
+}
+const CHUNK_SIZE = 64 * 1024 * 1024;
+const MANIFEST_VERSION = 1;
+const CHUNK_KDF_INFO = "payloads-chunk";
+const OBJECT_ID_BYTES = 16;
+const CEK_BYTES = 32;
+function subtle() {
+	return globalThis.crypto.subtle;
+}
+const textEncoder = new TextEncoder();
+function randomBytes(length) {
+	const out = new Uint8Array(length);
+	globalThis.crypto.getRandomValues(out);
+	return out;
+}
+function toHex(bytes) {
+	let out = "";
+	for (const b of bytes) out += b.toString(16).padStart(2, "0");
+	return out;
+}
+function fromHex(hex) {
+	if (hex.length % 2 !== 0) throw new Error("invalid hex: odd length");
+	if (hex.length > 0 && !/^[0-9a-fA-F]+$/.test(hex)) throw new Error("invalid hex: non-hex character");
+	const out = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+	return out;
+}
+async function contentHash(bytes) {
+	return new Uint8Array(await subtle().digest("SHA-256", bytes));
+}
+async function contentHashHex(bytes) {
+	return toHex(await contentHash(bytes));
+}
+/** Binary Merkle root over ordered hex leaf hashes (odd node promoted). */
+async function merkleRoot(leafHashesHex) {
+	if (leafHashesHex.length === 0) return contentHashHex(new Uint8Array(0));
+	let level = leafHashesHex.map(fromHex);
+	while (level.length > 1) {
+		const next = [];
+		for (let i = 0; i < level.length; i += 2) {
+			const left = level[i];
+			const right = i + 1 < level.length ? level[i + 1] : level[i];
+			const combined = new Uint8Array(left.length + right.length);
+			combined.set(left, 0);
+			combined.set(right, left.length);
+			next.push(await contentHash(combined));
+		}
+		level = next;
+	}
+	return toHex(level[0]);
+}
+async function deriveChunkKey(cek, index) {
+	const baseKey = await subtle().importKey("raw", cek, "HKDF", false, ["deriveKey"]);
+	const info = textEncoder.encode(`${CHUNK_KDF_INFO}:${index}`);
+	return subtle().deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: new Uint8Array(32),
+		info
+	}, baseKey, {
+		name: "AES-GCM",
+		length: 256
+	}, false, ["encrypt", "decrypt"]);
+}
+function chunkNonce(index) {
+	const nonce = new Uint8Array(12);
+	new DataView(nonce.buffer).setUint32(8, index >>> 0, false);
+	return nonce;
+}
+function chunkAad(objectId, index) {
+	const aad = new Uint8Array(objectId.length + 4);
+	aad.set(objectId, 0);
+	new DataView(aad.buffer).setUint32(objectId.length, index >>> 0, false);
+	return aad;
+}
+async function encryptChunk(cek, objectId, index, plaintext) {
+	const key = await deriveChunkKey(cek, index);
+	const ct = await subtle().encrypt({
+		name: "AES-GCM",
+		iv: chunkNonce(index),
+		additionalData: chunkAad(objectId, index)
+	}, key, plaintext);
+	return new Uint8Array(ct);
+}
+async function decryptChunk(cek, objectId, index, ciphertext) {
+	const key = await deriveChunkKey(cek, index);
+	const pt = await subtle().decrypt({
+		name: "AES-GCM",
+		iv: chunkNonce(index),
+		additionalData: chunkAad(objectId, index)
+	}, key, ciphertext);
+	return new Uint8Array(pt);
+}
+function authHeaders(apiKey) {
+	return { authorization: `Bearer ${apiKey}` };
+}
+function apiRoot(baseUrl) {
+	let end = baseUrl.length;
+	while (end > 0 && baseUrl.charCodeAt(end - 1) === 47) end--;
+	return `${baseUrl.slice(0, end)}/v1/payloads`;
+}
+const DEFAULT_MAX_RETRIES = 6;
+const RETRYABLE_STATUS = new Set([
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+* fetch with exponential backoff on transient failures. Request bodies here are
+* in-memory buffers/strings (never streams), so a retry can safely resend them.
+*/
+async function retryingFetch(url, init, label, maxRetries = DEFAULT_MAX_RETRIES) {
+	for (let attempt = 0;; attempt++) {
+		let res;
+		let networkError;
+		try {
+			res = await fetch(url, init);
+		} catch (err) {
+			networkError = err;
+		}
+		if (res && !RETRYABLE_STATUS.has(res.status)) return res;
+		if (attempt >= maxRetries) {
+			if (res) return res;
+			throw new Error(`${label}: network error after ${attempt} retries: ${networkError?.message ?? networkError}`);
+		}
+		if (res) await res.text().catch(() => {});
+		await sleep(Math.min(1e3 * 2 ** attempt, 15e3) + Math.floor(Math.random() * 250));
+	}
+}
+async function initiate(opts, manifest) {
+	const res = await retryingFetch(apiRoot(opts.baseUrl), {
+		method: "POST",
+		headers: {
+			...authHeaders(opts.apiKey),
+			"content-type": "application/json"
+		},
+		body: JSON.stringify({ manifest })
+	}, "initiate");
+	if (!res.ok) throw new Error(`initiate failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function putChunk(opts, root, d, bytes) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, {
+		method: "PUT",
+		headers: {
+			...authHeaders(opts.apiKey),
+			"content-type": "application/octet-stream"
+		},
+		body: bytes
+	}, `chunk ${d.index} upload`);
+	if (!res.ok) throw new Error(`chunk ${d.index} upload failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function finalize(opts, root) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/finalize`, {
+		method: "POST",
+		headers: authHeaders(opts.apiKey)
+	}, "finalize");
+	if (!res.ok) throw new Error(`finalize failed: HTTP ${res.status} ${await res.text()}`);
+	await res.text();
+}
+async function fetchManifest(opts, root) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/manifest`, { headers: authHeaders(opts.apiKey) }, "get manifest");
+	if (!res.ok) throw new Error(`get manifest failed: HTTP ${res.status} ${await res.text()}`);
+	return (await res.json()).data.manifest;
+}
+async function getChunkBytes(opts, root, d) {
+	const res = await retryingFetch(`${apiRoot(opts.baseUrl)}/${root}/chunks/${d.ciphertextHash}`, { headers: authHeaders(opts.apiKey) }, `get chunk ${d.index}`);
+	if (!res.ok) throw new Error(`get chunk ${d.index} failed: HTTP ${res.status}`);
+	return new Uint8Array(await res.arrayBuffer());
+}
+async function readWindow(fh, position, length) {
+	const buf = Buffer.allocUnsafe(length);
+	let read = 0;
+	while (read < length) {
+		const { bytesRead } = await fh.read(buf, read, length - read, position + read);
+		if (bytesRead === 0) break;
+		read += bytesRead;
+	}
+	return read === length ? buf : buf.subarray(0, read);
+}
+async function mapLimit(items, limit, fn) {
+	let next = 0;
+	let firstError;
+	const worker = async () => {
+		while (next < items.length && firstError === void 0) {
+			const i = next++;
+			try {
+				await fn(items[i], i);
+			} catch (err) {
+				if (firstError === void 0) firstError = err;
+				return;
+			}
+		}
+	};
+	await Promise.all(Array.from({ length: Math.min(limit, items.length || 1) }, () => worker()));
+	if (firstError !== void 0) throw firstError;
+}
+/**
+* Stream a file up as a Primitive Payload. Two passes over the file (encrypt to
+* build the manifest, then encrypt again to upload) keep memory bounded to a few
+* chunks — the whole object is never resident. Returns the content address
+* (merkleRoot) and the hex CEK needed to download it.
+*/
+async function pushFile(filePath, opts) {
+	const { open, stat } = await loadNodeFsPromises("pushFile");
+	const chunkSize = opts.chunkSize ?? CHUNK_SIZE;
+	const concurrency = opts.concurrency ?? 3;
+	const { size } = await stat(filePath);
+	const cek = randomBytes(CEK_BYTES);
+	const objectId = randomBytes(OBJECT_ID_BYTES);
+	const chunkCount = size === 0 ? 0 : Math.ceil(size / chunkSize);
+	const fh = await open(filePath, "r");
+	try {
+		const descriptors = [];
+		for (let index = 0; index < chunkCount; index++) {
+			const position = index * chunkSize;
+			const length = Math.min(chunkSize, size - position);
+			const plaintext = await readWindow(fh, position, length);
+			const ciphertext = await encryptChunk(cek, objectId, index, plaintext);
+			descriptors.push({
+				index,
+				ciphertextHash: await contentHashHex(ciphertext),
+				plaintextSize: length,
+				ciphertextSize: ciphertext.length
+			});
+			opts.onProgress?.("encrypt", index + 1, chunkCount);
+		}
+		const root = await merkleRoot(descriptors.map((d) => d.ciphertextHash));
+		await initiate(opts, {
+			version: MANIFEST_VERSION,
+			objectId: toHex(objectId),
+			chunkSize,
+			totalPlaintextSize: size,
+			chunkCount,
+			chunks: descriptors,
+			merkleRoot: root
+		});
+		let uploaded = 0;
+		await mapLimit(descriptors, concurrency, async (d) => {
+			const plaintext = await readWindow(fh, d.index * chunkSize, d.plaintextSize);
+			await putChunk(opts, root, d, await encryptChunk(cek, objectId, d.index, plaintext));
+			opts.onProgress?.("upload", ++uploaded, chunkCount);
+		});
+		await finalize(opts, root);
+		return {
+			merkleRoot: root,
+			cek: toHex(cek),
+			chunkCount,
+			totalBytes: size
+		};
+	} finally {
+		await fh.close();
+	}
+}
+/**
+* Stream a Primitive Payload down to a file, verifying and decrypting one chunk
+* at a time (bounded memory). Every chunk is content-address-checked before
+* decryption, so a corrupt or substituted chunk throws.
+*/
+async function pullFile(root, outPath, opts) {
+	const { createWriteStream } = await loadNodeFs("pullFile");
+	const { rm } = await loadNodeFsPromises("pullFile");
+	const manifest = await fetchManifest(opts, root);
+	const computedRoot = await merkleRoot(manifest.chunks.map((c) => c.ciphertextHash));
+	if (computedRoot !== root) throw new Error(`manifest does not match the requested content address (got ${computedRoot})`);
+	const cek = fromHex(opts.cek);
+	const objectId = fromHex(manifest.objectId);
+	const out = createWriteStream(outPath);
+	let onWriteError = () => {};
+	const writeErrored = new Promise((_, reject) => {
+		onWriteError = reject;
+	});
+	writeErrored.catch(() => {});
+	out.on("error", (err) => onWriteError(err));
+	try {
+		let done = 0;
+		for (const d of manifest.chunks) {
+			const ciphertext = await getChunkBytes(opts, root, d);
+			if (await contentHashHex(ciphertext) !== d.ciphertextHash) throw new Error(`chunk ${d.index} failed integrity check`);
+			const plaintext = await decryptChunk(cek, objectId, d.index, ciphertext);
+			if (!out.write(plaintext)) await Promise.race([new Promise((resolve) => out.once("drain", resolve)), writeErrored]);
+			opts.onProgress?.("download", ++done, manifest.chunkCount);
+		}
+		await Promise.race([new Promise((resolve) => out.end(resolve)), writeErrored]);
+	} catch (err) {
+		out.destroy();
+		await rm(outPath, { force: true });
+		throw err;
+	}
+	return manifest;
+}
+//#endregion
+//#region ../sdk-node/dist/api-DIgE1sxv.js
+const jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
+function createSseClient({ onRequest, onSseError, onSseEvent, responseTransformer, responseValidator, sseDefaultRetryDelay, sseMaxRetryAttempts, sseMaxRetryDelay, sseSleepFn, url, ...options }) {
+	let lastEventId;
+	const sleep = sseSleepFn ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+	const createStream = async function* () {
+		let retryDelay = sseDefaultRetryDelay ?? 3e3;
+		let attempt = 0;
+		const signal = options.signal ?? new AbortController().signal;
+		while (true) {
+			if (signal.aborted) break;
+			attempt++;
+			const headers = options.headers instanceof Headers ? options.headers : new Headers(options.headers);
+			if (lastEventId !== void 0) headers.set("Last-Event-ID", lastEventId);
+			try {
+				const requestInit = {
+					redirect: "follow",
+					...options,
+					body: options.serializedBody,
+					headers,
+					signal
+				};
+				let request = new Request(url, requestInit);
+				if (onRequest) request = await onRequest(url, requestInit);
+				const response = await (options.fetch ?? globalThis.fetch)(request);
+				if (!response.ok) throw new Error(`SSE failed: ${response.status} ${response.statusText}`);
+				if (!response.body) throw new Error("No body in SSE response");
+				const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();
+				let buffer = "";
+				const abortHandler = () => {
+					try {
+						reader.cancel();
+					} catch {}
+				};
+				signal.addEventListener("abort", abortHandler);
+				try {
+					while (true) {
+						const { done, value } = await reader.read();
+						if (done) break;
+						buffer += value;
+						buffer = buffer.replace(/\r\n?/g, "\n");
+						const chunks = buffer.split("\n\n");
+						buffer = chunks.pop() ?? "";
+						for (const chunk of chunks) {
+							const lines = chunk.split("\n");
+							const dataLines = [];
+							let eventName;
+							for (const line of lines) if (line.startsWith("data:")) dataLines.push(line.replace(/^data:\s*/, ""));
+							else if (line.startsWith("event:")) eventName = line.replace(/^event:\s*/, "");
+							else if (line.startsWith("id:")) lastEventId = line.replace(/^id:\s*/, "");
+							else if (line.startsWith("retry:")) {
+								const parsed = Number.parseInt(line.replace(/^retry:\s*/, ""), 10);
+								if (!Number.isNaN(parsed)) retryDelay = parsed;
+							}
+							let data;
+							let parsedJson = false;
+							if (dataLines.length) {
+								const rawData = dataLines.join("\n");
+								try {
+									data = JSON.parse(rawData);
+									parsedJson = true;
+								} catch {
+									data = rawData;
+								}
+							}
+							if (parsedJson) {
+								if (responseValidator) await responseValidator(data);
+								if (responseTransformer) data = await responseTransformer(data);
+							}
+							onSseEvent?.({
+								data,
+								event: eventName,
+								id: lastEventId,
+								retry: retryDelay
+							});
+							if (dataLines.length) yield data;
+						}
+					}
+				} finally {
+					signal.removeEventListener("abort", abortHandler);
+					reader.releaseLock();
+				}
+				break;
+			} catch (error) {
+				onSseError?.(error);
+				if (sseMaxRetryAttempts !== void 0 && attempt >= sseMaxRetryAttempts) break;
+				await sleep(Math.min(retryDelay * 2 ** (attempt - 1), sseMaxRetryDelay ?? 3e4));
+			}
+		}
+	};
+	return { stream: createStream() };
+}
+const separatorArrayExplode = (style) => {
+	switch (style) {
+		case "label": return ".";
+		case "matrix": return ";";
+		case "simple": return ",";
+		default: return "&";
+	}
+};
+const separatorArrayNoExplode = (style) => {
+	switch (style) {
+		case "form": return ",";
+		case "pipeDelimited": return "|";
+		case "spaceDelimited": return "%20";
+		default: return ",";
+	}
+};
+const separatorObjectExplode = (style) => {
+	switch (style) {
+		case "label": return ".";
+		case "matrix": return ";";
+		case "simple": return ",";
+		default: return "&";
+	}
+};
+const serializeArrayParam = ({ allowReserved, explode, name, style, value }) => {
+	if (!explode) {
+		const joinedValues = (allowReserved ? value : value.map((v) => encodeURIComponent(v))).join(separatorArrayNoExplode(style));
+		switch (style) {
+			case "label": return `.${joinedValues}`;
+			case "matrix": return `;${name}=${joinedValues}`;
+			case "simple": return joinedValues;
+			default: return `${name}=${joinedValues}`;
+		}
+	}
+	const separator = separatorArrayExplode(style);
+	const joinedValues = value.map((v) => {
+		if (style === "label" || style === "simple") return allowReserved ? v : encodeURIComponent(v);
+		return serializePrimitiveParam({
+			allowReserved,
+			name,
+			value: v
+		});
+	}).join(separator);
+	return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+const serializePrimitiveParam = ({ allowReserved, name, value }) => {
+	if (value === void 0 || value === null) return "";
+	if (typeof value === "object") throw new Error("Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.");
+	return `${name}=${allowReserved ? value : encodeURIComponent(value)}`;
+};
+const serializeObjectParam = ({ allowReserved, explode, name, style, value, valueOnly }) => {
+	if (value instanceof Date) return valueOnly ? value.toISOString() : `${name}=${value.toISOString()}`;
+	if (style !== "deepObject" && !explode) {
+		let values = [];
+		Object.entries(value).forEach(([key, v]) => {
+			values = [
+				...values,
+				key,
+				allowReserved ? v : encodeURIComponent(v)
+			];
+		});
+		const joinedValues = values.join(",");
+		switch (style) {
+			case "form": return `${name}=${joinedValues}`;
+			case "label": return `.${joinedValues}`;
+			case "matrix": return `;${name}=${joinedValues}`;
+			default: return joinedValues;
+		}
+	}
+	const separator = separatorObjectExplode(style);
+	const joinedValues = Object.entries(value).map(([key, v]) => serializePrimitiveParam({
+		allowReserved,
+		name: style === "deepObject" ? `${name}[${key}]` : key,
+		value: v
+	})).join(separator);
+	return style === "label" || style === "matrix" ? separator + joinedValues : joinedValues;
+};
+const PATH_PARAM_RE = /\{[^{}]+\}/g;
+const defaultPathSerializer = ({ path, url: _url }) => {
+	let url = _url;
+	const matches = _url.match(PATH_PARAM_RE);
+	if (matches) for (const match of matches) {
+		let explode = false;
+		let name = match.substring(1, match.length - 1);
+		let style = "simple";
+		if (name.endsWith("*")) {
+			explode = true;
+			name = name.substring(0, name.length - 1);
+		}
+		if (name.startsWith(".")) {
+			name = name.substring(1);
+			style = "label";
+		} else if (name.startsWith(";")) {
+			name = name.substring(1);
+			style = "matrix";
+		}
+		const value = path[name];
+		if (value === void 0 || value === null) continue;
+		if (Array.isArray(value)) {
+			url = url.replace(match, serializeArrayParam({
+				explode,
+				name,
+				style,
+				value
+			}));
+			continue;
+		}
+		if (typeof value === "object") {
+			url = url.replace(match, serializeObjectParam({
+				explode,
+				name,
+				style,
+				value,
+				valueOnly: true
+			}));
+			continue;
+		}
+		if (style === "matrix") {
+			url = url.replace(match, `;${serializePrimitiveParam({
+				name,
+				value
+			})}`);
+			continue;
+		}
+		const replaceValue = encodeURIComponent(style === "label" ? `.${value}` : value);
+		url = url.replace(match, replaceValue);
+	}
+	return url;
+};
+const getUrl = ({ baseUrl, path, query, querySerializer, url: _url }) => {
+	const pathUrl = _url.startsWith("/") ? _url : `/${_url}`;
+	let url = (baseUrl ?? "") + pathUrl;
+	if (path) url = defaultPathSerializer({
+		path,
+		url
+	});
+	let search = query ? querySerializer(query) : "";
+	if (search.startsWith("?")) search = search.substring(1);
+	if (search) url += `?${search}`;
+	return url;
+};
+function getValidRequestBody(options) {
+	const hasBody = options.body !== void 0;
+	if (hasBody && options.bodySerializer) {
+		if ("serializedBody" in options) return options.serializedBody !== void 0 && options.serializedBody !== "" ? options.serializedBody : null;
+		return options.body !== "" ? options.body : null;
+	}
+	if (hasBody) return options.body;
+}
+const getAuthToken = async (auth, callback) => {
+	const token = typeof callback === "function" ? await callback(auth) : callback;
+	if (!token) return;
+	if (auth.scheme === "bearer") return `Bearer ${token}`;
+	if (auth.scheme === "basic") return `Basic ${btoa(token)}`;
+	return token;
+};
+const createQuerySerializer = ({ parameters = {}, ...args } = {}) => {
+	const querySerializer = (queryParams) => {
+		const search = [];
+		if (queryParams && typeof queryParams === "object") for (const name in queryParams) {
+			const value = queryParams[name];
+			if (value === void 0 || value === null) continue;
+			const options = parameters[name] || args;
+			if (Array.isArray(value)) {
+				const serializedArray = serializeArrayParam({
+					allowReserved: options.allowReserved,
+					explode: true,
+					name,
+					style: "form",
+					value,
+					...options.array
+				});
+				if (serializedArray) search.push(serializedArray);
+			} else if (typeof value === "object") {
+				const serializedObject = serializeObjectParam({
+					allowReserved: options.allowReserved,
+					explode: true,
+					name,
+					style: "deepObject",
+					value,
+					...options.object
+				});
+				if (serializedObject) search.push(serializedObject);
+			} else {
+				const serializedPrimitive = serializePrimitiveParam({
+					allowReserved: options.allowReserved,
+					name,
+					value
+				});
+				if (serializedPrimitive) search.push(serializedPrimitive);
+			}
+		}
+		return search.join("&");
+	};
+	return querySerializer;
+};
+/**
+* Infers parseAs value from provided Content-Type header.
+*/
+const getParseAs = (contentType) => {
+	if (!contentType) return "stream";
+	const cleanContent = contentType.split(";")[0]?.trim();
+	if (!cleanContent) return;
+	if (cleanContent.startsWith("application/json") || cleanContent.endsWith("+json")) return "json";
+	if (cleanContent === "multipart/form-data") return "formData";
+	if ([
+		"application/",
+		"audio/",
+		"image/",
+		"video/"
+	].some((type) => cleanContent.startsWith(type))) return "blob";
+	if (cleanContent.startsWith("text/")) return "text";
+};
+const checkForExistence = (options, name) => {
+	if (!name) return false;
+	if (options.headers.has(name) || options.query?.[name] || options.headers.get("Cookie")?.includes(`${name}=`)) return true;
+	return false;
+};
+async function setAuthParams(options) {
+	for (const auth of options.security ?? []) {
+		if (checkForExistence(options, auth.name)) continue;
+		const token = await getAuthToken(auth, options.auth);
+		if (!token) continue;
+		const name = auth.name ?? "Authorization";
+		switch (auth.in) {
+			case "query":
+				if (!options.query) options.query = {};
+				options.query[name] = token;
+				break;
+			case "cookie":
+				options.headers.append("Cookie", `${name}=${token}`);
+				break;
+			default:
+				options.headers.set(name, token);
+				break;
+		}
+	}
+}
+const buildUrl = (options) => getUrl({
+	baseUrl: options.baseUrl,
+	path: options.path,
+	query: options.query,
+	querySerializer: typeof options.querySerializer === "function" ? options.querySerializer : createQuerySerializer(options.querySerializer),
+	url: options.url
+});
+const mergeConfigs = (a, b) => {
+	const config = {
+		...a,
+		...b
+	};
+	if (config.baseUrl?.endsWith("/")) config.baseUrl = config.baseUrl.substring(0, config.baseUrl.length - 1);
+	config.headers = mergeHeaders(a.headers, b.headers);
+	return config;
+};
+const headersEntries = (headers) => {
+	const entries = [];
+	headers.forEach((value, key) => {
+		entries.push([key, value]);
+	});
+	return entries;
+};
+const mergeHeaders = (...headers) => {
+	const mergedHeaders = new Headers();
+	for (const header of headers) {
+		if (!header) continue;
+		const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+		for (const [key, value] of iterator) if (value === null) mergedHeaders.delete(key);
+		else if (Array.isArray(value)) for (const v of value) mergedHeaders.append(key, v);
+		else if (value !== void 0) mergedHeaders.set(key, typeof value === "object" ? JSON.stringify(value) : value);
+	}
+	return mergedHeaders;
+};
+var Interceptors = class {
+	fns = [];
+	clear() {
+		this.fns = [];
+	}
+	eject(id) {
+		const index = this.getInterceptorIndex(id);
+		if (this.fns[index]) this.fns[index] = null;
+	}
+	exists(id) {
+		const index = this.getInterceptorIndex(id);
+		return Boolean(this.fns[index]);
+	}
+	getInterceptorIndex(id) {
+		if (typeof id === "number") return this.fns[id] ? id : -1;
+		return this.fns.indexOf(id);
+	}
+	update(id, fn) {
+		const index = this.getInterceptorIndex(id);
+		if (this.fns[index]) {
+			this.fns[index] = fn;
+			return id;
+		}
+		return false;
+	}
+	use(fn) {
+		this.fns.push(fn);
+		return this.fns.length - 1;
+	}
+};
+const createInterceptors = () => ({
+	error: new Interceptors(),
+	request: new Interceptors(),
+	response: new Interceptors()
+});
+const defaultQuerySerializer = createQuerySerializer({
+	allowReserved: false,
+	array: {
+		explode: true,
+		style: "form"
+	},
+	object: {
+		explode: true,
+		style: "deepObject"
+	}
+});
+const defaultHeaders = { "Content-Type": "application/json" };
+const createConfig = (override = {}) => ({
+	...jsonBodySerializer,
+	headers: defaultHeaders,
+	parseAs: "auto",
+	querySerializer: defaultQuerySerializer,
+	...override
+});
+const createClient = (config = {}) => {
+	let _config = mergeConfigs(createConfig(), config);
+	const getConfig = () => ({ ..._config });
+	const setConfig = (config) => {
+		_config = mergeConfigs(_config, config);
+		return getConfig();
+	};
+	const interceptors = createInterceptors();
+	const beforeRequest = async (options) => {
+		const opts = {
+			..._config,
+			...options,
+			fetch: options.fetch ?? _config.fetch ?? globalThis.fetch,
+			headers: mergeHeaders(_config.headers, options.headers),
+			serializedBody: void 0
+		};
+		if (opts.security) await setAuthParams(opts);
+		if (opts.requestValidator) await opts.requestValidator(opts);
+		if (opts.body !== void 0 && opts.bodySerializer) opts.serializedBody = opts.bodySerializer(opts.body);
+		if (opts.body === void 0 || opts.serializedBody === "") opts.headers.delete("Content-Type");
+		const resolvedOpts = opts;
+		return {
+			opts: resolvedOpts,
+			url: buildUrl(resolvedOpts)
+		};
+	};
+	const request = async (options) => {
+		const throwOnError = options.throwOnError ?? _config.throwOnError;
+		const responseStyle = options.responseStyle ?? _config.responseStyle;
+		let request;
+		let response;
+		try {
+			const { opts, url } = await beforeRequest(options);
+			const requestInit = {
+				redirect: "follow",
+				...opts,
+				body: getValidRequestBody(opts)
+			};
+			request = new Request(url, requestInit);
+			for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+			const _fetch = opts.fetch;
+			response = await _fetch(request);
+			for (const fn of interceptors.response.fns) if (fn) response = await fn(response, request, opts);
+			const result = {
+				request,
+				response
+			};
+			if (response.ok) {
+				const parseAs = (opts.parseAs === "auto" ? getParseAs(response.headers.get("Content-Type")) : opts.parseAs) ?? "json";
+				if (response.status === 204 || response.headers.get("Content-Length") === "0") {
+					let emptyData;
+					switch (parseAs) {
+						case "arrayBuffer":
+						case "blob":
+						case "text":
+							emptyData = await response[parseAs]();
+							break;
+						case "formData":
+							emptyData = new FormData();
+							break;
+						case "stream":
+							emptyData = response.body;
+							break;
+						default:
+							emptyData = {};
+							break;
+					}
+					return opts.responseStyle === "data" ? emptyData : {
+						data: emptyData,
+						...result
+					};
+				}
+				let data;
+				switch (parseAs) {
+					case "arrayBuffer":
+					case "blob":
+					case "formData":
+					case "text":
+						data = await response[parseAs]();
+						break;
+					case "json": {
+						const text = await response.text();
+						data = text ? JSON.parse(text) : {};
+						break;
+					}
+					case "stream": return opts.responseStyle === "data" ? response.body : {
+						data: response.body,
+						...result
+					};
+				}
+				if (parseAs === "json") {
+					if (opts.responseValidator) await opts.responseValidator(data);
+					if (opts.responseTransformer) data = await opts.responseTransformer(data);
+				}
+				return opts.responseStyle === "data" ? data : {
+					data,
+					...result
+				};
+			}
+			const textError = await response.text();
+			let jsonError;
+			try {
+				jsonError = JSON.parse(textError);
+			} catch {}
+			throw jsonError ?? textError;
+		} catch (error) {
+			let finalError = error;
+			for (const fn of interceptors.error.fns) if (fn) finalError = await fn(finalError, response, request, options);
+			finalError = finalError || {};
+			if (throwOnError) throw finalError;
+			return responseStyle === "data" ? void 0 : {
+				error: finalError,
+				request,
+				response
+			};
+		}
+	};
+	const makeMethodFn = (method) => (options) => request({
+		...options,
+		method
+	});
+	const makeSseFn = (method) => async (options) => {
+		const { opts, url } = await beforeRequest(options);
+		return createSseClient({
+			...opts,
+			body: opts.body,
+			method,
+			onRequest: async (url, init) => {
+				let request = new Request(url, init);
+				for (const fn of interceptors.request.fns) if (fn) request = await fn(request, opts);
+				return request;
+			},
+			serializedBody: getValidRequestBody(opts),
+			url
+		});
+	};
+	const _buildUrl = (options) => buildUrl({
+		..._config,
+		...options
+	});
+	return {
+		buildUrl: _buildUrl,
+		connect: makeMethodFn("CONNECT"),
+		delete: makeMethodFn("DELETE"),
+		get: makeMethodFn("GET"),
+		getConfig,
+		head: makeMethodFn("HEAD"),
+		interceptors,
+		options: makeMethodFn("OPTIONS"),
+		patch: makeMethodFn("PATCH"),
+		post: makeMethodFn("POST"),
+		put: makeMethodFn("PUT"),
+		request,
+		setConfig,
+		sse: {
+			connect: makeSseFn("CONNECT"),
+			delete: makeSseFn("DELETE"),
+			get: makeSseFn("GET"),
+			head: makeSseFn("HEAD"),
+			options: makeSseFn("OPTIONS"),
+			patch: makeSseFn("PATCH"),
+			post: makeSseFn("POST"),
+			put: makeSseFn("PUT"),
+			trace: makeSseFn("TRACE")
+		},
+		trace: makeMethodFn("TRACE")
+	};
+};
+const client$1 = createClient(createConfig({ baseUrl: "https://api.primitive.dev/v1" }));
+/**
+* Receive a pending webhook event without a public endpoint
+*
+* Wait up to 30 seconds for one existing event. The body string preserves the exact webhook serialization; headers and canonical occurrence/type metadata travel alongside it. A fixed lease protects the attempt while a short handler accepts input. Retry may redeliver an occurrence: deduplicate event_id. Empty delivery means no offer now, not proof all input was delivered; inspect backlog and persistent gap_count/last_gap_reason. Queue retention is 24 hours and does not extend source-content retention. Disconnecting preserves pending work. Same named destination shares consumption; different destinations get independent copies.
+*/
+const pullWebhookEvent = (options) => (options.client ?? client$1).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}/pull",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Report the outcome of a local webhook delivery attempt
+*
+* Report normalized handling evidence for the queue, attempt and lease. Required JSON fields: queue_id, delivery_id, lease_token, mode, duration_ms. For mode=exec include exit_code; stdout includes write_succeeded; http includes status_code and optional transport_error, error_code, confirmed. Supply this discriminated request with --raw-body in the generated CLI. The server classifies success and retry. Duplicate identical completion is idempotent; a stale lease cannot finish a newer attempt. Exec success means durable input acceptance, not completion of agent reasoning. Only successful HTTP handling with recognized confirmation evidence can confirm content discard. Never send arbitrary handler output or HTTP response bodies.
+*/
+const completeWebhookEvent = (options) => (options.client ?? client$1).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}/complete",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+var EventReceiverError = class extends Error {
+	constructor(message, code, status = 0, retryAfterMs = 0) {
+		super(message);
+		this.code = code;
+		this.status = status;
+		this.retryAfterMs = retryAfterMs;
+		this.name = "EventReceiverError";
+	}
+};
+function record$2(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function validateOffer(value) {
+	if (!record$2(value) || !Number.isSafeInteger(value.backlog) || Number(value.backlog) < 0 || !Number.isSafeInteger(value.gap_count) || Number(value.gap_count) < 0 || value.last_gap_reason !== null && typeof value.last_gap_reason !== "string" || value.retention_seconds !== 86400 || value.handler_timeout_seconds !== 30) throw new EventReceiverError("Invalid event status response", "invalid_response");
+	const d = value.delivery;
+	if (d !== null && (!record$2(d) || ![
+		"queue_id",
+		"event_id",
+		"delivery_id",
+		"lease_token",
+		"event_type",
+		"body",
+		"lease_expires_at"
+	].every((key) => typeof d[key] === "string") || !Number.isFinite(Date.parse(String(d.lease_expires_at))) || !record$2(d.headers) || !Object.values(d.headers).every((header) => typeof header === "string"))) throw new EventReceiverError("Invalid event delivery response", "invalid_response");
+	return value;
+}
+function retryAfter(value) {
+	if (!value) return 0;
+	const ms = /^\d+(\.\d+)?$/.test(value) ? Number(value) * 1e3 : Date.parse(value) - Date.now();
+	return Number.isFinite(ms) ? Math.max(0, ms) : 0;
+}
+function unwrap(result) {
+	if (result.data !== void 0 && !result.error) return result.data;
+	const code = record$2(result.error) && record$2(result.error.error) && typeof result.error.error.code === "string" ? result.error.error.code : "request_failed";
+	throw new EventReceiverError(`Event request failed (${result.response?.status ?? 0}, ${code})`, code, result.response?.status ?? 0, retryAfter(result.response?.headers.get("retry-after") ?? null));
+}
+/** Shared by the SDK and CLI. Completion retries preserve the original evidence. */
+var EventConnection = class {
+	socket;
+	pending;
+	origin;
+	touch;
+	constructor(client, endpointId, options = {}) {
+		this.client = client;
+		this.endpointId = endpointId;
+		this.options = options;
+	}
+	close() {
+		const socket = this.socket;
+		this.socket = void 0;
+		this.pending?.reject(new EventReceiverError("Event connection closed", "disconnected"));
+		this.pending = void 0;
+		socket?.close();
+	}
+	async open(signal) {
+		if (this.options.transport === "poll" || this.socket?.readyState === 1) return;
+		const config = this.client.getConfig();
+		if (this.origin !== void 0 && this.origin !== config.baseUrl) throw new EventReceiverError("The API environment changed; restart the receiver", "identity_changed", 403);
+		this.origin = config.baseUrl;
+		const auth = typeof config.auth === "function" ? await config.auth({
+			type: "http",
+			scheme: "bearer"
+		}) : config.auth;
+		const authorization = new Headers(config.headers).get("authorization");
+		const token = typeof auth === "string" ? auth.replace(/^Bearer /i, "") : authorization?.replace(/^Bearer /i, "");
+		if (!token) throw new EventReceiverError("Event receiver requires bearer credentials", "unauthorized", 401);
+		const url = new URL(`${config.baseUrl?.replace(/\/+$/, "")}/endpoints/${encodeURIComponent(this.endpointId)}/stream`);
+		if (url.protocol !== "https:" && !(url.protocol === "http:" && [
+			"localhost",
+			"127.0.0.1",
+			"[::1]"
+		].includes(url.hostname))) throw new EventReceiverError("Event connections require HTTPS (except loopback development)", "unsupported");
+		url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+		const socket = (this.options.webSocketFactory ?? ((address, protocol) => new WebSocket(address, protocol)))(url.href, "primitive.events.v1");
+		this.socket = socket;
+		socket.addEventListener("message", (message) => {
+			if (this.socket !== socket) return;
+			let frame;
+			try {
+				frame = JSON.parse(String(message.data));
+			} catch {
+				this.fail(new EventReceiverError("Invalid event frame", "invalid_response"));
+				return;
+			}
+			this.touch?.();
+			if (!record$2(frame)) {
+				this.fail(new EventReceiverError("Invalid event frame", "invalid_response"));
+				return;
+			}
+			if (frame.type === "ping") {
+				socket.send(JSON.stringify({ type: "pong" }));
+				try {
+					this.options.onHeartbeat?.();
+				} catch (error) {
+					this.fail(error);
+				}
+				return;
+			}
+			if (frame.type === "status") {
+				try {
+					this.options.onStatus?.(validateOffer(frame.data));
+				} catch (error) {
+					this.fail(error);
+				}
+				return;
+			}
+			if (frame.type === "error") {
+				this.fail(new EventReceiverError("Event stream request failed", typeof frame.code === "string" ? frame.code : "request_failed", typeof frame.status === "number" ? frame.status : 0, retryAfter(typeof frame.retry_after === "string" ? frame.retry_after : null)));
+				return;
+			}
+			this.pending?.resolve(frame);
+		});
+		socket.addEventListener("close", () => {
+			if (this.socket === socket) this.fail(new EventReceiverError("Event stream disconnected", "disconnected"));
+		});
+		socket.addEventListener("error", () => {
+			if (this.socket === socket) this.fail(new EventReceiverError("Event stream connection failed", "disconnected"));
+		});
+		const ready = await this.exchange(signal, void 0, () => {
+			socket.addEventListener("open", () => socket.send(JSON.stringify({
+				type: "authenticate",
+				token
+			})), { once: true });
+		}, 15e3);
+		if (!record$2(ready) || ready.type !== "ready" || ready.protocol !== "primitive.events.v1") {
+			this.close();
+			throw new EventReceiverError("Unsupported event stream protocol", "unsupported");
+		}
+	}
+	fail(error) {
+		this.pending?.reject(error);
+		this.pending = void 0;
+		this.close();
+	}
+	async exchange(signal, frame, start, timeoutMs = 6e4) {
+		signal.throwIfAborted();
+		if (this.pending) throw new EventReceiverError("Concurrent event operation", "busy", 409);
+		let cleanup = () => {};
+		try {
+			return await new Promise((resolve, reject) => {
+				const abort = () => {
+					reject(signal.reason);
+					this.close();
+				};
+				let timer;
+				this.touch = () => {
+					clearTimeout(timer);
+					timer = setTimeout(() => this.fail(new EventReceiverError("Event stream timed out", "disconnected")), timeoutMs);
+				};
+				this.touch();
+				cleanup = () => {
+					this.touch = void 0;
+					clearTimeout(timer);
+					signal.removeEventListener("abort", abort);
+					this.pending = void 0;
+				};
+				this.pending = {
+					resolve,
+					reject
+				};
+				signal.addEventListener("abort", abort, { once: true });
+				if (frame) this.socket?.send(JSON.stringify(frame));
+				start?.();
+			});
+		} finally {
+			cleanup();
+		}
+	}
+	async receive(signal) {
+		if (this.options.transport === "poll") return validateOffer(unwrap(await pullWebhookEvent({
+			client: this.client,
+			path: { id: this.endpointId },
+			body: { wait_seconds: 25 },
+			responseStyle: "fields",
+			throwOnError: false,
+			signal: AbortSignal.any([signal, AbortSignal.timeout(45e3)])
+		})).data);
+		await this.open(signal);
+		const frame = await this.exchange(signal, { type: "receive" }, void 0, 9e4);
+		if (!record$2(frame) || frame.type !== "event") throw new EventReceiverError("Invalid event frame", "invalid_response");
+		return validateOffer(frame.data);
+	}
+	async complete(body, signal) {
+		let receipt;
+		if (this.options.transport === "poll") receipt = unwrap(await completeWebhookEvent({
+			client: this.client,
+			path: { id: this.endpointId },
+			body,
+			responseStyle: "fields",
+			throwOnError: false,
+			signal: AbortSignal.any([signal, AbortSignal.timeout(15e3)])
+		})).data;
+		else {
+			await this.open(signal);
+			const frame = await this.exchange(signal, {
+				type: "complete",
+				body
+			}, void 0, 15e3);
+			if (!record$2(frame) || frame.type !== "receipt") throw new EventReceiverError("Invalid event receipt", "invalid_response");
+			receipt = frame.data;
+		}
+		if (!record$2(receipt) || !["completed", "already_completed"].includes(String(receipt.result))) throw new EventReceiverError("Invalid event receipt", "invalid_response");
+	}
+};
+//#endregion
+//#region src/oclif/shared-mail-watch.ts
+function ownerRecord(value) {
+	const o = mailObject(value, [
+		"generation",
+		"pid",
+		"identity",
+		"ready",
+		"gapCount",
+		"lastGapReason",
+		...value && typeof value === "object" && Object.hasOwn(value, "lastMailCheckAt") ? ["lastMailCheckAt"] : []
+	]);
+	if (typeof o.pid !== "number" || !Number.isSafeInteger(o.pid) || o.pid < 1 || typeof o.ready !== "boolean" || typeof o.gapCount !== "number" || !Number.isSafeInteger(o.gapCount) || o.gapCount < 0) throw invalidSharedMail();
+	return {
+		generation: mailId(o.generation),
+		pid: o.pid,
+		identity: mailString(o.identity),
+		ready: o.ready,
+		gapCount: o.gapCount,
+		lastGapReason: o.lastGapReason === null ? null : mailString(o.lastGapReason, 100),
+		lastMailCheckAt: o.lastMailCheckAt === void 0 || o.lastMailCheckAt === null ? null : mailTime(o.lastMailCheckAt)
+	};
+}
+function readSharedMailOwner(store) {
+	const raw = readMailJson(join(store.directory, "owner.json"));
+	if (raw === null) return null;
+	const owner = ownerRecord(raw);
+	return {
+		...owner,
+		alive: compareListenProcessIdentity(owner.identity, listenProcessIdentity(owner.pid)) === true
+	};
+}
+/** The caller stays in the foreground and owns the only remote stream until close. */
+function tryOwnSharedMail(store) {
+	let release;
+	try {
+		release = acquireListenLock(store.directory, "shared-mail-stream");
+	} catch (error) {
+		if (mailLockBusy(error)) return null;
+		throw error;
+	}
+	const path = join(store.directory, "owner.json"), identity = listenProcessIdentity(process.pid);
+	if (identity === null) {
+		release();
+		throw invalidSharedMail();
+	}
+	let current = {
+		generation: randomUUID(),
+		pid: process.pid,
+		identity,
+		ready: false,
+		gapCount: 0,
+		lastGapReason: null,
+		lastMailCheckAt: null
+	};
+	let closed = false;
+	try {
+		writeMailJson(path, current);
+	} catch (error) {
+		release();
+		throw error;
+	}
+	const markStatus = (status) => {
+		if (closed) throw invalidSharedMail();
+		const existing = readMailJson(path);
+		if (existing === null || ownerRecord(existing).generation !== current.generation) throw invalidSharedMail();
+		const next = ownerRecord({
+			...current,
+			...status
+		});
+		if (next.gapCount < current.gapCount) throw invalidSharedMail();
+		writeMailJson(path, next);
+		current = next;
+	};
+	return {
+		generation: current.generation,
+		markReady(status = {}) {
+			markStatus({
+				...status,
+				ready: true
+			});
+		},
+		markStatus,
+		markChecked() {
+			markStatus({ lastMailCheckAt: (/* @__PURE__ */ new Date()).toISOString() });
+		},
+		close() {
+			if (closed) return;
+			closed = true;
+			try {
+				const existing = readMailJson(path);
+				if (existing !== null && ownerRecord(existing).generation === current.generation) removeMailFile(path);
+			} finally {
+				release();
+			}
+		}
+	};
+}
+/** Install before reading state. Watches are hints; timeout reconciles local records only. */
+function waitForSharedMailChange(store, options) {
+	const timeoutMs = options.timeoutMs ?? 1e3;
+	if (!Number.isFinite(timeoutMs) || timeoutMs < 1 || timeoutMs > 6e4) throw new RangeError("Shared mail reconciliation delay must be between 1 and 60000 milliseconds.");
+	return new Promise((resolve, reject) => {
+		const watchers = [];
+		let timer;
+		let done = false;
+		const finish = (error) => {
+			if (done) return;
+			done = true;
+			clearTimeout(timer);
+			options.signal.removeEventListener("abort", abort);
+			for (const watcher of watchers) watcher.close();
+			if (error !== void 0) reject(error);
+			else resolve();
+		};
+		const abort = () => finish(options.signal.reason ?? /* @__PURE__ */ new Error("Shared mail wait aborted."));
+		options.signal.addEventListener("abort", abort, { once: true });
+		if (options.signal.aborted) {
+			abort();
+			return;
+		}
+		try {
+			for (const path of [
+				store.directory,
+				join(store.directory, "emails"),
+				join(store.directory, "waits")
+			]) {
+				const watcher = watch(path, (_event, filename) => {
+					const name = filename?.toString();
+					if (name && (path === store.directory ? name === "owner.json" : name.endsWith(".json") && !name.startsWith(".write-"))) finish();
+				});
+				watchers.push(watcher);
+				watcher.on("error", () => finish());
+			}
+			timer = setTimeout(() => finish(), timeoutMs);
+		} catch (error) {
+			finish(error);
+		}
+	});
+}
+//#endregion
+//#region src/oclif/wake-context.ts
+const security = [{
+	scheme: "bearer",
+	type: "http"
+}];
+const UUID = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
+const WAKE_ADDRESS = /^[a-z0-9._%+-]{1,64}@[a-z0-9.-]{1,253}$/;
+const afterUnsupported = /* @__PURE__ */ new WeakSet();
+/** The bare lowercase address in `Name <addr>` or `addr` form. */
+function bareAddress(value) {
+	if (typeof value !== "string") return null;
+	const address = (/<([^<>\s]+@[^<>\s]+)>\s*$/.exec(value)?.[1] ?? value).trim().toLowerCase();
+	return /^[^\s<>@]+@[^\s<>@]+$/.test(address) ? address : null;
+}
+function record$1(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function newerRows(value) {
+	if (!Array.isArray(value)) return void 0;
+	const rows = [];
+	for (const item of value.slice(-20)) {
+		const row = record$1(item);
+		const from = bareAddress(row?.from);
+		if (!row || typeof row.id !== "string" || !UUID.test(row.id) || !from || typeof row.received_at !== "string" || !Number.isFinite(Date.parse(row.received_at))) return void 0;
+		rows.push({
+			id: row.id.toLowerCase(),
+			from,
+			received_at: row.received_at
+		});
+	}
+	return rows;
+}
+/**
+* Read one thread, asking for mail newer than `afterEmailId`. The newer-mail
+* fields are feature-detected: an API that does not return them yields a
+* context without `newerInboundCount`. Returns null when the thread cannot be
+* read; callers treat that as "unknown", never as an error.
+*/
+async function readThreadContext(client, threadId, afterEmailId, signal) {
+	if (!UUID.test(threadId)) return null;
+	const bounded = AbortSignal.any([signal, AbortSignal.timeout(5e3)]);
+	const read = (after) => client.get({
+		security,
+		url: "/threads/{id}",
+		path: { id: threadId },
+		...after ? { query: { after } } : {},
+		signal: bounded,
+		responseStyle: "fields"
+	});
+	try {
+		const askAfter = afterEmailId !== void 0 && UUID.test(afterEmailId) && !afterUnsupported.has(client);
+		let result = await read(askAfter ? afterEmailId : void 0);
+		if (askAfter && result.response?.status === 400) {
+			afterUnsupported.add(client);
+			result = await read();
+		}
+		if (result.error !== void 0) return null;
+		const body = record$1(result.data);
+		const data = record$1(body?.data);
+		if (body?.success !== true || !data || !Array.isArray(data.messages)) return null;
+		const messages = data.messages.filter((message) => Boolean(record$1(message)) && typeof message.id === "string" && ["inbound", "outbound"].includes(message.direction));
+		const count = data.newer_inbound_count;
+		const newerInboundCount = typeof count === "number" && Number.isSafeInteger(count) && count >= 0 ? count : void 0;
+		const newerInbound = newerInboundCount === void 0 ? void 0 : newerRows(data.newer_inbound);
+		return {
+			threadId: threadId.toLowerCase(),
+			messages,
+			truncated: typeof data.message_count === "number" && data.message_count > messages.length,
+			...newerInboundCount === void 0 ? {} : { newerInboundCount },
+			...newerInbound === void 0 ? {} : { newerInbound }
+		};
+	} catch {
+		signal.throwIfAborted();
+		return null;
+	}
+}
+/** Whether `self` has an outbound message in the thread; undefined if unknowable. */
+function sentInThread(context, self) {
+	if (!context) return void 0;
+	const address = self.toLowerCase();
+	if (context.messages.some((message) => message.direction === "outbound" && bareAddress(message.from) === address)) return true;
+	return context.truncated ? void 0 : false;
+}
+/** The latest outbound message from `self` in the thread, if listed. */
+function latestOwnOutbound(context, self) {
+	const address = self.toLowerCase();
+	return [...context?.messages ?? []].reverse().find((message) => message.direction === "outbound" && bareAddress(message.from) === address);
+}
+function hasAttachments(detail) {
+	return (detail.parsed?.attachments?.length ?? 0) > 0;
+}
+/**
+* Map server-provided sender facts to one relationship label. The owner and
+* member labels come only from server admission; `agent` from the server's
+* connected-agent verification or network admission; `contact` from an
+* explicit contact allowance.
+*/
+function wakeRelationship(input) {
+	if (input.senderRelation) return input.senderRelation;
+	if (input.connectedAgentVerified || input.network) return "agent";
+	if (input.contact) return "contact";
+	return "other";
+}
+const SERVER_RELATIONSHIPS = {
+	owner: "owner",
+	org_agent: "agent",
+	member: "member",
+	contact: "contact",
+	other: "other"
+};
+/** The `collaboration` object of an email read, when the server sends one. */
+function collaborationOf(detail) {
+	return record$1(record$1(detail)?.collaboration);
+}
+/**
+* The sender relationship the server computed for this email
+* (`collaboration.sender_relationship`), mapped to the CLI's labels:
+* `org_agent` reads as `agent`. When present it is authoritative, `other`
+* included, so a stale local classification cannot override it. Returns
+* undefined only for an older server that sends no such field, or an
+* unrecognized value; the caller then keeps its own derivation.
+*/
+function serverRelationship(detail) {
+	const value = collaborationOf(detail)?.sender_relationship;
+	return typeof value === "string" && Object.hasOwn(SERVER_RELATIONSHIPS, value) ? SERVER_RELATIONSHIPS[value] : void 0;
+}
+/**
+* True when the server reports this email's thread as muted for the
+* receiving address (`collaboration.muted`, or `muted` on the email). An
+* older server sends neither and nothing is muted by it.
+*/
+function serverMuted(detail) {
+	return collaborationOf(detail)?.muted === true || record$1(detail)?.muted === true;
+}
+/**
+* An address fit to print as trusted metadata, or `unavailable`. The
+* sender's address is parsed from a header the sender wrote, so anything
+* outside a plain charset (quotes, spaces, line breaks) is withheld.
+*/
+function displayAddress(value) {
+	return WAKE_ADDRESS.test(value) ? value : "unavailable";
+}
+/** The metadata clause of a wake line. Addresses outside a plain charset are withheld. */
+function formatWakeContext(context) {
+	const sender = displayAddress(context.sender);
+	const thread = context.threadId && UUID.test(context.threadId) ? context.threadId.toLowerCase() : "none";
+	const newer = context.newer !== void 0 && Number.isSafeInteger(context.newer) && context.newer >= 0 ? ` newer=${Math.min(context.newer, 9999)}` : "";
+	return `from=${sender} relationship=${context.relationship} thread=${thread} in_thread=${context.inThread ? "yes" : "no"} attachments=${context.attachments ? "yes" : "no"}${newer}`;
+}
+/** Build a wake context, reading the thread once. Never throws for API failures. */
+async function describeWake(input) {
+	const { detail } = input;
+	const threadId = typeof detail.thread_id === "string" && UUID.test(detail.thread_id) ? detail.thread_id.toLowerCase() : null;
+	const thread = threadId ? await readThreadContext(input.client, threadId, detail.id, input.signal) : null;
+	return {
+		sender: detail.from_email.trim().toLowerCase(),
+		relationship: serverRelationship(detail) ?? input.relationship,
+		threadId,
+		inThread: input.localInThread || sentInThread(thread, input.self) === true,
+		attachments: hasAttachments(detail),
+		...thread?.newerInboundCount === void 0 ? {} : { newer: thread.newerInboundCount }
+	};
+}
+//#endregion
+//#region src/oclif/email-participants.ts
+/**
+* Everyone else an email was addressed to: its parsed To and Cc, as bare
+* lowercase addresses, without `self` (the mailbox reading it) or the sender,
+* in header order and de-duplicated. Bcc is never read. These are the
+* addresses `primitive reply --all` copies, and a non-empty list is what makes
+* an email a group email.
+*
+* Empty unless To or Cc names `self`. Mail that reached you without naming you
+* (a blind copy, an alias, a list) is not treated as a group: a blind
+* recipient who replies to everyone reveals the blind copy.
+*
+* To and Cc are written by the sender, so treat the list as the sender's
+* claim about who else received it, not as proof. Display them through
+* displayAddress, which withholds anything outside a plain charset.
+*/
+function otherParticipants(detail, self) {
+	const parsed = detail.parsed;
+	const me = bareAddress(self);
+	const excluded = new Set([me, bareAddress(detail.from_email)].filter((value) => value !== null));
+	const out = [];
+	let named = false;
+	for (const list of [parsed?.to_addresses, parsed?.cc]) {
+		if (!Array.isArray(list)) continue;
+		for (const entry of list) {
+			const address = bareAddress(typeof entry === "string" ? entry : entry && typeof entry === "object" ? entry.address : null);
+			if (address !== null && address === me) named = true;
+			if (!address || excluded.has(address)) continue;
+			excluded.add(address);
+			out.push(address);
+		}
+	}
+	return named ? out : [];
+}
+//#endregion
+//#region src/oclif/conversation-follow.ts
+function directory(context) {
+	const key = createHash("sha256").update(JSON.stringify([context.scope, mailAddress(context.recipient)])).digest("hex");
+	return join(context.configDir, "conversation-follows", key);
+}
+function session(value) {
+	const separator = value.indexOf(":");
+	const runtime = value.slice(0, separator);
+	if (!["codex", "claude"].includes(runtime)) throw new Error("Conversation receiving requires an exact runtime session.");
+	return `${runtime}:${mailId(value.slice(separator + 1))}`;
+}
+/** Read one exact server thread, never scan mail or infer a thread from a subject. */
+function readConversationFollow(context, threadId) {
+	const id = mailId(threadId), dir = directory(context);
+	try {
+		privateMailDirectory(dir);
+	} catch (error) {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	}
+	const value = readMailJson(join(dir, `${id}.json`));
+	if (value === null) return null;
+	const row = mailObject(value, [
+		"threadId",
+		"recipient",
+		"peer",
+		"sessionKey",
+		"since"
+	]);
+	const follow = {
+		threadId: mailId(row.threadId),
+		recipient: mailAddress(row.recipient),
+		peer: mailAddress(row.peer),
+		sessionKey: session(String(row.sessionKey)),
+		since: mailTime(row.since)
+	};
+	if (follow.threadId !== id || follow.recipient !== mailAddress(context.recipient)) throw new Error("Saved conversation identity does not match this connection.");
+	return follow;
+}
+/** Local receiving interest has no active waiter and never holds unrelated peer mail. */
+async function followEmailConversation(context, detail) {
+	if (detail.thread_id == null || !isPlainChatReply(detail)) return null;
+	const recipient = mailAddress(context.recipient), peer = mailAddress(context.peer);
+	if (otherParticipants(detail, recipient).length > 0) return null;
+	if (!["accepted", "completed"].includes(detail.status) || mailAddress(detail.recipient) !== recipient || mailAddress(detail.to_email) !== recipient || mailAddress(detail.from_email) !== peer || !scopedChatSenderTrust(detail, peer).trusted) throw new Error("Conversation receiving requires an authenticated email addressed to this connected agent.");
+	const follow = {
+		threadId: mailId(detail.thread_id),
+		recipient,
+		peer,
+		sessionKey: session(context.sessionKey),
+		since: mailTime(context.since ?? (/* @__PURE__ */ new Date()).toISOString())
+	};
+	const dir = directory(context);
+	privateMailDirectory(dir, true);
+	return withMailLock(dir, () => {
+		const existing = readConversationFollow(context, follow.threadId);
+		if (existing) {
+			if (existing.peer !== peer || existing.sessionKey !== follow.sessionKey) throw new Error("This conversation is already followed by another peer or native session. No receiving ownership was changed.");
+			return existing;
+		}
+		writeMailJson(join(dir, `${follow.threadId}.json`), follow);
+		return follow;
+	});
+}
+//#endregion
+//#region src/oclif/shared-mail-state.ts
+function createSharedMailWaiter() {
+	return {
+		token: randomUUID(),
+		pid: process.pid,
+		identity: listenProcessIdentity(process.pid)
+	};
+}
+function waiter(value) {
+	const owner = mailObject(value, [
+		"token",
+		"pid",
+		"identity"
+	]);
+	if (!Number.isSafeInteger(owner.pid) || Number(owner.pid) < 1) throw invalidSharedMail();
+	return {
+		token: mailId(owner.token),
+		pid: Number(owner.pid),
+		identity: owner.identity === null ? null : mailString(owner.identity)
+	};
+}
+function mayBeWaiting(owner) {
+	const identity = listenProcessIdentity(owner.pid);
+	const matches = compareListenProcessIdentity(owner.identity, identity);
+	if (matches !== null) return matches;
+	try {
+		process.kill(owner.pid, 0);
+	} catch (error) {
+		if (error.code === "ESRCH") return false;
+	}
+	return true;
+}
+function addWaiters(previous, owners) {
+	if (!previous.waiters) return previous;
+	const merged = new Map(previous.waiters.filter(mayBeWaiting).map((owner) => [owner.token, owner]));
+	for (const input of owners) {
+		const owner = waiter(input), existing = merged.get(owner.token);
+		if (existing && !same(existing, owner)) throw invalidSharedMail();
+		merged.set(owner.token, owner);
+	}
+	return {
+		...previous,
+		waiters: [...merged.values()]
+	};
+}
+const hash = (value) => createHash("sha256").update(value).digest("hex");
+const same = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+function details(value) {
+	const hasThread = Boolean(value && typeof value === "object" && Object.hasOwn(value, "threadId"));
+	const d = mailObject(value, [
+		...hasThread ? ["threadId"] : [],
+		"recipient",
+		"peer",
+		"replyToSentEmailId",
+		"receivedAt",
+		"authorization"
+	]);
+	if (d.authorization !== "pending" && d.authorization !== "trusted" && d.authorization !== "rejected") throw invalidSharedMail();
+	return {
+		...hasThread ? { threadId: mailId(d.threadId) } : {},
+		recipient: mailAddress(d.recipient),
+		peer: mailAddress(d.peer),
+		replyToSentEmailId: d.replyToSentEmailId === null ? null : mailId(d.replyToSentEmailId),
+		receivedAt: mailTime(d.receivedAt),
+		authorization: d.authorization
+	};
+}
+function wait(value) {
+	const hasWaiters = Boolean(value && typeof value === "object" && Object.hasOwn(value, "waiters"));
+	const hasControl = Boolean(value && typeof value === "object" && Object.hasOwn(value, "contactRequest"));
+	const w = mailObject(value, [
+		...hasWaiters ? ["waiters"] : [],
+		...hasControl ? ["contactRequest"] : [],
+		"requestId",
+		"peer",
+		"sessionKey",
+		"idempotencyKey",
+		"createdAt",
+		"status",
+		"sentEmailId"
+	]);
+	if (w.status !== "unbound" && w.status !== "uncertain" && w.status !== "bound" && w.status !== "completed" && w.status !== "cancelled") throw invalidSharedMail();
+	if (w.status !== "cancelled" && (w.status === "bound" || w.status === "completed") !== (w.sentEmailId !== null)) throw invalidSharedMail();
+	let owners;
+	if (hasWaiters) {
+		if (!Array.isArray(w.waiters) || w.waiters.length > 32) throw invalidSharedMail();
+		owners = w.waiters.map(waiter);
+		if (new Set(owners.map((owner) => owner.token)).size !== owners.length) throw invalidSharedMail();
+	}
+	return {
+		...owners ? { waiters: owners } : {},
+		...hasControl ? { contactRequest: contactRequestReference(w.contactRequest) } : {},
+		requestId: mailId(w.requestId),
+		peer: mailAddress(w.peer),
+		sessionKey: w.sessionKey === null ? null : mailString(w.sessionKey),
+		idempotencyKey: mailString(w.idempotencyKey),
+		createdAt: mailTime(w.createdAt),
+		status: w.status,
+		sentEmailId: w.sentEmailId === null ? null : mailId(w.sentEmailId)
+	};
+}
+function contactRequestReference(value) {
+	const r = mailObject(value, [
+		"interactionId",
+		"stepId",
+		"expiresAt"
+	]);
+	const interactionId = mailString(r.interactionId);
+	const at = interactionId.indexOf("@");
+	mailId(interactionId.slice(0, at));
+	mailAddress(interactionId);
+	return {
+		interactionId,
+		stepId: mailId(r.stepId),
+		expiresAt: mailTime(r.expiresAt)
+	};
+}
+function email(value) {
+	const e = mailObject(value, [
+		"emailId",
+		"eventId",
+		"receivedAt",
+		"firstSeenAt",
+		"details",
+		"route"
+	]);
+	let route = null;
+	if (e.route !== null) {
+		const raw = e.route;
+		if (raw.kind === "wait") {
+			const r = mailObject(raw, [
+				"kind",
+				"requestId",
+				"observed"
+			]);
+			if (typeof r.observed !== "boolean") throw invalidSharedMail();
+			route = {
+				kind: "wait",
+				requestId: mailId(r.requestId),
+				observed: r.observed
+			};
+		} else {
+			const r = mailObject(raw, [
+				"kind",
+				"sessionKey",
+				"state"
+			]);
+			if (r.kind !== "notification" || r.state !== "selected" && r.state !== "submitting" && r.state !== "accepted" && r.state !== "skipped" && r.state !== "unknown") throw invalidSharedMail();
+			route = {
+				kind: "notification",
+				sessionKey: mailString(r.sessionKey),
+				state: r.state
+			};
+		}
+	}
+	return {
+		emailId: mailId(e.emailId),
+		eventId: mailId(e.eventId),
+		receivedAt: mailTime(e.receivedAt),
+		firstSeenAt: mailTime(e.firstSeenAt),
+		details: e.details === null ? null : details(e.details),
+		route
+	};
+}
+function validate(path, value) {
+	const parts = path.split("/");
+	const file = parts.at(-1);
+	if (!file?.endsWith(".json")) throw invalidSharedMail();
+	const id = mailId(file.slice(0, -5));
+	if (parts.length === 2 && parts[0] === "emails") {
+		const e = email(value);
+		if (e.emailId !== id) throw invalidSharedMail();
+		return e;
+	}
+	if (parts.length === 2 && parts[0] === "waits") {
+		const w = wait(value);
+		if (w.requestId !== id) throw invalidSharedMail();
+		return w;
+	}
+	if (parts.length === 2 && parts[0] === "events") {
+		const r = mailObject(value, ["eventId", "emailId"]);
+		if (mailId(r.eventId) !== id) throw invalidSharedMail();
+		return {
+			eventId: id,
+			emailId: mailId(r.emailId)
+		};
+	}
+	if (parts.length === 2 && parts[0] === "parents") {
+		const r = mailObject(value, ["sentEmailId", "requestId"]);
+		if (mailId(r.sentEmailId) !== id) throw invalidSharedMail();
+		return {
+			sentEmailId: id,
+			requestId: mailId(r.requestId)
+		};
+	}
+	if (parts.length === 3 && parts[0] === "unbound" && /^[a-f0-9]{64}$/.test(parts[1] ?? "")) {
+		if (mailId(mailObject(value, ["requestId"]).requestId) !== id) throw invalidSharedMail();
+		return { requestId: id };
+	}
+	if (parts.length === 3 && parts[0] === "matches") {
+		const r = mailObject(value, ["emailId", "requestId"]);
+		if (mailId(r.emailId) !== id || mailId(r.requestId) !== mailId(parts[1])) throw invalidSharedMail();
+		return {
+			emailId: id,
+			requestId: mailId(parts[1])
+		};
+	}
+	throw invalidSharedMail();
+}
+function fileIds(directory, options) {
+	const limit = options.limit ?? 100;
+	if (!Number.isSafeInteger(limit) || limit < 1 || limit > 1e3) throw new SharedMailStateError("Shared mail page limit must be between 1 and 1000.");
+	const cursor = options.cursor === void 0 ? "" : mailId(options.cursor);
+	const selected = [];
+	let entries;
+	try {
+		privateMailDirectory(directory);
+		entries = opendirSync(directory);
+	} catch (error) {
+		if (error.code === "ENOENT") return {
+			ids: [],
+			nextCursor: null
+		};
+		throw error;
+	}
+	try {
+		for (let item = entries.readSync(); item !== null; item = entries.readSync()) {
+			if (item.name.startsWith(".write-")) continue;
+			if (!item.isFile() || !item.name.endsWith(".json")) throw invalidSharedMail();
+			const id = mailId(item.name.slice(0, -5));
+			if (item.name !== `${id}.json`) throw invalidSharedMail();
+			if (id <= cursor) continue;
+			selected.push(id);
+			selected.sort();
+			if (selected.length > limit + 1) selected.pop();
+		}
+	} finally {
+		entries.closeSync();
+	}
+	const more = selected.length > limit, ids = selected.slice(0, limit);
+	return {
+		ids,
+		nextCursor: more ? ids.at(-1) ?? null : null
+	};
+}
+/** Reserve the one local subscription before its server-verified recipient is known. */
+async function reserveSharedMailSubscription(options) {
+	options.signal?.throwIfAborted();
+	const directory = join(options.configDir, "shared-mail", hash(mailString(options.scope, 1024)));
+	privateMailDirectory(directory, true);
+	privateMailDirectory(dirname(directory));
+	return withMailLock(directory, () => {
+		const path = join(directory, "subscription.json"), raw = readMailJson(path);
+		const requested = options.recipient === void 0 ? null : mailAddress(options.recipient);
+		let name = `local-mail-${randomUUID()}`, recipient = requested;
+		if (raw !== null) {
+			const saved = mailObject(raw, ["name", "recipient"]);
+			if (typeof saved.name !== "string" || !saved.name.startsWith("local-mail-")) throw invalidSharedMail();
+			mailId(saved.name.slice(11));
+			name = saved.name;
+			const prior = saved.recipient === null ? null : mailAddress(saved.recipient);
+			if (prior !== null && requested !== null && prior !== requested) throw invalidSharedMail();
+			recipient = prior ?? requested;
+			if (recipient !== prior) writeMailJson(path, {
+				name,
+				recipient
+			});
+		} else writeMailJson(path, {
+			name,
+			recipient
+		});
+		for (const current of [
+			directory,
+			dirname(directory),
+			options.configDir
+		]) syncMailDirectory(current);
+		return {
+			directory,
+			name,
+			recipient
+		};
+	}, options.signal);
+}
+/** Metadata only. Callers validate exact GET recipient, authentication and ancestry before hydration. */
+async function openSharedMailStore(options) {
+	options.signal?.throwIfAborted();
+	const recipient = mailAddress(options.recipient);
+	const reserved = await reserveSharedMailSubscription(options);
+	const directory = reserved.directory;
+	for (const kind of [
+		"emails",
+		"events",
+		"waits",
+		"parents",
+		"unbound",
+		"matches"
+	]) privateMailDirectory(join(directory, kind), true);
+	const pathFor = (kind, id) => `${kind}/${mailId(id)}.json`;
+	const read = (path) => {
+		const parent = dirname(join(directory, path));
+		try {
+			privateMailDirectory(parent);
+		} catch (error) {
+			if (error.code === "ENOENT") return null;
+			throw error;
+		}
+		const raw = readMailJson(join(directory, path));
+		return raw === null ? null : validate(path, raw);
+	};
+	const readEmail = (id) => read(pathFor("emails", id));
+	const readWait = (id) => read(pathFor("waits", id));
+	const requiredEmail = (id) => {
+		const e = readEmail(id);
+		if (!e) throw invalidSharedMail();
+		return e;
+	};
+	const requiredWait = (id) => {
+		const w = readWait(id);
+		if (!w) throw invalidSharedMail();
+		return w;
+	};
+	function recover() {
+		const raw = readMailJson(join(directory, "pending.json"), 65536);
+		if (raw === null) return;
+		const pending = mailObject(raw, ["writes"]);
+		if (!Array.isArray(pending.writes) || !pending.writes.length || pending.writes.length > 8) throw invalidSharedMail();
+		const writes = pending.writes.map((value) => {
+			const w = mailObject(value, [
+				"path",
+				"before",
+				"after"
+			]), path = mailString(w.path, 200);
+			const before = w.before === null ? null : validate(path, w.before), after = w.after === null ? null : validate(path, w.after);
+			if (before === null && after === null) throw invalidSharedMail();
+			return {
+				path,
+				before,
+				after
+			};
+		});
+		if (new Set(writes.map((w) => w.path)).size !== writes.length) throw invalidSharedMail();
+		for (const w of writes) {
+			const current = read(w.path);
+			if (!same(current, w.before) && !same(current, w.after)) throw invalidSharedMail();
+		}
+		for (const w of writes) if (w.after === null) removeMailFile(join(directory, w.path));
+		else writeMailJson(join(directory, w.path), w.after);
+		removeMailFile(join(directory, "pending.json"));
+	}
+	function commit(changes) {
+		const writes = changes.map(({ path, value }) => ({
+			path,
+			before: read(path),
+			after: value === null ? null : validate(path, value)
+		})).filter((w) => !same(w.before, w.after));
+		if (!writes.length) return;
+		writeMailJson(join(directory, "pending.json"), { writes });
+		recover();
+	}
+	const transaction = (action) => withMailLock(directory, () => {
+		recover();
+		return action();
+	}, options.signal);
+	await transaction(() => {});
+	const subscriptionName = reserved.name;
+	const unboundPath = (w) => `unbound/${hash(w.peer)}/${w.requestId}.json`;
+	return {
+		directory,
+		subscriptionName,
+		recipient,
+		readEmail: (id) => transaction(() => readEmail(id)),
+		readWait: (id) => transaction(() => readWait(id)),
+		ingest(input) {
+			return transaction(() => {
+				const emailId = mailId(input.emailId), eventId = mailId(input.eventId), previous = readEmail(emailId);
+				const eventPath = pathFor("events", eventId), indexed = read(eventPath);
+				if (indexed && (indexed.emailId !== emailId || !previous)) throw invalidSharedMail();
+				const record = previous ?? {
+					emailId,
+					eventId,
+					receivedAt: mailTime(input.receivedAt),
+					firstSeenAt: (/* @__PURE__ */ new Date()).toISOString(),
+					details: null,
+					route: null
+				};
+				commit([{
+					path: pathFor("emails", emailId),
+					value: record
+				}, {
+					path: eventPath,
+					value: {
+						eventId,
+						emailId
+					}
+				}]);
+				return record;
+			});
+		},
+		hydrate(emailId, input) {
+			return transaction(() => {
+				const record = requiredEmail(emailId), verified = details(input);
+				if (verified.threadId === void 0 && record.details?.threadId) verified.threadId = record.details.threadId;
+				if (verified.recipient !== recipient) throw invalidSharedMail();
+				if (record.details && record.details.authorization !== "pending" && !same(details({
+					...record.details,
+					...record.details.replyToSentEmailId === null ? { replyToSentEmailId: verified.replyToSentEmailId } : {},
+					...record.details.threadId === void 0 && verified.threadId ? { threadId: verified.threadId } : {}
+				}), details(verified))) throw invalidSharedMail();
+				const next = {
+					...record,
+					receivedAt: verified.receivedAt,
+					details: verified
+				};
+				commit([{
+					path: pathFor("emails", emailId),
+					value: next
+				}]);
+				return next;
+			});
+		},
+		registerWait(input) {
+			return transaction(() => {
+				const { waiter: owner, ...registration } = input;
+				const requested = wait({
+					...registration,
+					...owner ? { waiters: [owner] } : {},
+					sessionKey: input.sessionKey ?? null,
+					status: "unbound",
+					sentEmailId: null
+				}), previous = readWait(requested.requestId);
+				if (previous) {
+					if (!same({
+						...previous,
+						waiters: void 0,
+						status: "unbound",
+						sentEmailId: null
+					}, {
+						...requested,
+						waiters: void 0
+					})) throw invalidSharedMail();
+					const next = addWaiters(previous, owner ? [owner] : []);
+					commit([{
+						path: pathFor("waits", next.requestId),
+						value: next
+					}]);
+					return next;
+				}
+				commit([{
+					path: pathFor("waits", requested.requestId),
+					value: requested
+				}, {
+					path: unboundPath(requested),
+					value: { requestId: requested.requestId }
+				}]);
+				return requested;
+			});
+		},
+		joinWait(requestId, owner) {
+			return transaction(() => {
+				const previous = requiredWait(requestId);
+				if (previous.status !== "bound" && previous.status !== "completed") throw invalidSharedMail();
+				const next = addWaiters(previous, [owner]);
+				commit([{
+					path: pathFor("waits", requestId),
+					value: next
+				}]);
+				return next;
+			});
+		},
+		releaseWaiter(requestId, token) {
+			return transaction(() => {
+				const previous = requiredWait(requestId), owner = mailId(token);
+				const records = [previous];
+				if (previous.status === "cancelled" && previous.sentEmailId) {
+					const parent = read(pathFor("parents", previous.sentEmailId));
+					if (parent && parent.requestId !== previous.requestId) records.push(requiredWait(parent.requestId));
+				}
+				commit(records.filter((record) => record.waiters).map((record) => ({
+					path: pathFor("waits", record.requestId),
+					value: {
+						...record,
+						waiters: record.waiters?.filter((entry) => entry.token !== owner)
+					}
+				})));
+				return requiredWait(requestId);
+			});
+		},
+		findWaitByParent(sentEmailId) {
+			return transaction(() => {
+				const parent = read(pathFor("parents", sentEmailId));
+				return parent === null ? null : requiredWait(parent.requestId);
+			});
+		},
+		wakeDisposition(emailId, sentEmailId) {
+			return transaction(() => {
+				const email = readEmail(mailId(emailId));
+				if (email?.route?.kind === "wait" && email.route.observed) return "observed";
+				const parent = read(pathFor("parents", mailId(sentEmailId)));
+				if (!parent) return "available";
+				const w = requiredWait(parent.requestId);
+				if (w.status === "bound" && w.waiters?.some(mayBeWaiting)) return "waiting";
+				return "available";
+			});
+		},
+		bindWait(requestId, sentEmailId) {
+			return transaction(() => {
+				const previous = requiredWait(requestId), parent = mailId(sentEmailId), parentPath = pathFor("parents", parent);
+				const occupied = read(parentPath);
+				if (previous.sentEmailId !== null && previous.sentEmailId !== parent) throw invalidSharedMail();
+				if (occupied && occupied.requestId !== previous.requestId) {
+					const canonical = requiredWait(occupied.requestId);
+					if (canonical.sentEmailId !== parent || canonical.peer !== previous.peer || canonical.sessionKey !== null && previous.sessionKey !== null && canonical.sessionKey !== previous.sessionKey || !same(canonical.contactRequest ?? null, previous.contactRequest ?? null)) throw invalidSharedMail();
+					if (canonical.status === "bound") {
+						if (previous.status !== "unbound" && previous.status !== "cancelled") throw invalidSharedMail();
+						const joined = previous.waiters ? addWaiters(canonical, previous.waiters) : {
+							...canonical,
+							waiters: void 0
+						};
+						if (joined.waiters === void 0) delete joined.waiters;
+						commit([
+							{
+								path: pathFor("waits", canonical.requestId),
+								value: joined
+							},
+							{
+								path: pathFor("waits", requestId),
+								value: {
+									...previous,
+									...previous.waiters ? { waiters: [] } : {},
+									status: "cancelled",
+									sentEmailId: parent
+								}
+							},
+							{
+								path: unboundPath(previous),
+								value: null
+							}
+						]);
+						return joined;
+					}
+					if (canonical.status !== "completed") throw invalidSharedMail();
+					previous.sessionKey ??= canonical.sessionKey;
+				}
+				if (previous.status === "cancelled" || previous.status === "completed") throw invalidSharedMail();
+				const next = {
+					...previous,
+					status: "bound",
+					sentEmailId: parent
+				};
+				commit([
+					{
+						path: pathFor("waits", requestId),
+						value: next
+					},
+					{
+						path: parentPath,
+						value: {
+							sentEmailId: parent,
+							requestId: previous.requestId
+						}
+					},
+					{
+						path: unboundPath(previous),
+						value: null
+					}
+				]);
+				return next;
+			});
+		},
+		cancelWaitBeforeSend(requestId) {
+			return transaction(() => {
+				const previous = requiredWait(requestId);
+				if (previous.status !== "unbound" && !(previous.status === "cancelled" && previous.sentEmailId === null)) throw invalidSharedMail();
+				const next = {
+					...previous,
+					status: "cancelled"
+				};
+				commit([{
+					path: pathFor("waits", requestId),
+					value: next
+				}, {
+					path: unboundPath(previous),
+					value: null
+				}]);
+				return next;
+			});
+		},
+		cancelRejectedSend(requestId) {
+			return transaction(() => {
+				const previous = requiredWait(requestId);
+				if (previous.sentEmailId !== null || ![
+					"unbound",
+					"uncertain",
+					"cancelled"
+				].includes(previous.status)) throw invalidSharedMail();
+				const next = {
+					...previous,
+					status: "cancelled"
+				};
+				commit([{
+					path: pathFor("waits", requestId),
+					value: next
+				}, {
+					path: unboundPath(previous),
+					value: null
+				}]);
+				return next;
+			});
+		},
+		finishWait(requestId) {
+			return transaction(() => {
+				const previous = requiredWait(requestId);
+				if (previous.status === "completed") return previous;
+				if (previous.status !== "bound") throw invalidSharedMail();
+				let observed = 0, cursor;
+				do {
+					const page = fileIds(join(directory, "matches", previous.requestId), { cursor });
+					for (const id of page.ids) {
+						if (read(`matches/${previous.requestId}/${id}.json`) === null) throw invalidSharedMail();
+						const r = requiredEmail(id).route;
+						if (r?.kind !== "wait" || r.requestId !== previous.requestId || !r.observed) throw invalidSharedMail();
+						observed++;
+					}
+					cursor = page.nextCursor ?? void 0;
+				} while (cursor);
+				if (!observed) throw invalidSharedMail();
+				const next = {
+					...previous,
+					status: "completed"
+				};
+				commit([{
+					path: pathFor("waits", requestId),
+					value: next
+				}]);
+				return next;
+			});
+		},
+		markWaitUncertain(requestId) {
+			return transaction(() => {
+				const previous = requiredWait(requestId);
+				if (previous.status !== "unbound" && previous.status !== "uncertain") throw invalidSharedMail();
+				const next = {
+					...previous,
+					status: "uncertain"
+				};
+				commit([{
+					path: pathFor("waits", requestId),
+					value: next
+				}]);
+				return next;
+			});
+		},
+		claimForWait(emailId, requestId, token) {
+			return transaction(() => {
+				const record = requiredEmail(emailId), w = requiredWait(requestId);
+				if (w.waiters && !w.waiters.some((owner) => owner.token === token && mayBeWaiting(owner))) return {
+					status: "held",
+					email: record
+				};
+				if (record.route?.kind === "notification" && ["accepted", "skipped"].includes(record.route.state) && w.contactRequest && w.waiters && w.status === "bound" && record.details?.authorization === "trusted" && record.details.peer === w.peer && record.details.replyToSentEmailId === w.sentEmailId) return {
+					status: "claimed",
+					email: record
+				};
+				if (record.route) return {
+					status: record.route.kind === "wait" && record.route.requestId === w.requestId ? record.route.observed ? "already_observed" : "claimed" : "held",
+					email: record
+				};
+				if (!record.details || record.details.authorization === "pending" || w.status !== "bound") return {
+					status: "held",
+					email: record
+				};
+				if (record.details.authorization !== "trusted" || record.details.peer !== w.peer || record.details.replyToSentEmailId !== w.sentEmailId) return {
+					status: "unmatched",
+					email: record
+				};
+				const next = {
+					...record,
+					route: {
+						kind: "wait",
+						requestId: w.requestId,
+						observed: false
+					}
+				};
+				commit([{
+					path: pathFor("emails", emailId),
+					value: next
+				}, {
+					path: `matches/${w.requestId}/${record.emailId}.json`,
+					value: {
+						emailId: record.emailId,
+						requestId: w.requestId
+					}
+				}]);
+				return {
+					status: "claimed",
+					email: next
+				};
+			});
+		},
+		markWaitObserved(emailId, requestId) {
+			return transaction(() => {
+				const record = requiredEmail(emailId);
+				if (record.route?.kind !== "wait" || record.route.requestId !== mailId(requestId)) throw invalidSharedMail();
+				const next = {
+					...record,
+					route: {
+						...record.route,
+						observed: true
+					}
+				};
+				commit([{
+					path: pathFor("emails", emailId),
+					value: next
+				}]);
+				return next;
+			});
+		},
+		observeNotifiedContactReply(emailId, requestId, token) {
+			return transaction(() => {
+				const record = requiredEmail(emailId), w = requiredWait(requestId);
+				if (record.route?.kind !== "notification" || !["accepted", "skipped"].includes(record.route.state)) return false;
+				if (!w.contactRequest || !["bound", "completed"].includes(w.status) || !w.waiters?.some((owner) => owner.token === token && mayBeWaiting(owner)) || record.details?.authorization !== "trusted" || record.details.peer !== w.peer || record.details.replyToSentEmailId !== w.sentEmailId) throw invalidSharedMail();
+				commit([{
+					path: pathFor("waits", requestId),
+					value: {
+						...w,
+						status: "completed"
+					}
+				}]);
+				return true;
+			});
+		},
+		claimForNotification(emailId, sessionKey) {
+			return transaction(() => {
+				const record = requiredEmail(emailId), session = mailString(sessionKey), d = record.details;
+				if (record.route) return {
+					status: record.route.kind === "notification" && record.route.state === "skipped" ? "already_observed" : record.route.kind === "notification" && record.route.sessionKey === session ? record.route.state === "selected" ? "claimed" : record.route.state === "accepted" ? "already_observed" : "held" : "held",
+					email: record
+				};
+				if (!d || d.authorization === "pending") return {
+					status: "held",
+					email: record
+				};
+				if (d.authorization !== "trusted") return {
+					status: "unmatched",
+					email: record
+				};
+				if (d.threadId) {
+					const followed = readConversationFollow({
+						configDir: options.configDir,
+						scope: options.scope,
+						recipient
+					}, d.threadId);
+					if (followed && followed.sessionKey !== session) return {
+						status: "held",
+						email: record
+					};
+				}
+				if (d.replyToSentEmailId) {
+					const parent = read(pathFor("parents", d.replyToSentEmailId));
+					if (parent) {
+						const w = requiredWait(parent.requestId);
+						if (w.sentEmailId !== d.replyToSentEmailId) throw invalidSharedMail();
+						if (w.sessionKey !== null && w.sessionKey !== session) return {
+							status: "held",
+							email: record
+						};
+						if (w.status === "bound" && w.peer === d.peer && (!w.waiters || w.waiters.some(mayBeWaiting))) return {
+							status: "held",
+							email: record
+						};
+					}
+				}
+				let cursor;
+				do {
+					const page = fileIds(join(directory, "unbound", hash(d.peer)), { cursor });
+					for (const id of page.ids) {
+						if (read(`unbound/${hash(d.peer)}/${id}.json`) === null) throw invalidSharedMail();
+						const w = requiredWait(id);
+						if (w.peer !== d.peer || w.status !== "unbound" && w.status !== "uncertain") throw invalidSharedMail();
+						return {
+							status: "held",
+							email: record
+						};
+					}
+					cursor = page.nextCursor ?? void 0;
+				} while (cursor);
+				const next = {
+					...record,
+					route: {
+						kind: "notification",
+						sessionKey: session,
+						state: "selected"
+					}
+				};
+				commit([{
+					path: pathFor("emails", emailId),
+					value: next
+				}]);
+				return {
+					status: "claimed",
+					email: next
+				};
+			});
+		},
+		releaseNotification(emailId, sessionKey) {
+			return transaction(() => {
+				const record = requiredEmail(emailId), route = record.route;
+				if (route?.kind !== "notification" || route.sessionKey !== mailString(sessionKey) || route.state !== "selected") throw invalidSharedMail();
+				const next = {
+					...record,
+					route: null
+				};
+				commit([{
+					path: pathFor("emails", emailId),
+					value: next
+				}]);
+				return next;
+			});
+		},
+		skipNotification(emailId, sessionKey) {
+			return transaction(() => {
+				const record = requiredEmail(emailId), route = record.route;
+				if (route?.kind !== "notification" || route.sessionKey !== mailString(sessionKey) || route.state !== "selected" && route.state !== "skipped") throw invalidSharedMail();
+				const next = {
+					...record,
+					route: {
+						...route,
+						state: "skipped"
+					}
+				};
+				commit([{
+					path: pathFor("emails", emailId),
+					value: next
+				}]);
+				return next;
+			});
+		},
+		markNotification(emailId, state) {
+			return transaction(() => {
+				const record = requiredEmail(emailId), route = record.route;
+				if (route?.kind !== "notification" || ![
+					"submitting",
+					"accepted",
+					"unknown"
+				].includes(state) || route.state === "selected" && state !== "submitting" || route.state !== "selected" && route.state !== "submitting" && route.state !== state) throw invalidSharedMail();
+				const next = {
+					...record,
+					route: {
+						...route,
+						state
+					}
+				};
+				commit([{
+					path: pathFor("emails", emailId),
+					value: next
+				}]);
+				return next;
+			});
+		},
+		listEmails(options = {}) {
+			return transaction(() => {
+				const page = fileIds(join(directory, "emails"), options);
+				return {
+					emails: page.ids.map(requiredEmail),
+					nextCursor: page.nextCursor
+				};
+			});
+		},
+		listWaitEmails(requestId, options = {}) {
+			return transaction(() => {
+				const request = mailId(requestId), page = fileIds(join(directory, "matches", request), options);
+				return {
+					emails: page.ids.map((id) => {
+						if (read(`matches/${request}/${id}.json`) === null) throw invalidSharedMail();
+						const e = requiredEmail(id);
+						if (e.route?.kind !== "wait" || e.route.requestId !== request) throw invalidSharedMail();
+						return e;
+					}),
+					nextCursor: page.nextCursor
+				};
+			});
+		}
+	};
+}
+//#endregion
+//#region src/oclif/shared-mail-transport.ts
+function invalid$1(message) {
+	return new EventReceiverError(message, "invalid_response");
+}
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+async function ensureSharedMailSubscription(options) {
+	const signal = options.signal;
+	const result = await createEndpoint({
+		client: options.apiClient.client,
+		body: {
+			kind: "pull",
+			name: options.subscription,
+			rules: { event_types: ["email.received"] }
+		},
+		signal: AbortSignal.any([signal, AbortSignal.timeout(15e3)]),
+		responseStyle: "fields"
+	});
+	if (result.error || !result.data?.data) throw new EventReceiverError("Could not open the shared inbound subscription.", "subscription_failed", result.response?.status ?? 0);
+	const created = result.data.data;
+	if (typeof created.id !== "string" || !created.id || created.kind !== "pull" || created.enabled !== true || !Array.isArray(created.rules?.event_types) || created.rules.event_types.length !== 1 || created.rules.event_types[0] !== "email.received" || typeof created.recipient !== "string" || !/^[^\s<>@]+@[^\s<>@]+\.[^\s<>@]+$/.test(created.recipient) || options.recipient !== void 0 && created.recipient.trim().toLowerCase() !== options.recipient.trim().toLowerCase() || !created.receiver_capabilities?.stream_protocols.includes("primitive.events.v1") || !created.receiver_capabilities.completion_modes.includes("sdk")) throw invalid$1("The API did not return a compatible subscription for the connected address.");
+	return {
+		endpointId: created.id,
+		recipient: created.recipient.trim().toLowerCase()
+	};
+}
+/** The elected foreground owner journals IDs before accepting remote delivery. */
+async function runSharedMailTransport(options) {
+	const failed = new AbortController();
+	const signal = AbortSignal.any([options.signal, failed.signal]);
+	let connected = false;
+	async function retry(operation, deadline) {
+		for (let attempt = 0;; attempt++) {
+			signal.throwIfAborted();
+			if (deadline !== void 0 && Date.now() >= deadline) throw invalid$1("The shared inbound completion lease expired; durable ingress remains available for redelivery.");
+			try {
+				return await operation();
+			} catch (error) {
+				signal.throwIfAborted();
+				if (!(error instanceof EventReceiverError) || ["invalid_response", "unsupported"].includes(error.code) || !([
+					0,
+					408,
+					429
+				].includes(error.status) || error.status >= 500)) throw error;
+				connected = false;
+				await options.status({ ready: false });
+				await setTimeout$1(Math.max(error.retryAfterMs, Math.min(1e4, 250 * 2 ** Math.min(attempt, 6))), void 0, { signal });
+			}
+		}
+	}
+	const created = await retry(() => ensureSharedMailSubscription({
+		...options,
+		signal
+	}));
+	let statusWork = Promise.resolve();
+	const publishChecked = () => {
+		const checked = options.checked;
+		if (!checked) return;
+		statusWork = statusWork.then(() => checked());
+		statusWork.catch((error) => failed.abort(error));
+	};
+	const publishStatus = (value) => {
+		publishChecked();
+		statusWork = statusWork.then(() => options.status({
+			gapCount: value.gap_count,
+			lastGapReason: value.last_gap_reason
+		}));
+		statusWork.catch((error) => failed.abort(error));
+	};
+	const stream = new EventConnection(options.apiClient.client, created.endpointId, { onStatus: publishStatus });
+	const ensureOpen = async () => {
+		if (connected) return;
+		await stream.open(signal);
+		await statusWork;
+		await options.ready();
+		connected = true;
+	};
+	try {
+		await retry(ensureOpen);
+		while (!signal.aborted) {
+			const offer = await retry(async () => {
+				await ensureOpen();
+				return stream.receive(signal);
+			});
+			publishStatus(offer);
+			await statusWork;
+			const delivery = offer.delivery;
+			if (!delivery) continue;
+			const started = performance.now();
+			let body;
+			try {
+				body = JSON.parse(delivery.body);
+			} catch {
+				throw invalid$1("The shared subscription returned invalid JSON.");
+			}
+			if (delivery.event_type !== "email.received" || !record(body) || !record(body.email) || typeof body.email.id !== "string" || !body.email.id || typeof body.email.received_at !== "string" || !Number.isFinite(Date.parse(body.email.received_at)) || !record(body.email.smtp) || !Array.isArray(body.email.smtp.rcpt_to) || body.email.smtp.rcpt_to.length !== 1 || typeof body.email.smtp.rcpt_to[0] !== "string" || body.email.smtp.rcpt_to[0].trim().toLowerCase() !== options.recipient.trim().toLowerCase()) throw invalid$1("The shared subscription returned an invalid or out-of-scope inbound event.");
+			await options.ingest({
+				eventId: delivery.event_id,
+				emailId: body.email.id,
+				receivedAt: body.email.received_at
+			});
+			const elapsed = Math.round(performance.now() - started);
+			if (elapsed > 3e4) throw invalid$1("Shared inbound persistence exceeded the handler deadline; durable ingress remains available for redelivery.");
+			const completion = {
+				queue_id: delivery.queue_id,
+				delivery_id: delivery.delivery_id,
+				lease_token: delivery.lease_token,
+				mode: "sdk",
+				accepted: true,
+				duration_ms: elapsed
+			};
+			const leaseDeadline = Date.parse(delivery.lease_expires_at);
+			if (Date.now() >= leaseDeadline) throw invalid$1("The shared inbound lease expired after durable recording; it remains eligible for redelivery.");
+			await retry(async () => {
+				await ensureOpen();
+				if (Date.now() >= leaseDeadline) throw invalid$1("The shared inbound completion lease expired; durable ingress remains available for redelivery.");
+				return stream.complete(completion, AbortSignal.any([signal, AbortSignal.timeout(Math.max(1, leaseDeadline - Date.now()))]));
+			}, leaseDeadline);
+		}
+	} finally {
+		stream.close();
+	}
+}
+//#endregion
+//#region src/oclif/shared-mail-receiver.ts
+function sharedMailScope(apiKey, baseUrl) {
+	if (!apiKey?.startsWith("pconn_")) throw new Error("Shared mail receiving requires connected credentials.");
+	return listenIdentity(baseUrl, `connection:${scryptSync(apiKey, "primitive-listener-identity-v1", 32).toString("hex")}`);
+}
+/** Join locally, or own the stable remote subscription while this command lives. */
+async function openSharedMailReceiver(options) {
+	const scope = sharedMailScope(options.apiKey, options.baseUrl);
+	const stopping = new AbortController();
+	let timer;
+	const arm = () => {
+		if (options.deadline == null) return;
+		const remaining = Math.max(0, options.deadline - Date.now());
+		timer = setTimeout(remaining > 2 ** 31 - 1 ? arm : () => stopping.abort(new DOMException("Mail wait timed out", "TimeoutError")), Math.min(remaining, 2 ** 31 - 1));
+	};
+	if (options.deadline != null && Date.now() >= options.deadline) stopping.abort(new DOMException("Mail wait timed out", "TimeoutError"));
+	else arm();
+	const signal = AbortSignal.any([stopping.signal, ...options.signal ? [options.signal] : []]);
+	const store = await openSharedMailStore({
+		configDir: options.configDir,
+		scope,
+		recipient: options.recipient,
+		signal
+	}).catch((error) => {
+		clearTimeout(timer);
+		throw error;
+	});
+	let failure;
+	let cleanupFailure;
+	let active;
+	function ensureOwner() {
+		signal.throwIfAborted();
+		if (failure !== void 0) throw failure;
+		const current = readSharedMailOwner(store);
+		if (current?.alive || active) return current;
+		const owner = tryOwnSharedMail(store);
+		if (!owner) return readSharedMailOwner(store);
+		active = runSharedMailTransport({
+			apiClient: options.apiClient,
+			subscription: store.subscriptionName,
+			recipient: store.recipient,
+			signal,
+			ready: async () => {
+				owner.markReady();
+			},
+			checked: async () => {
+				owner.markChecked();
+			},
+			status: async (status) => {
+				owner.markStatus(status);
+			},
+			ingest: async (event) => {
+				await store.ingest(event);
+			}
+		}).catch((error) => {
+			if (!signal.aborted) failure = error;
+		}).finally(() => {
+			try {
+				owner.close();
+			} catch (error) {
+				cleanupFailure = error;
+				failure ??= error;
+			} finally {
+				active = void 0;
+			}
+		});
+		return readSharedMailOwner(store);
+	}
+	function watch(deadline) {
+		const stop = new AbortController();
+		const promise = waitForSharedMailChange(store, {
+			signal: AbortSignal.any([signal, stop.signal]),
+			timeoutMs: deadline == null ? 1e3 : Math.max(1, Math.min(1e3, deadline - Date.now()))
+		});
+		promise.catch(() => {});
+		return {
+			promise,
+			close: () => stop.abort()
+		};
+	}
+	return {
+		store,
+		signal,
+		status: () => readSharedMailOwner(store),
+		async ready(deadline) {
+			while (deadline == null || Date.now() < deadline) {
+				const watching = watch(deadline);
+				try {
+					const owner = ensureOwner();
+					if (owner?.alive && owner.ready) return owner;
+					await watching.promise;
+				} finally {
+					watching.close();
+				}
+			}
+			return null;
+		},
+		async changed(deadline) {
+			const watching = watch(deadline);
+			try {
+				ensureOwner();
+				await watching.promise;
+			} finally {
+				watching.close();
+			}
+			if (failure !== void 0) throw failure;
+		},
+		async close() {
+			clearTimeout(timer);
+			stopping.abort();
+			await active;
+			if (cleanupFailure !== void 0) throw cleanupFailure;
+		}
+	};
+}
+//#endregion
+//#region src/oclif/reconcile-chat-send.ts
+/** Lookup only. An empty result never authorizes another send. */
+async function reconcileChatSend(params) {
+	const result = await readBeforeDeadline(params.deadline, (signal) => listSentEmails({
+		client: params.apiClient.client,
+		query: {
+			idempotency_key: params.idempotencyKey,
+			limit: 2
+		},
+		signal,
+		responseStyle: "fields"
+	}));
+	if (result === null) return null;
+	const page = result.data;
+	if (result.error || !page || !Array.isArray(page.data) || !page.meta || page.meta.cursor !== null || page.data.length > 1) throw new Errors.CLIError("Could not reconcile the saved send intent. Its outcome remains unknown; do not send again.", { exit: 1 });
+	const sent = page.data[0];
+	if (!sent) return null;
+	if (sent.client_idempotency_key !== params.idempotencyKey || typeof sent.from_address !== "string" || sent.from_address.trim().toLowerCase() !== params.from.trim().toLowerCase() || typeof sent.to_address !== "string" || sent.to_address.trim().toLowerCase() !== params.recipient.trim().toLowerCase() || typeof sent.id !== "string" || !sent.id) throw new Errors.CLIError("The saved send lookup returned conflicting identity metadata. Inspect the existing send before retrying.", { exit: 1 });
+	return sent;
+}
+//#endregion
+//#region src/oclif/send-outcome.ts
+const SEND_OUTCOME_EXIT_CODES = {
+	replied: 0,
+	sent: 0,
+	already_sent: 0,
+	not_sent: 1,
+	sent_awaiting_reply: 3,
+	uncertain: 4
+};
+const DEFINITIVE_SEND_REJECTION_STATUSES = [
+	400,
+	401,
+	402,
+	403,
+	404,
+	413,
+	422,
+	429
+];
+const SEND_OUTCOME_HELP = `Outcomes and exit codes, shared by chat, chat reply, send and reply (JSON output carries the name as "outcome"):
+  - exit 0 replied: chat only. The message was sent and a reply arrived.
+  - exit 0 sent: accepted for delivery. A queued status counts as sent.
+  - exit 0 already_sent: an identical earlier send exists (or was deleted: HTTP 410 sent_email_deleted). Nothing new went out. Do not resend.
+  - exit 1 not_sent: the API rejected the request (HTTP 400, 401, 402, 403, 404, 413, 422 or 429), the command failed before sending, or the send record has status agent_failed, gate_denied or canceled. Nothing went out.
+  - exit 2: invalid flags or arguments. Nothing went out.
+  - exit 3 sent_awaiting_reply: chat only. Sent, but no reply before the timeout. Wait; do not resend.
+  - exit 4 uncertain: transport error, conflict, server error, or a send record with status unknown. It may or may not have gone out. Reconcile with primitive sent get --idempotency-key <key> (the key is in the --json envelope) before retrying.`;
+function sendOutcomeExitCode(outcome) {
+	return SEND_OUTCOME_EXIT_CODES[outcome];
+}
+function sendFailureOutcome(httpStatus) {
+	return httpStatus !== void 0 && DEFINITIVE_SEND_REJECTION_STATUSES.includes(httpStatus) ? "not_sent" : "uncertain";
+}
+const SENT_EMAIL_DELETED_CODE = "sent_email_deleted";
+function errorPayloadCode(payload) {
+	if (payload === null || typeof payload !== "object") return void 0;
+	const code = payload.code;
+	return typeof code === "string" ? code : void 0;
+}
+function isDeletedEarlierSend(httpStatus, errorPayload) {
+	return httpStatus === 410 && errorPayloadCode(errorPayload) === SENT_EMAIL_DELETED_CODE;
+}
+/** Classify an API error from a send request. */
+function classifySendError(httpStatus, errorPayload) {
+	return isDeletedEarlierSend(httpStatus, errorPayload) ? "already_sent" : sendFailureOutcome(httpStatus);
+}
+function formatDeletedEarlierSendNotice() {
+	return "Already sent: an earlier send matching this request went out and its record was later deleted, so the API refused this one (HTTP 410 sent_email_deleted). Nothing new was sent. Do not resend or change the idempotency key to get around this.";
+}
+/** Read the HTTP status from a `responseStyle: "fields"` API result. */
+function apiResultHttpStatus(result) {
+	if (result === null || typeof result !== "object") return void 0;
+	if (!("response" in result)) return void 0;
+	const response = result.response;
+	return typeof response?.status === "number" ? response.status : void 0;
+}
+const SEND_STATUSES_THAT_DID_NOT_GO_OUT = new Set([
+	"agent_failed",
+	"canceled",
+	"gate_denied"
+]);
+const SEND_STATUSES_WITH_UNKNOWN_OUTCOME = new Set(["unknown"]);
+/**
+* Classify a send record the API returned with a 2xx. A 2xx alone does
+* not mean a message went out: the record's status can show the
+* attempt was rejected or that its result is indeterminate. The same
+* holds for an idempotent replay, which returns the earlier attempt's
+* record as it stands.
+*/
+function successfulSendOutcome(sent) {
+	if (SEND_STATUSES_THAT_DID_NOT_GO_OUT.has(sent.status)) return "not_sent";
+	if (SEND_STATUSES_WITH_UNKNOWN_OUTCOME.has(sent.status)) return "uncertain";
+	return sent.idempotent_replay === true ? "already_sent" : "sent";
+}
+/**
+* Summary for a 2xx send record whose status shows it did not go out
+* (`not_sent`) or that its result is indeterminate (`uncertain`).
+*/
+function formatSendRecordFailureSummary(noun, outcome, sent) {
+	const record = sent.idempotent_replay === true ? `the earlier identical attempt (sent id ${sent.id}) has status ${sent.status}` : `the send record (id ${sent.id}) has status ${sent.status}`;
+	if (outcome === "not_sent") return `${noun} not sent: ${record}. Nothing went out; fix the problem before retrying.`;
+	return `${noun} send outcome uncertain: ${record}. It may or may not have gone out. Do not resend blindly; check sent history first.`;
+}
+function describeSentStatus(status) {
+	if (status === "queued") return "queued for delivery";
+	if (status === "delivered") return "delivered";
+	return `status ${status}`;
+}
+function formatSentSummary(noun, sent) {
+	return `${noun} sent (${describeSentStatus(sent.status)}, id ${sent.id}). Do not resend.`;
+}
+function formatSendFailureSummary(noun, outcome, httpStatus) {
+	if (outcome === "not_sent") return `${noun} not sent: ${httpStatus === void 0 ? "the request failed before sending" : `the API rejected the request (HTTP ${httpStatus})`}. Nothing went out; fix the problem before retrying.`;
+	return `${noun} send outcome uncertain (${httpStatus === void 0 ? "no response from the API" : `HTTP ${httpStatus}`}): it may or may not have gone out. Do not resend blindly; check sent history first.`;
+}
+function priorRepliesThatWentOut(replies, options = {}) {
+	return (replies ?? []).filter((reply) => !SEND_STATUSES_THAT_DID_NOT_GO_OUT.has(reply.status) && reply.id !== options.excludeSentId);
+}
+function formatPriorRepliesWarning(prior) {
+	const latest = prior.at(-1);
+	if (!latest) return null;
+	return `This email already has ${prior.length === 1 ? "1 outgoing email" : `${prior.length} outgoing emails`}, most recently at ${latest.created_at} (sent id ${latest.id}). These may include activity updates and do not prove a completed answer. Sending this reply.`;
+}
+function formatPriorRepliesCheckSkipped(emailId, reason) {
+	return `Could not check whether you already replied to email ${emailId} (${reason}). Prior-reply check skipped; sending the reply anyway.`;
+}
+/**
+* Look up the inbound email and report replies to it that already
+* went out. Never throws: the check is advisory and must not block a
+* send, so every failure comes back as `skipped` with a reason the
+* caller surfaces.
+*/
+async function checkPriorReplies(params) {
+	try {
+		const result = await getEmail({
+			client: params.client,
+			path: { id: params.emailId },
+			responseStyle: "fields"
+		});
+		if (result.error) {
+			const status = apiResultHttpStatus(result);
+			return {
+				status: "skipped",
+				reason: status === void 0 ? "the email lookup failed" : `the email lookup returned HTTP ${status}`
+			};
+		}
+		const envelope = result.data;
+		const detail = envelope?.data ?? envelope;
+		if (!detail || !Array.isArray(detail.replies)) return {
+			status: "skipped",
+			reason: "the email lookup returned no reply history"
+		};
+		return {
+			status: "checked",
+			prior: priorRepliesThatWentOut(detail.replies),
+			detail
+		};
+	} catch (error) {
+		return {
+			status: "skipped",
+			reason: `the email lookup failed: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+}
+function shellQuote(value) {
+	if (/^[A-Za-z0-9_./:@%+=,-]+$/.test(value)) return value;
+	return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function commandFromArgv(argv) {
+	return argv.map(shellQuote).join(" ");
+}
+function buildFollowUpCommand(kind, description, argv, options = {}) {
+	const requiresMessage = options.requiresMessage ?? false;
+	return {
+		argv,
+		description,
+		command: commandFromArgv(argv),
+		kind,
+		placeholders: requiresMessage ? [{
+			description: "Replace with the message body before running.",
+			token: "<message>"
+		}] : [],
+		requires_message: requiresMessage
+	};
+}
+const SENT_HISTORY_CLOCK_SKEW_MS = 300 * 1e3;
+function sentHistoryWindowStart(attemptStartedAtIso) {
+	const started = Date.parse(attemptStartedAtIso);
+	if (!Number.isFinite(started)) return attemptStartedAtIso;
+	return new Date(started - SENT_HISTORY_CLOCK_SKEW_MS).toISOString();
+}
+/** Header rule for Idempotency-Key: 1 to 255 printable ASCII characters. */
+const IDEMPOTENCY_KEY_PATTERN = /^[\x21-\x7E]{1,255}$/;
+const IDEMPOTENCY_KEY_FLAG_DESCRIPTION = "Idempotency key for this send (1 to 255 printable ASCII characters). Retrying with the same key returns the original send instead of sending twice. Defaults to a key derived from the request content and the current five-minute window, so an identical retry within that window is deduplicated and a deliberate repeat later still sends. To retry an uncertain send after that, pass the key it reported. Look a send up later with `primitive sent get --idempotency-key <key>`.";
+function assertValidIdempotencyKey(key) {
+	if (!IDEMPOTENCY_KEY_PATTERN.test(key)) throw new Errors.CLIError("--idempotency-key must be 1 to 255 printable ASCII characters with no spaces.", { exit: 2 });
+	return key;
+}
+const NON_CONTENT_SEND_FIELDS = new Set(["wait", "wait_timeout_ms"]);
+function canonicalJson(value) {
+	if (Array.isArray(value)) return `[${value.map((item) => canonicalJson(item ?? null)).join(",")}]`;
+	if (value !== null && typeof value === "object") return `{${Object.entries(value).filter(([, item]) => item !== void 0).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`).join(",")}}`;
+	return JSON.stringify(value ?? null);
+}
+/**
+* How long a derived key stays the same. It matches the window the API
+* uses for the key it derives itself when a request carries none, so an
+* identical send repeated inside this window is deduplicated and a
+* deliberate repeat later (a digest, a heartbeat, the same short reply
+* on another day) still goes out, exactly as without a key. An explicit
+* --idempotency-key never expires.
+*/
+const DERIVED_IDEMPOTENCY_WINDOW_MS = 300 * 1e3;
+/**
+* The idempotency key a send uses when the caller passes none. It is a
+* hash of what is sent (and, for a reply, of the email replied to) and
+* of the current five-minute window, so dedup matches what the API did
+* before the CLI sent a key, while the CLI knows the key before the
+* request starts. That lets an uncertain outcome still report the key to
+* reconcile with, and to retry under with --idempotency-key.
+*/
+function deriveSendIdempotencyKey(kind, request, now = Date.now()) {
+	const content = Object.fromEntries(Object.entries(request).filter(([key]) => !NON_CONTENT_SEND_FIELDS.has(key)));
+	return `primitive-${kind}-${createHash("sha256").update(canonicalJson(content)).update(`:t${Math.floor(now / DERIVED_IDEMPOTENCY_WINDOW_MS)}`).digest("hex")}`;
+}
+/**
+* Identity fields every send, reply and chat `--json` envelope carries,
+* whatever the outcome. `sent_email_id` is null until a send record is
+* known; `idempotency_key` is known before the request starts, so an
+* uncertain outcome can be reconciled with
+* `primitive sent get --idempotency-key <key>`.
+*/
+function sendIdentityFields(params) {
+	return {
+		sent_email_id: params.sent?.id ?? null,
+		idempotency_key: params.idempotencyKey ?? params.sent?.client_idempotency_key ?? null
+	};
+}
+/**
+* Commands that inspect an existing send. None of them send again:
+* a caller that follows them after a failure cannot double-send.
+*/
+function buildSendCommandFollowUps(params) {
+	const commands = [];
+	if (params.sentId === null && params.outcome === "uncertain" && params.idempotencyKey) commands.push(buildFollowUpCommand("find_sent_email_by_idempotency_key", "Look up this attempt by its idempotency key before retrying", [
+		"primitive",
+		"sent",
+		"get",
+		"--idempotency-key",
+		params.idempotencyKey
+	]));
+	if (params.sentId !== null) commands.push(buildFollowUpCommand("inspect_sent_email", "Inspect the send and its delivery status", [
+		"primitive",
+		"sent",
+		"get",
+		"--id",
+		params.sentId
+	]));
+	if (params.outcome === "uncertain") commands.push(buildFollowUpCommand("list_recent_sent_emails", "Check sent history for this attempt before retrying", [
+		"primitive",
+		"sent",
+		"list",
+		"--date-from",
+		sentHistoryWindowStart(params.attemptStartedAtIso)
+	]));
+	return commands;
+}
+/**
+* Classify a `send` / `reply` API result, write the stderr summary,
+* and print stdout. Without `--json` stdout stays exactly what these
+* commands always printed (the SendMailResult, or `null`), so
+* existing `| jq` pipelines keep working; the outcome is on stderr
+* and in the exit code. With `--json` stdout is always an envelope,
+* whatever the outcome, and the summary is only its outcome_message.
+*/
+function reportSendCommandResult(params) {
+	const httpStatus = apiResultHttpStatus(params.result);
+	let outcome;
+	let outcomeMessage;
+	let sent = null;
+	let errorPayload = null;
+	if (params.result.error) {
+		errorPayload = extractErrorPayload(params.result.error);
+		params.onApiError(errorPayload);
+		const failure = classifySendError(httpStatus, errorPayload);
+		outcome = failure;
+		outcomeMessage = failure === "already_sent" ? formatDeletedEarlierSendNotice() : formatSendFailureSummary(params.noun, failure, httpStatus);
+		if (!params.json) params.writeStderr(`${outcomeMessage}\n`);
+	} else {
+		sent = params.result.data?.data ?? null;
+		if (sent === null) {
+			outcome = "uncertain";
+			outcomeMessage = `${params.noun} send outcome uncertain: the API accepted the request but returned no send record. Do not resend blindly; check sent history first.`;
+			errorPayload = { message: "The API returned no send record." };
+		} else {
+			outcome = successfulSendOutcome(sent);
+			outcomeMessage = outcome === "not_sent" || outcome === "uncertain" ? formatSendRecordFailureSummary(params.noun, outcome, sent) : outcome === "already_sent" ? formatAlreadySentNotice(sent) : formatSentSummary(params.noun, sent);
+		}
+		if (!params.json) params.writeStderr(`${outcomeMessage}\n`);
+	}
+	if (params.json) {
+		const envelope = {
+			outcome,
+			exit_code: sendOutcomeExitCode(outcome),
+			outcome_message: outcomeMessage,
+			...sendIdentityFields({
+				idempotencyKey: params.idempotencyKey,
+				sent
+			}),
+			sent,
+			http_status: httpStatus ?? null,
+			error: serializeErrorPayload(errorPayload),
+			follow_up_commands: buildSendCommandFollowUps({
+				attemptStartedAtIso: params.attemptStartedAtIso,
+				idempotencyKey: params.idempotencyKey,
+				outcome,
+				sentId: sent?.id ?? null
+			}),
+			...params.extraEnvelopeFields
+		};
+		params.log(JSON.stringify(envelope, null, 2));
+	} else if (!params.result.error) params.log(JSON.stringify(sent, null, 2));
+	return outcome;
+}
+/** JSON-safe form of an API error payload; `Error` objects stringify to `{}`. */
+function serializeErrorPayload(payload) {
+	if (!(payload instanceof Error)) return payload ?? null;
+	const serialized = {
+		name: payload.name,
+		message: payload.message
+	};
+	const cause = payload.cause;
+	if (cause && typeof cause.code === "string") serialized.code = cause.code;
+	return serialized;
+}
+/**
+* Envelope for a `send` / `reply` that threw instead of returning an
+* API result. Printed in --json mode so stdout carries an envelope for
+* every outcome. Before the request starts (bad input, missing auth,
+* unreadable attachment) nothing went out; after it starts the
+* outcome is unknown.
+*/
+function buildThrownSendFailureEnvelope(params) {
+	const message = params.error instanceof Error ? params.error.message : String(params.error);
+	const outcome = params.requestStarted ? "uncertain" : "not_sent";
+	return {
+		outcome,
+		exit_code: params.requestStarted ? sendOutcomeExitCode("uncertain") : thrownErrorExitCode(params.error),
+		outcome_message: formatSendFailureSummary(params.noun, outcome, void 0),
+		...sendIdentityFields({
+			idempotencyKey: params.idempotencyKey,
+			sent: null
+		}),
+		sent: null,
+		http_status: null,
+		error: { message },
+		follow_up_commands: params.requestStarted && params.attemptStartedAtIso ? buildSendCommandFollowUps({
+			attemptStartedAtIso: params.attemptStartedAtIso,
+			idempotencyKey: params.idempotencyKey,
+			outcome,
+			sentId: null
+		}) : [],
+		...params.extraEnvelopeFields
+	};
+}
+/** Exit code oclif will use for a thrown error (2 for usage errors). */
+function thrownErrorExitCode(error) {
+	const exit = error?.oclif?.exit;
+	return typeof exit === "number" ? exit : 1;
+}
+//#endregion
+//#region src/oclif/signal-command.ts
+const sendStatuses = new Set([
+	"queued",
+	"submitted_to_agent",
+	"agent_failed",
+	"gate_denied",
+	"unknown",
+	"delivered",
+	"bounced",
+	"deferred",
+	"wait_timeout",
+	"scheduled",
+	"canceled"
+]);
+const validSendStatus = (value) => typeof value === "string" && sendStatuses.has(value);
+const invalid = () => /* @__PURE__ */ new Error("Saved signal state is invalid. Preserve it; do not resend.");
+function input(options, parent, now, expires = now + (options.expiresIn ?? 30) * 1e3) {
+	if (options.kind === "ack") return {
+		kind: "ack",
+		parent,
+		status: options.status
+	};
+	if (options.kind === "read") return {
+		kind: "read",
+		parent
+	};
+	return {
+		kind: options.kind,
+		parent,
+		expiresAtMs: expires
+	};
+}
+function parseState(raw, options, parent) {
+	try {
+		const row = mailObject(raw, [
+			"version",
+			"prepared",
+			"phase",
+			"sentId"
+		]);
+		if (row.version !== 1 || ![
+			"prepared",
+			"submitting",
+			"sent",
+			"not_sent",
+			"uncertain",
+			"expired"
+		].includes(String(row.phase))) throw invalid();
+		const p = mailObject(row.prepared, [
+			"accountScope",
+			"preparedAtMs",
+			"expiresAtMs",
+			"idempotencyKey",
+			"requestJson"
+		]);
+		if (typeof p.requestJson !== "string" || typeof p.preparedAtMs !== "number" || p.expiresAtMs !== null && typeof p.expiresAtMs !== "number") throw invalid();
+		const body = JSON.parse(p.requestJson);
+		const control = JSON.parse(Buffer.from(body.attachments[0].content_base64, "base64").toString("utf8"));
+		const ids = [control.interaction_id.split("@")[0], control.step_id];
+		const rebuilt = prepareSignalEmail(input(options, parent, p.preparedAtMs, p.expiresAtMs ?? void 0), {
+			now: () => p.preparedAtMs,
+			uuid: () => ids.shift()
+		});
+		if (rebuilt.status !== "prepared" || JSON.stringify(rebuilt.prepared) !== JSON.stringify(row.prepared)) throw invalid();
+		return {
+			version: 1,
+			prepared: rebuilt.prepared,
+			phase: row.phase,
+			sentId: row.sentId === null ? null : mailId(row.sentId)
+		};
+	} catch {
+		throw invalid();
+	}
+}
+function report(state, repeated = false) {
+	const outcome = state.phase === "sent" ? repeated ? "already_sent" : "sent" : state.phase === "submitting" ? "uncertain" : state.phase;
+	return {
+		exitCode: outcome === "uncertain" ? 4 : outcome === "not_sent" ? 1 : 0,
+		data: {
+			outcome,
+			sent_id: state.sentId,
+			expires_at: state.prepared.expiresAtMs === null ? null : new Date(state.prepared.expiresAtMs).toISOString(),
+			guidance: outcome === "uncertain" ? "Outcome unknown. Repeat this exact command to reconcile the saved intent; never resend with a new key or profile." : outcome === "expired" ? "The saved activity expired without dispatch. A new explicit invocation may prepare fresh activity." : "Signals report communication state only; they do not grant task or tool authority."
+		}
+	};
+}
+/** Explicit one-shot signal send. The complete intent is durable before POST. */
+async function sendSignal(context, options) {
+	const id = mailId(options.id);
+	if (![
+		"read",
+		"ack",
+		"working",
+		"typing"
+	].includes(options.kind)) throw new Error("Unknown signal kind.");
+	if (options.kind === "ack" ? ![
+		"received",
+		"will_process",
+		"will_not_process"
+	].includes(options.status ?? "") : options.status !== void 0) throw new Error("Only ack requires --status received, will_process, or will_not_process.");
+	if (options.expiresIn !== void 0 && (!["working", "typing"].includes(options.kind) || !Number.isInteger(options.expiresIn) || options.expiresIn < 1 || options.expiresIn > (options.kind === "typing" ? 30 : 60))) throw new Error("--expires-in applies only to working/typing and must be 1-30 seconds for typing or 1-60 for working.");
+	const result = await getEmail({
+		client: context.apiClient.client,
+		path: { id },
+		responseStyle: "fields",
+		signal: AbortSignal.timeout(5e3)
+	});
+	const detail = result.data?.data;
+	if (result.error || !detail || detail.id !== id || detail.recipient.toLowerCase() !== context.identity.agentAddress.toLowerCase() || detail.to_email.toLowerCase() !== context.identity.agentAddress.toLowerCase() || !["accepted", "completed"].includes(detail.status)) throw new Error("The parent email is unavailable for this connected profile.");
+	const trust = scopedChatSenderTrust(detail, detail.from_email);
+	if (!trust.trusted) throw new Error(`Parent sender authentication rejected (reason: ${trust.reason}; retryable: ${trust.retryable}).`);
+	if (detail.from_email.trim().toLowerCase() === context.identity.agentAddress.toLowerCase()) throw new Error("Do not send a signal in response to this profile's own email.");
+	if (!isPlainChatReply(detail)) throw new Error("Signals require a fully parsed plain email. Signals, interactions, and unknown content cannot trigger another signal.");
+	if (!detail.message_id) throw new Error("The parent Message-ID is not available. Nothing was sent; retry this exact email after processing completes.");
+	const scope = sharedMailScope(context.apiKey, context.identity.apiBaseUrl);
+	const parent = {
+		accountScope: scope,
+		from: detail.from_email.trim().toLowerCase(),
+		to: context.identity.agentAddress,
+		messageId: detail.message_id,
+		subject: detail.subject ?? null,
+		references: detail.parsed.references ?? []
+	};
+	const key = createHash("sha256").update(JSON.stringify([
+		scope,
+		context.identity.orgId,
+		parent.to,
+		id,
+		options.kind,
+		options.status ?? null,
+		...options.slot === void 0 ? [] : [options.slot]
+	])).digest("hex");
+	const directory = join(context.configDir, "signals", key);
+	privateMailDirectory(directory, true);
+	const release = acquireListenLock(directory, "signal-send");
+	const path = join(directory, "intent.json"), now = context.now ?? Date.now;
+	try {
+		const raw = readMailJson(path, 256 * 1024);
+		let state = raw === null ? null : parseState(raw, options, parent);
+		if (state?.phase === "submitting" || state?.phase === "uncertain") {
+			let prior;
+			try {
+				prior = await reconcileChatSend({
+					apiClient: context.apiClient,
+					idempotencyKey: state.prepared.idempotencyKey,
+					from: parent.to,
+					recipient: parent.from,
+					deadline: Date.now() + 5e3
+				});
+			} catch {
+				return report(state);
+			}
+			if (!prior || !validSendStatus(prior.status)) return report(state);
+			const outcome = successfulSendOutcome({
+				status: prior.status,
+				idempotent_replay: true
+			});
+			state.phase = outcome === "uncertain" ? "uncertain" : outcome === "not_sent" ? "not_sent" : "sent";
+			try {
+				state.sentId = mailId(prior.id);
+			} catch {
+				state.phase = "uncertain";
+				writeMailJson(path, state);
+				return report(state);
+			}
+			writeMailJson(path, state);
+			if (state.sentId) recordSentSignal(context.configDir, state.sentId);
+			if (state.phase === "uncertain") return report(state);
+		}
+		const expired = state?.prepared.expiresAtMs !== null && state?.prepared.expiresAtMs !== void 0 && now() >= state.prepared.expiresAtMs;
+		if (state && [
+			"sent",
+			"not_sent",
+			"expired"
+		].includes(state.phase)) {
+			if (state.sentId) recordSentSignal(context.configDir, state.sentId);
+			if (!expired) return report(state, true);
+			state = null;
+		}
+		if (!state) {
+			const prepared = prepareSignalEmail(input(options, parent, now()), {
+				now,
+				uuid: randomUUID
+			});
+			if (prepared.status !== "prepared") throw new Error("The parent is not ready. Nothing was sent.");
+			state = {
+				version: 1,
+				prepared: prepared.prepared,
+				phase: "prepared",
+				sentId: null
+			};
+			writeMailJson(path, state);
+		}
+		if (state.prepared.expiresAtMs !== null && now() >= state.prepared.expiresAtMs) {
+			state.phase = "expired";
+			writeMailJson(path, state);
+			return report(state);
+		}
+		if (options.shouldSend && !options.shouldSend()) return report(state);
+		state.phase = "submitting";
+		writeMailJson(path, state);
+		let outcome;
+		try {
+			outcome = await sendPreparedSignal(async (body, idempotencyKey) => sendEmail({
+				client: context.apiClient.client,
+				body,
+				headers: { "Idempotency-Key": idempotencyKey },
+				responseStyle: "fields",
+				signal: AbortSignal.timeout(5e3)
+			}), state.prepared, {
+				accountScope: scope,
+				now
+			});
+		} catch {
+			state.phase = "uncertain";
+			writeMailJson(path, state);
+			return report(state);
+		}
+		let alreadySent = false;
+		if (outcome.status === "expired") state.phase = "expired";
+		else try {
+			const result = outcome.result, sent = result.data?.data;
+			if (sent && !validSendStatus(sent.status)) throw invalid();
+			const sentId = sent ? mailId(sent.id) : null;
+			const classification = result.error ? classifySendError(result.response?.status, extractErrorPayload(result.error)) : sent ? successfulSendOutcome(sent) : "uncertain";
+			alreadySent = classification === "already_sent";
+			state.phase = classification === "not_sent" ? "not_sent" : classification === "uncertain" ? "uncertain" : "sent";
+			state.sentId = sentId;
+		} catch {
+			state.phase = "uncertain";
+			state.sentId = null;
+		}
+		writeMailJson(path, state);
+		if (state.sentId) recordSentSignal(context.configDir, state.sentId);
+		return report(state, alreadySent);
+	} finally {
+		release();
+	}
+}
+//#endregion
+export { extractErrorCode as $, reserveSharedMailSubscription as A, queryUsesAutomated as At, sentInThread as B, thrownErrorExitCode as C, AutomatedFilterUnsupportedError as Ct, ensureSharedMailSubscription as D, expectedAutomatedVerdicts as Dt, sharedMailScope as E, ensureSearchReportsAutomated as Et, describeWake as F, resolveCliApiRequestConfig as Ft, EventConnection as G, serverRelationship as H, displayAddress as I, pushFile as J, EventReceiverError as K, formatWakeContext as L, readConversationFollow as M, createAuthenticatedCliApiClient as Mt, otherParticipants as N, createCliApiClient as Nt, createSharedMailWaiter as O, hasAutomatedVerdict as Ot, bareAddress as P, refreshStoredCliCredentials as Pt, createOperationCommand as Q, latestOwnOutbound as R, successfulSendOutcome as S, AUTOMATED_VALUES as St, openSharedMailReceiver as T, automatedRejectedError as Tt, wakeRelationship as U, serverMuted as V, readSharedMailOwner as W, API_ERROR_CODES as X, API_BASE_URL_FLAG_DESCRIPTION as Y, TIME_FLAG_DESCRIPTION as Z, reportSendCommandResult as _, queryUsesAwaiting as _t, assertValidIdempotencyKey as a, writeErrorWithHints as at, sentHistoryWindowStart as b, AUTOMATED_FILTER_UNSUPPORTED_CODE as bt, checkPriorReplies as c, REPLY_STATE_UNSUPPORTED_CODE as ct, formatDeletedEarlierSendNotice as d, awaitingRejectedError as dt, extractErrorPayload as et, formatPriorRepliesCheckSkipped as f, ensureSearchReportsReplyState as ft, priorRepliesThatWentOut as g, isAwaitingRejectedError as gt, formatSendRecordFailureSummary as h, hasReplyState as ht, apiResultHttpStatus as i, surfaceUnauthorizedHint as it, followEmailConversation as j, SAVED_CLI_OAUTH_SESSION_EXPIRED_MESSAGE as jt, openSharedMailStore as k, isAutomatedRejectedError as kt, classifySendError as l, ReplyStateUnsupportedError as lt, formatSendFailureSummary as m, formatRepliesCell as mt, IDEMPOTENCY_KEY_FLAG_DESCRIPTION as n, readTextFileFlag as nt, buildFollowUpCommand as o, AWAITING_FLAG_DESCRIPTION as ot, formatPriorRepliesWarning as p, formatAwaitingCell as pt, pullFile as q, SEND_OUTCOME_HELP as r, runWithTiming as rt, buildThrownSendFailureEnvelope as s, AWAITING_VALUES as st, sendSignal as t, formatErrorPayload as tt, deriveSendIdempotencyKey as u, assertAwaitingFilterRows as ut, sendIdentityFields as v, formatAlreadySentNotice as vt, reconcileChatSend as w, assertAutomatedVerdict as wt, serializeErrorPayload as x, AUTOMATED_FLAG_DESCRIPTION as xt, sendOutcomeExitCode as y, writeIdempotentReplayBannerIfReplay as yt, readThreadContext as z };