primcli 1.71.0 → 1.72.0

package/dist/oclif/index.js

@@ -1,16 +1,16 @@
 import { a as REPEAT_IDLE_MAX_MINUTES, b as parseWebhookEvent, d as parseRepeatTick, f as preparePresenceAliveEmail, i as REPEAT_EVERY_MAX_MINUTES, l as parseInteractionEnvelope$1, m as repeatStopCommand, o as REPEAT_MAX_SENDS_MAX, p as prepareSignalEmail, s as buildRepeatStopBody, u as parsePresenceEnvelope, v as isEmailReceivedEvent, x as parseFromHeader } from "../repeats-BL7ZC-_6-CKMKBlx7.js";
-import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadActiveChatState, P as agentProfileName, R as loadConnectedAgentProfile, T as saveSignupCredentials, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-DMszFbGn.js";
-import { $ as apiResultHttpStatus, $n as listWakeAuthorizations, $t as addDefaultNetworkMember, A as readThreadContext, An as getFunctionTestRunTrace, Ar as updateRoute, At as formatAlreadySentNotice, B as pendingMailPath, Bt as expectedAutomatedVerdicts, C as queryUsesAwaiting, Cr as startCliLogin, Ct as cliInvocation, D as displayAddress, Dn as getEmail, Dr as updateDefaultNetworkMember, Dt as identitySuggestions, E as describeWake, En as getDefaultNetworkAgent, Er as unsetFunctionRoute, Et as generatedAgentName, F as wakeReadCommand, Fn as getSentEmail, Ft as AUTOMATED_VALUES, G as interactionNextActions, Gn as listEmails, Gt as ATTACHMENT_WAIT_MAX_MS, H as recordPendingMail, Hn as listDefaultNetworkMembers, Ht as isAutomatedRejectedError, I as wakeRecipientField, In as getThread, It as AutomatedFilterUnsupportedError, J as replyInteractionWarning, Jn as listFunctions, K as readEmailInteraction, Kn as listEndpoints, Kt as withAttachmentWait, L as wakeRelationship, Ln as getWakeSchedule, Lt as assertAutomatedVerdict, M as serverMuted, Mn as getMemory, Mr as updateWakeSchedule, Mt as withFlagSuggestion, N as serverRelationship, Nn as getOrgRoutingTopology, Nr as verifyAgentClaim, Nt as AUTOMATED_FILTER_UNSUPPORTED_CODE, O as formatMailWakeLine, On as getFunction, Or as updateFunction, Ot as loadSkillLine, Pn as getRepeatingSend, Pr as verifyAgentSignup, Pt as AUTOMATED_FLAG_DESCRIPTION, Q as SEND_OUTCOME_HELP, Qn as listSentEmails, Qt as resolveCliApiRequestConfig, R as clearConsumedPendingMail, Rn as listAgentContacts, Rt as automatedRejectedError, S as isAwaitingRejectedError, Sn as getAgentContactPolicy, Sr as startAgentSignup, T as bareAddress, Tn as getCreditBalance, Tr as testFunction, U as removePendingMail, Un as listDomains, Ut as queryUsesAutomated, V as readPendingMail, Vn as listDefaultNetworkAgents, Vt as hasAutomatedVerdict, W as interactionHumanLine, Wn as listEmailAttachmentArchiveMembers, Wt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, X as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Xn as listRoutes, Xt as createCliApiClient, Yn as listRepeatingSends, Yt as createAuthenticatedCliApiClient, Z as MAX_SEND_WAIT_TIMEOUT_MS, Zn as listSentAttachmentArchiveMembers, Zt as refreshStoredCliCredentials, _ as awaitingRejectedError, _n as downloadEmailAttachmentByFilename, _r as setFunctionRoute, _t as sendWaitClampNotice, a as extractErrorCode, an as createEndpoint, at as deriveSendIdempotencyKey, b as formatRepliesCell, bn as downloadSentAttachmentByFilename, br as simulateRoute, bt as successfulSendOutcome, c as readTextFileFlag, cn as createWakeAuthorization, cr as removeDefaultNetworkMember, ct as formatDeletedEarlierSendNotice, d as writeErrorWithHints, dr as resendAgentSignupVerification, dt as formatSendFailureSummary, en as cancelSentEmail, er as listWakeDispatches, et as assertValidIdempotencyKey, f as AWAITING_FLAG_DESCRIPTION, fn as deleteMemory, fr as runWakeSchedule, ft as formatSendRecordFailureSummary, g as assertAwaitingFilterRows, gn as downloadEmailAttachmentArchiveMember, gr as sendEmail, gt as sendOutcomeExitCode, h as ReplyStateUnsupportedError, hn as deleteWakeSchedule, hr as semanticSearch, ht as sendIdentityFields, i as createOperationCommand, in as completeWebhookEvent, it as classifySendError, j as sentInThread, jn as getInboxStatus, jr as updateWakeAuthorization, jt as writeIdempotentReplayBannerIfReplay, k as latestOwnOutbound, kn as getFunctionRouting, kr as updateRepeatingSend, kt as currentMailSessionKey, l as runWithTiming, ln as createWakeSchedule, lr as reorderRoutes, lt as formatPriorRepliesCheckSkipped, m as REPLY_STATE_UNSUPPORTED_CODE, mn as deleteWakeAuthorization, mr as searchMemories, mt as reportSendCommandResult, n as API_ERROR_CODES, nn as checkDefaultNetworkContactAdmission, nr as pollCliLogin, nt as buildThrownSendFailureEnvelope, o as extractErrorPayload, on as createFunction, ot as excludeSignalReplies, p as AWAITING_VALUES, pn as deleteRoute, pr as searchEmails, pt as priorRepliesThatWentOut, q as replyExpectation, qn as listFunctionLogs, qt as ConnectedAgentKeyRequiredError, r as TIME_FLAG_DESCRIPTION, rn as cliLogout, rr as pullWebhookEvent, rt as checkPriorReplies, s as formatErrorPayload, sn as createRoute, sr as redeemCreditCode, st as followUpCommandPrefix, t as API_BASE_URL_FLAG_DESCRIPTION, tn as cancelSentEmailByIdempotencyKey, tr as listWakeSchedules, tt as buildFollowUpCommand, u as surfaceUnauthorizedHint, ur as replyToEmail, ut as formatPriorRepliesWarning, v as ensureSearchReportsReplyState, vr as setFunctionSecret, vt as sentHistoryWindowStart, w as explainPendingMailNotFound, wn as getConversation, wr as stopRepeatFromEmail, wt as connectNextSteps, x as hasReplyState, xn as getAccount, xr as startAgentClaim, xt as thrownErrorExitCode, y as formatAwaitingCell, yn as downloadSentAttachmentArchiveMember, yr as setMemory, yt as serializeErrorPayload, z as clearReadPendingMail, zn as listAgentNetworks, zt as ensureSearchReportsAutomated } from "../api-command-B8C3jr7A.js";
+import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, F as agentProfileName, G as PrimitiveApiClient, I as agentProfilesDirectory, M as AGENT_PROFILE_ENV, N as AgentConnectionSetupError, O as loadActiveChatState, P as agentProfileDirectory, T as saveSignupCredentials, U as requireDefaultLoginProfile, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_ADDRESS_ENV, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname, z as loadConnectedAgentProfile } from "../cli-config--YTRdJ3t.js";
+import { $ as MAX_SEND_WAIT_TIMEOUT_MS, $n as listSentAttachmentArchiveMembers, $t as refreshStoredCliCredentials, A as formatMailWakeLine, An as getFunction, Ar as updateFunction, At as loadSkillLine, B as clearConsumedPendingMail, Bn as listAgentContacts, Bt as automatedRejectedError, C as hasReplyState, Cn as getAccount, Cr as startAgentClaim, Ct as thrownErrorExitCode, D as bareAddress, Dn as getCreditBalance, Dr as testFunction, E as explainPendingMailNotFound, En as getConversation, Er as stopRepeatFromEmail, Et as connectNextSteps, F as serverRelationship, Fn as getOrgRoutingTopology, Fr as verifyAgentClaim, Ft as AUTOMATED_FILTER_UNSUPPORTED_CODE, G as removePendingMail, Gn as listDomains, Gt as queryUsesAutomated, H as pendingMailPath, Ht as expectedAutomatedVerdicts, In as getRepeatingSend, Ir as verifyAgentSignup, It as AUTOMATED_FLAG_DESCRIPTION, J as readEmailInteraction, Jn as listEndpoints, Jt as withAttachmentWait, K as interactionHumanLine, Kn as listEmailAttachmentArchiveMembers, Kt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, L as wakeReadCommand, Ln as getSentEmail, Lt as AUTOMATED_VALUES, M as readThreadContext, Mn as getFunctionTestRunTrace, Mr as updateRoute, Mt as formatAlreadySentNotice, N as sentInThread, Nn as getInboxStatus, Nr as updateWakeAuthorization, Nt as writeIdempotentReplayBannerIfReplay, O as describeWake, On as getDefaultNetworkAgent, Or as unsetFunctionRoute, Ot as generatedAgentName, P as serverMuted, Pn as getMemory, Pr as updateWakeSchedule, Pt as withFlagSuggestion, Q as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Qn as listRoutes, Qt as createCliApiClient, R as wakeRecipientField, Rn as getThread, Rt as AutomatedFilterUnsupportedError, S as formatRepliesCell, Sn as downloadSentAttachmentByFilename, Sr as simulateRoute, St as successfulSendOutcome, T as queryUsesAwaiting, Tr as startCliLogin, Tt as cliInvocation, U as readPendingMail, Un as listDefaultNetworkAgents, Ut as hasAutomatedVerdict, V as clearReadPendingMail, Vn as listAgentNetworks, Vt as ensureSearchReportsAutomated, W as recordPendingMail, Wn as listDefaultNetworkMembers, Wt as isAutomatedRejectedError, X as replyInteractionWarning, Xn as listFunctions, Y as replyExpectation, Yn as listFunctionLogs, Yt as ConnectedAgentKeyRequiredError, Zn as listRepeatingSends, Zt as createAuthenticatedCliApiClient, _ as ReplyStateUnsupportedError, _n as deleteWakeSchedule, _r as semanticSearch, _t as sendIdentityFields, a as extractErrorCode, an as cliLogout, ar as pullWebhookEvent, at as checkPriorReplies, b as ensureSearchReportsReplyState, br as setFunctionSecret, bt as sentHistoryWindowStart, c as hasControlCharacter$1, cn as createFunction, ct as excludeSignalReplies, d as runWithTiming, dn as createWakeSchedule, dr as reorderRoutes, dt as formatPriorRepliesCheckSkipped, en as resolveCliApiRequestConfig, er as listSentEmails, et as SEND_OUTCOME_HELP, f as surfaceUnauthorizedHint, fr as replyToEmail, ft as formatPriorRepliesWarning, g as REPLY_STATE_UNSUPPORTED_CODE, gn as deleteWakeAuthorization, gr as searchMemories, gt as reportSendCommandResult, h as AWAITING_VALUES, hn as deleteRoute, hr as searchEmails, ht as priorRepliesThatWentOut, i as createOperationCommand, in as checkDefaultNetworkContactAdmission, ir as pollCliLogin, it as buildThrownSendFailureEnvelope, j as latestOwnOutbound, jn as getFunctionRouting, jr as updateRepeatingSend, jt as currentMailSessionKey, k as displayAddress, kn as getEmail, kr as updateDefaultNetworkMember, kt as identitySuggestions, l as headerFlagName, ln as createRoute, lr as redeemCreditCode, lt as followUpCommandPrefix, m as AWAITING_FLAG_DESCRIPTION, mn as deleteMemory, mr as runWakeSchedule, mt as formatSendRecordFailureSummary, n as API_ERROR_CODES, nn as cancelSentEmail, nr as listWakeDispatches, nt as assertValidIdempotencyKey, o as extractErrorPayload, on as completeWebhookEvent, ot as classifySendError, p as writeErrorWithHints, pr as resendAgentSignupVerification, pt as formatSendFailureSummary, q as interactionNextActions, qn as listEmails, qt as ATTACHMENT_WAIT_MAX_MS, r as TIME_FLAG_DESCRIPTION, rn as cancelSentEmailByIdempotencyKey, rr as listWakeSchedules, rt as buildFollowUpCommand, s as formatErrorPayload, sn as createEndpoint, st as deriveSendIdempotencyKey, t as API_BASE_URL_FLAG_DESCRIPTION, tn as addDefaultNetworkMember, tr as listWakeAuthorizations, tt as apiResultHttpStatus, u as readTextFileFlag, un as createWakeAuthorization, ur as removeDefaultNetworkMember, ut as formatDeletedEarlierSendNotice, v as assertAwaitingFilterRows, vn as downloadEmailAttachmentArchiveMember, vr as sendEmail, vt as sendOutcomeExitCode, w as isAwaitingRejectedError, wn as getAgentContactPolicy, wr as startAgentSignup, x as formatAwaitingCell, xn as downloadSentAttachmentArchiveMember, xr as setMemory, xt as serializeErrorPayload, y as awaitingRejectedError, yn as downloadEmailAttachmentByFilename, yr as setFunctionRoute, yt as sendWaitClampNotice, z as wakeRelationship, zn as getWakeSchedule, zt as assertAutomatedVerdict } from "../api-command-BrwPbyPP.js";
 import { S as resolveListenSubscription, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, x as normalizeListenOrigin, y as listenIdentity } from "../shared-mail-files-MwlVE90c.js";
-import { _ as detectAgentRuntime, a as NotificationRetryError, b as installedVersion, c as readConversationStatusContent, d as defaultSessionSocket, f as NativeSessionDisconnectedError, g as connectSkillTarget, h as NotificationOutcomeUnknownError, i as notificationReceiptPage, l as SESSION_UUID$1, m as NativeSessionNotLoadedError, n as notificationSenders, o as isRoutineNotificationContent, p as NativeSessionError, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, v as installConnectSkill, x as readBundledConnectSkill, y as installedConnectSkillFile } from "../notify-session-JbFGcjiM.js";
-import { $ as installClaudeWakeHook, A as evaluateContactPolicy, B as contactAddress, C as RECEIVER_MODES, Ct as withOwnerMemberAddress, D as NETWORK_ADMISSION_PENDING_RETRY_MS, E as ContactPolicyReadRetryError, F as disconnectAgent, G as connectAgent, H as runContactRequest, I as AddressNotesApiError, J as refusalAfterReplacement, K as readAgentInvitation, L as addressNoteTarget, M as AgentDisconnectError, N as claimOverRevokedSetup, O as NetworkAdmissionPendingError, P as clearRevokedAddresses, Q as releaseRegistrationsForProfile, R as runAddressNotesRequest, S as runAgentConnect, St as refreshOwnerMemberAddressPeriodically, T as verificationReplySubmitted, U as agentConnectionStatus, V as contactAgentAddress, W as agentInvitationHash, X as savedReceiver, Y as saveConnectionName, Z as MACHINE_RUNTIMES, _ as enrollmentResumes, _t as jsonIndentation, a as endSession, at as describeSessionHookItem, b as invitationProfileName, bt as writeManagedFile, c as pendingSessionDisconnects, ct as findOnPath, d as registerSession, dt as readClaudeSettings, et as recordHookMailCheck, f as retryPendingDisconnects, ft as repairClaudeHooks, g as enrollAgent, gt as inspectManagedBlock, h as staleSessionAgents, ht as MachineFileError, i as connectedProfilesForSession, it as describeSessionHookChange, j as canonicalContactSelector, k as createNotificationContactPolicy, l as psProcessInfo, lt as hasMachineSessionHooks, m as runDetached, mt as writeClaudeSettings, n as OMP_MAIN, nt as claudeConfigDir, o as headlessClaudeRun, ot as ensureHookLauncher, p as revokeStaleSessionAgents, pt as samePath, q as receiverStatusCommand, r as agentConnectionState, rt as currentCliLocation, st as ephemeralCliReason, t as HOOK_END_GRACE_MS, tt as boundSessionProfiles, u as readClaudeHookInput, ut as inspectClaudeHooks, v as connectWarnings, vt as readManagedFile, w as externalReceivingState, x as pollCheckCommand, xt as readHookLauncherWarning, y as defaultAgentProfileName, yt as upsertManagedBlock, z as ContactsApiError } from "../machine-session-BrTXqxK9.js";
+import { _ as detectAgentRuntime, a as NotificationRetryError, b as installedVersion, c as readConversationStatusContent, d as defaultSessionSocket, f as NativeSessionDisconnectedError, g as connectSkillTarget, h as NotificationOutcomeUnknownError, i as notificationReceiptPage, l as SESSION_UUID$1, m as NativeSessionNotLoadedError, n as notificationSenders, o as isRoutineNotificationContent, p as NativeSessionError, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, v as installConnectSkill, x as readBundledConnectSkill, y as installedConnectSkillFile } from "../notify-session-Byt5sPWW.js";
+import { $ as installClaudeWakeHook, A as evaluateContactPolicy, B as contactAddress, C as RECEIVER_MODES, Ct as withOwnerMemberAddress, D as NETWORK_ADMISSION_PENDING_RETRY_MS, E as ContactPolicyReadRetryError, F as disconnectAgent, G as connectAgent, H as runContactRequest, I as AddressNotesApiError, J as refusalAfterReplacement, K as readAgentInvitation, L as addressNoteTarget, M as AgentDisconnectError, N as claimOverRevokedSetup, O as NetworkAdmissionPendingError, P as clearRevokedAddresses, Q as releaseRegistrationsForProfile, R as runAddressNotesRequest, S as runAgentConnect, St as refreshOwnerMemberAddressPeriodically, T as verificationReplySubmitted, U as agentConnectionStatus, V as contactAgentAddress, W as agentInvitationHash, X as savedReceiver, Y as saveConnectionName, Z as MACHINE_RUNTIMES, _ as enrollmentResumes, _t as jsonIndentation, a as endSession, at as describeSessionHookItem, b as invitationProfileName, bt as writeManagedFile, c as pendingSessionDisconnects, ct as findOnPath, d as registerSession, dt as readClaudeSettings, et as recordHookMailCheck, f as retryPendingDisconnects, ft as repairClaudeHooks, g as enrollAgent, gt as inspectManagedBlock, h as staleSessionAgents, ht as MachineFileError, i as connectedProfilesForSession, it as describeSessionHookChange, j as canonicalContactSelector, k as createNotificationContactPolicy, l as psProcessInfo, lt as hasMachineSessionHooks, m as runDetached, mt as writeClaudeSettings, n as OMP_MAIN, nt as claudeConfigDir, o as headlessClaudeRun, ot as ensureHookLauncher, p as revokeStaleSessionAgents, pt as samePath, q as receiverStatusCommand, r as agentConnectionState, rt as currentCliLocation, st as ephemeralCliReason, t as HOOK_END_GRACE_MS, tt as boundSessionProfiles, u as readClaudeHookInput, ut as inspectClaudeHooks, v as connectWarnings, vt as readManagedFile, w as externalReceivingState, x as pollCheckCommand, xt as readHookLauncherWarning, y as defaultAgentProfileName, yt as upsertManagedBlock, z as ContactsApiError } from "../machine-session-Be6j29GE.js";
 import { a as scopedChatSenderTrust, i as readBeforeDeadline, n as isPlainChatReply, o as presenceDisposition, r as isScopedChatReply, s as readPresenceProjection, t as isConnectedChatCredential } from "../scoped-chat-DTFkP360.js";
 import { c as startBackgroundListen, i as backgroundListenToken, l as stopBackgroundListen, o as runBackgroundListen, r as backgroundListenStatus, u as verifyBackgroundListenTarget } from "../listen-background--0peztKE.js";
-import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-B2TZ8n9c.js";
+import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-DeEEZPbQ.js";
 import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, readWorkingLease, restoreAutoWorking } from "./auto-signals.js";
-import { t as guardJsonOutputCommands } from "../json-output-CEskSQJi.js";
+import { n as jsonOutputRequested, r as runStreamingJson, t as guardJsonOutputCommands } from "../json-output-Ce10AsSb.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
-import { chmodSync, closeSync, constants, cpSync, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { appendFileSync, chmodSync, closeSync, constants, cpSync, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID, scryptSync } from "node:crypto";
 import path, { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
@@ -10661,19 +10661,182 @@ const openapiDocument = {
 									"address_note_conflict",
 									"address_not_controlled",
 									"contact_conflict",
-									"sent_mail_search_unavailable",
-									"latest_message_mismatch",
-									"latest_message_thread_unresolved",
-									"thread_busy",
+									"connection_removed",
+									"connection_create_request_conflict",
+									"connection_already_claimed",
+									"connection_revoked",
+									"connection_cleanup_pending",
 									"attachment_name_ambiguous",
-									"archive_limit_exceeded",
+									"attachment_not_archive",
 									"archive_unsafe_path",
 									"archive_invalid",
 									"archive_unsupported",
-									"attachment_not_archive",
+									"archive_limit_exceeded",
 									"archive_busy",
+									"latest_message_mismatch",
+									"latest_message_thread_unresolved",
+									"thread_busy",
+									"sent_mail_search_unavailable",
+									"member_address_unavailable",
+									"member_address_history_confirmation_required",
+									"member_address_immutable",
+									"member_address_domain_unavailable",
+									"email_admission_unavailable",
+									"pull_subscription_requires_agent_connection",
+									"address_in_use",
+									"address_not_owned",
+									"address_owned_by_another_org",
+									"agent_account_managed_domain_only",
+									"agent_changed",
+									"agent_limit",
+									"agent_misconfigured",
+									"agent_not_defined",
+									"agent_not_found",
+									"agent_unreachable",
+									"already_claimed",
+									"already_member",
+									"bad_request",
+									"body_not_supported",
+									"build_failed",
+									"builder_unavailable",
+									"chunk_too_large",
+									"chunks_missing",
+									"claim_not_pending",
+									"clerk_failed",
+									"code_expired",
+									"contact_request_invalid",
+									"contact_request_not_ready",
+									"contact_request_unauthenticated",
+									"contact_request_unavailable",
+									"cursor_expired",
+									"delete_failed",
+									"deploy_failed",
+									"direct_delivery_failed",
+									"direct_delivery_unavailable",
+									"directory_limit",
+									"dns_publication_failed",
+									"dns_publication_pending",
+									"dns_verification_failed",
+									"download_token_expired",
+									"download_token_invalid",
+									"email_in_use",
+									"embedding_provider_unavailable",
+									"expired",
+									"fresh_send_not_authorized",
+									"function_effect_email_mismatch",
+									"function_effect_mismatch",
+									"function_forked",
+									"function_github_linked",
+									"function_not_deployed",
+									"function_scope_forbidden",
+									"handle_in_cooldown",
+									"handle_reserved",
+									"handle_taken",
+									"hash_mismatch",
+									"hipaa_mode_check_unavailable",
+									"hipaa_mode_external_send_blocked",
+									"idempotency_conflict",
+									"invalid_code",
 									"invalid_cursor",
-									"cursor_expired"
+									"invalid_email",
+									"invalid_input",
+									"invalid_payload_reference",
+									"invalid_request",
+									"invalid_step",
+									"invalid_token",
+									"invalid_topic_sources",
+									"invitation_accepted",
+									"invitation_changed",
+									"invitation_pending",
+									"invitation_sending",
+									"invitation_unconfirmed",
+									"invitations_pending",
+									"mail_relay_unavailable",
+									"mail_routing_conflict",
+									"mail_topic_edit_conflict",
+									"mail_topic_generation_conflict",
+									"mailbox_not_found",
+									"managed_build_failed",
+									"managed_domain",
+									"member_changed",
+									"message_not_found",
+									"name_taken",
+									"network_member_excluded",
+									"network_member_not_found",
+									"network_peer_not_found",
+									"network_view_denied",
+									"no_code",
+									"no_endpoint",
+									"not_a_template_install",
+									"not_claimable",
+									"not_pending",
+									"open_policy_not_allowed",
+									"outbound_edge_rejected",
+									"outbound_email_limit_exceeded",
+									"outbound_relay_timeout",
+									"payload_too_large",
+									"presence_admission_busy",
+									"presence_idempotency_conflict",
+									"presence_probe_stale",
+									"pro_plan_required",
+									"project_changed",
+									"protocol_unavailable",
+									"publication_not_found",
+									"publish_policy_denied",
+									"recipient_changed",
+									"recipient_suppressed",
+									"registry_create_not_allowed",
+									"registry_not_found",
+									"rename_not_allowed",
+									"resend_limit_exceeded",
+									"resend_too_soon",
+									"schedule_allowlist_not_provided",
+									"schedule_sender_collision",
+									"schedule_wake_disabled",
+									"scheduled_payload_invalid",
+									"search_unavailable",
+									"semantic_search_not_enabled",
+									"send_failed",
+									"sender_not_authorized",
+									"sent_email_tail_unavailable",
+									"settlement_unresolved",
+									"shared_parent_recipient",
+									"shopping_binding_conflict",
+									"shopping_decision_conflict",
+									"shopping_identity_conflict",
+									"shopping_not_found",
+									"shopping_owner_mail_required",
+									"shopping_package_not_found",
+									"shopping_proposal_expired",
+									"shopping_replay_conflict",
+									"shopping_source_unavailable",
+									"shopping_too_many_shipments",
+									"shopping_tracking_invalid",
+									"shopping_version_conflict",
+									"shopping_wake_unavailable",
+									"shredded",
+									"sign_in_email_change_required",
+									"signal_not_allowed",
+									"signal_parent_not_ready",
+									"signal_sender_unauthenticated",
+									"slug_taken",
+									"step_rejected",
+									"storage_error",
+									"storage_limit_exceeded",
+									"template_unavailable",
+									"template_update_failed",
+									"terms_not_accepted",
+									"too_many_attempts",
+									"too_many_concurrent_builds",
+									"too_many_resends",
+									"topic_edit_too_large",
+									"topic_generation_too_large",
+									"unavailable",
+									"unknown_chunk",
+									"update_needs_input",
+									"upstream_error",
+									"usage_limit_exceeded",
+									"vendor_unavailable"
 								]
 							},
 							"message": { "type": "string" },
@@ -18213,6 +18376,7 @@ const operationManifest = [
 		"path": "/account",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -18306,6 +18470,7 @@ const operationManifest = [
 		"path": "/account/storage",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -18376,6 +18541,7 @@ const operationManifest = [
 		"path": "/account/webhook-secret",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -18401,6 +18567,7 @@ const operationManifest = [
 		"path": "/account/member-address",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"$schema": "https://json-schema.org/draft/2020-12/schema",
 			"type": "object",
@@ -18443,6 +18610,7 @@ const operationManifest = [
 		"path": "/account/webhook-secret/rotate",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -18468,6 +18636,7 @@ const operationManifest = [
 		"path": "/account",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -18524,6 +18693,7 @@ const operationManifest = [
 		"path": "/whoami",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -18577,6 +18747,7 @@ const operationManifest = [
 		"path": "/agent/accounts",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -18684,6 +18855,7 @@ const operationManifest = [
 		"path": "/agent/claim/link",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -18722,6 +18894,7 @@ const operationManifest = [
 		"path": "/agent/signup/resend",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -18774,6 +18947,7 @@ const operationManifest = [
 		"path": "/agent/claim/start",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -18814,6 +18988,7 @@ const operationManifest = [
 		"path": "/agent/signup/start",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -18890,6 +19065,7 @@ const operationManifest = [
 		"path": "/agent/claim/verify",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -18964,6 +19140,7 @@ const operationManifest = [
 		"path": "/agent/signup/verify",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -19079,6 +19256,7 @@ const operationManifest = [
 		"path": "/agent-connections/setup",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "agentConnectionSetup",
@@ -19097,6 +19275,13 @@ const operationManifest = [
 		"path": "/agent-connections/claim",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [{
+			"description": "Optional compatibility header. This operation does not guarantee response replay or safe retries through this header. Use the operation's documented recovery flow after an uncertain response.",
+			"enum": null,
+			"name": "Idempotency-Key",
+			"required": false,
+			"type": "string"
+		}],
 		"requestSchema": {
 			"$schema": "https://json-schema.org/draft/2020-12/schema",
 			"type": "object",
@@ -19309,6 +19494,13 @@ const operationManifest = [
 		"path": "/agent-connections",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [{
+			"description": "Optional compatibility header. This operation does not guarantee response replay or safe retries through this header. Use the operation's documented recovery flow after an uncertain response.",
+			"enum": null,
+			"name": "Idempotency-Key",
+			"required": false,
+			"type": "string"
+		}],
 		"requestSchema": {
 			"$schema": "https://json-schema.org/draft/2020-12/schema",
 			"type": "object",
@@ -19630,6 +19822,13 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [{
+			"description": "Optional compatibility header. This operation does not guarantee response replay or safe retries through this header. Use the operation's documented recovery flow after an uncertain response.",
+			"enum": null,
+			"name": "Idempotency-Key",
+			"required": false,
+			"type": "string"
+		}],
 		"requestSchema": {
 			"$schema": "https://json-schema.org/draft/2020-12/schema",
 			"type": "object",
@@ -19822,6 +20021,7 @@ const operationManifest = [
 				"type": "string"
 			}
 		],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -19974,6 +20174,13 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [{
+			"description": "Optional client-supplied idempotency key. Retrying a request with the same key returns the original result instead of performing the action a second time; if omitted the server derives one from the canonical payload hash. Safe to retry network failures without duplicating side effects.",
+			"enum": null,
+			"name": "Idempotency-Key",
+			"required": false,
+			"type": "string"
+		}],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -20017,6 +20224,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -20164,6 +20372,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -20279,6 +20488,7 @@ const operationManifest = [
 		"path": "/agent-networks/default/contact-admission",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"description": "Check only a received email already stored for the bound recipient. The server verifies its sender against delivery evidence.",
@@ -20348,6 +20558,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -20433,6 +20644,7 @@ const operationManifest = [
 		"path": "/agent-networks",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -20508,6 +20720,7 @@ const operationManifest = [
 				"type": "string"
 			}
 		],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -20621,6 +20834,7 @@ const operationManifest = [
 				"type": "string"
 			}
 		],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -20745,6 +20959,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -20776,6 +20991,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"description": "Set one or both independent discovery permissions.",
@@ -20942,6 +21158,7 @@ const operationManifest = [
 				"type": "string"
 			}
 		],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -21749,6 +21966,7 @@ const operationManifest = [
 		"path": "/cli/logout",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -21794,6 +22012,7 @@ const operationManifest = [
 		"path": "/cli/login/poll",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -21881,6 +22100,7 @@ const operationManifest = [
 		"path": "/cli/signup/resend",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -21933,6 +22153,7 @@ const operationManifest = [
 		"path": "/cli/login/start",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -22004,6 +22225,7 @@ const operationManifest = [
 		"path": "/cli/signup/start",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -22080,6 +22302,7 @@ const operationManifest = [
 		"path": "/cli/signup/verify",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -22197,6 +22420,7 @@ const operationManifest = [
 			"required": true,
 			"type": "string"
 		}],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -22232,6 +22456,7 @@ const operationManifest = [
 			"required": true,
 			"type": "string"
 		}],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -22261,6 +22486,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -22452,6 +22678,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -22505,6 +22732,7 @@ const operationManifest = [
 		"path": "/contact-policy",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -22608,6 +22836,7 @@ const operationManifest = [
 			"required": false,
 			"type": "integer"
 		}],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -22698,6 +22927,7 @@ const operationManifest = [
 			"required": false,
 			"type": "integer"
 		}],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -22766,6 +22996,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": { "oneOf": [{
 			"type": "object",
 			"additionalProperties": false,
@@ -22875,6 +23106,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": { "oneOf": [{
 			"type": "object",
 			"additionalProperties": false,
@@ -23138,6 +23370,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": { "oneOf": [{
 			"type": "object",
 			"additionalProperties": false,
@@ -23220,6 +23453,7 @@ const operationManifest = [
 		"path": "/contact-policy",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": { "oneOf": [{
 			"type": "object",
 			"additionalProperties": false,
@@ -23374,6 +23608,7 @@ const operationManifest = [
 		"path": "/credits/balance",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -23472,6 +23707,13 @@ const operationManifest = [
 		"path": "/credits/redeem",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [{
+			"description": "Required client-supplied key: 1 to 200 printable ASCII\ncharacters, without spaces. Use a new key for each code you\nredeem and reuse it only to retry the same request.\n",
+			"enum": null,
+			"name": "Idempotency-Key",
+			"required": true,
+			"type": "string"
+		}],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -23549,6 +23791,7 @@ const operationManifest = [
 		"path": "/domains",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -23699,6 +23942,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -24251,6 +24495,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "deleteDomain",
@@ -24281,6 +24526,7 @@ const operationManifest = [
 			"required": false,
 			"type": "boolean"
 		}],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "downloadDomainZoneFile",
@@ -24299,6 +24545,7 @@ const operationManifest = [
 		"path": "/domains",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -24470,6 +24717,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -24546,6 +24794,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": { "oneOf": [{
 			"type": "object",
@@ -24765,6 +25014,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "deleteEmail",
@@ -24789,6 +25039,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -24832,6 +25083,7 @@ const operationManifest = [
 			"required": false,
 			"type": "string"
 		}],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "downloadAttachments",
@@ -24872,6 +25124,7 @@ const operationManifest = [
 			}
 		],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "downloadEmailAttachmentArchiveMember",
@@ -24902,6 +25155,7 @@ const operationManifest = [
 			"required": true,
 			"type": "string"
 		}],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "downloadEmailAttachmentByFilename",
@@ -24934,6 +25188,7 @@ const operationManifest = [
 			"type": "integer"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "downloadEmailAttachmentPart",
@@ -24964,6 +25219,7 @@ const operationManifest = [
 			"required": false,
 			"type": "string"
 		}],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "downloadRawEmail",
@@ -24994,6 +25250,7 @@ const operationManifest = [
 			"required": false,
 			"type": "string"
 		}],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -25174,6 +25431,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -25772,6 +26030,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -25956,6 +26215,7 @@ const operationManifest = [
 				"type": "string"
 			}
 		],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -26267,6 +26527,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -26497,6 +26758,7 @@ const operationManifest = [
 				"type": "string"
 			}
 		],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -26873,6 +27135,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"oneOf": [
 				{
@@ -27125,6 +27388,7 @@ const operationManifest = [
 		"path": "/endpoints",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -27344,6 +27608,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "deleteEndpoint",
@@ -27362,6 +27627,7 @@ const operationManifest = [
 		"path": "/endpoints",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -27526,6 +27792,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"properties": { "wait_seconds": {
@@ -27660,6 +27927,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -27701,6 +27969,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -27806,6 +28075,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -27991,6 +28261,7 @@ const operationManifest = [
 		"path": "/filters",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -28074,6 +28345,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "deleteFilter",
@@ -28092,6 +28364,7 @@ const operationManifest = [
 		"path": "/filters",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -28157,6 +28430,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -28218,6 +28492,7 @@ const operationManifest = [
 		"path": "/functions",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -28294,6 +28569,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -28354,6 +28630,7 @@ const operationManifest = [
 		"path": "/org/secrets",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -28420,6 +28697,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "deleteFunction",
@@ -28450,6 +28728,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "deleteFunctionSecret",
@@ -28474,6 +28753,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "deleteOrgSecret",
@@ -28498,6 +28778,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -28569,6 +28850,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": { "oneOf": [{
 			"type": "object",
@@ -28646,6 +28928,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -29071,6 +29354,7 @@ const operationManifest = [
 		"path": "/functions/routing-topology",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -29178,6 +29462,7 @@ const operationManifest = [
 			"required": false,
 			"type": "string"
 		}],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -29262,6 +29547,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -29312,6 +29598,7 @@ const operationManifest = [
 		"path": "/functions",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -29376,6 +29663,7 @@ const operationManifest = [
 		"path": "/org/secrets",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -29426,6 +29714,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"description": "Target for a route binding. Either a specific verified domain\n(scoped) or the org-wide fallback. Pass `takeover: true` to\ndeactivate any conflicting binding before installing this one.\n",
@@ -29556,6 +29845,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -29614,6 +29904,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -29672,6 +29963,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"properties": { "local_part": {
@@ -29761,6 +30053,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -29792,6 +30085,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -29879,6 +30173,7 @@ const operationManifest = [
 		"path": "/inbox/status",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -30095,6 +30390,13 @@ const operationManifest = [
 				"type": "string"
 			}
 		],
+		"headerParams": [{
+			"description": "Optional function id UUID used as the default scope when query\nscope parameters are omitted.\n",
+			"enum": null,
+			"name": "x-primitive-function-id",
+			"required": false,
+			"type": "string"
+		}],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -30164,6 +30466,13 @@ const operationManifest = [
 				"type": "string"
 			}
 		],
+		"headerParams": [{
+			"description": "Optional function id UUID used as the default scope when query\nscope parameters are omitted.\n",
+			"enum": null,
+			"name": "x-primitive-function-id",
+			"required": false,
+			"type": "string"
+		}],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -30350,6 +30659,13 @@ const operationManifest = [
 				"type": "string"
 			}
 		],
+		"headerParams": [{
+			"description": "Optional function id UUID used as the default scope when query\nscope parameters are omitted.\n",
+			"enum": null,
+			"name": "x-primitive-function-id",
+			"required": false,
+			"type": "string"
+		}],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -30476,6 +30792,13 @@ const operationManifest = [
 		"path": "/memories",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [{
+			"description": "Optional function id UUID used as the default scope when the body\ndoes not include `scope`. Ignored when `scope` is provided.\n",
+			"enum": null,
+			"name": "x-primitive-function-id",
+			"required": false,
+			"type": "string"
+		}],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -30680,6 +31003,7 @@ const operationManifest = [
 		"path": "/x402/challenges",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -30876,6 +31200,13 @@ const operationManifest = [
 		"path": "/x402/email-challenges",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [{
+			"description": "Optional idempotency key. Retrying a request with the same key returns\nthe original result instead of repeating the side effect (for\n`createEmailChallenge`, re-sending the email).\n",
+			"enum": null,
+			"name": "idempotency-key",
+			"required": false,
+			"type": "string"
+		}],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -31054,6 +31385,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -31213,6 +31545,7 @@ const operationManifest = [
 		"path": "/x402/spend-policy",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -31262,6 +31595,7 @@ const operationManifest = [
 		"path": "/x402/declined-payments",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -31325,6 +31659,7 @@ const operationManifest = [
 		"path": "/x402/payout-addresses",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -31390,6 +31725,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -31488,6 +31824,7 @@ const operationManifest = [
 		"path": "/x402/payout-addresses",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -31580,6 +31917,7 @@ const operationManifest = [
 		"path": "/x402/spend-policy",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -31652,6 +31990,7 @@ const operationManifest = [
 		"path": "/registries",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"properties": {
@@ -31721,6 +32060,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"properties": { "decision": {
@@ -31753,6 +32093,7 @@ const operationManifest = [
 		"path": "/agents",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"properties": {
@@ -31822,6 +32163,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "deleteRegistry",
@@ -31846,6 +32188,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -31901,6 +32244,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -31948,6 +32292,7 @@ const operationManifest = [
 		"path": "/registries",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -32018,6 +32363,7 @@ const operationManifest = [
 			"required": false,
 			"type": "string"
 		}],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -32084,6 +32430,7 @@ const operationManifest = [
 			"required": false,
 			"type": "integer"
 		}],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -32134,6 +32481,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"description": "Publish an agent into a registry. When display_name is present the agent identity is defined (create-or-get by address) in the same call before publishing; omit the define fields to publish an already-defined agent.",
@@ -32227,6 +32575,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -32288,6 +32637,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "unpublishAgent",
@@ -32312,6 +32662,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"minProperties": 1,
@@ -32367,6 +32718,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "deleteRepeatingSend",
@@ -32391,6 +32743,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -32514,6 +32867,7 @@ const operationManifest = [
 			"required": false,
 			"type": "string"
 		}],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -32634,6 +32988,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -32697,6 +33052,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -32850,6 +33206,7 @@ const operationManifest = [
 		"path": "/routes",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -32972,6 +33329,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "deleteRoute",
@@ -32990,6 +33348,7 @@ const operationManifest = [
 		"path": "/routes",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -33068,6 +33427,7 @@ const operationManifest = [
 		"path": "/routes/reorder",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -33171,6 +33531,7 @@ const operationManifest = [
 		"path": "/routes/simulate",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -33292,6 +33653,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -33399,6 +33761,7 @@ const operationManifest = [
 		"path": "/semantic-search",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"properties": {
@@ -33631,6 +33994,7 @@ const operationManifest = [
 			"required": false,
 			"type": "integer"
 		}],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -33741,6 +34105,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"description": "Full sent-email record, including `body_text` and\n`body_html`. Returned by /sent-emails/{id}.\n",
@@ -34281,6 +34646,7 @@ const operationManifest = [
 		"path": "/sent-emails/cancel",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -34845,6 +35211,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -34902,6 +35269,7 @@ const operationManifest = [
 			}
 		],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "downloadSentAttachmentArchiveMember",
@@ -34932,6 +35300,7 @@ const operationManifest = [
 			"required": true,
 			"type": "string"
 		}],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "downloadSentAttachmentByFilename",
@@ -34964,6 +35333,7 @@ const operationManifest = [
 			"type": "integer"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "downloadSentAttachmentPart",
@@ -34982,6 +35352,7 @@ const operationManifest = [
 		"path": "/outbound/status",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -35076,6 +35447,7 @@ const operationManifest = [
 		"path": "/send-permissions",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -35211,6 +35583,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"description": "Full sent-email record, including `body_text` and\n`body_html`. Returned by /sent-emails/{id}.\n",
@@ -35763,6 +36136,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -35917,6 +36291,7 @@ const operationManifest = [
 				"type": "string"
 			}
 		],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -36318,6 +36693,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -36604,6 +36980,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -37153,6 +37530,13 @@ const operationManifest = [
 		"path": "/send-mail",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [{
+			"description": "Optional customer-supplied idempotency key. If omitted, Primitive\nderives one from the canonical request payload and echoes the\neffective value in the `Idempotency-Key` response header.\n",
+			"enum": null,
+			"name": "Idempotency-Key",
+			"required": false,
+			"type": "string"
+		}],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -37549,6 +37933,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -37907,6 +38292,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -37980,6 +38366,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -38104,6 +38491,7 @@ const operationManifest = [
 				"type": "integer"
 			}
 		],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -38210,6 +38598,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -38339,6 +38728,7 @@ const operationManifest = [
 		"path": "/wake/authorizations",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -38423,6 +38813,7 @@ const operationManifest = [
 		"path": "/wake/schedules",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -38550,6 +38941,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "deleteWakeAuthorization",
@@ -38574,6 +38966,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": null,
 		"sdkName": "deleteWakeSchedule",
@@ -38598,6 +38991,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -38681,6 +39075,7 @@ const operationManifest = [
 			"required": false,
 			"type": "string"
 		}],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -38743,6 +39138,7 @@ const operationManifest = [
 			"required": false,
 			"type": "integer"
 		}],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -38798,6 +39194,7 @@ const operationManifest = [
 		"path": "/wake/schedules",
 		"pathParams": [],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -38884,6 +39281,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -38911,6 +39309,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -38972,6 +39371,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": {
 			"type": "object",
 			"additionalProperties": false,
@@ -39146,6 +39546,7 @@ const operationManifest = [
 				"type": "string"
 			}
 		],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "array",
@@ -39253,6 +39654,7 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [],
+		"headerParams": [],
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
@@ -41164,12 +41566,73 @@ var AgentSessionEndCommand = class AgentSessionEndCommand extends Command {
 	}
 };
 //#endregion
+//#region src/oclif/session-agent-env.ts
+/**
+* Claude Code gives SessionStart hooks a file in CLAUDE_ENV_FILE and runs its
+* contents before every later Bash command in the session.
+*/
+const CLAUDE_ENV_FILE_ENV = "CLAUDE_ENV_FILE";
+const PLAIN_ADDRESS = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+$/;
+const ASSIGNS = (name) => new RegExp(`^\\s*(?:export\\s+)?${name}=`, "m");
+function sessionAgentEnvLines(profileName, address) {
+	return [`export ${AGENT_PROFILE_ENV}=${profileName}`, `export ${AGENT_ADDRESS_ENV}=${address}`];
+}
+/**
+* Select a registered session's own agent for every later command in the
+* session by appending two export lines to CLAUDE_ENV_FILE. Writes only for a
+* profile that is saved and loads now, so a session is never pointed at a
+* profile that does not exist. Leaves the file alone when the session's
+* environment already sets PRIMITIVE_AGENT_PROFILE (even to the empty
+* opt-out value) or the file already assigns either variable. Never throws.
+*/
+function exportSessionAgentEnv(params) {
+	const env = params.env ?? process.env;
+	const envFile = env[CLAUDE_ENV_FILE_ENV]?.trim();
+	if (!envFile) return "no_env_file";
+	if (Object.hasOwn(env, "PRIMITIVE_AGENT_PROFILE")) return "explicit_env";
+	try {
+		const profileName = agentProfileName(params.profileName);
+		const profile = loadConnectedAgentProfile(params.configDir, profileName);
+		if (!profile || profile.agent_address.toLowerCase() !== params.address.toLowerCase() || !PLAIN_ADDRESS.test(profile.agent_address)) return "no_profile";
+		let existing = "";
+		try {
+			existing = readFileSync(envFile, "utf8");
+		} catch (error) {
+			if (error.code !== "ENOENT") return "failed";
+		}
+		const lines = sessionAgentEnvLines(profileName, profile.agent_address);
+		const present = existing.split(/\r?\n/);
+		if (lines.every((line) => present.includes(line))) return "already_written";
+		if (ASSIGNS("PRIMITIVE_AGENT_PROFILE").test(existing) || ASSIGNS("PRIMITIVE_AGENT_ADDRESS").test(existing)) return "env_file_conflict";
+		const separator = existing && !existing.endsWith("\n") ? "\n" : "";
+		appendFileSync(envFile, `${separator}${lines.join("\n")}\n`);
+		return "written";
+	} catch {
+		return "failed";
+	}
+}
+/**
+* "session_hook" when the selected profile is this Claude Code session's own
+* agent and PRIMITIVE_AGENT_ADDRESS names its address, which is what the
+* SessionStart hook exports; "env" for any other PRIMITIVE_AGENT_PROFILE.
+*/
+function agentIdentitySource(identity, env = process.env) {
+	const session = env.CLAUDE_CODE_SESSION_ID?.trim().toLowerCase();
+	return session && identity.profileName === `session-${session}` && env["PRIMITIVE_AGENT_ADDRESS"]?.trim().toLowerCase() === identity.agentAddress.toLowerCase() ? "session_hook" : "env";
+}
+//#endregion
 //#region src/oclif/commands/agent-session-register.ts
 /** A hook waits this long for registration before letting the session start. */
 const HOOK_BUDGET_MS = 3e3;
+/** Outcomes whose profile is saved and connected, or was and is only unchecked. */
+const EXPORTABLE_STATUSES = /* @__PURE__ */ new Set([
+	"registered",
+	"already_registered",
+	"offline"
+]);
 var AgentSessionRegisterCommand = class AgentSessionRegisterCommand extends Command {
 	static summary = "Register this coding session with Primitive, once";
-	static description = "Gives the current Claude Code, Codex or omp session an address in your organization using the saved member login, without a browser. Safe to run on every start and resume: a session that already has a profile is only re-verified, and a session that ended and starts again (for example `claude --resume`) keeps its agent and address, and a session whose agent was disconnected or removed never gets a second address. Each run also disconnects the agents of sessions on this machine that ended more than 30 days ago without starting again, only while their profile still holds the credential this command created. The session ID comes from CLAUDE_CODE_SESSION_ID (Claude), CODEX_THREAD_ID or CODEX_SESSION_ID (Codex), or --session. omp does not expose a session ID to commands, so omp sessions use one generated ID per running omp process, and receiving mail is not supported for them. The agent is named <runtime>-<repository> and gets a private AGENT_INFO note naming the runtime and repository when it has none. A connected Claude Code or Codex session also gets a private AGENT_RESUME note holding the one-line command that resumes it (`claude --resume <session>` or `codex resume <session>`), rewritten only when it changes; a failure to write it is reported as a warning and never fails the registration. Claude sessions receive mail through exact-session hooks; Codex through the native receiver. Non-interactive Claude runs (claude -p and SDK hosts, by CLAUDE_CODE_ENTRYPOINT) are skipped with status skipped_headless. Never blocks a session: every outcome, including no login or no network, exits 0 with a status. --hook reads Claude's or Codex's SessionStart hook input from stdin, returns within a few seconds and finishes slower work in the background.";
+	static description = "Gives the current Claude Code, Codex or omp session an address in your organization using the saved member login, without a browser. Safe to run on every start and resume: a session that already has a profile is only re-verified, and a session that ended and starts again (for example `claude --resume`) keeps its agent and address, and a session whose agent was disconnected or removed never gets a second address. Each run also disconnects the agents of sessions on this machine that ended more than 30 days ago without starting again, only while their profile still holds the credential this command created. The session ID comes from CLAUDE_CODE_SESSION_ID (Claude), CODEX_THREAD_ID or CODEX_SESSION_ID (Codex), or --session. omp does not expose a session ID to commands, so omp sessions use one generated ID per running omp process, and receiving mail is not supported for them. The agent is named <runtime>-<repository> and gets a private AGENT_INFO note naming the runtime and repository when it has none. A connected Claude Code or Codex session also gets a private AGENT_RESUME note holding the one-line command that resumes it (`claude --resume <session>` or `codex resume <session>`), rewritten only when it changes; a failure to write it is reported as a warning and never fails the registration. Claude sessions receive mail through exact-session hooks; Codex through the native receiver. Non-interactive Claude runs (claude -p and SDK hosts, by CLAUDE_CODE_ENTRYPOINT) are skipped with status skipped_headless. Never blocks a session: every outcome, including no login or no network, exits 0 with a status. --hook reads Claude's or Codex's SessionStart hook input from stdin, returns within a few seconds and finishes slower work in the background. For Claude, once the session's profile is saved and connected, --hook also appends `export PRIMITIVE_AGENT_PROFILE=<profile>` and `export PRIMITIVE_AGENT_ADDRESS=<address>` to the file named by CLAUDE_ENV_FILE, so later commands in the session run as the session's agent; it writes nothing when the session already sets PRIMITIVE_AGENT_PROFILE (an empty value keeps the member login) or the file already assigns either variable.";
 	static examples = [
 		"<%= config.bin %> agent session-register --runtime codex --quiet",
 		"<%= config.bin %> agent session-register --runtime claude --json",
@@ -41185,7 +41648,8 @@ var AgentSessionRegisterCommand = class AgentSessionRegisterCommand extends Comm
 		cwd: Flags.string({ description: "Working directory used for the agent's name and AGENT_INFO; defaults to the current directory" }),
 		hook: Flags.boolean({ description: "Read Claude or Codex SessionStart hook JSON from stdin and finish in the background if registration is slow" }),
 		json: Flags.boolean({ description: "Print the result as JSON" }),
-		quiet: Flags.boolean({ description: "Print nothing" })
+		quiet: Flags.boolean({ description: "Print nothing" }),
+		"export-env": Flags.boolean({ hidden: true })
 	};
 	async run() {
 		const { flags } = await this.parse(AgentSessionRegisterCommand);
@@ -41204,7 +41668,8 @@ var AgentSessionRegisterCommand = class AgentSessionRegisterCommand extends Comm
 					"--session",
 					input.sessionId,
 					...input.cwd ? ["--cwd", input.cwd] : [],
-					"--quiet"
+					"--quiet",
+					...runtime === "claude" && process.env["CLAUDE_ENV_FILE"]?.trim() ? ["--export-env"] : []
 				],
 				env: {
 					...process.env,
@@ -41222,6 +41687,11 @@ var AgentSessionRegisterCommand = class AgentSessionRegisterCommand extends Comm
 			cwd: flags.cwd,
 			cliPath: process.argv[1] ?? ""
 		});
+		if (flags["export-env"] && runtime === "claude" && result.session && result.profile && result.address && EXPORTABLE_STATUSES.has(result.status) && !result.receiverHeld && connectedProfilesForSession(this.config.configDir, result.session, result.profile).length === 0) exportSessionAgentEnv({
+			configDir: this.config.configDir,
+			profileName: result.profile,
+			address: result.address
+		});
 		const { status, ...rest } = result;
 		const identity = status === "registered" && result.profile ? identitySuggestions({
 			invocation: cliInvocation(process.argv[1]),
@@ -43122,6 +43592,17 @@ function deriveChatSubject(body) {
 function isVerifiedDomain(domain) {
 	return domain.is_active === true;
 }
+/**
+* A selected agent always sends as its own address. An explicit --from that
+* names any other address fails before anything is sent; the same address,
+* with or without a display name, is accepted.
+*/
+function assertAgentFromAddress(from, connectedAgent) {
+	if (from === void 0 || !connectedAgent) return;
+	const parsed = parseFromHeader(from);
+	if (parsed.ok && parsed.value.address.toLowerCase() === connectedAgent.agentAddress.toLowerCase()) return;
+	throw new Errors.CLIError(`--from ${from} is not this agent's address; omit --from to send as ${connectedAgent.agentAddress}.`, { exit: 1 });
+}
 async function pickDefaultFromAddress(apiClient, authFailureContext) {
 	if (authFailureContext.auth.connectedAgent) return authFailureContext.auth.connectedAgent.agentAddress;
 	if (isConnectedChatCredential(authFailureContext.auth.apiKey)) throw new Errors.CLIError("Connected agents must pass --from with their connected email address.", { exit: 1 });
@@ -46139,6 +46620,12 @@ var EmailsAttachmentMembersCommand = class EmailsAttachmentMembersCommand extend
   the path the listing reports. stdout then carries only its bytes,
   unless --output names a file.
 
+  The listing is JSON with or without --json; --json is accepted like on
+  every other command, and with it a failure prints one JSON document on
+  stdout (the error with exit_code) and nothing on stderr. --envelope
+  prints the full response envelope instead of only the listing. Neither
+  applies to a --member download, whose output is the file's bytes.
+
   The server refuses archives that are not zip or tar, that hold an
   unsafe path (absolute, "..", backslashes and similar), or that exceed
   its size, entry-count or compression-ratio limits. Each refusal exits 1
@@ -46147,7 +46634,8 @@ var EmailsAttachmentMembersCommand = class EmailsAttachmentMembersCommand extend
 	static examples = [
 		"<%= config.bin %> emails attachment-members <email-id> logs.zip",
 		"<%= config.bin %> emails attachment-members <email-id> 0 --member logs/run.txt --output run.txt",
-		"<%= config.bin %> emails attachment-members <sent-email-id> bundle.tar.gz --sent"
+		"<%= config.bin %> emails attachment-members <sent-email-id> bundle.tar.gz --sent",
+		"<%= config.bin %> emails attachment-members <email-id> logs.zip --json"
 	];
 	static args = {
 		id: Args.string({
@@ -46161,7 +46649,15 @@ var EmailsAttachmentMembersCommand = class EmailsAttachmentMembersCommand extend
 	};
 	static flags = {
 		...sharedFlags,
-		member: Flags.string({ description: "Download the file at this path inside the archive, as the listing reports it." })
+		member: Flags.string({ description: "Download the file at this path inside the archive, as the listing reports it." }),
+		json: Flags.boolean({
+			description: "Print exactly one JSON document on stdout, on success and on failure, and nothing on stderr. On success it is the listing, as without --json (or the full envelope with --envelope); a failure prints the error with exit_code. Not for --member downloads or --output.",
+			exclusive: ["member", "output"]
+		}),
+		envelope: Flags.boolean({
+			description: "Print the full response envelope instead of only the listing. Not for --member downloads.",
+			exclusive: ["member"]
+		})
 	};
 	async run() {
 		const { args, flags } = await this.parse(EmailsAttachmentMembersCommand);
@@ -46203,7 +46699,8 @@ var EmailsAttachmentMembersCommand = class EmailsAttachmentMembersCommand extend
 				reportFailure(this, context, result.error);
 				return;
 			}
-			const listing = result.data?.data;
+			const envelope = result.data;
+			const listing = flags.envelope ? envelope ?? null : envelope?.data;
 			const text = `${JSON.stringify(listing, null, 2)}\n`;
 			if (flags.output) writeFileSync(flags.output, text);
 			else process.stdout.write(text);
@@ -46985,7 +47482,7 @@ const ID_DISPLAY_WIDTH_FULL = 36;
 const RECEIVED_DISPLAY_WIDTH = 19;
 const AWAITING_DISPLAY_WIDTH = 8;
 const REPLIES_DISPLAY_WIDTH = 7;
-function truncate$2(value, width) {
+function truncate$3(value, width) {
 	if (value.length <= width) return value.padEnd(width);
 	return `${value.slice(0, width - 3)}...`;
 }
@@ -47000,12 +47497,12 @@ function pickIdWidth(isTty) {
 	return isTty ? ID_DISPLAY_WIDTH_SHORT : ID_DISPLAY_WIDTH_FULL;
 }
 function formatRow$1(email, idWidth) {
-	const id = truncate$2(email.id.slice(0, idWidth), idWidth);
+	const id = truncate$3(email.id.slice(0, idWidth), idWidth);
 	const received = formatReceivedAt(email.received_at);
-	const from = truncate$2(email.sender ?? "", ADDRESS_DISPLAY_WIDTH);
-	const to = truncate$2(email.recipient ?? "", ADDRESS_DISPLAY_WIDTH);
-	const subjectCol = truncate$2((email.subject ?? "").replace(/\s+/g, " "), SUBJECT_DISPLAY_WIDTH);
-	return `${id}  ${received}  ${from}  ${to}  ${truncate$2(formatAwaitingCell(email), AWAITING_DISPLAY_WIDTH)}  ${truncate$2(formatRepliesCell(email), REPLIES_DISPLAY_WIDTH)}  ${subjectCol}`;
+	const from = truncate$3(email.sender ?? "", ADDRESS_DISPLAY_WIDTH);
+	const to = truncate$3(email.recipient ?? "", ADDRESS_DISPLAY_WIDTH);
+	const subjectCol = truncate$3((email.subject ?? "").replace(/\s+/g, " "), SUBJECT_DISPLAY_WIDTH);
+	return `${id}  ${received}  ${from}  ${to}  ${truncate$3(formatAwaitingCell(email), AWAITING_DISPLAY_WIDTH)}  ${truncate$3(formatRepliesCell(email), REPLIES_DISPLAY_WIDTH)}  ${subjectCol}`;
 }
 function formatHeader$1(idWidth) {
 	return `${"ID".padEnd(idWidth)}  ${"RECEIVED (UTC)".padEnd(RECEIVED_DISPLAY_WIDTH)}  ${"FROM".padEnd(ADDRESS_DISPLAY_WIDTH)}  ${"TO".padEnd(ADDRESS_DISPLAY_WIDTH)}  ${"AWAITING".padEnd(AWAITING_DISPLAY_WIDTH)}  ${"REPLIES".padEnd(REPLIES_DISPLAY_WIDTH)}  SUBJECT`;
@@ -47162,7 +47659,9 @@ var EmailsWaitCommand = class EmailsWaitCommand extends Command {
   the window. Matching requires the exact sent ID, receiving address, and an
   authenticated peer. Interaction attachments and incomplete replies remain
   pending for inspection. JSONL contains each matching email detail; --table
-  prints compact rows. A plain reply does not prove task completion.
+  prints compact rows. --json prints the same JSONL and also reports a
+  timeout or error as one final JSON line instead of text on stderr. A plain
+  reply does not prove task completion.
 
   Connected waits share an address event subscription and recover replies with
   exact-parent search. They never scan inbox history. Additional content
@@ -47174,6 +47673,7 @@ var EmailsWaitCommand = class EmailsWaitCommand extends Command {
 		"<%= config.bin %> emails wait --to test@example.com",
 		"<%= config.bin %> emails wait --subject verify --number 5 --timeout 120",
 		"<%= config.bin %> emails wait --q 'domain:example.com' --table",
+		"<%= config.bin %> emails wait --from peer@example.com --number 3 --json",
 		"<%= config.bin %> emails wait --awaiting you --include-existing",
 		"<%= config.bin %> emails wait --awaiting you --automated false"
 	];
@@ -47212,6 +47712,10 @@ var EmailsWaitCommand = class EmailsWaitCommand extends Command {
 			description: "Exit successfully after this many matching emails",
 			min: 1
 		}),
+		json: Flags.boolean({
+			description: "Print newline-delimited JSON: one object per matching email as it arrives (the same email summary as the default output, with id, sender, recipient, subject, received_at and thread_id among its fields). On a timeout or error, one last line is an object with error {code, message}, exit_code and, when there were any, warnings; a timeout adds matched, the number of emails printed, and uses code \"wait_timeout\". Nothing is written to stderr. Exit codes are unchanged.",
+			exclusive: ["table"]
+		}),
 		"page-size": Flags.integer({
 			default: 50,
 			description: `Emails to fetch per poll (1-100)`,
@@ -47224,7 +47728,10 @@ var EmailsWaitCommand = class EmailsWaitCommand extends Command {
 		"spam-score-gte": Flags.integer({ description: "Only match emails with spam score greater than or equal to this value" }),
 		"spam-score-lt": Flags.integer({ description: "Only match emails with spam score below this value" }),
 		subject: Flags.string({ description: "Full-text subject filter" }),
-		table: Flags.boolean({ description: "Print a human-readable table instead of JSONL" }),
+		table: Flags.boolean({
+			description: "Print a human-readable table instead of JSONL",
+			exclusive: ["json"]
+		}),
 		timeout: Flags.integer({
 			default: DEFAULT_WAIT_TIMEOUT_SECONDS$2,
 			description: "Seconds to wait before exiting nonzero; 0 waits forever",
@@ -47232,7 +47739,18 @@ var EmailsWaitCommand = class EmailsWaitCommand extends Command {
 		}),
 		to: Flags.string({ description: "Recipient address or domain; connected waits derive it from the referenced send" })
 	};
+	timedOut;
 	async run() {
+		if (!jsonOutputRequested(this.argv)) return this.wait();
+		await runStreamingJson(() => this.wait(), () => this.timedOut && {
+			error: {
+				code: "wait_timeout",
+				message: this.timedOut.message
+			},
+			fields: { matched: this.timedOut.matched }
+		});
+	}
+	async wait() {
 		const { flags } = await this.parse(EmailsWaitCommand);
 		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
 			apiKey: flags["api-key"],
@@ -47339,7 +47857,12 @@ var EmailsWaitCommand = class EmailsWaitCommand extends Command {
 			if (deadline !== null && Date.now() >= deadline) break;
 			await sleep$2(flags.interval * 1e3);
 		}
-		process.stderr.write(`Timed out waiting for ${flags.number} matching email${flags.number === 1 ? "" : "s"}; received ${matched}.\n`);
+		const message = `Timed out waiting for ${flags.number} matching email${flags.number === 1 ? "" : "s"}; received ${matched}.`;
+		this.timedOut = {
+			matched,
+			message
+		};
+		process.stderr.write(`${message}\n`);
 		process.exitCode = 1;
 	}
 };
@@ -48633,7 +49156,7 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	url: "https://primitive.dev"
 };
 const SDK_VERSION_RANGE = "^2.0.0";
-const CLI_VERSION_RANGE = "^1.71.0";
+const CLI_VERSION_RANGE = "^1.72.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -50471,7 +50994,7 @@ const INBOX_NEXT_EXIT_CODE_HELP = `Exit codes:
   - 5: nothing awaits your reply (with --wait: still nothing when --timeout elapsed).`;
 const SCAN_PAGE_SIZE = 100;
 const DEFAULT_WAIT_TIMEOUT_SECONDS = 300;
-const MAX_LONG_POLL_SECONDS = 30;
+const MAX_LONG_POLL_SECONDS$1 = 30;
 const EPOCH_CURSOR = "1970-01-01T00:00:00.000000Z|00000000-0000-4000-8000-000000000000";
 /** An API call failed; carries the error payload for printing. */
 var InboxNextApiError = class extends Error {
@@ -50484,7 +51007,7 @@ var InboxNextApiError = class extends Error {
 		this.name = "InboxNextApiError";
 	}
 };
-function str(value) {
+function str$1(value) {
 	return typeof value === "string" && value !== "" ? value : null;
 }
 /** The server's verdict from a row, or null when it did not report one. */
@@ -50500,12 +51023,12 @@ function serverAutomated(row) {
 function toInboxNextEmail(detail) {
 	return {
 		id: String(detail.id),
-		thread_id: str(detail.thread_id),
-		message_id: str(detail.message_id),
-		received_at: str(detail.received_at),
-		from: str(detail.from_header) ?? str(detail.from_email),
-		from_email: str(detail.from_email),
-		to: str(detail.recipient) ?? str(detail.to_email),
+		thread_id: str$1(detail.thread_id),
+		message_id: str$1(detail.message_id),
+		received_at: str$1(detail.received_at),
+		from: str$1(detail.from_header) ?? str$1(detail.from_email),
+		from_email: str$1(detail.from_email),
+		to: str$1(detail.recipient) ?? str$1(detail.to_email),
 		subject: typeof detail.subject === "string" ? detail.subject : null,
 		awaiting: detail.awaiting,
 		reply_count: detail.reply_count,
@@ -50650,7 +51173,7 @@ async function findNextAwaiting(params) {
 		for (const row of page.rows) {
 			if (row.awaiting !== "you") continue;
 			if (needsNoReply(row)) continue;
-			const id = str(row.id);
+			const id = str$1(row.id);
 			if (!id) continue;
 			const detailResult = await api.getEmail({
 				client: params.apiClient.client,
@@ -50735,8 +51258,8 @@ async function countAutomatedAwaiting(params) {
 */
 async function baselineCursor(params) {
 	const newest = (await listPage(params.api ?? DEFAULT_API, params.apiClient, { limit: 1 })).rows[0];
-	const createdAt = str(newest?.created_at);
-	const id = str(newest?.id);
+	const createdAt = str$1(newest?.created_at);
+	const id = str$1(newest?.id);
 	return createdAt && id ? `${createdAt}|${id}` : EPOCH_CURSOR;
 }
 /**
@@ -50747,7 +51270,7 @@ async function waitForActivity(params) {
 	return (await listPage(params.api ?? DEFAULT_API, params.apiClient, {
 		limit: SCAN_PAGE_SIZE,
 		since: params.since,
-		wait: Math.max(0, Math.min(MAX_LONG_POLL_SECONDS, params.seconds))
+		wait: Math.max(0, Math.min(MAX_LONG_POLL_SECONDS$1, params.seconds))
 	})).cursor ?? params.since;
 }
 function toJson(result, bin) {
@@ -50970,7 +51493,7 @@ var InboxNextCommand = class InboxNextCommand extends Command {
 					await this.printResult(result, bin, flags, apiClient);
 					return;
 				}
-				const remainingMs = deadline === null ? MAX_LONG_POLL_SECONDS * 1e3 : deadline - Date.now();
+				const remainingMs = deadline === null ? MAX_LONG_POLL_SECONDS$1 * 1e3 : deadline - Date.now();
 				if (remainingMs <= 0) {
 					await this.printResult(result, bin, flags, apiClient);
 					return;
@@ -51057,7 +51580,7 @@ function formatInboxDate(value) {
 	const pad = (n) => String(n).padStart(2, "0");
 	return `${d.getUTCFullYear()}-${pad(d.getUTCMonth() + 1)}-${pad(d.getUTCDate())} ${pad(d.getUTCHours())}:${pad(d.getUTCMinutes())}:${pad(d.getUTCSeconds())} UTC`;
 }
-function truncate$1(value, width) {
+function truncate$2(value, width) {
 	if (value.length <= width) return value.padEnd(width);
 	return `${value.slice(0, width - 3)}...`;
 }
@@ -51107,7 +51630,7 @@ function formatDomainHeader() {
 }
 function formatDomainRow(domain) {
 	return [
-		truncate$1(domain.domain, DOMAIN_DISPLAY_WIDTH),
+		truncate$2(domain.domain, DOMAIN_DISPLAY_WIDTH),
 		statusText(domain.status).padEnd(STATUS_DISPLAY_WIDTH),
 		yesNo(domain.receiving_ready).padEnd(BOOL_DISPLAY_WIDTH),
 		yesNo(domain.processing_ready).padEnd(BOOL_DISPLAY_WIDTH),
@@ -59892,6 +60415,76 @@ function resolveMessageBodies(input) {
 	};
 }
 //#endregion
+//#region src/oclif/send-options.ts
+/**
+* Options shared by `send` and `reply` that map straight onto request
+* fields: custom headers (`--header`) and, for `send`, a schedule time
+* (`--scheduled-at`). Only the shape is checked here. Which header names
+* are allowed, and how far ahead a send may be scheduled, are the
+* server's rules, and its `validation_error` says what to change.
+*/
+const HEADER_FLAG_DESCRIPTION = "Extra header to send, as `Name: value` or `Name=value`. Repeatable, once per name (names compare case-insensitively), at most 25. The server decides which names are allowed: Auto-Submitted, Precedence, X-Auto-Response-Suppress, or a custom X- name that is not credential-like and not in a reserved family; a refused name is a validation_error. Values are 1 to 200 printable ASCII characters. Custom headers are sent as spelled and are not DKIM-signed.";
+const HEADER_NAME = /^[A-Za-z0-9]+(-[A-Za-z0-9]+)*$/;
+const HEADER_EXAMPLE = "--header \"X-Campaign-Id: spring-sale\"";
+function headerError(message) {
+	return new Errors.CLIError(message, { exit: 2 });
+}
+/**
+* Parse repeated `--header` values into the request's `headers` object.
+* Each value is `Name: value` or `Name=value`, split at the first `:` or
+* `=` (a header name holds neither, so the value may). Returns undefined
+* when no header was passed.
+*/
+function parseHeaderFlags(values) {
+	if (values === void 0 || values.length === 0) return void 0;
+	const headers = {};
+	const seen = /* @__PURE__ */ new Map();
+	for (const entry of values) {
+		const separator = entry.search(/[:=]/);
+		if (separator === -1) throw headerError(`--header expects "Name: value" or "Name=value" (got ${JSON.stringify(entry)}). Example: ${HEADER_EXAMPLE}`);
+		if (hasControlCharacter$1(entry)) throw headerError(`--header ${JSON.stringify(entry)} has a control character (such as a line break). Names and values are printable ASCII.`);
+		const name = entry.slice(0, separator).trim();
+		const value = entry.slice(separator + 1).trim();
+		if (!HEADER_NAME.test(name)) throw headerError(`--header name ${JSON.stringify(name)} is not a header name: use letters and digits joined by single hyphens, such as X-Campaign-Id. Example: ${HEADER_EXAMPLE}`);
+		if (value === "") throw headerError(`--header ${name} has no value. Example: ${HEADER_EXAMPLE}`);
+		const key = name.toLowerCase();
+		const earlier = seen.get(key);
+		if (earlier !== void 0) throw headerError(earlier === name ? `--header ${name} is given more than once. Pass each header once.` : `--header ${earlier} and ${name} name the same header (names compare case-insensitively). Pass each header once.`);
+		seen.set(key, name);
+		headers[name] = value;
+	}
+	return headers;
+}
+/**
+* One readable line for a `validation_error` on a request that carried
+* custom headers or a schedule time, so the server's reason is not
+* buried in the JSON error. Null for any other error, or when the
+* request carried neither.
+*/
+function sendOptionsValidationHint(payload, sent) {
+	if (sent.headers === void 0 && sent.scheduledAt === void 0) return null;
+	if (extractErrorCode(payload) !== "validation_error") return null;
+	const message = (payload && typeof payload === "object" && "error" in payload ? payload.error : payload)?.message;
+	if (typeof message !== "string" || message.trim() === "") return null;
+	const reason = message.trim();
+	const advice = [];
+	if (sent.headers !== void 0 && /header/i.test(reason)) advice.push("Check the --header names and values; --help lists which names are allowed.");
+	if (sent.scheduledAt !== void 0 && /schedul/i.test(reason)) advice.push("--scheduled-at must be in the future and at most 30 days out.");
+	return [`The API refused the request: ${reason}`, ...advice].join(" ");
+}
+const ISO_INSTANT_WITH_ZONE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/i;
+/** True for an ISO 8601 date and time with Z or a numeric UTC offset. */
+function isIsoInstantWithZone(value) {
+	return ISO_INSTANT_WITH_ZONE.test(value) && !Number.isNaN(Date.parse(value));
+}
+const SCHEDULED_AT_FLAG_DESCRIPTION = "Send later instead of now: an ISO 8601 time with Z or a numeric UTC offset, such as 2026-10-09T17:00:00Z or 2026-10-09T13:00:00-04:00. The server requires it to be in the future and at most 30 days out. The send is recorded with status scheduled and goes out at that time; cancel it before then with `primitive sent cancel --id <id>` or `primitive sent cancel --idempotency-key <key>`. Cannot be combined with --wait, --wait-timeout-ms, --attachment, --fyi or --if-latest-message-id.";
+/** Validate `--scheduled-at` before any request. */
+function assertScheduledAt(value) {
+	const trimmed = value.trim();
+	if (!isIsoInstantWithZone(trimmed)) throw new Errors.CLIError("--scheduled-at must be an ISO 8601 time with a time zone, such as 2026-10-09T17:00:00Z or 2026-10-09T13:00:00-04:00.", { exit: 2 });
+	return trimmed;
+}
+//#endregion
 //#region src/oclif/thread-latest-inbound.ts
 var ThreadResolutionError = class extends Error {};
 /**
@@ -59999,7 +60592,8 @@ var ReplyCommand = class ReplyCommand extends Command {
 		"<%= config.bin %> reply --id <inbound-email-id> --from 'Support <support@example.com>' --body 'Thanks!'",
 		"<%= config.bin %> reply --thread <thread-id> --body 'Answering the latest message.'",
 		"<%= config.bin %> reply --id <inbound-email-id> --fyi --body 'Done, merged. No action needed.'",
-		"<%= config.bin %> reply --id <inbound-email-id> --all --body 'Answering everyone on this email.'"
+		"<%= config.bin %> reply --id <inbound-email-id> --all --body 'Answering everyone on this email.'",
+		"<%= config.bin %> reply --id <inbound-email-id> --body 'Ticket updated.' --header 'X-Ticket-Id: 4821'"
 	];
 	static flags = {
 		"api-key": Flags.string({
@@ -60048,6 +60642,10 @@ var ReplyCommand = class ReplyCommand extends Command {
 		"if-latest-message-id": Flags.string({ description: "Send only if this message id is still the newest message in the thread, as your credential sees it (received or sent, in the order messages joined the thread). Otherwise nothing is sent and the command exits 1 with error code latest_message_mismatch and the current newest id in error.details.latest_message_id. Pass latest_message_id from `primitive emails conversation`. Cannot be combined with a repeat." }),
 		wait: Flags.boolean({ description: "Block until the receiving MTA returns an outcome. Without --wait, the call returns once Primitive has accepted the reply for delivery." }),
 		"idempotency-key": Flags.string({ description: IDEMPOTENCY_KEY_FLAG_DESCRIPTION }),
+		header: Flags.string({
+			description: HEADER_FLAG_DESCRIPTION,
+			multiple: true
+		}),
 		json: Flags.boolean({ description: "Emit one outcome envelope { outcome, exit_code, outcome_message, sent_email_id, idempotency_key, sent, http_status, error, follow_up_commands, prior_replies, prior_replies_check } on stdout for every outcome, including failures, with nothing on stderr. Without --json, stdout is the send record as before." }),
 		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION }),
 		...repeatFlags([
@@ -60101,6 +60699,7 @@ var ReplyCommand = class ReplyCommand extends Command {
 		});
 		if (bodies.kind === "error") throw new Errors.CLIError(bodies.message);
 		if (flags["idempotency-key"] !== void 0) this.idempotencyKey = assertValidIdempotencyKey(flags["idempotency-key"]);
+		const customHeaders = parseHeaderFlags(flags.header);
 		await runWithTiming(flags.time, async () => {
 			const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
 				apiKey: flags["api-key"],
@@ -60111,6 +60710,7 @@ var ReplyCommand = class ReplyCommand extends Command {
 				configDir: this.config.configDir,
 				connectedAgent: auth.connectedAgent
 			});
+			assertAgentFromAddress(flags.from, auth.connectedAgent);
 			const attachments = readAttachmentFiles(flags.attachment);
 			const repeat = repeatFromFlags(flags);
 			const receivingSince = (/* @__PURE__ */ new Date()).toISOString();
@@ -60161,6 +60761,7 @@ var ReplyCommand = class ReplyCommand extends Command {
 				fyi: true,
 				...bodies.body !== void 0 ? { body_text: bodies.body.trimEnd() } : {},
 				...flags.from !== void 0 ? { from: flags.from } : {},
+				...customHeaders !== void 0 ? { headers: customHeaders } : {},
 				in_reply_to_email_id: emailId,
 				...flags["if-latest-message-id"] !== void 0 ? { if_latest_message_id: flags["if-latest-message-id"] } : {}
 			} : {
@@ -60168,6 +60769,7 @@ var ReplyCommand = class ReplyCommand extends Command {
 				...flags.from !== void 0 ? { from: flags.from } : {},
 				...flags.all ? { reply_all: true } : {},
 				...repeat !== void 0 ? { repeat } : {},
+				...customHeaders !== void 0 ? { headers: customHeaders } : {},
 				...flags["if-latest-message-id"] !== void 0 ? { if_latest_message_id: flags["if-latest-message-id"] } : {},
 				in_reply_to_email_id: emailId
 			});
@@ -60196,6 +60798,7 @@ var ReplyCommand = class ReplyCommand extends Command {
 				...flags.wait !== void 0 ? { wait: flags.wait } : {},
 				...flags.all ? { reply_all: true } : {},
 				...repeat !== void 0 ? { repeat } : {},
+				...customHeaders !== void 0 ? { headers: customHeaders } : {},
 				...flags["if-latest-message-id"] !== void 0 ? { if_latest_message_id: flags["if-latest-message-id"] } : {}
 			};
 			const halted = await haltAutoWorking(this.config.configDir, {
@@ -60229,6 +60832,8 @@ var ReplyCommand = class ReplyCommand extends Command {
 				onApiError: (errorPayload) => {
 					writeErrorWithHints(errorPayload);
 					writeRepeatErrorHint(errorPayload);
+					const optionsHint = sendOptionsValidationHint(errorPayload, { headers: customHeaders });
+					if (optionsHint) process.stderr.write(`${optionsHint}\n`);
 					surfaceUnauthorizedHint({
 						auth,
 						baseUrlOverridden,
@@ -60726,7 +61331,7 @@ const SOURCE_WIDTH = 4;
 const SUBJECT_WIDTH = 40;
 const FROM_WIDTH = 26;
 const SNIPPET_WIDTH = 60;
-function truncate(value, width) {
+function truncate$1(value, width) {
 	if (value.length <= width) return value.padEnd(width);
 	return `${value.slice(0, width - 3)}...`;
 }
@@ -60734,7 +61339,7 @@ function sourceLabel(t) {
 	return t === "inbound_email" ? "in" : "out";
 }
 function formatRow(r) {
-	return `${r.score.toFixed(3).padStart(SCORE_WIDTH)}  ${sourceLabel(r.source_type).padEnd(SOURCE_WIDTH)}  ${truncate((r.subject ?? "").replace(/\s+/g, " "), SUBJECT_WIDTH)}  ${truncate(r.from ?? "", FROM_WIDTH)}  ${truncate((r.snippets[0]?.text ?? "").replace(/\s+/g, " "), SNIPPET_WIDTH)}`;
+	return `${r.score.toFixed(3).padStart(SCORE_WIDTH)}  ${sourceLabel(r.source_type).padEnd(SOURCE_WIDTH)}  ${truncate$1((r.subject ?? "").replace(/\s+/g, " "), SUBJECT_WIDTH)}  ${truncate$1(r.from ?? "", FROM_WIDTH)}  ${truncate$1((r.snippets[0]?.text ?? "").replace(/\s+/g, " "), SNIPPET_WIDTH)}`;
 }
 function formatHeader() {
 	return `${"SCORE".padStart(SCORE_WIDTH)}  ${"SRC".padEnd(SOURCE_WIDTH)}  ${"SUBJECT".padEnd(SUBJECT_WIDTH)}  ${"FROM".padEnd(FROM_WIDTH)}  EXCERPT`;
@@ -61132,6 +61737,11 @@ var SendCommand = class SendCommand extends Command {
   --from defaults to agent@<your-first-verified-outbound-domain> when omitted.
   --subject defaults to the first line of the body when omitted.
   --attachment attaches a file; repeat it to attach multiple files.
+  --header adds a custom header such as "X-Campaign-Id: spring-sale";
+  repeat it for more. The server decides which names are allowed.
+  --scheduled-at sends at a later time instead of now. The summary
+  then says the message is scheduled and how to cancel it with
+  \`primitive sent cancel\`.
   --fyi (with --in-reply-to) sends an informational acknowledgement of
   that message that receivers do not wake for. To answer an inbound
   email you received, prefer \`primitive reply --id <id> --fyi\`.
@@ -61159,6 +61769,8 @@ var SendCommand = class SendCommand extends Command {
 		"<%= config.bin %> send --to alice@example.com --html '<p>Hello!</p>'",
 		"<%= config.bin %> send --to alice@example.com --cc bob@example.com --bcc audit@example.com --body 'Loop bob in; audit copy stays hidden.'",
 		"<%= config.bin %> send --to alice@example.com --body 'Confirmed' --wait",
+		"<%= config.bin %> send --to alice@example.com --body 'Spring sale' --header 'X-Campaign-Id: spring-sale' --header 'Auto-Submitted: auto-generated'",
+		"<%= config.bin %> send --to alice@example.com --body 'Reminder: standup' --scheduled-at 2026-10-09T17:00:00Z --idempotency-key standup-2026-10-09",
 		"<%= config.bin %> send --to alice@example.com --in-reply-to '<parent@example.com>' --fyi --body 'Deployed. No action needed.'",
 		"<%= config.bin %> send --to inbox@your-managed-domain.primitive.email --body 'self-loop smoke test' --wait  # any *.primitive.email address routes back to the sending account; useful for proving outbound + inbound work end-to-end"
 	];
@@ -61217,6 +61829,20 @@ var SendCommand = class SendCommand extends Command {
 			min: 1
 		}),
 		"idempotency-key": Flags.string({ description: IDEMPOTENCY_KEY_FLAG_DESCRIPTION }),
+		header: Flags.string({
+			description: HEADER_FLAG_DESCRIPTION,
+			multiple: true
+		}),
+		"scheduled-at": Flags.string({
+			description: SCHEDULED_AT_FLAG_DESCRIPTION,
+			exclusive: [
+				"wait",
+				"wait-timeout-ms",
+				"attachment",
+				"fyi",
+				"if-latest-message-id"
+			]
+		}),
 		json: Flags.boolean({ description: "Emit one outcome envelope { outcome, exit_code, outcome_message, sent_email_id, idempotency_key, sent, http_status, error, follow_up_commands } on stdout for every outcome, including failures, with nothing on stderr. Without --json, stdout is the send record as before." }),
 		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION }),
 		...repeatFlags([
@@ -61266,6 +61892,8 @@ var SendCommand = class SendCommand extends Command {
 		});
 		if (bodies.kind === "error") throw new Errors.CLIError(bodies.message);
 		if (flags["idempotency-key"] !== void 0) this.idempotencyKey = assertValidIdempotencyKey(flags["idempotency-key"]);
+		const customHeaders = parseHeaderFlags(flags.header);
+		const scheduledAt = flags["scheduled-at"] === void 0 ? void 0 : assertScheduledAt(flags["scheduled-at"]);
 		const attachments = readAttachmentFiles(flags.attachment);
 		const repeat = repeatFromFlags(flags);
 		await runWithTiming(flags.time, async () => {
@@ -61283,6 +61911,7 @@ var SendCommand = class SendCommand extends Command {
 				baseUrlOverridden,
 				configDir: this.config.configDir
 			};
+			assertAgentFromAddress(flags.from, auth.connectedAgent);
 			const from = flags.from ?? await pickDefaultFromAddress(apiClient, authFailureContext);
 			const subject = flags.subject ?? (bodies.body ? deriveSubject(bodies.body) : flags.fyi ? "Re: Your message" : "Message");
 			const plainContent = {
@@ -61295,7 +61924,8 @@ var SendCommand = class SendCommand extends Command {
 				to: flags.to,
 				...flags.cc !== void 0 ? { cc: flags.cc } : {},
 				...flags.bcc !== void 0 ? { bcc: flags.bcc } : {},
-				subject
+				subject,
+				...customHeaders !== void 0 ? { headers: customHeaders } : {}
 			};
 			const requestedWait = flags["wait-timeout-ms"];
 			const waitTimeoutMs = requestedWait === void 0 ? void 0 : Math.min(requestedWait, MAX_SEND_WAIT_TIMEOUT_MS);
@@ -61306,7 +61936,8 @@ var SendCommand = class SendCommand extends Command {
 				...flags["if-latest-message-id"] !== void 0 ? { if_latest_message_id: flags["if-latest-message-id"] } : {},
 				...flags.wait !== void 0 ? { wait: flags.wait } : {},
 				...waitTimeoutMs !== void 0 ? { wait_timeout_ms: waitTimeoutMs } : {},
-				...repeat !== void 0 ? { repeat } : {}
+				...repeat !== void 0 ? { repeat } : {},
+				...scheduledAt !== void 0 ? { scheduled_at: scheduledAt } : {}
 			};
 			const idempotencyKey = this.idempotencyKey ?? deriveSendIdempotencyKey("send", flags.fyi ? {
 				...envelope,
@@ -61337,10 +61968,13 @@ var SendCommand = class SendCommand extends Command {
 				...content,
 				...threading
 			};
-			const halted = await haltAutoWorking(this.config.configDir, {
+			const halted = scheduledAt === void 0 ? await haltAutoWorking(this.config.configDir, {
 				peers: [flags.to],
 				profileName: auth.connectedAgent?.profileName
-			}, flags.fyi ? "fyi" : "reply");
+			}, flags.fyi ? "fyi" : "reply") : {
+				configDir: this.config.configDir,
+				stops: []
+			};
 			const attemptStartedAtIso = (/* @__PURE__ */ new Date()).toISOString();
 			this.attemptStartedAtIso = attemptStartedAtIso;
 			this.sendRequestStarted = true;
@@ -61361,6 +61995,11 @@ var SendCommand = class SendCommand extends Command {
 				onApiError: (errorPayload) => {
 					writeErrorWithHints(errorPayload);
 					writeRepeatErrorHint(errorPayload);
+					const optionsHint = sendOptionsValidationHint(errorPayload, {
+						headers: customHeaders,
+						scheduledAt
+					});
+					if (optionsHint) process.stderr.write(`${optionsHint}\n`);
 					surfaceUnauthorizedHint({
 						...authFailureContext,
 						payload: errorPayload
@@ -61391,7 +62030,6 @@ function formatCanceledSend(send) {
 	if (send.client_idempotency_key) parts.push(`Idempotency-Key ${send.client_idempotency_key} is free to use again.`);
 	return parts.join(" ");
 }
-const ISO_INSTANT_WITH_ZONE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/i;
 var SentCancelCommand = class SentCancelCommand extends Command {
 	static summary = "Cancel a scheduled send";
 	static description = "Cancel a send that is still scheduled, by its id or by the Idempotency-Key you sent it with. Nothing is sent, the record is kept with status `canceled`, and the key is released so it can schedule a new send. A send the scheduler has already picked up, or one already sent, canceled or failed, cannot be canceled and the command exits 1 with its current status. A connected agent can cancel only its own sends.";
@@ -61427,7 +62065,7 @@ var SentCancelCommand = class SentCancelCommand extends Command {
 		const key = flags["idempotency-key"]?.trim();
 		if (key !== void 0 && key.length === 0) this.error("--idempotency-key must not be empty.", { exit: 2 });
 		const createdBefore = flags["created-before"];
-		if (createdBefore !== void 0 && (!ISO_INSTANT_WITH_ZONE.test(createdBefore) || Number.isNaN(Date.parse(createdBefore)))) this.error("--created-before must be an ISO 8601 time with a time zone, such as 2026-10-20T14:00:00Z.", { exit: 2 });
+		if (createdBefore !== void 0 && !isIsoInstantWithZone(createdBefore)) this.error("--created-before must be an ISO 8601 time with a time zone, such as 2026-10-20T14:00:00Z.", { exit: 2 });
 		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
 			apiKey: flags["api-key"],
 			apiBaseUrl: flags["api-base-url"],
@@ -62235,6 +62873,609 @@ var ThreadsMutedCommand = class ThreadsMutedCommand extends Command {
 	}
 };
 //#endregion
+//#region src/oclif/verification-extract.ts
+const CODE_KEYWORD = /\b(?:verification|verify|verifying|one[- ]?time|otp|passcode|pass code|security code|login code|log[- ]?in code|sign[- ]?in code|access code|auth(?:entication)? code|confirmation code|confirm|code|pin|2fa|two[- ]factor|launch code)\b/i;
+const NOT_A_CODE = /\b(?:order|invoice|receipt|total|subtotal|amount|price|paid|charged|phone|tel|call|fax|mobile|ref|reference|ticket|case|account|acct|customer|member|zip|postal|suite|ste|po box|tracking|transaction|txn|item|sku|qty|quantity|street|st|ave|avenue|blvd|road|rd|floor)\b|[#$€£¥]/i;
+const NON_CODE_PHRASES = /\b(?:zip|postal|post|area|promo(?:tional)?|discount|coupon|country|dial(?:ing)?|tracking|sort|bank|swift|product|source|referral|gift)\s+codes?\b/gi;
+function lastMatchIndex(regex, text) {
+	const global = new RegExp(regex.source, "gi");
+	let last = -1;
+	for (const match of text.matchAll(global)) last = match.index ?? last;
+	return last;
+}
+const DURATION_AFTER = /^\s?(?:s|secs?|seconds?|mins?|minutes?|h|hrs?|hours?|days?)\b/i;
+const DURATION_GLOBAL = /\b\d+\s?(?:s|secs?|seconds?|mins?|minutes?|h|hrs?|hours?|days?)\b/gi;
+const CURRENCY_AFTER = /^\s?(?:usd|eur|gbp|cad|aud|dollars|euros)\b/i;
+const PHONE = /(?:\+?\d{1,3}[\s.-])?(?:\(\d{2,4}\)\s?|\d{3}[\s.-])\d{3}[\s.-]\d{4}\b/g;
+const URL_IN_TEXT = /\b(?:https?:\/\/|www\.)[^\s<>"']+/gi;
+const EMAIL_ADDRESS = /[\w.+-]+@[\w-]+(?:\.[\w-]+)+/g;
+const CODE_PATTERNS = [
+	{
+		form: "spaced-digits",
+		regex: /(?<![\w])\d(?: \d){3,7}(?![\w]| \d)/g
+	},
+	{
+		form: "split-digits",
+		regex: /(?<![\w$€£¥#@/]|\d[.,]|\d[ -])\d{3,4}[ -]\d{3,4}(?![\w%]|[.,]\d|[ -]\d)/g
+	},
+	{
+		form: "digits",
+		regex: /(?<![\w$€£¥#@/]|\d[.,]|\d-)\d{4,8}(?![\w%]|[.,]\d|-\d)/g
+	},
+	{
+		form: "alnum",
+		regex: /(?<![\w#@/.-])(?=[A-Z0-9]*\d)(?=[A-Z0-9]*[A-Z])[A-Z0-9]{5,10}(?![\w/-])/g
+	},
+	{
+		form: "dashed",
+		regex: /(?<![\w#@/.-])[A-Z0-9]{3,4}-[A-Z0-9]{3,4}(?![\w/]|-[A-Z0-9])/g
+	}
+];
+function blank(match) {
+	return match.replace(/[^\n]/g, " ");
+}
+/** Normalised lines the code scan reads: subject first, then the body. */
+function codeLines(subject, body) {
+	return `${subject ?? ""}\n\n${body}`.replace(/\r\n?/g, "\n").replace(NON_CODE_PHRASES, (match) => "#".repeat(match.length)).replace(/[   \t]/g, " ").replace(URL_IN_TEXT, blank).replace(EMAIL_ADDRESS, blank).replace(PHONE, blank).split("\n");
+}
+function previousContent(lines, index, count) {
+	const out = [];
+	for (let i = index - 1; i >= 0 && out.length < count; i--) if (lines[i].trim() !== "") out.push(lines[i]);
+	return out;
+}
+const NEXT_LINE_LABEL = /^\s*(?:is|was|[-:=(])?\s*(?:your|the|this)?\b.{0,30}?\b(?:code|passcode|otp|pin)\b/i;
+/** The next line labels the code above it and supplies no code of its own. */
+function isLabelBelow(line) {
+	return line !== null && NEXT_LINE_LABEL.test(line) && !/\d{4,}|\b(?=[A-Z0-9-]*\d)[A-Z0-9][A-Z0-9-]{3,}\b/.test(line.replace(DURATION_GLOBAL, " "));
+}
+function nextContent(lines, index) {
+	for (let i = index + 1; i < lines.length; i++) if (lines[i].trim() !== "") return lines[i];
+	return null;
+}
+function scoreCode(candidate, lines, mentionsCode) {
+	const line = lines[candidate.line];
+	const before = line.slice(0, candidate.start);
+	const near30 = before.slice(-30);
+	const after = line.slice(candidate.end);
+	const near = before.slice(-40);
+	let score = 0;
+	if (CODE_KEYWORD.test(near)) score += 12;
+	else if (CODE_KEYWORD.test(before)) score += 8;
+	else if (CODE_KEYWORD.test(after.slice(0, 40))) score += 10;
+	else if (previousContent(lines, candidate.line, 2).some((l) => CODE_KEYWORD.test(l))) score += 7;
+	else if (after.trim() === "" && isLabelBelow(nextContent(lines, candidate.line))) score += 7;
+	else return null;
+	if (mentionsCode) score += 2;
+	if (line.trim() === candidate.raw) score += 4;
+	const digits = candidate.value.replace(/\D/g, "").length;
+	if (candidate.form === "digits" || candidate.form === "split-digits") score += digits === 6 ? 3 : 1;
+	else if (candidate.form === "spaced-digits") score += digits === 6 ? 2 : 0;
+	else if (candidate.form === "alnum") score += 1;
+	const negative = lastMatchIndex(NOT_A_CODE, near30);
+	if (negative >= 0 && negative > lastMatchIndex(CODE_KEYWORD, near30)) score -= 15;
+	if (CURRENCY_AFTER.test(after)) score -= 15;
+	if (DURATION_AFTER.test(after)) score -= 15;
+	if (candidate.form === "digits" && /^(?:19|20)\d\d$/.test(candidate.value)) score -= 6;
+	if (candidate.form === "dashed" && !/\d/.test(candidate.value) && score < 12) score -= 10;
+	return score;
+}
+function dropContained(candidates) {
+	return candidates.filter((c) => !candidates.some((other) => other !== c && other.line === c.line && other.start <= c.start && other.end >= c.end && other.end - other.start > c.end - c.start));
+}
+/** Below this, a candidate has no keyword evidence and is not reported. */
+const MIN_CODE_SCORE = 8;
+/**
+* The verification or one-time code in an email, with spaces and dashes
+* between groups removed ("123 456" -> "123456"), or null when none is found.
+*/
+function extractVerificationCode(email) {
+	const fromText = email.text?.trim() ? codeInBody(email.subject, email.text) : null;
+	if (fromText !== null) return fromText;
+	return codeInBody(email.subject, email.html?.trim() ? htmlToText(email.html) : "");
+}
+function codeInBody(subject, body) {
+	const lines = codeLines(subject, body);
+	const mentionsCode = lines.some((line) => CODE_KEYWORD.test(line));
+	const found = [];
+	lines.forEach((line, index) => {
+		for (const { form, regex } of CODE_PATTERNS) for (const match of line.matchAll(regex)) {
+			const start = match.index ?? 0;
+			const raw = match[0];
+			const value = raw.replace(/[ -]/g, "");
+			if (value.length < 4 || value.length > 10) continue;
+			found.push({
+				value,
+				raw,
+				form,
+				line: index,
+				start,
+				end: start + raw.length,
+				score: 0
+			});
+		}
+	});
+	let best = null;
+	for (const candidate of dropContained(found)) {
+		const score = scoreCode(candidate, lines, mentionsCode);
+		if (score === null) continue;
+		candidate.score = score;
+		if (candidate.score >= MIN_CODE_SCORE && (best === null || candidate.score > best.score)) best = candidate;
+	}
+	return best?.value ?? null;
+}
+const ANCHOR = /<a\b[^>]*?\shref\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>"']+))[^>]*>([\s\S]*?)<\/a\s*>/gi;
+const HREF_ENTITIES = {
+	"&amp;": "&",
+	"&#38;": "&",
+	"&#x26;": "&",
+	"&quot;": "\"",
+	"&#34;": "\"",
+	"&#x22;": "\"",
+	"&apos;": "'",
+	"&#39;": "'",
+	"&#x27;": "'"
+};
+/** Decode the entities an href carries, in one pass so none is decoded twice. */
+function decodeHref(value) {
+	return value.trim().replace(/&(?:amp|quot|apos|#0*(?:38|34|39)|#x0*(?:26|22|27));/gi, (match) => {
+		const key = match.toLowerCase().replace(/^&#(x?)0+/, "&#$1");
+		return HREF_ENTITIES[key] ?? match;
+	});
+}
+function anchorLabel(html) {
+	return htmlToText(html).replace(/\s+/g, " ").trim();
+}
+function trimUrl(url) {
+	return url.replace(/[).,;:!?'"\]>]+$/, "");
+}
+function linkCandidates(email) {
+	const out = [];
+	if (email.html?.trim()) for (const match of email.html.matchAll(ANCHOR)) {
+		const href = decodeHref(match[1] ?? match[2] ?? match[3] ?? "");
+		out.push({
+			url: href,
+			label: anchorLabel(match[4] ?? "")
+		});
+	}
+	if (email.text?.trim()) {
+		const lines = email.text.replace(/\r\n?/g, "\n").split("\n");
+		lines.forEach((line, index) => {
+			for (const match of line.matchAll(/\bhttps?:\/\/[^\s<>"']+/gi)) {
+				const url = trimUrl(match[0]);
+				const label = [line.replace(match[0], " "), ...previousContent(lines, index, 1)].join(" ").replace(/\s+/g, " ").trim();
+				out.push({
+					url,
+					label
+				});
+			}
+		});
+	}
+	return out;
+}
+const TRACKING_KEYS = [
+	"url",
+	"u",
+	"q",
+	"target",
+	"redirect",
+	"redirect_url",
+	"dest",
+	"destination",
+	"link",
+	"r"
+];
+const TRACKING_HOST = /(?:^|\.)(?:click|clicks|track|tracking|trk|links?|email|e|ct|t)\.|safelinks\.protection\.outlook\.com$|urldefense\.|sendgrid\.net$|mailgun\.|mandrillapp\.com$|list-manage\.com$|hubspotlinks\.com$|awstrack\.me$|mjt\.lu$|^(?:www\.)?google\.com$/i;
+const TRACKING_PATH = /(?:^|\/)(?:c|cl|l|r|t|click|clicks|track|redirect|url)\/?$/i;
+/**
+* The destination of an obvious click-tracking redirect whose target is
+* embedded whole as a query parameter; otherwise the URL unchanged.
+*/
+function unwrapTrackingRedirect(url) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return url;
+	}
+	if (!TRACKING_HOST.test(parsed.hostname) && !TRACKING_PATH.test(parsed.pathname)) return url;
+	for (const key of TRACKING_KEYS) {
+		const value = parsed.searchParams.get(key);
+		if (value && /^https?:\/\/[^\s]+$/i.test(value)) try {
+			new URL(value);
+			return value;
+		} catch {
+			return url;
+		}
+	}
+	return url;
+}
+const SKIP_TOKENS = /* @__PURE__ */ new Set([
+	"unsubscribe",
+	"unsub",
+	"optout",
+	"preferences",
+	"privacy",
+	"terms",
+	"legal",
+	"help",
+	"support",
+	"faq",
+	"feedback",
+	"policy",
+	"cookies",
+	"abuse"
+]);
+const SKIP_LABEL = /\b(?:opt[- ]out|manage (?:your )?(?:preferences|notifications|subscriptions|email settings)|view (?:this (?:email|message) )?(?:in (?:your |a )?browser|online)|web version|contact us|report (?:this|abuse))\b/i;
+const SOCIAL_HOST = /(?:^|\.)(?:twitter\.com|x\.com|facebook\.com|fb\.com|instagram\.com|linkedin\.com|youtube\.com|youtu\.be|tiktok\.com|pinterest\.com|threads\.net|discord\.gg|apps\.apple\.com|play\.google\.com)$/i;
+const IMAGE_PATH = /\.(?:png|gif|jpe?g|svg|webp|ico)$/i;
+const LABEL_POSITIVE = /\b(?:verify|verification|confirm|confirmation|sign[- ]?in|sign me in|log[- ]?in|magic|activate|activation|reset|validate|authenticate|authorize|accept (?:the )?invit\w*|join|get started|continue)\b/i;
+const NEGATED_LABEL = /\b(?:did ?n[o']t|didn't|not you|wasn't you|was not you|ignore)\b/i;
+const URL_POSITIVE = /(?:verify|verification|confirm|signin|sign-in|sign_in|login|log-in|log_in|magic|activate|activation|reset|validate|auth|callback|invite|accept)/i;
+function urlTokens(parsed) {
+	return `${parsed.hostname} ${parsed.pathname}`.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+}
+function scoreLink(candidate) {
+	const url = unwrapTrackingRedirect(candidate.url);
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return null;
+	}
+	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+	if (SOCIAL_HOST.test(parsed.hostname)) return null;
+	if (IMAGE_PATH.test(parsed.pathname)) return null;
+	const labelTokens = candidate.label.toLowerCase().split(/[^a-z0-9]+/);
+	if (urlTokens(parsed).some((t) => SKIP_TOKENS.has(t)) || labelTokens.some((t) => SKIP_TOKENS.has(t)) || SKIP_LABEL.test(candidate.label)) return null;
+	let score = 0;
+	if (LABEL_POSITIVE.test(candidate.label)) score += 6;
+	if (NEGATED_LABEL.test(candidate.label)) score -= 4;
+	if (URL_POSITIVE.test(`${parsed.pathname}${parsed.search}`)) score += 4;
+	else if (URL_POSITIVE.test(parsed.hostname)) score += 2;
+	if (/[?&/=][A-Za-z0-9_-]{24,}/.test(`${parsed.pathname}${parsed.search}`)) score += 1;
+	if (parsed.protocol === "http:") score -= 1;
+	return score;
+}
+/**
+* The most likely verification, sign-in, confirm or magic link in an email,
+* with an obvious click-tracking wrapper removed, or null when no link has
+* evidence of being one.
+*/
+function extractVerificationLink(email) {
+	let best = null;
+	for (const candidate of linkCandidates(email)) {
+		const score = scoreLink(candidate);
+		if (score === null || score < 4) continue;
+		if (best === null || score > best.score) best = {
+			url: unwrapTrackingRedirect(candidate.url),
+			score
+		};
+	}
+	return best?.url ?? null;
+}
+//#endregion
+//#region src/oclif/commands/wait.ts
+/** Exit codes. 2 is oclif's invalid-flags exit. */
+const WAIT_EXIT_CODES = {
+	found: 0,
+	error: 1,
+	timeout: 5,
+	notFound: 6
+};
+const MAX_LONG_POLL_SECONDS = 30;
+const TAIL_PAGE_SIZE = 100;
+const EXISTING_PAGE_SIZE = 50;
+const PRINTED_BODY_CHARS = 1200;
+const JSON_TEXT_CHARS = 4e3;
+/**
+* Seconds from "90", "90s", "5m", "1h" or "1m30s". 0 waits forever. Throws
+* on anything else.
+*/
+function parseWaitDuration(value) {
+	const text = value.trim().toLowerCase();
+	if (/^\d+$/.test(text)) return Number(text);
+	const match = /^(?:(\d+)h)?(?:(\d+)m)?(?:(\d+)s)?$/.exec(text);
+	if (!match || text === "") throw new Error(`--timeout must be a duration such as 90s, 5m, 1h or plain seconds; got "${value}".`);
+	const [, h, m, s] = match;
+	return Number(h ?? 0) * 3600 + Number(m ?? 0) * 60 + Number(s ?? 0);
+}
+/**
+* Whether any of an email's sender addresses matches `--from`. A value with
+* an @ matches that address exactly; a bare domain ("github.com" or
+* "@github.com") matches any address at it or at its subdomains.
+*/
+function senderMatches(filter, addresses) {
+	const wanted = filter.trim().toLowerCase();
+	const domainOnly = wanted.startsWith("@") || !wanted.includes("@");
+	const domain = wanted.replace(/^@/, "");
+	return addresses.some((raw) => {
+		const address = raw?.trim().toLowerCase();
+		if (!address) return false;
+		if (!domainOnly) return address === wanted;
+		const at = address.lastIndexOf("@");
+		const own = at >= 0 ? address.slice(at + 1) : "";
+		return own === domain || own.endsWith(`.${domain}`);
+	});
+}
+function str(value) {
+	return typeof value === "string" && value !== "" ? value : null;
+}
+function subjectMatches(filter, subject) {
+	return (str(subject) ?? "").toLowerCase().includes(filter.toLowerCase());
+}
+/** Cheap checks on a list row, before its detail is read. */
+function rowMayMatch(row, filters) {
+	if (row.status !== "accepted" && row.status !== "completed") return false;
+	if (presenceDisposition(row) !== "ordinary") return false;
+	if (filters.subject && !subjectMatches(filters.subject, row.subject)) return false;
+	if (filters.thread && str(row.thread_id) !== filters.thread) return false;
+	return true;
+}
+function detailMatches(detail, filters) {
+	if (filters.from && !senderMatches(filters.from, [detail.from_email, detail.sender])) return false;
+	if (filters.subject && !subjectMatches(filters.subject, detail.subject)) return false;
+	if (filters.thread && (detail.thread_id ?? null) !== filters.thread) return false;
+	if (filters.replyTo && (detail.reply_to_sent_email_id ?? "").toLowerCase() !== filters.replyTo.toLowerCase()) return false;
+	return true;
+}
+function truncate(text, max) {
+	return text.length <= max ? {
+		text,
+		cut: false
+	} : {
+		text: `${text.slice(0, max).trimEnd()}...`,
+		cut: true
+	};
+}
+function waitJson(detail, options) {
+	const compact = buildEmailCompact(detail);
+	const body = truncate(compact.body_text, JSON_TEXT_CHARS);
+	const extractInput = {
+		subject: detail.subject,
+		text: detail.body_text,
+		html: detail.body_html
+	};
+	return {
+		id: detail.id,
+		thread_id: compact.thread_id,
+		from: compact.from,
+		to: compact.to,
+		subject: compact.subject,
+		received_at: compact.received_at,
+		text: body.text,
+		text_truncated: body.cut,
+		...options.code ? { code: extractVerificationCode(extractInput) } : {},
+		...options.link ? { link: extractVerificationLink(extractInput) } : {}
+	};
+}
+function formatWaitEmail(email, bin) {
+	const body = truncate(email.text, PRINTED_BODY_CHARS);
+	const lines = [
+		`From: ${email.from}`,
+		`Subject: ${email.subject ?? "(no subject)"}`,
+		`Received: ${email.received_at}`,
+		`ID: ${email.id}`,
+		"",
+		body.text || "(no text)"
+	];
+	if (body.cut || email.text_truncated) lines.push("", `Full email: ${bin} emails get --id ${email.id}`);
+	lines.push("", `Reply: ${bin} reply --id ${email.id} --body "..."`);
+	return sanitizeForTerminal(lines.join("\n"));
+}
+async function listRows(apiClient, query) {
+	const result = await listEmails({
+		client: apiClient.client,
+		query,
+		responseStyle: "fields"
+	});
+	if (result.error) throw new InboxNextApiError("GET /emails", extractErrorPayload(result.error));
+	const envelope = result.data;
+	return {
+		rows: (envelope?.data ?? []).filter((row) => row !== null && typeof row === "object"),
+		cursor: envelope?.meta?.cursor ?? null
+	};
+}
+async function readDetail(apiClient, id) {
+	const result = await getEmail({
+		client: apiClient.client,
+		path: { id },
+		responseStyle: "fields"
+	});
+	if (result.error) {
+		const payload = extractErrorPayload(result.error);
+		if (extractErrorCode(payload) === "not_found") return null;
+		throw new InboxNextApiError(`GET /emails/${id}`, payload);
+	}
+	const detail = result.data?.data;
+	return detail !== null && typeof detail === "object" ? detail : null;
+}
+async function firstMatch(apiClient, rows, filters, seen) {
+	for (const row of rows) {
+		const id = str(row.id);
+		if (!id || seen.has(id)) continue;
+		seen.add(id);
+		if (!rowMayMatch(row, filters)) continue;
+		const detail = await readDetail(apiClient, id);
+		if (detail && detailMatches(detail, filters)) return detail;
+	}
+	return null;
+}
+function arrivedSince(row, threshold) {
+	const at = Date.parse(str(row.created_at) ?? str(row.received_at) ?? "");
+	return Number.isFinite(at) && at >= threshold;
+}
+/**
+* Block until an email matching `filters` arrives (or, with
+* `includeExisting`, is among the newest already received). Returns null at
+* the deadline.
+*/
+async function waitForEmail(params) {
+	const { apiClient, filters, deadline } = params;
+	const seen = /* @__PURE__ */ new Set();
+	let since = await baselineCursor({ apiClient });
+	const recent = await listRows(apiClient, { limit: EXISTING_PAGE_SIZE });
+	const early = await firstMatch(apiClient, recent.rows.filter((row) => arrivedSince(row, params.startedAt)).reverse(), filters, seen);
+	if (early) return early;
+	if (params.includeExisting) {
+		const found = await firstMatch(apiClient, recent.rows, filters, seen);
+		if (found) return found;
+	}
+	for (;;) {
+		const remainingMs = deadline === null ? MAX_LONG_POLL_SECONDS * 1e3 : deadline - Date.now();
+		if (remainingMs <= 0) return null;
+		const startedAt = Date.now();
+		const page = await listRows(apiClient, {
+			limit: TAIL_PAGE_SIZE,
+			since,
+			wait: Math.max(0, Math.min(MAX_LONG_POLL_SECONDS, Math.floor(remainingMs / 1e3)))
+		});
+		const found = await firstMatch(apiClient, page.rows, filters, seen);
+		if (found) return found;
+		if (page.rows.length > 0 && page.cursor) {
+			since = page.cursor;
+			continue;
+		}
+		if (Date.now() - startedAt < 1e3) await sleep$2(Math.max(0, Math.min(1e3, remainingMs)));
+	}
+}
+function describeFilters(filters) {
+	const parts = [
+		filters.from ? `from ${filters.from}` : null,
+		filters.subject ? `with subject containing "${filters.subject}"` : null,
+		filters.thread ? `in thread ${filters.thread}` : null,
+		filters.replyTo ? `replying to ${filters.replyTo}` : null
+	].filter(Boolean);
+	return parts.length > 0 ? ` ${parts.join(" ")}` : "";
+}
+var WaitCommand = class WaitCommand extends Command {
+	static summary = "Wait for the next email to you and print it, its code or its link";
+	static description = `Wait for the next email to this identity and print it. Made for sign-ups and logins: use your address with a service, then let this command pick the code or link out of the email it sends.
+
+Only mail that arrives after the command starts matches, unless --include-existing also lets one of the newest 50 emails match. The identity is the one the CLI resolves: a connected agent profile receives only its own address's mail; a member login receives any inbound mail in the organization.
+
+--from takes an address (exact match) or a bare domain: github.com matches any sender at github.com or its subdomains. It is checked against the From address and the envelope sender, which the sender controls; it narrows the wait, it does not prove who sent the mail.
+
+--code prints only the verification or one-time code, with spaces or dashes between its groups removed. --link prints only the most likely verification, sign-in, confirm, magic or reset link, with an obvious click-tracking wrapper removed. Without either, the email is printed: sender, subject, time, its ID and the start of its text, ready for \`primitive reply --id <id>\`. --json prints one object with id, thread_id, from, to, subject, received_at, text and, when asked, code and link (null when none was found).
+
+Exit codes:
+  - 0: a matching email arrived and was printed.
+  - 1: error (API failure or authentication).
+  - 2: invalid flags or arguments.
+  - 5: no matching email arrived before --timeout.
+  - 6: the email arrived but had no code (--code) or link (--link); its ID is printed on stderr.`;
+	static examples = [
+		{
+			description: "Sign up with your address, then read the code",
+			command: "<%= config.bin %> wait --from github.com --code"
+		},
+		{
+			description: "Click through a magic sign-in link",
+			command: "<%= config.bin %> wait --from vercel.com --link"
+		},
+		{
+			description: "Wait up to 90 seconds for a specific subject",
+			command: "<%= config.bin %> wait --subject \"verify your email\" --timeout 90s"
+		},
+		{
+			description: "Machine-readable, code included",
+			command: "<%= config.bin %> wait --from stripe.com --code --json"
+		},
+		{
+			description: "The code already arrived before you started waiting",
+			command: "<%= config.bin %> wait --from slack.com --code --include-existing"
+		}
+	];
+	static flags = {
+		"api-key": Flags.string({
+			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
+			env: "PRIMITIVE_API_KEY"
+		}),
+		"api-base-url": Flags.string({
+			description: "Override the primary API base URL. Internal testing only; not documented to customers.",
+			env: "PRIMITIVE_API_BASE_URL",
+			hidden: true
+		}),
+		from: Flags.string({ description: "Sender address, or a domain matching any sender at it or its subdomains (github.com)" }),
+		subject: Flags.string({ description: "Only match emails whose subject contains this text (case-insensitive)" }),
+		thread: Flags.string({ description: "Only match emails in this thread ID" }),
+		"reply-to": Flags.string({ description: "Only match replies to this sent email ID" }),
+		timeout: Flags.string({
+			default: "5m",
+			description: "How long to wait: 90s, 5m, 1h or plain seconds; 0 waits forever"
+		}),
+		code: Flags.boolean({ description: "Print only the verification or one-time code" }),
+		link: Flags.boolean({ description: "Print only the verification or sign-in link" }),
+		json: Flags.boolean({ description: "Print one JSON object for the email" }),
+		"include-existing": Flags.boolean({ description: "Also match the newest 50 emails already received" })
+	};
+	async run() {
+		const startedAt = Date.now();
+		const { flags } = await this.parse(WaitCommand);
+		let timeoutSeconds;
+		try {
+			timeoutSeconds = parseWaitDuration(flags.timeout);
+		} catch (error) {
+			this.error(error instanceof Error ? error.message : String(error), { exit: 2 });
+		}
+		const filters = {
+			from: flags.from?.trim() || void 0,
+			subject: flags.subject?.trim() || void 0,
+			thread: flags.thread?.trim() || void 0,
+			replyTo: flags["reply-to"]?.trim() || void 0
+		};
+		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
+			apiKey: flags["api-key"],
+			apiBaseUrl: flags["api-base-url"],
+			configDir: this.config.configDir
+		});
+		const deadline = timeoutSeconds === 0 ? null : Date.now() + timeoutSeconds * 1e3;
+		if (process.stderr.isTTY) {
+			const to = auth.connectedAgent?.agentAddress;
+			process.stderr.write(`Waiting${timeoutSeconds === 0 ? "" : ` up to ${flags.timeout}`} for mail${to ? ` to ${to}` : ""}${describeFilters(filters)}...\n`);
+		}
+		let detail;
+		try {
+			detail = await waitForEmail({
+				apiClient,
+				filters,
+				includeExisting: flags["include-existing"],
+				deadline,
+				startedAt
+			});
+		} catch (error) {
+			if (!(error instanceof InboxNextApiError)) throw error;
+			writeErrorWithHints(error.payload);
+			surfaceUnauthorizedHint({
+				auth,
+				baseUrlOverridden,
+				configDir: this.config.configDir,
+				payload: error.payload
+			});
+			process.exitCode = WAIT_EXIT_CODES.error;
+			return;
+		}
+		if (!detail) {
+			process.stderr.write(`Timed out after ${flags.timeout} with no matching email${describeFilters(filters)}.\n`);
+			process.exitCode = WAIT_EXIT_CODES.timeout;
+			return;
+		}
+		const email = waitJson(detail, {
+			code: flags.code,
+			link: flags.link
+		});
+		const missing = [flags.code && !email.code ? "code" : null, flags.link && !email.link ? "link" : null].filter((item) => item !== null);
+		if (flags.json) this.log(JSON.stringify(email));
+		else if (flags.code || flags.link) {
+			if (flags.code && email.code) this.log(email.code);
+			if (flags.link && email.link) this.log(sanitizeForTerminal(email.link));
+		} else this.log(formatWaitEmail(email, this.config.bin));
+		if (missing.length > 0) {
+			process.stderr.write(`No verification ${missing.join(" or ")} found in email ${email.id}; read it with: ${this.config.bin} emails get --id ${email.id}\n`);
+			process.exitCode = WAIT_EXIT_CODES.notFound;
+		}
+	}
+};
+//#endregion
 //#region src/oclif/commands/wake-authorizations-create.ts
 var WakeAuthorizationsCreateCommand = class WakeAuthorizationsCreateCommand extends Command {
 	static description = "Grant a sender domain (and optionally an address and command set) permission to wake a target function.";
@@ -62880,7 +64121,7 @@ function formatWhoamiSummary(account, managedInboxDomain) {
 var WhoamiCommand = class WhoamiCommand extends Command {
 	static description = `Print the account currently authenticated by saved OAuth credentials or an explicit API key. For account credentials this is a live credentials smoke test. Use account whoami for the authenticated caller, their assigned member address and an address suggestion; account provision-member-address --address <email> saves your chosen personal address.
 
-  With PRIMITIVE_AGENT_PROFILE selected, print the saved connected-agent identity offline. This does not verify live authentication, app pairing, or listener readiness. Inspect the receiver separately: the output names the command for the profile's receiver mode (agent connect --status for Claude hook and poll receivers, listen --status --notify-session for a native listener).
+  With PRIMITIVE_AGENT_PROFILE selected, print the saved connected-agent identity offline, with no API call. The first line is the agent's email address alone; --json adds address, profile and source (session_hook when the selected profile is this Claude Code session's own agent exported by the session start hook, env otherwise). This does not verify live authentication, app pairing, or listener readiness. Inspect the receiver separately: the output names the command for the profile's receiver mode (agent connect --status for Claude hook and poll receivers, listen --status --notify-session for a native listener).
 
   The default output is a concise human summary. Pass --json for the full /account response or the explicit offline connected-agent identity envelope.`;
 	static summary = "Print the live account or saved connected-agent identity";
@@ -62916,13 +64157,18 @@ var WhoamiCommand = class WhoamiCommand extends Command {
 				const statusCommand = `${cliInvocation(process.argv[1])} agent connect --profile ${identity.profileName} --status --json`;
 				const receiver = receiverStatusCommand(this.config.configDir, identity.profileName);
 				const guidance = `Saved identity only. Live authentication, app pairing, and receiving readiness are not verified. Inspect the ${receiver.mode === "external" ? "Claude hook receiver" : receiver.mode === "poll" ? "poll receiver" : "receiver"} with \`${receiver.command}\`.`;
+				const source = agentIdentitySource(identity);
+				const selectedBy = source === "session_hook" ? `this Claude Code session's start hook (PRIMITIVE_AGENT_PROFILE=${identity.profileName})` : `PRIMITIVE_AGENT_PROFILE=${identity.profileName}`;
 				this.log(flags.json ? JSON.stringify({
+					address: identity.agentAddress,
+					profile: identity.profileName,
+					source,
 					auth_method: "agent_connection",
 					verification: "offline",
 					identity,
 					status_command: statusCommand,
 					guidance
-				}, null, 2) : `Saved connected-agent profile: ${identity.profileName}\nAgent address: ${identity.agentAddress}\nOwner personal address (send reports here): ${identity.ownerMemberAddress ?? "unknown; reply to the member who wrote to you"}\nControl address (setup and presence only): ${identity.ownerAddress}\nAPI origin: ${identity.apiBaseUrl}\n${guidance}\nSaved profile status: ${statusCommand}`);
+				}, null, 2) : `${identity.agentAddress}\nSelected by: ${selectedBy}. Prefix a command with \`PRIMITIVE_AGENT_PROFILE=\` to run it as the member login instead.\nSaved connected-agent profile: ${identity.profileName}\nAgent address: ${identity.agentAddress}\nOwner personal address (send reports here): ${identity.ownerMemberAddress ?? "unknown; reply to the member who wrote to you"}\nControl address (setup and presence only): ${identity.ownerAddress}\nAPI origin: ${identity.apiBaseUrl}\n${guidance}\nSaved profile status: ${statusCommand}`);
 				return;
 			}
 			if (isConnectedChatCredential(auth.apiKey)) throw new Errors.CLIError("This connection credential cannot inspect an account. Select its saved profile with PRIMITIVE_AGENT_PROFILE to inspect the connected identity offline.", { exit: 1 });
@@ -63024,6 +64270,7 @@ function renderFishCompletion(binName) {
 		for (const operation of topicOperations) {
 			lines.push(`complete -c ${binName} -f -n '__fish_${binName}_topic_needs_subcommand ${fishEscape(topic)}' -a '${fishEscape(operation.command)}' -d '${fishEscape(operation.summary ?? `${operation.method} ${operation.path}`)}'`);
 			for (const parameter of [...operation.pathParams, ...operation.queryParams]) lines.push(`complete -c ${binName} -n '${operationCondition(operation).replace(BIN_PLACEHOLDER, binName)}' -l '${fishEscape(parameter.name.replace(/_/g, "-"))}' -r -d '${fishEscape(parameter.description ?? parameter.name)}'`);
+			for (const parameter of operation.headerParams) lines.push(`complete -c ${binName} -n '${operationCondition(operation).replace(BIN_PLACEHOLDER, binName)}' -l '${fishEscape(headerFlagName(parameter.name))}' -r -d '${fishEscape(parameter.description ?? parameter.name)}'`);
 			lines.push(`complete -c ${binName} -n '${operationCondition(operation).replace(BIN_PLACEHOLDER, binName)}' -l 'api-key' -r -d 'Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)'`);
 			if (!operation.binaryResponse) lines.push(`complete -c ${binName} -n '${operationCondition(operation).replace(BIN_PLACEHOLDER, binName)}' -l 'envelope' -d 'Print the full response envelope, including pagination metadata'`);
 			if (operation.hasJsonBody) lines.push(`complete -c ${binName} -n '${operationCondition(operation).replace(BIN_PLACEHOLDER, binName)}' -l 'body' -r -d 'JSON request body'`, `complete -c ${binName} -n '${operationCondition(operation).replace(BIN_PLACEHOLDER, binName)}' -l 'body-file' -r -d 'Path to a JSON file used as the request body'`);
@@ -63400,6 +64647,7 @@ const COMMANDS = {
 	"domains:download-domain-zone-file": DomainsZoneFileCommand,
 	"inbox:setup": InboxSetupCommand,
 	"inbox:next": InboxNextCommand,
+	wait: WaitCommand,
 	listen: ListenCommand,
 	"listen:init": ListenInitCommand,
 	"listen:pending": ListenPendingCommand,