primcli 1.63.0 → 1.65.0

package/dist/oclif/index.js

@@ -1,12 +1,12 @@
-import { a as REPEAT_IDLE_MAX_MINUTES, d as parseRepeatTick, f as preparePresenceAliveEmail, g as isEmailReceivedEvent, i as REPEAT_EVERY_MAX_MINUTES, l as parseInteractionEnvelope$1, m as repeatStopCommand, o as REPEAT_MAX_SENDS_MAX, p as prepareSignalEmail, s as buildRepeatStopBody, u as parsePresenceEnvelope, v as parseWebhookEvent, y as parseFromHeader } from "../repeats-x4QM2yoG-DTpqXyRo.js";
+import { a as REPEAT_IDLE_MAX_MINUTES, b as parseWebhookEvent, d as parseRepeatTick, f as preparePresenceAliveEmail, i as REPEAT_EVERY_MAX_MINUTES, l as parseInteractionEnvelope$1, m as repeatStopCommand, o as REPEAT_MAX_SENDS_MAX, p as prepareSignalEmail, s as buildRepeatStopBody, u as parsePresenceEnvelope, v as isEmailReceivedEvent, x as parseFromHeader } from "../repeats-BL7ZC-_6-Dzangtkf.js";
 import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadActiveChatState, P as agentProfileName, R as loadConnectedAgentProfile, T as saveSignupCredentials, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-DMszFbGn.js";
-import { $ as apiResultHttpStatus, $n as replyToEmail, $t as completeWebhookEvent, A as readThreadContext, An as listAgentNetworks, At as formatAlreadySentNotice, B as pendingMailPath, Bn as listRoutes, Bt as expectedAutomatedVerdicts, C as queryUsesAwaiting, Cn as getMemory, Cr as verifyAgentSignup, Ct as cliInvocation, D as displayAddress, Dn as getThread, Dt as identitySuggestions, E as describeWake, En as getSentEmail, Et as generatedAgentName, F as wakeReadCommand, Fn as listEmails, Ft as AUTOMATED_VALUES, G as interactionNextActions, Gn as pollCliLogin, H as recordPendingMail, Hn as listWakeAuthorizations, Ht as isAutomatedRejectedError, I as wakeRecipientField, In as listEndpoints, It as AutomatedFilterUnsupportedError, J as replyInteractionWarning, Jt as refreshStoredCliCredentials, K as readEmailInteraction, Kn as pullWebhookEvent, Kt as createAuthenticatedCliApiClient, L as wakeRelationship, Ln as listFunctionLogs, Lt as assertAutomatedVerdict, M as serverMuted, Mn as listDefaultNetworkAgents, Mt as withFlagSuggestion, N as serverRelationship, Nn as listDefaultNetworkMembers, Nt as AUTOMATED_FILTER_UNSUPPORTED_CODE, O as formatMailWakeLine, On as getWakeSchedule, Ot as loadSkillLine, Pn as listDomains, Pt as AUTOMATED_FLAG_DESCRIPTION, Q as SEND_OUTCOME_HELP, Qn as reorderRoutes, Qt as cliLogout, R as clearConsumedPendingMail, Rn as listFunctions, Rt as automatedRejectedError, S as isAwaitingRejectedError, Sn as getInboxStatus, Sr as verifyAgentClaim, T as bareAddress, Tn as getRepeatingSend, U as removePendingMail, Un as listWakeDispatches, Ut as queryUsesAutomated, V as readPendingMail, Vn as listSentEmails, Vt as hasAutomatedVerdict, W as interactionHumanLine, Wn as listWakeSchedules, Wt as ConnectedAgentKeyRequiredError, X as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Xn as redeemCreditCode, Xt as addDefaultNetworkMember, Yt as resolveCliApiRequestConfig, Z as MAX_SEND_WAIT_TIMEOUT_MS, Zn as removeDefaultNetworkMember, Zt as checkDefaultNetworkContactAdmission, _ as awaitingRejectedError, _n as getDefaultNetworkAgent, _r as updateFunction, _t as sendWaitClampNotice, a as extractErrorCode, ar as sendEmail, at as deriveSendIdempotencyKey, b as formatRepliesCell, bn as getFunctionRouting, br as updateWakeAuthorization, bt as successfulSendOutcome, c as readTextFileFlag, cn as deleteRoute, cr as setMemory, ct as formatDeletedEarlierSendNotice, d as writeErrorWithHints, dr as startAgentSignup, dt as formatSendFailureSummary, en as createEndpoint, er as resendAgentSignupVerification, et as assertValidIdempotencyKey, f as AWAITING_FLAG_DESCRIPTION, fn as getAccount, fr as startCliLogin, ft as formatSendRecordFailureSummary, g as assertAwaitingFilterRows, gn as getCreditBalance, gr as updateDefaultNetworkMember, gt as sendOutcomeExitCode, h as ReplyStateUnsupportedError, hn as getConversation, hr as unsetFunctionRoute, ht as sendIdentityFields, i as createOperationCommand, in as createWakeSchedule, ir as semanticSearch, it as classifySendError, j as sentInThread, jt as writeIdempotentReplayBannerIfReplay, k as latestOwnOutbound, kn as listAgentContacts, kt as currentMailSessionKey, l as runWithTiming, ln as deleteWakeAuthorization, lr as simulateRoute, lt as formatPriorRepliesCheckSkipped, m as REPLY_STATE_UNSUPPORTED_CODE, mr as testFunction, mt as reportSendCommandResult, n as API_ERROR_CODES, nn as createRoute, nr as searchEmails, nt as buildThrownSendFailureEnvelope, o as extractErrorPayload, or as setFunctionRoute, ot as excludeSignalReplies, p as AWAITING_VALUES, pn as getAgentContactPolicy, pr as stopRepeatFromEmail, pt as priorRepliesThatWentOut, q as replyExpectation, qt as createCliApiClient, r as TIME_FLAG_DESCRIPTION, rn as createWakeAuthorization, rr as searchMemories, rt as checkPriorReplies, s as formatErrorPayload, sn as deleteMemory, sr as setFunctionSecret, st as followUpCommandPrefix, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createFunction, tr as runWakeSchedule, tt as buildFollowUpCommand, u as surfaceUnauthorizedHint, un as deleteWakeSchedule, ur as startAgentClaim, ut as formatPriorRepliesWarning, v as ensureSearchReportsReplyState, vn as getEmail, vr as updateRepeatingSend, vt as sentHistoryWindowStart, w as explainPendingMailNotFound, wn as getOrgRoutingTopology, wt as connectNextSteps, x as hasReplyState, xn as getFunctionTestRunTrace, xr as updateWakeSchedule, xt as thrownErrorExitCode, y as formatAwaitingCell, yn as getFunction, yr as updateRoute, yt as serializeErrorPayload, z as clearReadPendingMail, zn as listRepeatingSends, zt as ensureSearchReportsAutomated } from "../api-command-CDjvGDQS.js";
+import { $ as apiResultHttpStatus, $n as replyToEmail, $t as completeWebhookEvent, A as readThreadContext, An as listAgentNetworks, At as formatAlreadySentNotice, B as pendingMailPath, Bn as listRoutes, Bt as expectedAutomatedVerdicts, C as queryUsesAwaiting, Cn as getMemory, Cr as verifyAgentSignup, Ct as cliInvocation, D as displayAddress, Dn as getThread, Dt as identitySuggestions, E as describeWake, En as getSentEmail, Et as generatedAgentName, F as wakeReadCommand, Fn as listEmails, Ft as AUTOMATED_VALUES, G as interactionNextActions, Gn as pollCliLogin, H as recordPendingMail, Hn as listWakeAuthorizations, Ht as isAutomatedRejectedError, I as wakeRecipientField, In as listEndpoints, It as AutomatedFilterUnsupportedError, J as replyInteractionWarning, Jt as refreshStoredCliCredentials, K as readEmailInteraction, Kn as pullWebhookEvent, Kt as createAuthenticatedCliApiClient, L as wakeRelationship, Ln as listFunctionLogs, Lt as assertAutomatedVerdict, M as serverMuted, Mn as listDefaultNetworkAgents, Mt as withFlagSuggestion, N as serverRelationship, Nn as listDefaultNetworkMembers, Nt as AUTOMATED_FILTER_UNSUPPORTED_CODE, O as formatMailWakeLine, On as getWakeSchedule, Ot as loadSkillLine, Pn as listDomains, Pt as AUTOMATED_FLAG_DESCRIPTION, Q as SEND_OUTCOME_HELP, Qn as reorderRoutes, Qt as cliLogout, R as clearConsumedPendingMail, Rn as listFunctions, Rt as automatedRejectedError, S as isAwaitingRejectedError, Sn as getInboxStatus, Sr as verifyAgentClaim, T as bareAddress, Tn as getRepeatingSend, U as removePendingMail, Un as listWakeDispatches, Ut as queryUsesAutomated, V as readPendingMail, Vn as listSentEmails, Vt as hasAutomatedVerdict, W as interactionHumanLine, Wn as listWakeSchedules, Wt as ConnectedAgentKeyRequiredError, X as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Xn as redeemCreditCode, Xt as addDefaultNetworkMember, Yt as resolveCliApiRequestConfig, Z as MAX_SEND_WAIT_TIMEOUT_MS, Zn as removeDefaultNetworkMember, Zt as checkDefaultNetworkContactAdmission, _ as awaitingRejectedError, _n as getDefaultNetworkAgent, _r as updateFunction, _t as sendWaitClampNotice, a as extractErrorCode, ar as sendEmail, at as deriveSendIdempotencyKey, b as formatRepliesCell, bn as getFunctionRouting, br as updateWakeAuthorization, bt as successfulSendOutcome, c as readTextFileFlag, cn as deleteRoute, cr as setMemory, ct as formatDeletedEarlierSendNotice, d as writeErrorWithHints, dr as startAgentSignup, dt as formatSendFailureSummary, en as createEndpoint, er as resendAgentSignupVerification, et as assertValidIdempotencyKey, f as AWAITING_FLAG_DESCRIPTION, fn as getAccount, fr as startCliLogin, ft as formatSendRecordFailureSummary, g as assertAwaitingFilterRows, gn as getCreditBalance, gr as updateDefaultNetworkMember, gt as sendOutcomeExitCode, h as ReplyStateUnsupportedError, hn as getConversation, hr as unsetFunctionRoute, ht as sendIdentityFields, i as createOperationCommand, in as createWakeSchedule, ir as semanticSearch, it as classifySendError, j as sentInThread, jt as writeIdempotentReplayBannerIfReplay, k as latestOwnOutbound, kn as listAgentContacts, kt as currentMailSessionKey, l as runWithTiming, ln as deleteWakeAuthorization, lr as simulateRoute, lt as formatPriorRepliesCheckSkipped, m as REPLY_STATE_UNSUPPORTED_CODE, mr as testFunction, mt as reportSendCommandResult, n as API_ERROR_CODES, nn as createRoute, nr as searchEmails, nt as buildThrownSendFailureEnvelope, o as extractErrorPayload, or as setFunctionRoute, ot as excludeSignalReplies, p as AWAITING_VALUES, pn as getAgentContactPolicy, pr as stopRepeatFromEmail, pt as priorRepliesThatWentOut, q as replyExpectation, qt as createCliApiClient, r as TIME_FLAG_DESCRIPTION, rn as createWakeAuthorization, rr as searchMemories, rt as checkPriorReplies, s as formatErrorPayload, sn as deleteMemory, sr as setFunctionSecret, st as followUpCommandPrefix, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createFunction, tr as runWakeSchedule, tt as buildFollowUpCommand, u as surfaceUnauthorizedHint, un as deleteWakeSchedule, ur as startAgentClaim, ut as formatPriorRepliesWarning, v as ensureSearchReportsReplyState, vn as getEmail, vr as updateRepeatingSend, vt as sentHistoryWindowStart, w as explainPendingMailNotFound, wn as getOrgRoutingTopology, wt as connectNextSteps, x as hasReplyState, xn as getFunctionTestRunTrace, xr as updateWakeSchedule, xt as thrownErrorExitCode, y as formatAwaitingCell, yn as getFunction, yr as updateRoute, yt as serializeErrorPayload, z as clearReadPendingMail, zn as listRepeatingSends, zt as ensureSearchReportsAutomated } from "../api-command-0u5Qd_a-.js";
 import { S as resolveListenSubscription, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, x as normalizeListenOrigin, y as listenIdentity } from "../shared-mail-files-MwlVE90c.js";
-import { _ as detectAgentRuntime, a as NotificationRetryError, b as installedVersion, c as readConversationStatusContent, d as defaultSessionSocket, f as NativeSessionDisconnectedError, g as connectSkillTarget, h as NotificationOutcomeUnknownError, i as notificationReceiptPage, l as SESSION_UUID$1, m as NativeSessionNotLoadedError, n as notificationSenders, o as isRoutineNotificationContent, p as NativeSessionError, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, v as installConnectSkill, x as readBundledConnectSkill, y as installedConnectSkillFile } from "../notify-session-7JzG7GNX.js";
-import { $ as describeSessionHookItem, A as evaluateContactPolicy, B as agentInvitationHash, C as RECEIVER_MODES, D as NETWORK_ADMISSION_PENDING_RETRY_MS, E as ContactPolicyReadRetryError, F as ContactsApiError, G as saveConnectionName, H as readAgentInvitation, I as contactAddress, J as recordHookMailCheck, K as savedReceiver, L as contactAgentAddress, M as AddressNotesApiError, N as addressNoteTarget, O as NetworkAdmissionPendingError, P as runAddressNotesRequest, Q as describeSessionHookChange, R as runContactRequest, S as runAgentConnect, T as verificationReplySubmitted, U as receiverStatusCommand, V as connectAgent, W as refusalAfterReplacement, X as claudeConfigDir, Y as boundSessionProfiles, Z as currentCliLocation, _ as disconnectAgent, _t as withOwnerMemberAddress, a as endSession, at as readClaudeSettings, b as invitationProfileName, c as pendingSessionDisconnects, ct as writeClaudeSettings, d as registerSession, dt as jsonIndentation, et as ensureHookLauncher, f as retryPendingDisconnects, ft as readManagedFile, g as AgentDisconnectError, gt as refreshOwnerMemberAddressPeriodically, h as enrollmentResumes, ht as readHookLauncherWarning, i as connectedProfilesForSession, it as inspectClaudeHooks, j as canonicalContactSelector, k as createNotificationContactPolicy, l as psProcessInfo, lt as MachineFileError, m as enrollAgent, mt as writeManagedFile, n as OMP_MAIN, nt as findOnPath, o as headlessClaudeRun, ot as repairClaudeHooks, p as runDetached, pt as upsertManagedBlock, q as installClaudeWakeHook, r as agentConnectionState, rt as hasMachineSessionHooks, st as samePath, t as MACHINE_RUNTIMES, tt as ephemeralCliReason, u as readClaudeHookInput, ut as inspectManagedBlock, v as connectWarnings, w as externalReceivingState, x as pollCheckCommand, y as defaultAgentProfileName, z as agentConnectionStatus } from "../machine-session-NjXIXTRX.js";
-import { a as scopedChatSenderTrust, i as readBeforeDeadline, n as isPlainChatReply, o as presenceDisposition, r as isScopedChatReply, s as readPresenceProjection, t as isConnectedChatCredential } from "../scoped-chat-BvkUTggT.js";
+import { _ as detectAgentRuntime, a as NotificationRetryError, b as installedVersion, c as readConversationStatusContent, d as defaultSessionSocket, f as NativeSessionDisconnectedError, g as connectSkillTarget, h as NotificationOutcomeUnknownError, i as notificationReceiptPage, l as SESSION_UUID$1, m as NativeSessionNotLoadedError, n as notificationSenders, o as isRoutineNotificationContent, p as NativeSessionError, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, v as installConnectSkill, x as readBundledConnectSkill, y as installedConnectSkillFile } from "../notify-session-BaS84f3y.js";
+import { $ as boundSessionProfiles, A as AgentDisconnectError, B as runContactRequest, C as verificationReplySubmitted, D as createNotificationContactPolicy, E as NetworkAdmissionPendingError, F as addressNoteTarget, G as receiverStatusCommand, H as agentInvitationHash, I as runAddressNotesRequest, J as savedReceiver, K as refusalAfterReplacement, L as ContactsApiError, M as clearRevokedAddresses, N as disconnectAgent, O as evaluateContactPolicy, P as AddressNotesApiError, Q as recordHookMailCheck, R as contactAddress, S as externalReceivingState, T as NETWORK_ADMISSION_PENDING_RETRY_MS, U as connectAgent, V as agentConnectionStatus, W as readAgentInvitation, X as releaseRegistrationsForProfile, Y as MACHINE_RUNTIMES, Z as installClaudeWakeHook, _ as defaultAgentProfileName, _t as upsertManagedBlock, a as endSession, at as ephemeralCliReason, b as runAgentConnect, bt as refreshOwnerMemberAddressPeriodically, c as pendingSessionDisconnects, ct as inspectClaudeHooks, d as registerSession, dt as samePath, et as claudeConfigDir, f as retryPendingDisconnects, ft as writeClaudeSettings, g as connectWarnings, gt as readManagedFile, h as enrollmentResumes, ht as jsonIndentation, i as connectedProfilesForSession, it as ensureHookLauncher, j as claimOverRevokedSetup, k as canonicalContactSelector, l as psProcessInfo, lt as readClaudeSettings, m as enrollAgent, mt as inspectManagedBlock, n as OMP_MAIN, nt as describeSessionHookChange, o as headlessClaudeRun, ot as findOnPath, p as runDetached, pt as MachineFileError, q as saveConnectionName, r as agentConnectionState, rt as describeSessionHookItem, st as hasMachineSessionHooks, t as HOOK_END_GRACE_MS, tt as currentCliLocation, u as readClaudeHookInput, ut as repairClaudeHooks, v as invitationProfileName, vt as writeManagedFile, w as ContactPolicyReadRetryError, x as RECEIVER_MODES, xt as withOwnerMemberAddress, y as pollCheckCommand, yt as readHookLauncherWarning, z as contactAgentAddress } from "../machine-session-Bmv7ZOQh.js";
+import { a as scopedChatSenderTrust, i as readBeforeDeadline, n as isPlainChatReply, o as presenceDisposition, r as isScopedChatReply, s as readPresenceProjection, t as isConnectedChatCredential } from "../scoped-chat-BW041zEY.js";
 import { c as startBackgroundListen, i as backgroundListenToken, l as stopBackgroundListen, o as runBackgroundListen, r as backgroundListenStatus, u as verifyBackgroundListenTarget } from "../listen-background--0peztKE.js";
-import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-50rw5Sh-.js";
+import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-CwIFkT9e.js";
 import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, readWorkingLease, restoreAutoWorking } from "./auto-signals.js";
 import { t as guardJsonOutputCommands } from "../json-output-CEskSQJi.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
@@ -1651,7 +1651,8 @@ const openapiDocument = {
 				},
 				"responses": {
 					"200": {
-						"description": "Outbound relay result",
+						"description": "Outbound relay result. When the request was answered with an\nexisting send instead of making a new one, the response carries\n`Idempotent-Replayed: true` and `data.idempotency`, and nothing\nwas sent for this request.\n",
+						"headers": { "Idempotent-Replayed": { "$ref": "#/components/headers/IdempotentReplayed" } },
 						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
 							"type": "object",
 							"properties": { "data": { "$ref": "#/components/schemas/SendMailResult" } }
@@ -2409,7 +2410,7 @@ const openapiDocument = {
 		"/webhooks/deliveries": { "get": {
 			"operationId": "listDeliveries",
 			"summary": "List webhook deliveries",
-			"description": "Returns a paginated list of webhook delivery attempts. Each delivery\nincludes a nested `email` object with sender, recipient, and subject.\n",
+			"description": "Returns a paginated list of webhook delivery attempts, newest first.\nA delivery of an inbound email includes a nested `email` object with\nsender, recipient, and subject. A delivery of an opt-in\n`sent_email.*` event has `email_id` and `email` set to null and\n`sent_email_id` set to the send it is about. Filter by `event_type`\nand `sent_email_id` to find the deliveries of one send.\n",
 			"tags": ["Webhook Deliveries"],
 			"parameters": [
 				{ "$ref": "#/components/parameters/Cursor" },
@@ -2423,6 +2424,25 @@ const openapiDocument = {
 					},
 					"description": "Filter by email ID"
 				},
+				{
+					"name": "event_type",
+					"in": "query",
+					"schema": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 200
+					},
+					"description": "Only deliveries of this event type, for example `sent_email.failed`. Deliveries recorded before event types existed have none and never match."
+				},
+				{
+					"name": "sent_email_id",
+					"in": "query",
+					"schema": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"description": "Only deliveries of `sent_email.*` events about this sent email."
+				},
 				{
 					"name": "status",
 					"in": "query",
@@ -2432,7 +2452,8 @@ const openapiDocument = {
 							"pending",
 							"delivered",
 							"header_confirmed",
-							"failed"
+							"failed",
+							"skipped_by_rules"
 						]
 					},
 					"description": "Filter by delivery status"
@@ -2478,14 +2499,14 @@ const openapiDocument = {
 				"required": true,
 				"schema": {
 					"type": "string",
-					"pattern": "^\\d+$"
+					"pattern": "^(\\d+|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$"
 				},
-				"description": "Delivery ID (numeric)"
+				"description": "Delivery ID, as `id` in the deliveries list: a numeric string or a UUID."
 			}],
 			"post": {
 				"operationId": "replayDelivery",
 				"summary": "Replay a webhook delivery",
-				"description": "Re-sends the stored webhook payload from a previous delivery attempt.\nIf the original endpoint is still active, it is targeted. If the\noriginal endpoint was deleted, the oldest active endpoint is used.\nDeactivated endpoints cannot be replayed to. Rate limited per-org,\nsharing an org-wide budget with email replays.\n",
+				"description": "Re-sends a previous delivery to its original endpoint. If that\nendpoint was deleted or deactivated, the replay is rejected.\nSupports inbound email deliveries and `sent_email.*` deliveries.\nAn inbound email delivery is replayed with its original stored\npayload and event id. A `sent_email.*` delivery is replayed with the\nsame event id but a payload rebuilt from the send as it is now; it\nis rejected if the send was deleted or the endpoint is no longer an\nactive http endpoint. Rate limited per-org, sharing an org-wide\nbudget with email replays.\n",
 				"tags": ["Webhook Deliveries"],
 				"responses": {
 					"200": {
@@ -2555,7 +2576,8 @@ const openapiDocument = {
 			},
 			"responses": {
 				"200": {
-					"description": "Outbound relay result",
+					"description": "Outbound relay result. When the request was answered with an\nexisting send instead of making a new one, the response carries\n`Idempotent-Replayed: true` and `data.idempotency`, and nothing\nwas sent for this request.\n",
+					"headers": { "Idempotent-Replayed": { "$ref": "#/components/headers/IdempotentReplayed" } },
 					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
 						"type": "object",
 						"properties": { "data": { "$ref": "#/components/schemas/SendMailResult" } }
@@ -8275,6 +8297,20 @@ const openapiDocument = {
 				}
 			}
 		},
+		"headers": {
+			"IdempotentReplayed": {
+				"description": "Set to `true` when the request was answered with an existing send\ninstead of making a new one. Absent on a request that sent. On a\nbatch it means at least one message replayed; see\n`Idempotent-Replayed-Count`.\n",
+				"schema": { "type": "string" },
+				"example": "true"
+			},
+			"IdempotentReplayedCount": {
+				"description": "Batch sends only: how many messages were answered with an existing\nsend instead of being sent. Absent when every message sent.\n",
+				"schema": {
+					"type": "integer",
+					"minimum": 1
+				}
+			}
+		},
 		"responses": {
 			"AttachmentPart": {
 				"description": "Original attachment bytes; never a JSON envelope or a base64 string",
@@ -12806,6 +12842,11 @@ const openapiDocument = {
 						"type": "string",
 						"description": "Bare email address parsed from `to_header`."
 					},
+					"recipient_count": {
+						"type": ["integer", "null"],
+						"minimum": 0,
+						"description": "Every recipient of the send, To, Cc and Bcc together, each address counted once: the size of `to_addresses`, `cc` and `bcc` combined without duplicates. On a mail relay send `bcc` lists every hidden recipient. Null when the request uses an address-bound agent connection key whose address is not the sender, because the count would reveal Bcc recipients. The `sent_email` object of the `sent_email.*` webhook events carries the same field."
+					},
 					"subject": { "type": "string" },
 					"body_size_bytes": {
 						"type": "integer",
@@ -13724,6 +13765,46 @@ const openapiDocument = {
 					"reply_sent_email_id"
 				]
 			},
+			"SendMailIdempotencyReplay": {
+				"type": "object",
+				"description": "Present only when the request was answered with an existing send\ninstead of making a new one (`idempotent_replay: true`). Nothing\nwas sent for this request. Says how the idempotency key was\nderived and which send the request collapsed onto. On the replay\nof a stored failure the same object is under `error.details`.\n",
+				"properties": {
+					"replayed": {
+						"type": "boolean",
+						"description": "Always `true`. The object is absent on a request that made a send of its own."
+					},
+					"key_source": {
+						"type": "string",
+						"enum": [
+							"explicit",
+							"auto_content",
+							"function_trigger"
+						],
+						"description": "`explicit`: the request carried an `Idempotency-Key` header.\n`auto_content`: no header was sent, so the key was derived\nfrom the canonical request content (recipients included) and\na fixed 5-minute window; an identical send inside the same\nwindow was not sent again. `function_trigger`: no header on a\nsend made by a Function, so the key was derived from the\ncontent, the Function and the inbound email (or event) that\ninvoked it.\n"
+					},
+					"original_sent_email_id": {
+						"type": "string",
+						"format": "uuid",
+						"description": "The send this request collapsed onto. Same value as `id`."
+					},
+					"original_created_at": {
+						"type": ["string", "null"],
+						"format": "date-time",
+						"description": "When that send was created."
+					},
+					"window_seconds": {
+						"type": ["integer", "null"],
+						"description": "Length of the content window (300) when an `auto_content`\nkey matched on content. Null for `explicit` and\n`function_trigger` keys, which have no window, and for a\nkeyless reply matched because its parent already has a reply\n(`dedup_reason: parent_already_replied`).\n"
+					}
+				},
+				"required": [
+					"replayed",
+					"key_source",
+					"original_sent_email_id",
+					"original_created_at",
+					"window_seconds"
+				]
+			},
 			"SendMailResult": {
 				"type": "object",
 				"properties": {
@@ -13780,6 +13861,11 @@ const openapiDocument = {
 						"type": "boolean",
 						"description": "True when the response replays a previously-recorded send\nkeyed by `client_idempotency_key` (same key, same canonical\npayload). False on a fresh send and on gate-denied\nresponses. Lets callers branch on cache state without\ndiffing fields.\n"
 					},
+					"dedup_reason": {
+						"type": ["string", "null"],
+						"description": "Why the response was a replay; null or absent on a fresh\nsend. `content_hash_match`: the idempotency key matched an\nearlier send. `parent_already_replied`: a reply sent without\nan `Idempotency-Key` header was matched to the reply its\nparent email already has. Pass an `Idempotency-Key` to send\nanother reply to the same email.\n"
+					},
+					"idempotency": { "$ref": "#/components/schemas/SendMailIdempotencyReplay" },
 					"scheduled_at": {
 						"type": "string",
 						"format": "date-time",
@@ -14337,7 +14423,8 @@ const openapiDocument = {
 							"items": {
 								"type": "string",
 								"minLength": 1
-							}
+							},
+							"description": "Event types this endpoint subscribes to, matched by exact string. Omitted means every event type except the opt-in `sent_email.*` events (`sent_email.accepted`, `sent_email.delivered`, `sent_email.failed`, `sent_email.completed`), which an endpoint receives only when it lists them, and only for sends made after it first listed one. An endpoint that lists `sent_email.*` events and also handles inbound mail must keep its inbound event types (such as `email.received`) in the list. An empty array is rejected; omit the field instead."
 						} }
 					},
 					"created_at": {
@@ -14460,7 +14547,8 @@ const openapiDocument = {
 							"items": {
 								"type": "string",
 								"minLength": 1
-							}
+							},
+							"description": "Event types this endpoint subscribes to, matched by exact string. Omitted means every event type except the opt-in `sent_email.*` events (`sent_email.accepted`, `sent_email.delivered`, `sent_email.failed`, `sent_email.completed`), which an endpoint receives only when it lists them, and only for sends made after it first listed one. An endpoint that lists `sent_email.*` events and also handles inbound mail must keep its inbound event types (such as `email.received`) in the list. An empty array is rejected; omit the field instead."
 						} }
 					},
 					"is_route_target": {
@@ -14498,7 +14586,8 @@ const openapiDocument = {
 							"items": {
 								"type": "string",
 								"minLength": 1
-							}
+							},
+							"description": "Event types this endpoint subscribes to, matched by exact string. Omitted means every event type except the opt-in `sent_email.*` events (`sent_email.accepted`, `sent_email.delivered`, `sent_email.failed`, `sent_email.completed`), which an endpoint receives only when it lists them, and only for sends made after it first listed one. An endpoint that lists `sent_email.*` events and also handles inbound mail must keep its inbound event types (such as `email.received`) in the list. An empty array is rejected; omit the field instead."
 						} }
 					}
 				},
@@ -15182,11 +15271,21 @@ const openapiDocument = {
 				"properties": {
 					"id": {
 						"type": "string",
-						"description": "Delivery ID (numeric string)"
+						"description": "Delivery ID: a numeric string or a UUID. Pass it to the replay operation as is."
 					},
 					"email_id": {
-						"type": "string",
-						"format": "uuid"
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The inbound email this delivery is about. Null for deliveries that are not about a received email, such as `sent_email.*` events."
+					},
+					"event_type": {
+						"type": ["string", "null"],
+						"description": "The delivered event type, for example `email.received` or `sent_email.delivered`. Null for deliveries recorded before event types existed."
+					},
+					"sent_email_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The sent email a `sent_email.*` delivery is about. Null for every other delivery."
 					},
 					"org_id": {
 						"type": "string",
@@ -15196,19 +15295,27 @@ const openapiDocument = {
 						"type": "string",
 						"format": "uuid"
 					},
-					"endpoint_url": { "type": "string" },
+					"endpoint_url": {
+						"type": ["string", "null"],
+						"description": "The endpoint's URL. For a function-backed endpoint, an opaque `function://<id>` identifier rather than a callable URL."
+					},
 					"status": {
 						"type": "string",
 						"enum": [
 							"pending",
 							"delivered",
 							"header_confirmed",
-							"failed"
+							"failed",
+							"skipped_by_rules"
 						]
 					},
 					"attempt_count": { "type": "integer" },
 					"duration_ms": { "type": ["integer", "null"] },
 					"last_error": { "type": ["string", "null"] },
+					"last_error_code": {
+						"type": ["string", "null"],
+						"description": "A stable code for the last failure, for example `http_500`."
+					},
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -15221,10 +15328,11 @@ const openapiDocument = {
 						"type": ["object", "null"],
 						"properties": {
 							"sender": { "type": "string" },
-							"recipient": { "type": "string" },
+							"recipient": { "type": ["string", "null"] },
 							"subject": { "type": ["string", "null"] }
 						},
-						"required": ["sender", "recipient"]
+						"required": ["sender", "recipient"],
+						"description": "Null for deliveries that are not about a received email."
 					}
 				},
 				"required": [
@@ -24736,7 +24844,8 @@ const operationManifest = [
 						"items": {
 							"type": "string",
 							"minLength": 1
-						}
+						},
+						"description": "Event types this endpoint subscribes to, matched by exact string. Omitted means every event type except the opt-in `sent_email.*` events (`sent_email.accepted`, `sent_email.delivered`, `sent_email.failed`, `sent_email.completed`), which an endpoint receives only when it lists them, and only for sends made after it first listed one. An endpoint that lists `sent_email.*` events and also handles inbound mail must keep its inbound event types (such as `email.received`) in the list. An empty array is rejected; omit the field instead."
 					} }
 				},
 				"is_route_target": {
@@ -24808,7 +24917,8 @@ const operationManifest = [
 						"items": {
 							"type": "string",
 							"minLength": 1
-						}
+						},
+						"description": "Event types this endpoint subscribes to, matched by exact string. Omitted means every event type except the opt-in `sent_email.*` events (`sent_email.accepted`, `sent_email.delivered`, `sent_email.failed`, `sent_email.completed`), which an endpoint receives only when it lists them, and only for sends made after it first listed one. An endpoint that lists `sent_email.*` events and also handles inbound mail must keep its inbound event types (such as `email.received`) in the list. An empty array is rejected; omit the field instead."
 					} }
 				},
 				"created_at": {
@@ -24988,7 +25098,8 @@ const operationManifest = [
 							"items": {
 								"type": "string",
 								"minLength": 1
-							}
+							},
+							"description": "Event types this endpoint subscribes to, matched by exact string. Omitted means every event type except the opt-in `sent_email.*` events (`sent_email.accepted`, `sent_email.delivered`, `sent_email.failed`, `sent_email.completed`), which an endpoint receives only when it lists them, and only for sends made after it first listed one. An endpoint that lists `sent_email.*` events and also handles inbound mail must keep its inbound event types (such as `email.received`) in the list. An empty array is rejected; omit the field instead."
 						} }
 					},
 					"created_at": {
@@ -25394,7 +25505,8 @@ const operationManifest = [
 						"items": {
 							"type": "string",
 							"minLength": 1
-						}
+						},
+						"description": "Event types this endpoint subscribes to, matched by exact string. Omitted means every event type except the opt-in `sent_email.*` events (`sent_email.accepted`, `sent_email.delivered`, `sent_email.failed`, `sent_email.completed`), which an endpoint receives only when it lists them, and only for sends made after it first listed one. An endpoint that lists `sent_email.*` events and also handles inbound mail must keep its inbound event types (such as `email.received`) in the list. An empty array is rejected; omit the field instead."
 					} }
 				}
 			},
@@ -25458,7 +25570,8 @@ const operationManifest = [
 						"items": {
 							"type": "string",
 							"minLength": 1
-						}
+						},
+						"description": "Event types this endpoint subscribes to, matched by exact string. Omitted means every event type except the opt-in `sent_email.*` events (`sent_email.accepted`, `sent_email.delivered`, `sent_email.failed`, `sent_email.completed`), which an endpoint receives only when it lists them, and only for sends made after it first listed one. An endpoint that lists `sent_email.*` events and also handles inbound mail must keep its inbound event types (such as `email.received`) in the list. An empty array is rejected; omit the field instead."
 					} }
 				},
 				"created_at": {
@@ -31368,6 +31481,11 @@ const operationManifest = [
 						"type": "string",
 						"description": "Bare email address parsed from `to_header`."
 					},
+					"recipient_count": {
+						"type": ["integer", "null"],
+						"minimum": 0,
+						"description": "Every recipient of the send, To, Cc and Bcc together, each address counted once: the size of `to_addresses`, `cc` and `bcc` combined without duplicates. On a mail relay send `bcc` lists every hidden recipient. Null when the request uses an address-bound agent connection key whose address is not the sender, because the count would reveal Bcc recipients. The `sent_email` object of the `sent_email.*` webhook events carries the same field."
+					},
 					"subject": { "type": "string" },
 					"body_size_bytes": {
 						"type": "integer",
@@ -32103,6 +32221,11 @@ const operationManifest = [
 						"type": "string",
 						"description": "Bare email address parsed from `to_header`."
 					},
+					"recipient_count": {
+						"type": ["integer", "null"],
+						"minimum": 0,
+						"description": "Every recipient of the send, To, Cc and Bcc together, each address counted once: the size of `to_addresses`, `cc` and `bcc` combined without duplicates. On a mail relay send `bcc` lists every hidden recipient. Null when the request uses an address-bound agent connection key whose address is not the sender, because the count would reveal Bcc recipients. The `sent_email` object of the `sent_email.*` webhook events carries the same field."
+					},
 					"subject": { "type": "string" },
 					"body_size_bytes": {
 						"type": "integer",
@@ -32603,6 +32726,11 @@ const operationManifest = [
 						"type": "string",
 						"description": "Bare email address parsed from `to_header`."
 					},
+					"recipient_count": {
+						"type": ["integer", "null"],
+						"minimum": 0,
+						"description": "Every recipient of the send, To, Cc and Bcc together, each address counted once: the size of `to_addresses`, `cc` and `bcc` combined without duplicates. On a mail relay send `bcc` lists every hidden recipient. Null when the request uses an address-bound agent connection key whose address is not the sender, because the count would reveal Bcc recipients. The `sent_email` object of the `sent_email.*` webhook events carries the same field."
+					},
 					"subject": { "type": "string" },
 					"body_size_bytes": {
 						"type": "integer",
@@ -33007,6 +33135,50 @@ const operationManifest = [
 					"type": "boolean",
 					"description": "True when the response replays a previously-recorded send\nkeyed by `client_idempotency_key` (same key, same canonical\npayload). False on a fresh send and on gate-denied\nresponses. Lets callers branch on cache state without\ndiffing fields.\n"
 				},
+				"dedup_reason": {
+					"type": ["string", "null"],
+					"description": "Why the response was a replay; null or absent on a fresh\nsend. `content_hash_match`: the idempotency key matched an\nearlier send. `parent_already_replied`: a reply sent without\nan `Idempotency-Key` header was matched to the reply its\nparent email already has. Pass an `Idempotency-Key` to send\nanother reply to the same email.\n"
+				},
+				"idempotency": {
+					"type": "object",
+					"description": "Present only when the request was answered with an existing send\ninstead of making a new one (`idempotent_replay: true`). Nothing\nwas sent for this request. Says how the idempotency key was\nderived and which send the request collapsed onto. On the replay\nof a stored failure the same object is under `error.details`.\n",
+					"properties": {
+						"replayed": {
+							"type": "boolean",
+							"description": "Always `true`. The object is absent on a request that made a send of its own."
+						},
+						"key_source": {
+							"type": "string",
+							"enum": [
+								"explicit",
+								"auto_content",
+								"function_trigger"
+							],
+							"description": "`explicit`: the request carried an `Idempotency-Key` header.\n`auto_content`: no header was sent, so the key was derived\nfrom the canonical request content (recipients included) and\na fixed 5-minute window; an identical send inside the same\nwindow was not sent again. `function_trigger`: no header on a\nsend made by a Function, so the key was derived from the\ncontent, the Function and the inbound email (or event) that\ninvoked it.\n"
+						},
+						"original_sent_email_id": {
+							"type": "string",
+							"format": "uuid",
+							"description": "The send this request collapsed onto. Same value as `id`."
+						},
+						"original_created_at": {
+							"type": ["string", "null"],
+							"format": "date-time",
+							"description": "When that send was created."
+						},
+						"window_seconds": {
+							"type": ["integer", "null"],
+							"description": "Length of the content window (300) when an `auto_content`\nkey matched on content. Null for `explicit` and\n`function_trigger` keys, which have no window, and for a\nkeyless reply matched because its parent already has a reply\n(`dedup_reason: parent_already_replied`).\n"
+						}
+					},
+					"required": [
+						"replayed",
+						"key_source",
+						"original_sent_email_id",
+						"original_created_at",
+						"window_seconds"
+					]
+				},
 				"scheduled_at": {
 					"type": "string",
 					"format": "date-time",
@@ -33122,6 +33294,11 @@ const operationManifest = [
 						"type": "string",
 						"description": "Bare email address parsed from `to_header`."
 					},
+					"recipient_count": {
+						"type": ["integer", "null"],
+						"minimum": 0,
+						"description": "Every recipient of the send, To, Cc and Bcc together, each address counted once: the size of `to_addresses`, `cc` and `bcc` combined without duplicates. On a mail relay send `bcc` lists every hidden recipient. Null when the request uses an address-bound agent connection key whose address is not the sender, because the count would reveal Bcc recipients. The `sent_email` object of the `sent_email.*` webhook events carries the same field."
+					},
 					"subject": { "type": "string" },
 					"body_size_bytes": {
 						"type": "integer",
@@ -33775,6 +33952,50 @@ const operationManifest = [
 					"type": "boolean",
 					"description": "True when the response replays a previously-recorded send\nkeyed by `client_idempotency_key` (same key, same canonical\npayload). False on a fresh send and on gate-denied\nresponses. Lets callers branch on cache state without\ndiffing fields.\n"
 				},
+				"dedup_reason": {
+					"type": ["string", "null"],
+					"description": "Why the response was a replay; null or absent on a fresh\nsend. `content_hash_match`: the idempotency key matched an\nearlier send. `parent_already_replied`: a reply sent without\nan `Idempotency-Key` header was matched to the reply its\nparent email already has. Pass an `Idempotency-Key` to send\nanother reply to the same email.\n"
+				},
+				"idempotency": {
+					"type": "object",
+					"description": "Present only when the request was answered with an existing send\ninstead of making a new one (`idempotent_replay: true`). Nothing\nwas sent for this request. Says how the idempotency key was\nderived and which send the request collapsed onto. On the replay\nof a stored failure the same object is under `error.details`.\n",
+					"properties": {
+						"replayed": {
+							"type": "boolean",
+							"description": "Always `true`. The object is absent on a request that made a send of its own."
+						},
+						"key_source": {
+							"type": "string",
+							"enum": [
+								"explicit",
+								"auto_content",
+								"function_trigger"
+							],
+							"description": "`explicit`: the request carried an `Idempotency-Key` header.\n`auto_content`: no header was sent, so the key was derived\nfrom the canonical request content (recipients included) and\na fixed 5-minute window; an identical send inside the same\nwindow was not sent again. `function_trigger`: no header on a\nsend made by a Function, so the key was derived from the\ncontent, the Function and the inbound email (or event) that\ninvoked it.\n"
+						},
+						"original_sent_email_id": {
+							"type": "string",
+							"format": "uuid",
+							"description": "The send this request collapsed onto. Same value as `id`."
+						},
+						"original_created_at": {
+							"type": ["string", "null"],
+							"format": "date-time",
+							"description": "When that send was created."
+						},
+						"window_seconds": {
+							"type": ["integer", "null"],
+							"description": "Length of the content window (300) when an `auto_content`\nkey matched on content. Null for `explicit` and\n`function_trigger` keys, which have no window, and for a\nkeyless reply matched because its parent already has a reply\n(`dedup_reason: parent_already_replied`).\n"
+						}
+					},
+					"required": [
+						"replayed",
+						"key_source",
+						"original_sent_email_id",
+						"original_created_at",
+						"window_seconds"
+					]
+				},
 				"scheduled_at": {
 					"type": "string",
 					"format": "date-time",
@@ -35340,7 +35561,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-deliveries",
-		"description": "Returns a paginated list of webhook delivery attempts. Each delivery\nincludes a nested `email` object with sender, recipient, and subject.\n",
+		"description": "Returns a paginated list of webhook delivery attempts, newest first.\nA delivery of an inbound email includes a nested `email` object with\nsender, recipient, and subject. A delivery of an opt-in\n`sent_email.*` event has `email_id` and `email` set to null and\n`sent_email_id` set to the send it is about. Filter by `event_type`\nand `sent_email_id` to find the deliveries of one send.\n",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listDeliveries",
@@ -35371,13 +35592,28 @@ const operationManifest = [
 				"required": false,
 				"type": "string"
 			},
+			{
+				"description": "Only deliveries of this event type, for example `sent_email.failed`. Deliveries recorded before event types existed have none and never match.",
+				"enum": null,
+				"name": "event_type",
+				"required": false,
+				"type": "string"
+			},
+			{
+				"description": "Only deliveries of `sent_email.*` events about this sent email.",
+				"enum": null,
+				"name": "sent_email_id",
+				"required": false,
+				"type": "string"
+			},
 			{
 				"description": "Filter by delivery status",
 				"enum": [
 					"pending",
 					"delivered",
 					"header_confirmed",
-					"failed"
+					"failed",
+					"skipped_by_rules"
 				],
 				"name": "status",
 				"required": false,
@@ -35406,11 +35642,21 @@ const operationManifest = [
 				"properties": {
 					"id": {
 						"type": "string",
-						"description": "Delivery ID (numeric string)"
+						"description": "Delivery ID: a numeric string or a UUID. Pass it to the replay operation as is."
 					},
 					"email_id": {
-						"type": "string",
-						"format": "uuid"
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The inbound email this delivery is about. Null for deliveries that are not about a received email, such as `sent_email.*` events."
+					},
+					"event_type": {
+						"type": ["string", "null"],
+						"description": "The delivered event type, for example `email.received` or `sent_email.delivered`. Null for deliveries recorded before event types existed."
+					},
+					"sent_email_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The sent email a `sent_email.*` delivery is about. Null for every other delivery."
 					},
 					"org_id": {
 						"type": "string",
@@ -35420,19 +35666,27 @@ const operationManifest = [
 						"type": "string",
 						"format": "uuid"
 					},
-					"endpoint_url": { "type": "string" },
+					"endpoint_url": {
+						"type": ["string", "null"],
+						"description": "The endpoint's URL. For a function-backed endpoint, an opaque `function://<id>` identifier rather than a callable URL."
+					},
 					"status": {
 						"type": "string",
 						"enum": [
 							"pending",
 							"delivered",
 							"header_confirmed",
-							"failed"
+							"failed",
+							"skipped_by_rules"
 						]
 					},
 					"attempt_count": { "type": "integer" },
 					"duration_ms": { "type": ["integer", "null"] },
 					"last_error": { "type": ["string", "null"] },
+					"last_error_code": {
+						"type": ["string", "null"],
+						"description": "A stable code for the last failure, for example `http_500`."
+					},
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -35445,10 +35699,11 @@ const operationManifest = [
 						"type": ["object", "null"],
 						"properties": {
 							"sender": { "type": "string" },
-							"recipient": { "type": "string" },
+							"recipient": { "type": ["string", "null"] },
 							"subject": { "type": ["string", "null"] }
 						},
-						"required": ["sender", "recipient"]
+						"required": ["sender", "recipient"],
+						"description": "Null for deliveries that are not about a received email."
 					}
 				},
 				"required": [
@@ -35473,13 +35728,13 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "replay-delivery",
-		"description": "Re-sends the stored webhook payload from a previous delivery attempt.\nIf the original endpoint is still active, it is targeted. If the\noriginal endpoint was deleted, the oldest active endpoint is used.\nDeactivated endpoints cannot be replayed to. Rate limited per-org,\nsharing an org-wide budget with email replays.\n",
+		"description": "Re-sends a previous delivery to its original endpoint. If that\nendpoint was deleted or deactivated, the replay is rejected.\nSupports inbound email deliveries and `sent_email.*` deliveries.\nAn inbound email delivery is replayed with its original stored\npayload and event id. A `sent_email.*` delivery is replayed with the\nsame event id but a payload rebuilt from the send as it is now; it\nis rejected if the send was deleted or the endpoint is no longer an\nactive http endpoint. Rate limited per-org, sharing an org-wide\nbudget with email replays.\n",
 		"hasJsonBody": false,
 		"method": "POST",
 		"operationId": "replayDelivery",
 		"path": "/webhooks/deliveries/{id}/replay",
 		"pathParams": [{
-			"description": "Delivery ID (numeric)",
+			"description": "Delivery ID, as `id` in the deliveries list: a numeric string or a UUID.",
 			"enum": null,
 			"name": "id",
 			"required": true,
@@ -36137,6 +36392,11 @@ async function replaceSessionAddresses(params) {
 				const directory = agentProfileDirectory(params.configDir, profile);
 				archive(join(directory, "setup.json"), stamp);
 				archive(join(directory, "enrollment", "state.json"), stamp);
+				await releaseRegistrationsForProfile({
+					configDir: params.configDir,
+					profileName: profile,
+					now: params.now
+				});
 			}
 		} catch (error) {
 			const done = replaced.length ? ` Already disconnected: ${replaced.map((r) => r.address).join(", ")}.` : "";
@@ -36188,8 +36448,16 @@ function statusProfileMissingDetail(bound) {
 function invocation$1(entry) {
 	return entry && /[\\/]_npx[\\/]/.test(entry) ? "npx -y primitive@latest" : "primitive";
 }
+/**
+* Names the addresses this run cleared as already revoked, so a later
+* refusal or failure that says nothing changed is not taken literally.
+*/
+function withClearedNote(message, cleared) {
+	if (!cleared.length) return message;
+	return `${message} Before that, this run cleared ${cleared.map((row) => `${row.address} (profile ${row.profile})`).join(", ")} on this machine because Primitive confirmed ${cleared.length === 1 ? "its credential was" : "their credentials were"} already revoked; ${cleared.length === 1 ? "it stays" : "they stay"} disconnected.`;
+}
 var AgentConnectCommand = class AgentConnectCommand extends Command {
-	static description = `Connect this coding session to Primitive in one call. With --session, the command checks this CLI's capabilities, installs or refreshes the matching primitive-connect skill for the detected runtime (Claude Code or Codex) from files bundled in this CLI, claims the owner's private setup invitation from piped stdin, answers one authenticated setup challenge, enables owner notifications, starts receiving, seeds a private AGENT_INFO note from --name and --info when absent, and prints one JSON result. The receiver defaults to external hooks in Claude Code and the native background listener elsewhere. When the native default cannot work because this machine has no local session socket (for example Codex older than 0.158.0), the command connects with poll receiving instead and reports receiving.fallbackReason and receiving.fallbackDetail. Without a session (no --session, or an empty one) the receiver is poll: for runtimes with no local session ID or hooks, such as a cloud-hosted conversation whose commands run in a separate sandbox, the invitation is claimed and verified the same way, nothing is installed, and the result's receiving.checkCommand is the command the agent runs to check for new mail at the start of each turn and after it sends. Native receiving starts or reuses a supervised background listener and waits briefly for its first successful mail check; external receiving installs the exact Claude session's fail-open Stop hook and resume SessionStart hook after the verification reply; a real idle mail event must still verify wake. The profile defaults to session-<session>, or to connection-<invitation hash prefix> without a session. --resume continues saved progress without reading stdin or replaying a claim or uncertain verification send. After the reply is submitted it waits up to a minute for the server to confirm the connection and reports verification.state verified, or reply_submitted while confirmation is still pending. Verification is separate from receiver health. Both official production (https://api.primitive.dev/v1) and staging (https://api.primitive-staging-1.com/v1) invitations pin their API origin. Never pass an invitation as a command argument. One address per session: if this session already has a connected Primitive address, including one saved in the profile being connected, the command claims nothing, leaves stdin unread, and exits 3 with status already_connected. Its detail names how to continue that profile's own connection when that is the only one: --resume for a setup with saved progress, or --keep-existing to refresh a claim-only profile from the same invitation. Otherwise ask the user whether to keep the existing address or disconnect it first, then rerun with --keep-existing or --replace-existing. Never choose for the user. Select the saved identity with PRIMITIVE_AGENT_PROFILE. Use --status --json with --profile, with PRIMITIVE_AGENT_PROFILE set, or with --session (the address connected for that session) to inspect saved identity and local receiver health offline; it exits 1 when nothing is configured. A status check before connecting is optional: connect itself claims nothing and exits 3 when the session already has an address. A completed connection's result carries nextSteps, in order: report to the owner in two short sentences, make one offer to rename a generated name and record where the agent runs, and load the primitive-connect skill before handling mail. When the claim reported one, the result also carries the connection's name and nameIsDefault.`;
+	static description = `Connect this coding session to Primitive in one call. With --session, the command checks this CLI's capabilities, installs or refreshes the matching primitive-connect skill for the detected runtime (Claude Code or Codex) from files bundled in this CLI, claims the owner's private setup invitation from piped stdin, answers one authenticated setup challenge, enables owner notifications, starts receiving, seeds a private AGENT_INFO note from --name and --info when absent, and prints one JSON result. The receiver defaults to external hooks in Claude Code and the native background listener elsewhere. When the native default cannot work because this machine has no local session socket (for example Codex older than 0.158.0), the command connects with poll receiving instead and reports receiving.fallbackReason and receiving.fallbackDetail. Without a session (no --session, or an empty one) the receiver is poll: for runtimes with no local session ID or hooks, such as a cloud-hosted conversation whose commands run in a separate sandbox, the invitation is claimed and verified the same way, nothing is installed, and the result's receiving.checkCommand is the command the agent runs to check for new mail at the start of each turn and after it sends. Native receiving starts or reuses a supervised background listener and waits briefly for its first successful mail check; external receiving installs the exact Claude session's fail-open Stop hook and resume SessionStart hook after the verification reply; a real idle mail event must still verify wake. The profile defaults to session-<session>, or to connection-<invitation hash prefix> without a session. --resume continues saved progress without reading stdin or replaying a claim or uncertain verification send. After the reply is submitted it waits up to a minute for the server to confirm the connection and reports verification.state verified, or reply_submitted while confirmation is still pending. Verification is separate from receiver health. Both official production (https://api.primitive.dev/v1) and staging (https://api.primitive-staging-1.com/v1) invitations pin their API origin. Never pass an invitation as a command argument. One address per session: an address whose credential Primitive confirms was already revoked (for example, revoked in the app before the owner reconnected it) no longer counts; it is disconnected locally, reported in clearedRevoked, and its saved setup is moved aside so the new invitation can be claimed into the same profile. Otherwise, if this session already has a connected Primitive address, including one saved in the profile being connected, the command claims nothing, leaves stdin unread, and exits 3 with status already_connected. Its detail names how to continue that profile's own connection when that is the only one: --resume for a setup with saved progress, or --keep-existing to refresh a claim-only profile from the same invitation. Otherwise ask the user whether to keep the existing address or disconnect it first, then rerun with --keep-existing or --replace-existing. Never choose for the user. Select the saved identity with PRIMITIVE_AGENT_PROFILE. Use --status --json with --profile, with PRIMITIVE_AGENT_PROFILE set, or with --session (the address connected for that session) to inspect saved identity and local receiver health offline; it exits 1 when nothing is configured. A status check before connecting is optional: connect itself claims nothing and exits 3 when the session already has an address. A completed connection's result carries nextSteps, in order: report to the owner in two short sentences, make one offer to rename a generated name and record where the agent runs, and load the primitive-connect skill before handling mail. When the claim reported one, the result also carries the connection's name and nameIsDefault.`;
 	static summary = "Connect and verify an agent address";
 	static examples = [
 		"<%= config.bin %> agent connect --session \"$CODEX_THREAD_ID\" --name Research --info \"Reviews pull requests\" --json < private-invitation.txt",
@@ -36250,6 +36518,7 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 		const { flags } = await this.parse(AgentConnectCommand);
 		let pollProfile;
 		let replaced = [];
+		let cleared = [];
 		try {
 			if (flags.status) {
 				const statusSession = flags.session?.trim();
@@ -36321,10 +36590,25 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 					address: check.target.address
 				}];
 				if (bound.length > 0 && !flags["replace-existing"]) {
-					const continuation = check.target && targetContinuation(this.config.configDir, check.target.profile, claimOnly);
+					const result = await clearRevokedAddresses({
+						configDir: this.config.configDir,
+						rows: bound,
+						disconnect: disconnectAgent
+					});
+					bound = result.remaining;
+					cleared = result.cleared;
+					if (!flags.json) for (const row of cleared) this.log(`Cleared ${row.address} (profile ${row.profile}): Primitive confirmed its credential was already revoked.`);
+				}
+				if (bound.length > 0 && !flags["replace-existing"]) {
+					const continuation = check.target && bound.some((row) => row.profile === check.target?.profile) && targetContinuation(this.config.configDir, check.target.profile, claimOnly);
 					const refusal = alreadyConnected(guardSession, bound, "connect", continuation || void 0);
-					if (flags.json) this.log(JSON.stringify(refusal));
-					else this.log(refusal.detail);
+					const detail = withClearedNote(refusal.detail, cleared);
+					if (flags.json) this.log(JSON.stringify(cleared.length ? {
+						...refusal,
+						detail,
+						clearedRevoked: cleared
+					} : refusal));
+					else this.log(detail);
 					process.exitCode = 3;
 					return;
 				}
@@ -36386,10 +36670,11 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 						guidance: `${output.guidance} Next: ${nextSteps.join(" ")}`
 					} : {}
 				};
-				if (flags.json) this.log(JSON.stringify(replaced.length ? {
+				if (flags.json) this.log(JSON.stringify({
 					...suggested,
-					replacedExisting: replaced
-				} : suggested));
+					...replaced.length ? { replacedExisting: replaced } : {},
+					...cleared.length ? { clearedRevoked: cleared } : {}
+				}));
 				else {
 					this.log(`Agent ${output.address}: verification ${output.verification.state}; receiving ${output.receiving.state}; skill ${output.skill.state}.`);
 					this.log(`Select it with ${output.selectProfile}.`);
@@ -36411,25 +36696,29 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 			}
 			if (!flags.profile) throw new AgentConnectionSetupError("Pass --profile for claim-only.");
 			const invitation = await readInvitationOnce();
-			agentInvitationHash(invitation);
+			const invitationHash = agentInvitationHash(invitation);
 			await replaceExisting?.();
-			const claimed = await connectAgent({
+			const profileName = flags.profile;
+			const claimed = await claimOverRevokedSetup({
 				configDir: this.config.configDir,
-				profileName: flags.profile,
-				invitation
-			});
+				profileName,
+				invitationHash
+			}, (claimLockHeld) => connectAgent({
+				configDir: this.config.configDir,
+				profileName,
+				invitation,
+				claimLockHeld
+			}));
 			const result = await withOwnerMemberAddress(claimed, {
 				configDir: this.config.configDir,
 				onlyIfUnknown: claimed.status === "claimed"
 			});
 			const warnings = connectWarnings(this.config.configDir, result.identity.profileName);
-			if (flags.json) this.log(JSON.stringify(replaced.length ? {
+			if (flags.json) this.log(JSON.stringify({
 				...result,
 				warnings,
-				replacedExisting: replaced
-			} : {
-				...result,
-				warnings
+				...replaced.length ? { replacedExisting: replaced } : {},
+				...cleared.length ? { clearedRevoked: cleared } : {}
 			}));
 			else {
 				this.log(result.status === "claimed" ? "Agent profile saved. Email readiness is not yet verified." : "Agent profile already configured; no claim was sent.");
@@ -36439,7 +36728,7 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 			}
 		} catch (caught) {
 			const error = refusalAfterReplacement(caught, replaced);
-			throw new Errors.CLIError(error instanceof AgentConnectionSetupError ? error.message : flags.session?.trim() ? `Setup paused. Preserve the private profile and run ${invocation$1(process.argv[1])} agent connect --profile ${flags.profile ?? defaultAgentProfileName(flags.session.trim())} --session ${flags.session.trim()}${flags.receiver ? ` --receiver ${flags.receiver}` : ""} --resume --json. Do not manually resend verification or reclaim the invitation.` : pollProfile ? `Setup paused. Preserve the private profile and run ${invocation$1(process.argv[1])} agent connect --profile ${pollProfile} --receiver poll --resume --json. Do not manually resend verification or reclaim the invitation.` : "Agent setup did not complete. Preserve the private profile and request a fresh owner invitation if a claim may have been submitted.", { exit: 1 });
+			throw new Errors.CLIError(withClearedNote(error instanceof AgentConnectionSetupError ? error.message : flags.session?.trim() ? `Setup paused. Preserve the private profile and run ${invocation$1(process.argv[1])} agent connect --profile ${flags.profile ?? defaultAgentProfileName(flags.session.trim())} --session ${flags.session.trim()}${flags.receiver ? ` --receiver ${flags.receiver}` : ""} --resume --json. Do not manually resend verification or reclaim the invitation.` : pollProfile ? `Setup paused. Preserve the private profile and run ${invocation$1(process.argv[1])} agent connect --profile ${pollProfile} --receiver poll --resume --json. Do not manually resend verification or reclaim the invitation.` : "Agent setup did not complete. Preserve the private profile and request a fresh owner invitation if a claim may have been submitted.", cleared), { exit: 1 });
 		}
 	}
 };
@@ -36620,7 +36909,7 @@ var AgentContactsUpdateCommand = class AgentContactsUpdateCommand extends Comman
 //#endregion
 //#region src/oclif/commands/agent-disconnect.ts
 var AgentDisconnectCommand = class AgentDisconnectCommand extends Command {
-	static description = "Disconnect exactly one saved connected-agent profile. Stop its tracked bound receiver, revoke only that address's bound credential at its pinned Primitive origin, then remove only the local credential after confirmed revocation. Mail, notes, setup evidence and notification receipts remain. This does not permanently remove the connection record; an owner or admin can do that separately.";
+	static description = "Disconnect exactly one saved connected-agent profile. Stop its tracked bound receiver, revoke only that address's bound credential at its pinned Primitive origin, then remove only the local credential after confirmed revocation. When Primitive refuses the credential as unauthorized because it was already revoked (in the app or from another machine), the same credential is checked once more and, only if that confirms it no longer authenticates, the disconnect completes and reports revocation already_revoked; a server error or network failure is never treated as confirmation. Mail, notes, setup evidence and notification receipts remain. This does not permanently remove the connection record; an owner or admin can do that separately.";
 	static summary = "Disconnect one connected agent";
 	static examples = ["<%= config.bin %> agent disconnect --profile work", "<%= config.bin %> agent disconnect --profile work --json"];
 	static flags = {
@@ -37291,7 +37580,7 @@ var AgentRuntimeGetCommand = class AgentRuntimeGetCommand extends Command {
 //#region src/oclif/commands/agent-session-end.ts
 var AgentSessionEndCommand = class AgentSessionEndCommand extends Command {
 	static summary = "Disconnect the agent a session registered when it ends";
-	static description = "Disconnects the agent that `primitive agent session-register` created for this session, and removes its exact-session receive hooks. Agents connected any other way are left connected. Never blocks or fails a session: every outcome exits 0 with a status. --hook reads Claude's SessionEnd hook input from stdin and disconnects in the background.";
+	static description = "Disconnects the agent that `primitive agent session-register` created for this session, and removes its exact-session receive hooks. Agents connected any other way are left connected, including an agent later connected into the same profile with `primitive agent connect`. Never blocks or fails a session: every outcome exits 0 with a status. --hook reads Claude's SessionEnd hook input from stdin and disconnects in the background after a grace period: Claude reports the same end for a restart, a switch to another session and a real exit, so a start of the same session within the grace period cancels the end and keeps its agent.";
 	static examples = ["<%= config.bin %> agent session-end --runtime claude --json", "<%= config.bin %> agent session-end --runtime codex --session 11111111-1111-4111-8111-111111111111"];
 	static flags = {
 		runtime: Flags.string({
@@ -37300,6 +37589,12 @@ var AgentSessionEndCommand = class AgentSessionEndCommand extends Command {
 			description: "The coding agent runtime this session runs in"
 		}),
 		session: Flags.string({ description: "Exact session UUID; defaults to the runtime's own session ID" }),
+		grace: Flags.integer({
+			min: 0,
+			max: 3600,
+			description: "Seconds to wait before disconnecting; a start of the same session meanwhile cancels the end"
+		}),
+		reason: Flags.string({ description: "The runtime's reason for the end, recorded with it" }),
 		hook: Flags.boolean({ description: "Read Claude hook JSON from stdin and disconnect in the background" }),
 		json: Flags.boolean({ description: "Print the result as JSON" }),
 		quiet: Flags.boolean({ description: "Print nothing" })
@@ -37320,6 +37615,9 @@ var AgentSessionEndCommand = class AgentSessionEndCommand extends Command {
 					runtime,
 					"--session",
 					input.sessionId,
+					"--grace",
+					String(HOOK_END_GRACE_MS / 1e3),
+					...input.reason ? ["--reason", input.reason] : [],
 					"--quiet"
 				],
 				env: process.env,
@@ -37330,7 +37628,9 @@ var AgentSessionEndCommand = class AgentSessionEndCommand extends Command {
 		const result = await endSession({
 			configDir: this.config.configDir,
 			runtime,
-			session: flags.session
+			session: flags.session,
+			graceMs: (flags.grace ?? 0) * 1e3,
+			reason: flags.reason ?? null
 		});
 		const { status, ...rest } = result;
 		if (flags.json) this.log(JSON.stringify({
@@ -39490,6 +39790,10 @@ function chatFailureText(message) {
 function chatHeading(text) {
 	return chatColor("bold", text);
 }
+const CHAT_REPLAY_NOTICE = {
+	keyOrigin: "cli_derived",
+	advise: false
+};
 function chatNoticeText(message) {
 	return chatColor("yellow", message);
 }
@@ -39789,7 +40093,7 @@ function chatNoun(context) {
 	return context.parentReply === void 0 ? "Message" : "Reply";
 }
 function formatChatRepliedMessage(context, outcome) {
-	if (outcome === "already_sent") return `${formatAlreadySentNotice(context.sent)} Its existing reply from ${context.reply.from_email} is shown.`;
+	if (outcome === "already_sent") return `${formatAlreadySentNotice(context.sent, CHAT_REPLAY_NOTICE)} Its existing reply from ${context.reply.from_email} is shown.`;
 	return `${chatNoun(context)} sent (id ${context.sent.id}) and a reply arrived from ${context.reply.from_email}.`;
 }
 function buildChatJsonEnvelope(context, outcome = "replied") {
@@ -39853,7 +40157,7 @@ function formatChatAwaitingReplyMessage(context, options) {
 		const [next] = buildChatExistingReplyCommands(context, options.existingReplyId);
 		const status = options.waitError === void 0 ? "No reply to it yet." : `Loading its reply failed: ${options.waitError}.`;
 		const action = next.kind === "inspect_reply" ? "read the reply with" : next.kind === "inspect_inbox" ? "inspect the inbox with" : "wait with";
-		return `${formatAlreadySentNotice(context.sent)} ${status} Do NOT resend; ${action}: ${next.command}`;
+		return `${formatAlreadySentNotice(context.sent, CHAT_REPLAY_NOTICE)} ${status} Do NOT resend; ${action}: ${next.command}`;
 	}
 	const [wait] = buildChatRecoveryCommands(context);
 	const status = options.waitError === void 0 ? `No reply yet after ${context.timeoutSeconds}s.` : `Waiting for the reply failed: ${options.waitError}`;
@@ -40656,7 +40960,7 @@ var ChatCommand = class ChatCommand extends Command {
 				await connectedWait?.bind(sent.id);
 				if (flags.async) {
 					const outcome = sent.idempotent_replay ? "already_sent" : "sent";
-					const message = sent.idempotent_replay ? `${formatAlreadySentNotice(sent)} This conversation remains bound to this session; inspect it if the answer may have arrived already.` : `${chatNoun(baseContext)} sent (id ${sent.id}). This conversation is bound to this session for status and later replies. Keep its configured receiver active.`;
+					const message = sent.idempotent_replay ? `${formatAlreadySentNotice(sent, CHAT_REPLAY_NOTICE)} This conversation remains bound to this session; inspect it if the answer may have arrived already.` : `${chatNoun(baseContext)} sent (id ${sent.id}). This conversation is bound to this session for status and later replies. Keep its configured receiver active.`;
 					const result = {
 						outcome,
 						exit_code: sendOutcomeExitCode(outcome),
@@ -40855,7 +41159,7 @@ var ChatCommand = class ChatCommand extends Command {
 	}
 	reportReplied(context, outcome) {
 		this.chatProgress.outcomeReported = true;
-		if (outcome === "already_sent") process.stderr.write(`${chatNoticeText(formatAlreadySentNotice(context.sent))}\n`);
+		if (outcome === "already_sent") process.stderr.write(`${chatNoticeText(formatAlreadySentNotice(context.sent, CHAT_REPLAY_NOTICE))}\n`);
 		if (context.json) this.log(JSON.stringify(buildChatJsonEnvelope(context, outcome), null, 2));
 		else this.log(formatChatResponse(context));
 	}
@@ -44604,7 +44908,7 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	url: "https://primitive.dev"
 };
 const SDK_VERSION_RANGE = "^2.0.0";
-const CLI_VERSION_RANGE = "^1.63.0";
+const CLI_VERSION_RANGE = "^1.65.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -54990,9 +55294,12 @@ var PaymentsPayEmailCommand = class PaymentsPayEmailCommand extends Command {
 			}
 			const sent = result.data?.data ?? null;
 			const replayed = sent?.idempotent_replay === true;
-			if (replayed) writeIdempotentReplayBannerIfReplay(sent, { write: (chunk) => {
-				process.stderr.write(chunk);
-			} });
+			if (replayed) writeIdempotentReplayBannerIfReplay(sent, {
+				advise: false,
+				write: (chunk) => {
+					process.stderr.write(chunk);
+				}
+			});
 			let settlement = null;
 			if (flags["wait-settle"] && !replayed && payeeTo) {
 				process.stderr.write("Payment sent. Waiting for the x402 settlement interaction email (settlement is async)...\n");
@@ -55867,6 +56174,7 @@ var ReplyCommand = class ReplyCommand extends Command {
 			const outcome = reportSendCommandResult({
 				attemptStartedAtIso,
 				idempotencyKey,
+				idempotencyKeyOrigin: flags["idempotency-key"] === void 0 ? "cli_derived" : "caller",
 				extraEnvelopeFields: {
 					...priorRepliesEnvelopeFields(priorRepliesCheck),
 					...replyTargetEnvelopeFields(flags, this.replyTarget),
@@ -56993,6 +57301,7 @@ var SendCommand = class SendCommand extends Command {
 				attemptStartedAtIso,
 				...this.waitNotice ? { extraEnvelopeFields: { wait_notice: this.waitNotice } } : {},
 				idempotencyKey,
+				idempotencyKeyOrigin: flags["idempotency-key"] === void 0 ? "cli_derived" : "caller",
 				json: flags.json,
 				log: (line) => this.log(line),
 				noun: "Message",