primcli 3.0.0-preview.1 → 3.0.0-preview.11

package/dist/{repeats-Dj_o6c-X-Bf9G0xds.js → repeats-Dj_o6c-X-ChTwFlyB.js}

@@ -34,6 +34,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 const client = createClient(createConfig({ baseUrl: "https://api.primitive.dev/v1" }));
 // ../packages/api-core/src/api/sdk.gen.ts
 var sdk_gen_exports = /* @__PURE__ */ __exportAll({
+	acceptEmailRuleObjection: () => acceptEmailRuleObjection,
 	acceptEmailRuleRequest: () => acceptEmailRuleRequest,
 	addDefaultNetworkMember: () => addDefaultNetworkMember,
 	addDomain: () => addDomain,
@@ -52,6 +53,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	cancelSentEmailByIdempotencyKey: () => cancelSentEmailByIdempotencyKey,
 	checkDefaultNetworkContactAdmission: () => checkDefaultNetworkContactAdmission,
 	checkDomainDns: () => checkDomainDns,
+	checkEmailRuleRequestTarget: () => checkEmailRuleRequestTarget,
 	checkSendability: () => checkSendability,
 	checkVanityInboxName: () => checkVanityInboxName,
 	claimAgentConnection: () => claimAgentConnection,
@@ -63,6 +65,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	createAgentClaimLink: () => createAgentClaimLink,
 	createAgentConnection: () => createAgentConnection,
 	createEmailRule: () => createEmailRule,
+	createEmailRuleObjection: () => createEmailRuleObjection,
 	createEmailRuleRequest: () => createEmailRuleRequest,
 	createEndpoint: () => createEndpoint,
 	createFilter: () => createFilter,
@@ -78,6 +81,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	createWakeSchedule: () => createWakeSchedule,
 	decideAccessMode: () => decideAccessMode,
 	decideSuspension: () => decideSuspension,
+	declineEmailRuleObjection: () => declineEmailRuleObjection,
 	declineEmailRuleRequest: () => declineEmailRuleRequest,
 	deleteAddressNote: () => deleteAddressNote,
 	deleteAgentContact: () => deleteAgentContact,
@@ -85,6 +89,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	deleteDomain: () => deleteDomain,
 	deleteEmail: () => deleteEmail,
 	deleteEmailRule: () => deleteEmailRule,
+	deleteEmailRuleRequest: () => deleteEmailRuleRequest,
 	deleteEndpoint: () => deleteEndpoint,
 	deleteFilter: () => deleteFilter,
 	deleteFunction: () => deleteFunction,
@@ -112,6 +117,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	downloadSentAttachments: () => downloadSentAttachments,
 	endBreakGlass: () => endBreakGlass,
 	endEmailRuleShare: () => endEmailRuleShare,
+	generateLookAlikes: () => generateLookAlikes,
 	getAccessMode: () => getAccessMode,
 	getAccount: () => getAccount,
 	getAddressNote: () => getAddressNote,
@@ -128,8 +134,14 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	getEmail: () => getEmail,
 	getEmailReadable: () => getEmailReadable,
 	getEmailRule: () => getEmailRule,
+	getEmailRuleCoveringMe: () => getEmailRuleCoveringMe,
+	getEmailRuleObjection: () => getEmailRuleObjection,
 	getEmailRuleRequest: () => getEmailRuleRequest,
+	getEmailRuleScope: () => getEmailRuleScope,
 	getEmailRuleShare: () => getEmailRuleShare,
+	getEmailRuleVocabulary: () => getEmailRuleVocabulary,
+	getEndpoint: () => getEndpoint,
+	getEndpointSigningSecret: () => getEndpointSigningSecret,
 	getFunction: () => getFunction,
 	getFunctionDeployment: () => getFunctionDeployment,
 	getFunctionInvocation: () => getFunctionInvocation,
@@ -159,6 +171,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	getRelayAutoJoin: () => getRelayAutoJoin,
 	getRepeatingSend: () => getRepeatingSend,
 	getSearchSettings: () => getSearchSettings,
+	getSendFrom: () => getSendFrom,
 	getSendPermissions: () => getSendPermissions,
 	getSentEmail: () => getSentEmail,
 	getSentHourlyStats: () => getSentHourlyStats,
@@ -174,6 +187,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	inviteOrganizationMember: () => inviteOrganizationMember,
 	inviteProjectMember: () => inviteProjectMember,
 	leaveOrganization: () => leaveOrganization,
+	listActivityObjects: () => listActivityObjects,
 	listAddressNotes: () => listAddressNotes,
 	listAddressNotesBatch: () => listAddressNotesBatch,
 	listAgentConnections: () => listAgentConnections,
@@ -191,10 +205,16 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	listDomains: () => listDomains,
 	listEmailAttachmentArchiveMembers: () => listEmailAttachmentArchiveMembers,
 	listEmailRuleDecisions: () => listEmailRuleDecisions,
+	listEmailRuleDecisionsOnMyMail: () => listEmailRuleDecisionsOnMyMail,
+	listEmailRuleObjections: () => listEmailRuleObjections,
 	listEmailRuleRequests: () => listEmailRuleRequests,
+	listEmailRuleResults: () => listEmailRuleResults,
+	listEmailRuleScopeOptions: () => listEmailRuleScopeOptions,
 	listEmailRuleShareEmails: () => listEmailRuleShareEmails,
 	listEmailRuleShares: () => listEmailRuleShares,
+	listEmailRuleVersions: () => listEmailRuleVersions,
 	listEmailRules: () => listEmailRules,
+	listEmailRulesCoveringMe: () => listEmailRulesCoveringMe,
 	listEmails: () => listEmails,
 	listEndpoints: () => listEndpoints,
 	listFilters: () => listFilters,
@@ -272,6 +292,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	revokeOAuthGrant: () => revokeOAuthGrant,
 	revokeOrganizationInvitation: () => revokeOrganizationInvitation,
 	revokeProjectInvitation: () => revokeProjectInvitation,
+	rotateEndpointSigningSecret: () => rotateEndpointSigningSecret,
 	rotateKey: () => rotateKey,
 	rotateWebhookSecret: () => rotateWebhookSecret,
 	runWakeSchedule: () => runWakeSchedule,
@@ -340,6 +361,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	verifyCliSignup: () => verifyCliSignup,
 	verifyDomain: () => verifyDomain,
 	whoami: () => whoami,
+	withdrawEmailRuleObjection: () => withdrawEmailRuleObjection,
 	withdrawEmailRuleRequest: () => withdrawEmailRuleRequest
 });
 /**
@@ -626,7 +648,7 @@ const getAccount = (options) => (options?.client ?? client).get({
 /**
 * Update account settings
 *
-* Update the mutable account settings (such as display name and notification preferences) for the authenticated organization.
+* Update the organization's spam threshold (spam_threshold) and whether an email's content is discarded once a webhook confirms receipt (discard_content_on_webhook_confirmed), the opt-in POST /emails/{id}/discard-content needs.
 */
 const updateAccount = (options) => (options.client ?? client).patch({
 	security: [{
@@ -660,10 +682,7 @@ const getStorageStats = (options) => (options?.client ?? client).get({
 * secret exists yet, one is generated automatically on first
 * access.
 *
-* Signing is account-scoped, not per-endpoint. Every webhook
-* delivery from any of your registered endpoints is signed
-* with this single secret. Rotate via
-* `POST /account/webhook-secret/rotate`.
+* Every webhook is signed with this secret unless it has its own. Rotate this secret via `POST /account/webhook-secret/rotate`. A webhook whose signed_with is own_secret is signed with its own secret instead; read it from GET /endpoints/{id}/signing-secret. A webhook's own secret rotates via `POST /endpoints/{id}/signing-secret/rotate`.
 *
 * **Secret format**: the returned string looks base64-shaped
 * (e.g. `XNHBBW8VqoBjRfNs1tkZj11jTk...`) but is NOT base64.
@@ -1208,15 +1227,10 @@ const listEndpoints = (options) => (options?.client ?? client).get({
 /**
 * Create a webhook endpoint
 *
-* Creates a new webhook endpoint. If a deactivated endpoint
-* with the same URL and domain exists, it is reactivated
-* instead. Subject to plan limits on the number of active
+* Creates a new webhook endpoint. A URL can have one endpoint per domain, route targets included (unlike the one default destination per domain), and endpoints with no domain_id count as one domain. A disabled endpoint still holds its URL; a deleted one does not. A create at a URL another endpoint has on the same domain is refused (400). A deleted endpoint's URL can be used again: the create makes a new endpoint, with a new id, and the deleted one stays as it was. Subject to plan limits on the number of active
 * endpoints.
 *
-* **Signing is account-scoped, not per-endpoint.** This call
-* does not return any signing material; every endpoint on the
-* account uses the same webhook secret, fetched via
-* `GET /account/webhook-secret`. See the API-level "Webhook
+* **Signing.** A webhook is signed with the organization's webhook secret (`GET /account/webhook-secret`) unless it has its own. A webhook made as a person's own, or by an API key limited to some mailboxes, a third-party app or an agent delegate for itself, is made with its own secret: the response carries it once as `signing_secret`, and `GET /endpoints/{id}/signing-secret` returns it afterwards. Other webhooks, those a person who can read every mailbox makes among them, sign with the organization's secret until given their own. `signed_with` on the endpoint says which secret signs it. See the API-level "Webhook
 * signing" section for the full wire format (header name,
 * signed string, hash algo, secret format, tolerance) and a
 * language-agnostic verification recipe.
@@ -1260,14 +1274,27 @@ const deleteEndpoint = (options) => (options.client ?? client).delete({
 	...options
 });
 /**
+* Get an endpoint
+*
+* One endpoint, as GET /endpoints shows it, to a caller who would see it there. Any other id, a deleted endpoint's included, answers 404. For a webhook, delivery says whether it is being sent received mail at all, why not, and how much rule-granted mail is held while its owner cannot act.
+*/
+const getEndpoint = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}",
+	...options
+});
+/**
 * Update a webhook endpoint
 *
-* Updates an active webhook endpoint. If the URL is changed, the old
-* endpoint is deactivated and a new one is created (or an existing
-* deactivated endpoint with the new URL is reactivated).
+* Updates an active webhook endpoint. Changing the URL keeps the endpoint: its id, recipient routes, signing secret, delivery history and any deliveries still owed to it stay with it, and owed deliveries go to the new URL. A URL can have one endpoint per domain, route targets included (unlike the one default destination per domain), and endpoints with no domain_id count as one domain. A disabled endpoint still holds its URL; a deleted one does not. A change onto a URL another endpoint has on the same domain is refused (400), and a move onto a domain where another endpoint has this URL is refused (409).
 *
 *
 * Pull destinations cannot be assigned a URL, function or recipient-routing domain. Existing endpoint deletion disconnects the destination; creating a new destination does not backfill historical events.
+*
+* Giving a webhook the organization does not own to a different key (owner_key_id), or a key's webhook back to the organization (owner_key_id null), turns it off unless the request also sets enabled: its URL was chosen under its previous owner. It then reads enabled false with disabled_reason owner_changed, and turning it on or giving it a new URL starts it again. A key that carries on for the owning key through rotation (its successor, at any depth up to 16 rotations) is not a different key: the webhook stays as it was, with the same signing secret. That does not hold when the owning key was made from a key a transfer moved or rotated away, or from one that has since been deleted: no successor carries on for it. The answer's warnings name each such change (turned_off_owner_changed, turned_on_new_url), so a client can say so.
 */
 const updateEndpoint = (options) => (options.client ?? client).patch({
 	security: [{
@@ -1324,6 +1351,8 @@ const completeWebhookEvent = (options) => (options.client ?? client).post({
 * Successful deliveries and verified-domain endpoints are exempt
 * from the rate limit.
 *
+*
+* The test is sent whether or not real mail would be. reachable says whether the endpoint answered it with a 2xx; delivery says, apart from that, whether real email.received events would be sent to the endpoint by its own conditions (on, not held, an owner that can receive mail, subscribed to the event), with every reason it would not be. A 200 from the test alone does not mean mail arrives.
 */
 const testEndpoint = (options) => (options.client ?? client).post({
 	security: [{
@@ -1357,6 +1386,8 @@ const testEndpoint = (options) => (options.client ?? client).post({
 * delivered as if unfiltered), so `rules_valid: false` exposes a
 * misconfiguration that is otherwise silent.
 *
+*
+* would_deliver also covers the endpoint's own delivery conditions for this email (delivery): it is on, neither it nor the email's route is held, its owner may receive this email, and it subscribes to the event. Which endpoint routing sends the email to is decided separately: POST /routes/simulate answers that. A 503 means those conditions could not be read just now; retry.
 */
 const testEndpointRules = (options) => (options.client ?? client).post({
 	security: [{
@@ -1629,6 +1660,7 @@ const listRoutes = (options) => (options?.client ?? client).get({
 * transaction, enabling per-address function routing (e.g.
 * `alice@acme.com -> functionA`).
 *
+* A route that could never deliver is refused: an exact pattern that the endpoint's owner may not receive, or that the route's own owner may not act on, answers 400 validation_error with details.reason endpoint_owner_access or route_owner_access and details.recipient. A wildcard or regex route to an owned endpoint is written, with warnings saying it delivers only what the owner may receive. A route written disabled is judged when it is turned on.
 */
 const createRoute = (options) => (options.client ?? client).post({
 	security: [{
@@ -1694,7 +1726,7 @@ const deleteRoute = (options) => (options.client ?? client).delete({
 /**
 * Update a recipient route
 *
-* Update a recipient route
+* A route that could never deliver is refused: an exact pattern that the endpoint's owner may not receive, or that the route's own owner may not act on, answers 400 validation_error with details.reason endpoint_owner_access or route_owner_access and details.recipient. A wildcard or regex route to an owned endpoint is written, with warnings saying it delivers only what the owner may receive. A route written disabled is judged when it is turned on.
 */
 const updateRoute = (options) => (options.client ?? client).patch({
 	security: [{
@@ -1976,7 +2008,7 @@ const listSentEmails = (options) => (options?.client ?? client).get({
 /**
 * Delete a sent email
 *
-* Permanently deletes eligible sender mailbox history and its owned attachment archive and transient payload. Allows delivered, bounced, agent_failed, gate_denied, canceled, deferred and wait_timeout; other states return 409 (cancel scheduled sends first). Preserves recipient copies, received replies and independent interaction/delivery audit. This does not recall or cancel delivery already admitted. A minimal non-content record preserves occupied idempotency keys and delivered-reply deduplication. Keys already released by cancellation, gate denial or a never-attempted failure remain reusable; deleting those records does not revoke their existing retry permission. Repeating a completed deletion returns success; unknown or foreign IDs return 404. Organization API keys, sessions and OAuth are supported; Function and connected-agent credentials are denied.
+* Permanently deletes eligible sender mailbox history and its owned attachment archive and transient payload. Allows delivered, bounced, agent_failed, gate_denied, canceled, deferred and wait_timeout; other states return 409 (cancel scheduled sends first). Preserves recipient copies, received replies and independent interaction/delivery audit. This does not recall or cancel delivery already admitted. A minimal non-content record preserves occupied idempotency keys and delivered-reply deduplication. Keys already released by cancellation, gate denial or a never-attempted failure remain reusable; deleting those records does not revoke their existing retry permission. Unknown IDs return 404. Needs sent:manage, and follows mail access rather than role: a caller with the whole organization's mail (an owner, admin or member whose access covers every mailbox, or an organization-wide key) can delete any send in the organization; a caller limited to some mailboxes, an owner or admin included, can delete only sends from addresses its access covers, made since that access starts (a member limited to their own mail: their own), and any other send returns 404. Repeating a completed deletion returns success; for a caller limited to some mailboxes, only when the send was from an address its access names one by one, otherwise 404. Organization API keys, sessions and OAuth are supported; Function and connected-agent credentials are denied.
 */
 const deleteSentEmail = (options) => (options.client ?? client).delete({
 	security: [{
@@ -3035,7 +3067,7 @@ const putAgentContactPolicy = (options) => (options.client ?? client).put({
 /**
 * Get current caller identity
 *
-* Current authenticated identity. member_address is null for machine credentials or an unavailable member address.
+* Current authenticated identity. member_address is null for machine credentials or an unavailable member address. email (your own sign-in email) and role_name (your role as the members list labels it) are set only when you are signed in as yourself, in the dashboard or with your own Primitive CLI or app login, and are null for API keys, Functions, connected agents, agent signup logins and other apps acting for you.
 */
 const whoami = (options) => (options?.client ?? client).get({
 	security: [{
@@ -3575,9 +3607,35 @@ const getWebhookDeliveryStats = (options) => (options?.client ?? client).get({
 	...options
 });
 /**
+* List what you created, or what you were asked
+*
+* The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules, rule requests and objections to rules over their mail (objections only on the dashboard or the Primitive CLI). Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, and the objections to rules they wrote, under their current membership, each naming the member who asked or objected in created_through. A key, an app or an agent has none, and gets both kinds in withheld. With relation=concerning it lists instead what other members did that concerns the person's own mail: each time a rule started covering one of their mailboxes or saved a new version while covering it, named as the rule was then, naming its author in created_through, under their current membership; only on the dashboard or the Primitive CLI. A key, an app or an agent has none, and gets email_rule_coverage in withheld. A notice never reads as ended.
+*/
+const listActivityObjects = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/activity/objects",
+	...options
+});
+/**
+* Read the column catalog
+*
+* What a rule tree you write yourself can say: each column of the current vocabulary with its type, source, meaning, operators and the value each takes, options, and whether it takes min_confidence; and the tree's limits, its stored size included. Built from the checks a saved or tested tree must pass. A tree is {version: tree_version, vocabulary: version, when, questions}. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
+*/
+const getEmailRuleVocabulary = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rules/vocabulary",
+	...options
+});
+/**
 * Compile a rule description
 *
-* Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to three yes/no questions, asked about an email only after its conditions match. Nothing is saved. The SQL the rule renders to is returned only when include_sql is true. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Turns a plain-English description of which received emails to match into a rule tree over the column contract, with an explanation of what it matches, the assumptions made, and warnings for what the columns cannot express. Where the columns fall short it adds up to five yes/no questions, asked only after the conditions match; they read the subject, the new text and attachment file names, never attachment contents. Nothing is saved. For a rule with no questions, breadth counts, read only, how much of your recent classified mail its conditions match. include_sql returns the SQL it renders to. kind do_not_share compiles for recall. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const compileEmailRule = (options) => (options.client ?? client).post({
 	security: [{
@@ -3594,7 +3652,7 @@ const compileEmailRule = (options) => (options.client ?? client).post({
 /**
 * Test a rule against received mail
 *
-* Runs a rule over received mail and reports what it would decide for each email: matched, near_miss, no_match, unclassified or not_found. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version, run with its author's access). Either way the rule reads only mail its author can read. Without email_ids, the newest emails it can read are tested, at most 200 and none older than 30 days. Emails not classified yet that arrived more than 2 hours ago are classified first and their classification is saved, unless classify_missing is false; newer ones are left to normal classification and reported unclassified with reason pending. The rule itself records nothing and grants nothing. Classification and the rule's own questions stop at about 90 seconds; run the test again to continue where it stopped. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Runs a rule over received mail and reports what it would decide for each email (matched, near_miss, no_match, unclassified, skipped or not_found), with a summary of how each top-level condition and question decided. Test an unsaved tree, or a saved rule by rule_id (its current version, as its author). It reads only mail its author can read and its scope covers. Without email_ids it tests the newest emails, at most 200 and none older than 30 days, plus any expected ones. Unclassified emails over 2 hours old are classified first unless classify_missing is false. It records no decision and grants nothing, and stops at about 90 seconds. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const testEmailRule = (options) => (options.client ?? client).post({
 	security: [{
@@ -3609,9 +3667,26 @@ const testEmailRule = (options) => (options.client ?? client).post({
 	}
 });
 /**
+* Write look-alike emails a rule should or should not match
+*
+* Writes made-up emails that come close to what a grant rule describes, and reports what the rule decides for each, as test-sample would. Most should not match (expected no_match): business near misses from its senders and topic (kind other: an all-clear, a reply with nothing new, a related document, another subject) and private mail (a personal medical bill, pay for named people, a personal purchase, personal banking or tax). By default a third, rounded down, are near cases it should match (expected match, kind other). failed means the rule decided one against expected. Nothing is stored and no mail is read. Keep them, with their expected, with add_expectation_samples, or for a request with the accept's expectation_samples. Limited to 20 an hour per member. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
+*/
+const generateLookAlikes = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rules/look-alikes",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
 * Test a rule against a made-up email
 *
-* Reports what a rule would decide for an email you describe: its sender, recipients, subject, plain text and attachment types, and optionally whether it is automated or from a mailing list and its spam score. The email is classified the way received mail is, and the rule's conditions and its own questions are decided as they would be for received mail with that content and those signals, received now. Without them it is not automated and not from a mailing list; a rule that reads a spam score you gave none for is decided on no score, and spam_score is listed in unset_columns. Nothing is stored: no email, classification or decision. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version). The answer includes what the classifier read from the email. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Reports what a rule would decide for an email you describe (sender, recipients, subject, plain text, attachment types; optionally automated, from a mailing list, and a spam score), classified and decided as received mail would be. A rule reading a spam score you gave none for decides on none (unset_columns). Nothing is stored. Test an unsaved tree or a saved rule by rule_id. The answer includes what the classifier read. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const testEmailRuleOnSample = (options) => (options.client ?? client).post({
 	security: [{
@@ -3628,7 +3703,7 @@ const testEmailRuleOnSample = (options) => (options.client ?? client).post({
 /**
 * List rules
 *
-* The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. With matched_email_id, only the rules that matched that email. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. Each carries its scope (evaluation_scope, and scope_selection for a selected rule) and current_version, but not the version's text: read that under current from GET /email-rules/{id}. With matched_email_id, only the rules that matched that email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRules = (options) => (options?.client ?? client).get({
 	security: [{
@@ -3641,7 +3716,7 @@ const listEmailRules = (options) => (options?.client ?? client).get({
 /**
 * Create a rule
 *
-* Saves a rule as version 1, from a compile response or a tree you wrote. The tree is checked against the column contract. New rules start in observe, where what the rule matches is recorded and nothing is granted; draft is not evaluated. The caller is the rule's author, and the rule never reaches mail the author cannot read. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Saves a rule as version 1 from a compile response or a tree you wrote, checked against the column contract. It starts in observe (recorded, nothing granted or blocked) unless state is draft, or active for a do_not_share rule. You are its author, and it never reaches mail you cannot read. evaluation_scope is own_mailboxes unless you name author or selected (scope_selection names only what you can read). expectations are judged in expectations_check. kind do_not_share blocks sharing what it matches; a key cannot list it (details.reason rule_blocks_sharing). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const createEmailRule = (options) => (options.client ?? client).post({
 	security: [{
@@ -3658,7 +3733,7 @@ const createEmailRule = (options) => (options.client ?? client).post({
 /**
 * Delete a rule
 *
-* Deletes a rule with its versions, its decisions and the access it granted. The author, or a caller who reads the whole organization's mail, may delete it; while it is shared with another member, only the author or someone who manages members from the dashboard. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Deletes a rule with its versions, its decisions and the access it granted. A share of it ends (end_reason rule_deleted), and the member who shared can still list what it handed over. The answer lists the shares it ended (ended_shares) and the unrevoked keys that still list it, which now read nothing through it (keys, other_keys; left out when they could not be read). The author or a reader of all the organization's mail may delete it; while it is shared, only the author or someone who manages members from the dashboard. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const deleteEmailRule = (options) => (options.client ?? client).delete({
 	security: [{
@@ -3671,7 +3746,7 @@ const deleteEmailRule = (options) => (options.client ?? client).delete({
 /**
 * Read a rule
 *
-* A rule and its current version. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* A rule, its scope (evaluation_scope, and scope_selection for a selected rule), its current version and its saved expectations. The current version's text (english, tree, explanation, assumptions, warnings) is under current, and current_version is its number. What the scope comes to for its author now is GET /email-rules/{id}/scope. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const getEmailRule = (options) => (options.client ?? client).get({
 	security: [{
@@ -3684,7 +3759,7 @@ const getEmailRule = (options) => (options.client ?? client).get({
 /**
 * Change a rule
 *
-* Renames the rule, saves a new version (english, tree and explanation together; earlier versions are kept unchanged) or changes its state: draft (disabled), observe or active. Only the rule's author may rename it, add a version or move it to observe or active; anyone else who can see it may only disable it (state draft), and while it is shared with another member only if they manage members from the dashboard. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Renames the rule, saves a new version (english and tree together; earlier versions stay) or restores one (restore_version), changes its state (draft is off; observe; active), its scope (evaluation_scope, with scope_selection when selected) or its saved expectations (judged in expectations_check). Anyone but its author who sees it may only set state draft, and while it is shared only if they manage members from the dashboard. A scope change saves a new version; a shared rule keeps its scope, and a kind never changes. A saved version takes effect at once. if_version refuses a write once a version was saved since you read it; if_revision, once anything changed. Without if_expectations_pass a version is saved even when its expectations fail. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const updateEmailRule = (options) => (options.client ?? client).patch({
 	security: [{
@@ -3701,7 +3776,7 @@ const updateEmailRule = (options) => (options.client ?? client).patch({
 /**
 * List a rule's decisions
 *
-* What the rule decided for each email it was evaluated against, newest first: whether it matched, whether it nearly did, how each part decided and the answers to its questions. Only decisions on emails the caller can read are listed. With matched, only matches (true) or only the rest (false). Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* What the rule decided for each email it was evaluated against, newest first: whether it matched, whether it nearly did, how each part decided and the answers to its questions, with which email it was (from_address, subject, received_at). Only decisions on emails the caller can read are listed. With matched, only matches (true) or only the rest (false). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRuleDecisions = (options) => (options.client ?? client).get({
 	security: [{
@@ -3712,9 +3787,61 @@ const listEmailRuleDecisions = (options) => (options.client ?? client).get({
 	...options
 });
 /**
+* List every rule's result on an email
+*
+* What each rule you can see decided about this email (matched, not matched, or not run), in the words of the deciding version. A do_not_share rule that matched it blocks sharing while active; earlier shares stay. Only a caller who can read the email gets an answer. classification is every fact the classifier read, as rule conditions read it. At most 50 rules are listed, results first; not_listed counts the rest. Another member's rule that decided on your own mail is listed read_only (dashboard and CLI only), with who receives what it shares (receivers) while it covers you; hidden counts deciding rules you cannot see. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
+*/
+const listEmailRuleResults = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/emails/{id}/rule-results",
+	...options
+});
+/**
+* Read versions of a rule
+*
+* A rule's versions as they were written: what each one's conditions and questions were, so a decision can be read against the version that made it. Without versions, every version newest first, a page at a time (meta.cursor). With versions, only those named, oldest first; numbers that are not versions of the rule are left out. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
+*/
+const listEmailRuleVersions = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rules/{id}/versions",
+	...options
+});
+/**
+* Read what a rule covers
+*
+* Whose mail the rule runs over, and what that comes to now: a rule never reaches further than what its author can read when it runs, so what a selected rule names and its author can no longer read stops matching. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
+*/
+const getEmailRuleScope = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rules/{id}/scope",
+	...options
+});
+/**
+* List what a rule can cover
+*
+* How much the caller can read, and the inboxes and domains the caller can read, which is what they may name when a rule runs over selected inboxes and domains. For a caller who reads the whole organization, addresses lists the inboxes known as someone's (member addresses, members' verified work emails at the organization's domains, agents' addresses and inboxes with shared access), not every address that receives mail: may_name_unlisted says when an address that is not listed, such as an inbox nobody has claimed, may be named too. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
+*/
+const listEmailRuleScopeOptions = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rule-scope-options",
+	...options
+});
+/**
 * List rule requests
 *
-* Rule requests, newest first: those made to you (box incoming, the default), those you made (outgoing), or every one you can see (all). Pending ones by default; status decided lists accepted, declined and withdrawn ones, and any lists both. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Rule requests, newest first: those made to you (box incoming, the default), those you made (outgoing), or every one you can see (all). Pending ones by default; status decided lists accepted, declined and withdrawn ones, and any lists both. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRuleRequests = (options) => (options?.client ?? client).get({
 	security: [{
@@ -3727,7 +3854,7 @@ const listEmailRuleRequests = (options) => (options?.client ?? client).get({
 /**
 * Ask a member for a rule
 *
-* Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address (at most 30 lookups by address an hour). Nothing is evaluated and nothing is shared until they accept, and they may change the rule first; they see the request and can preview what it matches in their own mail. You may have at most 5 pending requests to one member and 50 in all. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated or shared until they accept, and they may change the rule first. A message (up to 500 characters, fixed once sent) tells them why you ask. At most 5 pending requests to one member and 50 in all. With members:read the answer says whether they can accept it under their role (target_can_accept, target_warning); POST /v1/email-rule-requests/target-check checks first. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const createEmailRuleRequest = (options) => (options.client ?? client).post({
 	security: [{
@@ -3742,9 +3869,39 @@ const createEmailRuleRequest = (options) => (options.client ?? client).post({
 	}
 });
 /**
+* Check whether a member can accept a rule request
+*
+* Says, before you ask, whether a member could accept a rule request now under their role, and if not, which permission their role lacks. Nothing is sent and nothing is recorded. Needs members:read, as listing members and their roles does. At most 60 checks an hour. Name them by user id, or by their member mailbox address or verified work email (counted with asking: at most 30 lookups by address an hour). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
+*/
+const checkEmailRuleRequestTarget = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rule-requests/target-check",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Delete a withdrawn rule request
+*
+* Deletes a request you withdrew, for everyone who could see it. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
+*/
+const deleteEmailRuleRequest = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rule-requests/{id}",
+	...options
+});
+/**
 * Read a rule request
 *
-* A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. If you are the member asked, you can try the rule as proposed before answering: pass the request's tree to POST /v1/email-rules/test to test it on mail you have received. To try it on an email that has not arrived, pass the request's tree to POST /v1/email-rules/test-sample with one you make up, or have look-alikes written (POST /v1/email-rules/look-alikes with request_id); neither stores anything. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const getEmailRuleRequest = (options) => (options.client ?? client).get({
 	security: [{
@@ -3757,7 +3914,7 @@ const getEmailRuleRequest = (options) => (options.client ?? client).get({
 /**
 * Decline a rule request
 *
-* Declines a pending request made to you. Nothing is written but the decision. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Declines a pending request made to you. Nothing is written but the decision and, if you give one, its reason (reason, up to 500 characters), which the member who asked sees with the request. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const declineEmailRuleRequest = (options) => (options.client ?? client).post({
 	security: [{
@@ -3765,12 +3922,16 @@ const declineEmailRuleRequest = (options) => (options.client ?? client).post({
 		type: "http"
 	}],
 	url: "/email-rule-requests/{id}/decline",
-	...options
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
 });
 /**
 * Withdraw a rule request
 *
-* Withdraws a pending request you made. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Withdraws a pending request you made. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const withdrawEmailRuleRequest = (options) => (options.client ?? client).post({
 	security: [{
@@ -3783,7 +3944,7 @@ const withdrawEmailRuleRequest = (options) => (options.client ?? client).post({
 /**
 * Accept a rule request
 *
-* Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked. Send no body to accept it as asked, or change it first with english, tree and explanation together. Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Also needs mail:send_as_member: a role that can only read this mailbox is refused. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked: each email in full with its attachments, but never raw. It does not go back through mail already received. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Before accepting, test it on your mail: pass the request's tree to POST /v1/email-rules/test. To try it on an email that has not arrived, pass the request's tree to POST /v1/email-rules/test-sample with one you make up, or have look-alikes written (POST /v1/email-rules/look-alikes with request_id); neither stores anything. expectation_samples are kept on the rule it writes. Accepting also needs mail:share_own. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const acceptEmailRuleRequest = (options) => (options.client ?? client).post({
 	security: [{
@@ -3800,7 +3961,7 @@ const acceptEmailRuleRequest = (options) => (options.client ?? client).post({
 /**
 * List rule shares
 *
-* Lists rules shared with you, rules you share, or every share you can see. A share is visible to its two people and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Lists rules shared with you, rules you share, or every share you can see. A share is visible to its two people and the organization's owners and admins. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRuleShares = (options) => (options?.client ?? client).get({
 	security: [{
@@ -3826,7 +3987,7 @@ const listGivenEmailRuleShares = (options) => (options?.client ?? client).get({
 /**
 * End a rule share
 *
-* Stops sharing. Either person on the share can do this, or an owner or admin who manages members. The share is kept, marked as ended. This needs no mail access and does not depend on the email rules feature. An owner or admin not on the share must use a dashboard session. Otherwise use your own session, or an OAuth or CLI token that acts with your full access: API keys and agent keys are refused.
+* Stops sharing; the rule itself is left unchanged, as the answer's note says. Either person on the share can do this, or an owner or admin who manages members. The share is kept, marked as ended. This needs no mail access and does not depend on the email rules feature. An owner or admin not on the share must use a dashboard session. Otherwise use your own session, or an OAuth or CLI token that acts with your full access: API keys and agent keys are refused.
 */
 const endEmailRuleShare = (options) => (options.client ?? client).delete({
 	security: [{
@@ -3839,7 +4000,7 @@ const endEmailRuleShare = (options) => (options.client ?? client).delete({
 /**
 * Get a rule share
 *
-* One share. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* One share. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const getEmailRuleShare = (options) => (options.client ?? client).get({
 	security: [{
@@ -3850,9 +4011,9 @@ const getEmailRuleShare = (options) => (options.client ?? client).get({
 	...options
 });
 /**
-* List the emails a rule share has given you
+* List the emails a rule share has given
 *
-* The emails a rule shared with you has matched, newest first, as the email list shows them. Only the person it was shared with can list them, from the dashboard or the Primitive CLI. An ended share lists nothing. A page can be short or empty and still carry a cursor: keep reading until meta.cursor is null.
+* The emails a rule share has given, newest first, as the email list shows them, each with shared_at. For the person it was shared with: what they can read through it now, so an ended share lists nothing, and shared_at is when the share's rule first matched the email. For the person sharing their mail: everything it has handed over while it ran, including after it ended and whatever the rule's state now, so they can see what left their mailbox, and shared_at is when it was handed over. Only those two people can list them, from the dashboard or the Primitive CLI. A page can be short or empty and still carry a cursor: keep reading until meta.cursor is null.
 */
 const listEmailRuleShareEmails = (options) => (options.client ?? client).get({
 	security: [{
@@ -3863,6 +4024,131 @@ const listEmailRuleShareEmails = (options) => (options.client ?? client).get({
 	...options
 });
 /**
+* List the rules over your mail
+*
+* Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, and the member each belongs to, or the organization. You do not see which keys, webhooks or shares they are (no ids, names, prefixes or URLs), the other inboxes and domains its scope names, or its saved expectations. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.
+*/
+const listEmailRulesCoveringMe = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rules/covering-me",
+	...options
+});
+/**
+* Get a rule over your mail
+*
+* One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, and the member each belongs to, or the organization. You do not see which keys, webhooks or shares they are (no ids, names, prefixes or URLs), the other inboxes and domains its scope names, or its saved expectations. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.
+*/
+const getEmailRuleCoveringMe = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rules/covering-me/{id}",
+	...options
+});
+/**
+* List what a rule decided about your mail
+*
+* What a rule that covers your mailboxes, or decided on your mail, decided about mail at your own mailboxes, newest first: never about anyone else's mail. Each decision is in the words of the version that made it, which can be earlier than the current one: the questions it asked about that email (question_answers) and the columns its conditions read (parts). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.
+*/
+const listEmailRuleDecisionsOnMyMail = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rules/covering-me/{id}/decisions",
+	...options
+});
+/**
+* List objections
+*
+* Objections you made, objections to rules you wrote, or every objection you can see, newest first. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.
+*/
+const listEmailRuleObjections = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rule-objections",
+	...options
+});
+/**
+* Object to a rule over your mail
+*
+* Asks the author of a rule that covers one of your own mailboxes now to turn it off. Only a rule that covers you now: one you see only because it once decided on your mail cannot be objected to. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. You may have one pending objection per rule and 50 in all, and object to the same rule again only 10 minutes after you last did, whatever became of it. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.
+*/
+const createEmailRuleObjection = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rule-objections",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Get an objection
+*
+* One objection you can see. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.
+*/
+const getEmailRuleObjection = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rule-objections/{id}",
+	...options
+});
+/**
+* Withdraw an objection
+*
+* Withdraws a pending objection you made, and clears its message. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.
+*/
+const withdrawEmailRuleObjection = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rule-objections/{id}/withdraw",
+	...options
+});
+/**
+* Decline an objection to your rule
+*
+* Declines a pending objection to a rule you wrote, optionally saying why; the rule stays as it is. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.
+*/
+const declineEmailRuleObjection = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rule-objections/{id}/decline",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Accept an objection to your rule
+*
+* Accepts a pending objection to a rule you wrote: turns the rule off (state draft), as updating it would, and records the objection accepted, together. You can turn the rule on again later. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.
+*/
+const acceptEmailRuleObjection = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rule-objections/{id}/accept",
+	...options
+});
+/**
 * Get a domain's Agent Authorization status
 *
 * Whether the domain publishes an Agent Authorization (`_agents`) TXT record that lets agents on Primitive email it, read from DNS with the same engine the send path uses (an answer may be up to five minutes old): published (a record authorizes them), published_unauthorized (a record exists but does not), not_set_up (no record, the default) or inconclusive (the lookup could not tell; retry). The domain is one of the organization's, verified or pending; a credential confined to some mailboxes sees only the domains its scope covers. Needs domains:read.
@@ -4077,6 +4363,19 @@ const getOwnGrant = (options) => (options?.client ?? client).get({
 	...options
 });
 /**
+* List the addresses this credential can send from
+*
+* The From addresses the calling credential may send from with POST /send-mail, and the one a send that names no From should use. Every address listed is one that send would accept as From for this credential, recipients aside. A connected agent's default is its own address. A person's default is their own member address, for a session and for every OAuth login of theirs, an agent's included. Any other credential has a default only when exactly one address and no domain is listed, and never a person's own member address. When there is no default, `reason` says why. `domains` lists the domains at which the credential may send from any address that is not reserved to someone else or left out of its grant; each is one GET /outbound/status lists as sendable for it. A credential that cannot send new mail, or one in an account where outbound mail is not enabled, gets no addresses and no domains. Every credential may ask about itself, a connected agent's key included, except a Function-bound key limited to its Function's own operations (403 function_scope_forbidden). It answers nothing about any other credential.
+*/
+const getSendFrom = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/whoami/send-from",
+	...options
+});
+/**
 * List consumer Inbox routing rules
 *
 * Mailbox-scoped exact visible audiences, excluding the owner and Bcc. Direct and group audiences are independent. Restores persist an explicit Conversations rule. New writes require the observed version (zero creates); only an identical latest mutation with its original expected version can be retried. Stale writes return mail_routing_conflict. Source messages and read state are unchanged. Merge paged rules by version; responses are never cached.
@@ -4269,7 +4568,7 @@ const listFunctionActivity = (options) => (options.client ?? client).get({
 /**
 * List a function's invocations
 *
-* Each run of the function, newest first, with its outcome, timings, response status and exception. Lists runs only: a webhook delivery that never reached the function (for example one refused before it ran) is not an invocation; find those with listDeliveries.
+* Each run of the function, newest first, with its outcome, timings, response status and exception. Lists runs only: a webhook delivery that never reached the function (for example one refused before it ran) is not an invocation; find those with listDeliveries and its endpoint_id filter.
 */
 const listFunctionInvocations = (options) => (options.client ?? client).get({
 	security: [{
@@ -4419,7 +4718,7 @@ const checkSendability = (options) => (options.client ?? client).post({
 /**
 * Get a webhook delivery
 *
-* One webhook delivery attempt record, by the id listDeliveries returns.
+* One webhook delivery attempt record, by the id listDeliveries returns, with every attempt of the same delivery (a retry is recorded as a new attempt with its own id).
 */
 const getDelivery = (options) => (options.client ?? client).get({
 	security: [{
@@ -4467,7 +4766,7 @@ const revokeOrganizationInvitation = (options) => (options.client ?? client).del
 	...options
 });
 /**
-* Requires a current human organization membership, or an org-wide API key: a super admin key, or a custom key with no addresses or domains whose grant holds members:read. A key lists members as the person it belongs to, at that person's live grant, and only while that person still holds members:read. Narrowed, Function and connected keys are refused. No local paths or existing conversation history are shared.
+* Requires a current human organization membership, or an org-wide API key: a super admin key, or a custom key with no addresses or domains whose grant holds members:read. A key lists members as the person it belongs to, at that person's live grant, and only while that person still holds members:read. Narrowed, Function and connected keys are refused. A caller holding members:read also gets each person's mail_access. No local paths or existing conversation history are shared.
 */
 const listOrganizationPeople = (options) => (options?.client ?? client).get({
 	security: [{
@@ -4580,7 +4879,7 @@ const revokeProjectInvitation = (options) => (options.client ?? client).delete({
 /**
 * List mailbox access
 *
-* Every access entry in the organization: who (a member, group, agent or address) may read, draft or send for each mailbox or domain. An entry that reads a mailbox reads the full email; raw MIME follows the person's mail.raw:read. `depth` is deprecated: it is accepted and ignored, and new entries record content. Needs members:read: a person, or an org-wide API key whose person holds it.
+* Every access entry in the organization: who (a member, group, agent or address) may read, draft or send for each mailbox or domain. An entry that reads a mailbox reads the full email; raw MIME follows the person's mail.raw:read. `depth` is deprecated: it is accepted and ignored, and new entries record content. With no entries, `note` says where each member's mail access comes from instead. Needs members:read: a person, or an org-wide API key whose person holds it.
 */
 const listMailboxAccess = (options) => (options?.client ?? client).get({
 	security: [{
@@ -4670,7 +4969,7 @@ const updateGroup = (options) => (options.client ?? client).patch({
 /**
 * List every credential
 *
-* Every credential that can act in the organization: API keys, Function keys, agent connection keys, connected apps (OAuth), agent delegates and, where enabled, CLI logins. Secrets are never returned. Filter with kind. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* Every credential that can act in the organization: API keys, Function keys, agent connection keys, connected apps (OAuth), agent delegates and, where enabled, CLI logins. Secrets are never returned. A key's grant.mail_scope.depth is raw only when it holds mail.raw:read and its scope lists an address or a domain, otherwise content. A rule the key lists that reads nothing any more (a deleted rule, or a share that ended) is listed under grant.mail_scope.ended_rules, each with its id and reason (rule_deleted or share_ended), and not under rules. Filter with kind. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.
 */
@@ -4685,9 +4984,9 @@ const listCredentials = (options) => (options?.client ?? client).get({
 /**
 * Revoke a credential
 *
-* Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up keeps working and is listed in standing_objects for review. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked by the person who holds it, whatever it reaches, or by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. Revoking an API key also revokes the keys it replaced in its rotation that are still in their overlap and that you may revoke (predecessors_revoked_count; predecessors_left counts the rest), so its webhooks stop at once; the keys that replaced it carry its work on. Revoking a key already revoked does the same for those keys. What the credential set up or owns is listed in standing_objects for review, and for an API key also what it carries on for the keys it was rotated from, each saying whether anything still acts for it (still_acting, with the key in acting_key_id) and, for a webhook, whether it is still delivering. An organization-owned object (org_owned true) keeps working; any other keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to, except that a block filter an app made keeps blocking, within the reach the app had, unless the person revoking chose to stop it. An API key (kind org_key or connected_key) that is already revoked, and whose record is kept, answers 200 with already_revoked true, to a caller who could have revoked it, and revoked counts only the keys it replaced that were revoked now; anyone else gets the answer they would get for a key that does not exist. The person's own Primitive CLI login revokes an API key (kind org_key) as the person, with no step-up unless the organization's credential policy sets cli_writes_require_approval (then it takes a keys.create step-up); every other kind (a connected key named as org_key included, 403 grant_forbidden target_not_covered), and every other app even with a step-up, is refused outside the dashboard (403). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
-* Person only: a dashboard session. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.
+* Person only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.
 */
 const revokeCredential = (options) => (options.client ?? client).post({
 	security: [{
@@ -4704,7 +5003,7 @@ const revokeCredential = (options) => (options.client ?? client).post({
 /**
 * Revoke every credential (emergency)
 *
-* The emergency response to a leak: revokes every API key, agent connection key and connected app created since a time, rotates the organization Function key and every running Function's own key, and optionally suspends Functions. Owners only, from a dashboard session, and the body must confirm with "revoke all". Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* The emergency response to a leak: revokes every API key, agent connection key and connected app created since a time, rotates the organization Function key and every running Function's own key, and optionally suspends Functions. Owners only, from a dashboard session, and the body must confirm with "revoke all". Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credentials:revoke_all. API keys, agent connection keys and agents are refused.
 */
@@ -4723,7 +5022,7 @@ const revokeAllCredentials = (options) => (options.client ?? client).post({
 /**
 * Read the credential audit trail
 *
-* Credential events (created, rotated, edited, revoked, used with a step-up, policy changes), newest first, with a cursor. format=csv returns the same page as CSV. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* Credential events (created, rotated, edited, revoked, used with a step-up, policy changes), newest first, with a cursor. format=csv returns the same page as CSV. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credential_events:read. API keys, agent connection keys and agents are refused.
 */
@@ -4738,7 +5037,7 @@ const listCredentialEvents = (options) => (options?.client ?? client).get({
 /**
 * Read the credential policy
 *
-* The organization credential policy: key lifetime and expiry rules, who may create super admin keys, whether members may create keys and the other rules every new key is held to. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* The organization credential policy: key lifetime and expiry rules, who may create super admin keys, whether members may create keys and the other rules every new key is held to. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.
 */
@@ -4753,7 +5052,7 @@ const getCredentialPolicy = (options) => (options?.client ?? client).get({
 /**
 * Change the credential policy
 *
-* Change one or more policy rules. Admins may only tighten the policy; loosening any rule needs an owner. Owners and admins are emailed about every change. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* Change one or more policy rules. Admins may only tighten the policy; loosening any rule needs an owner. Owners and admins are emailed about every change. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credential_policy:manage. API keys, agent connection keys and agents are refused.
 */
@@ -4772,7 +5071,7 @@ const updateCredentialPolicy = (options) => (options.client ?? client).patch({
 /**
 * Read the key builder
 *
-* The key presets the caller may use (each with whether it is available and why not), the permission matrix for custom keys and the policy in force. An area marked org_wide_only (Members) is listed only to a person who holds its permission, and only a custom key with no addresses or domains may hold it. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* The key presets the caller may use (each with whether it is available and why not), the permission matrix for custom keys and the policy in force. An area marked org_wide_only (Members) is listed only to a person who holds its permission, and only a custom key with no addresses or domains may hold it. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.
 */
@@ -4787,7 +5086,7 @@ const getKeyBuilder = (options) => (options?.client ?? client).get({
 /**
 * List API keys
 *
-* Key metadata, never a secret: name, prefix, grant, creator, last use, expiry and suspension. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* Key metadata, never a secret: name, prefix, grant, creator, last use, expiry, suspension and whether each key works now (status). Revoked keys are left out unless include_revoked is true, which lists them too with status revoked, revoked_at and revoked_by, under the same access rules as keys that work. A grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. A rule the key lists that reads nothing any more (a deleted rule, or a share that ended) is listed under grant.mail_scope.ended_rules, each with its id and reason (rule_deleted or share_ended), and not under rules. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.
 */
@@ -4802,9 +5101,9 @@ const listKeys = (options) => (options?.client ?? client).get({
 /**
 * Create an API key
 *
-* Create an API key, super admin or narrowed to a preset or a custom permission set, optionally with an expiry and conditions. The secret is returned once. A key never holds more than the person creating it; the credential policy decides who may create which keys. grant is required: a request without it is refused (400 validation_error, details.reason grant_required), never treated as super admin. A custom key must say which mail it reaches: the addresses and domains it lists (grant.addresses, grant.domains), or every mailbox in the organization with grant.mail_scope "org", which cannot be combined with them; one that says neither is refused (400 validation_error, details.reason mail_scope_required). Super admin, Send only and Read only reach every mailbox by definition. members:read is only for an org-wide custom key: naming it with grant.addresses or grant.domains is refused (400). Owners and admins are emailed about every super admin key. Send an Idempotency-Key to retry safely: a second create by the same person under the same key makes no second key and is refused (409 idempotency_key_reused) with the first key's id in error.details.key_id, so a caller whose first answer was lost can revoke that key. The onboarding field is for the dashboard only. The Primitive CLI's token is refused, even with a step-up: keys are created in the dashboard or by an app the person connected. While the organization's keys API is not enabled, this answers 404 feature_disabled, except that a dashboard session may still create a super admin key (the dashboard's own create).
+* Create an API key, super admin or narrowed to a preset or a custom permission set, optionally with an expiry and conditions. The secret is returned once. A key never holds more than the person creating it; the credential policy decides who may create which keys. grant is required: a request without it is refused (400 validation_error, details.reason grant_required), never treated as super admin. A custom key must say which mail it reaches: the addresses and domains it lists (grant.addresses, grant.domains), or every mailbox in the organization with grant.mail_scope "org", which cannot be combined with them; one that says neither is refused (400 validation_error, details.reason mail_scope_required). Super admin, Send only and Read only reach every mailbox by definition. members:read is only for an org-wide custom key: naming it with grant.addresses or grant.domains is refused (400). Owners and admins are emailed about every super admin key. Send an Idempotency-Key to retry safely: a second create by the same person under the same key makes no second key and is refused (409 idempotency_key_reused) with the first key's id in error.details.key_id, so a caller whose first answer was lost can revoke that key. The onboarding field is for the dashboard only. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. While the organization's keys API is not enabled, this answers 404 feature_disabled (details.feature keys_api; contact Primitive to turn it on), except that a dashboard session may still create a super admin key (the dashboard's own create).
 *
-* Person only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
+* Person only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
 */
 const createKey = (options) => (options.client ?? client).post({
 	security: [{
@@ -4821,9 +5120,9 @@ const createKey = (options) => (options.client ?? client).post({
 /**
 * Rotate an API key
 *
-* Mint a successor with the same grant and return its secret once. The old key keeps working for overlap_seconds, then stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner created is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The Primitive CLI's token is refused, even with a step-up. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Revoking the successor during the overlap also revokes the old key when you may revoke that one too; the revoke's predecessors_left counts any left working. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
-* Person only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
+* Person only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
 */
 const rotateKey = (options) => (options.client ?? client).post({
 	security: [{
@@ -4840,7 +5139,7 @@ const rotateKey = (options) => (options.client ?? client).post({
 /**
 * Get an API key
 *
-* One key's metadata, never its secret. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* One key's metadata, never its secret, with whether it works now (status). A revoked key whose record is kept is answered too, with status revoked, revoked_at and revoked_by, under the same access rules as a key that works: one the caller may not read is 404, revoked or not. Its grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. A rule the key lists that reads nothing any more (a deleted rule, or a share that ended) is listed under grant.mail_scope.ended_rules, each with its id and reason (rule_deleted or share_ended), and not under rules. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.
 */
@@ -4855,9 +5154,9 @@ const getKey = (options) => (options.client ?? client).get({
 /**
 * Change an API key
 *
-* Rename a key, change its expiry, its grant or its conditions, or suspend it. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. The Primitive CLI's token is refused, even with a step-up. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* Rename a key, change its expiry, its grant or its conditions, or suspend it. A later expires_at extends the key, which is how to keep a key working past its expiry (rotating keeps it, unless the rotation gives the new key an expires_at): it is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and like any loosening needs the person to be allowed to create a key with the key's access. An expired key's expiry cannot be changed (409 conflict, details.reason key_expired); make a new key instead. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. The one exception is suspending a key (suspended true with no other change; expected_grant_ref may accompany it), which the person who holds it may do whatever the key reaches, calling as themself rather than through another app; lifting a suspension is a change like any other. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. It replaces the whole grant: send expected_grant_ref (grant.ref from GET /v1/keys/{id}) to have it refused (409 conflict, details.reason grant_changed) if the grant changed since that read; a grant change sent without it answers grant_unguarded: true. On a key limited to selected resources (grant.resources), a grant change must drop the limits on purpose with a custom grant and grant.resources {}; one that leaves them out is refused (409 conflict, details.reason key_has_resource_limits) and nothing changes. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
-* Person only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
+* Person only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
 */
 const updateKey = (options) => (options.client ?? client).patch({
 	security: [{
@@ -4874,7 +5173,7 @@ const updateKey = (options) => (options.client ?? client).patch({
 /**
 * Suggest a least-privilege grant for a key
 *
-* The permissions a key used over the last 30 days, as a custom grant that would have served every successful call (also as builder areas), the narrowest mail scope its calls support (depth is deprecated: raw when it downloaded raw MIME, otherwise content) (the mailboxes of the messages it named and sent, with notes on what the request log cannot account for), and whether it is unused. Calls to routes only the super admin key can use (groups and mailbox access) derive no permission, since a custom key is refused there; super_admin_only_calls counts them. usage gives the same window anonymized: successful and failed requests per UTC day, the routes called by their declared template (never the called path) with the permission each needed, and how many mailboxes the key read and sent from (counts only, and only for a person with access to the whole organization's mail). Nothing is applied: narrowing is a change to the key (PATCH /v1/keys/:id). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* The permissions a key used over the last 30 days, as a custom grant that would have served every successful call (also as builder areas), the narrowest mail scope its calls support (depth is deprecated: raw when it downloaded raw MIME, otherwise content) (the mailboxes of the messages it named and sent, with notes on what the request log cannot account for), and whether it is unused. Calls to routes only the super admin key can use (groups and mailbox access) derive no permission, since a custom key is refused there; super_admin_only_calls counts them. usage gives the same window anonymized: successful and failed requests per UTC day, the routes called by their declared template (never the called path) with the permission each needed, and how many mailboxes the key read and sent from (counts only, and only for a person with access to the whole organization's mail). Nothing is applied: narrowing is a change to the key (PATCH /v1/keys/:id). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.
 */
@@ -5055,7 +5354,7 @@ const updateSearchSettings = (options) => (options.client ?? client).put({
 /**
 * List roles
 *
-* Every role in the organization (built-in, template copies and custom roles), with how many members and groups hold each, the templates not yet copied, and whether roles can be assigned now. Any person (a session or OAuth token); API keys are refused.
+* Every role in the organization (built-in, template copies and custom roles), with how many members and groups hold each, the templates not yet copied, and whether roles can be assigned now. `unassigned` describes role restricted on a member with no role_id, which is not a role and is never in `roles`. Needs members:read (owners, admins, members and roles that grant it); API keys are refused.
 */
 const listRoles = (options) => (options?.client ?? client).get({
 	security: [{
@@ -5068,7 +5367,7 @@ const listRoles = (options) => (options?.client ?? client).get({
 /**
 * Create a custom role
 *
-* A role nobody can use to gain access they do not hold: its permissions and mail scope must be within the author's own. mail_scope is "org" (the default) or { addresses, domains }; any other value is refused with 400 `validation_error`. Every role that reaches mail reads it in full, and raw MIME follows the role's mail.raw:read; `depth` is deprecated and ignored. Its mail scope names no other member's personal mailbox: otherwise 403 `grant_forbidden` with `details.reason` `personal_mailbox_member_only`. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `roles.write` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs roles:assign. API keys are refused.
+* A role nobody can use to gain access they do not hold: its permissions and mail scope must be within the author's own. mail_scope is "org" (the default) or { addresses, domains }; any other value is refused with 400 `validation_error`. Every role that reaches mail reads it in full, and raw MIME follows the role's mail.raw:read; `depth` is deprecated and ignored. Its mail scope names no other member's personal mailbox: otherwise 403 `grant_forbidden` with `details.reason` `personal_mailbox_member_only`. Each permission must have what it requires in the same role: mail:read for mail.raw:read, mail.search:semantic, mail:share_own, changes:read and webhooks:read; mail:send for mail:send_batch and mail:send_as_member; functions:deploy for templates:install; agent_connections:manage for agent_connections:custom_domains. Otherwise 400 `validation_error` with `details.reason` `unmet_requirement`, `details.permission` and `details.requires`. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `roles.write` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs roles:assign. API keys are refused.
 */
 const createRole = (options) => (options.client ?? client).post({
 	security: [{
@@ -5098,7 +5397,7 @@ const deleteRole = (options) => (options.client ?? client).delete({
 /**
 * Change a custom role
 *
-* A new version of the role, with a new `id`: the version you edited is retired, the response is the new one (same `key`, `version` one higher), and every member and group holding the role moves to it. The old id answers 404 `not_found` from then on, so store the returned `id` (or look the role up by `key` in GET /roles) before editing or assigning it again. Every holder whose access shrinks goes through the reduction path. mail_scope follows the same rules as creating a role; a role whose stored scope cannot be read must be sent a new mail_scope, otherwise 400 `validation_error` with `details.reason` `invalid_mail_scope`.  A personal mailbox the new version adds must be the author's own, and every holder must be the member of each personal mailbox it names: otherwise 403 `grant_forbidden` with `details.reason` `personal_mailbox_member_only`. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `roles.write` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs roles:assign. API keys are refused.
+* A new version of the role, with a new `id`: the version you edited is retired, the response is the new one (same `key`, `version` one higher), and every member and group holding the role moves to it. The old id answers 404 `not_found` from then on, so store the returned `id` (or look the role up by `key` in GET /roles) before editing or assigning it again. Every holder whose access shrinks goes through the reduction path. mail_scope follows the same rules as creating a role; a role whose stored scope cannot be read must be sent a new mail_scope, otherwise 400 `validation_error` with `details.reason` `invalid_mail_scope`.  A personal mailbox the new version adds must be the author's own, and every holder must be the member of each personal mailbox it names: otherwise 403 `grant_forbidden` with `details.reason` `personal_mailbox_member_only`. Each permission in the new version must have what it requires in the same role, as when creating one, including permissions carried over unchanged. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `roles.write` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs roles:assign. API keys are refused.
 */
 const updateRole = (options) => (options.client ?? client).patch({
 	security: [{
@@ -5158,7 +5457,7 @@ const leaveOrganization = (options) => (options?.client ?? client).post({
 /**
 * Get the mailbox access mode
 *
-* Whole-org or delegated mailbox access. Holders of roles:assign also get the preview of a switch (every item that needs a decision, each with the decision_options it takes, worded for what the switch does) and the decisions made, plus notices: member and group domain entries that delegated mode keeps off personal mailboxes, each with how many it leaves out. Notices are informational, never decided, and never hold the switch (notices_truncated past 500, notices_unavailable when they could not be read). In whole-org mode it also lists narrowed_agents: every live agent connection the switch narrows to an own-address key (personal agents of members, and shared agents), informational in the same way (narrowed_agents_truncated past 500, narrowed_agents_unavailable when they could not be read). Any person; API keys are refused.
+* Whole-org or delegated mailbox access. Holders of roles:assign also get the preview of a switch (every item that needs a decision, each with the decision_options it takes, worded for what the switch does) and the decisions made, plus notices: member and group domain entries that delegated mode keeps off personal mailboxes, each with how many it leaves out. Notices are informational, never decided, and never hold the switch (notices_truncated past 500, notices_unavailable when they could not be read). In whole-org mode it also lists narrowed_agents: every live agent connection the switch narrows to an own-address key (personal agents of members, and shared agents), informational in the same way (narrowed_agents_truncated past 500, narrowed_agents_unavailable when they could not be read). Needs members:read (owners, admins, members and roles that grant it); API keys are refused.
 */
 const getAccessMode = (options) => (options?.client ?? client).get({
 	security: [{
@@ -5321,7 +5620,7 @@ const listSuspensions = (options) => (options?.client ?? client).get({
 /**
 * Decide a suspension
 *
-* Keep, narrow or revoke one suspended or flagged item. Keeping it, and revoking an API key, needs the decider to cover it (revoking an uncovered key is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.
+* Keep, narrow or revoke one suspended or flagged item. Keeping it needs the decider to cover it, and so does revoking an API key unless the decider holds it and decides as themself rather than through another app (revoking an uncovered key someone else holds is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. A rule share paused by a role change (`email_rule_share`) takes keep, which leaves it paused, or revoke, which ends the share and needs confirm: true (the person it was shared with loses the emails already shared; without it, 409 `confirmation_required`, as for revoking a filter). Neither of the share's two people may keep it (`grant_forbidden`, `share_decision_forbidden`). Access a person gave on their own mailbox (`mailbox_access`) takes keep or revoke, and both need delegations:manage; revoke removes only what that person gave on that mailbox. Nobody the access reaches, nor the person who gave it, may keep it (`grant_forbidden`, `mailbox_access_decision_forbidden`). Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.
 */
 const decideSuspension = (options) => (options.client ?? client).post({
 	security: [{
@@ -5443,6 +5742,32 @@ const releaseSentEmail = (options) => (options.client ?? client).post({
 	}
 });
 /**
+* Get a webhook's own signing secret
+*
+* The secret deliveries to this webhook are signed with, when it signs with its own (signed_with is own_secret). Verify the Primitive-Signature header with it. A webhook a person owns is given its secret the first time it is asked for. A webhook that signs with the organization's secret answers 409 conflict: rotate its signing secret to give it its own. Answered to the person who owns the webhook; for a webhook an API key owns, to the key that acts for it and the person who holds that key; for one a third-party app or an agent delegate owns, to that app or delegate; and for a webhook the organization owns, to a caller who may change it and holds webhook_secret:read.
+*/
+const getEndpointSigningSecret = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}/signing-secret",
+	...options
+});
+/**
+* Rotate a webhook's signing secret, or give it its own
+*
+* Replaces the webhook's own signing secret, or gives a webhook that signs with the organization's secret one of its own, and returns it. Deliveries are signed with the new secret at once, so update the handler at the same time. Answered to the person who owns the webhook; for a webhook an API key owns, to the key that acts for it and the person who holds that key; for one a third-party app or an agent delegate owns, to that app or delegate; and for a webhook the organization owns, to a caller who may change it and holds webhook_secret:read.
+*/
+const rotateEndpointSigningSecret = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}/signing-secret/rotate",
+	...options
+});
+/**
 * Send a batch of emails in one request
 *
 * Send up to 100 independent messages in a single call. Each message uses the same body schema and the same send path as `POST /send-mail`, so auth, validation, rate limiting, and idempotency apply per message. Messages are processed independently: one failing does not fail the others. Every message gets an entry in `results` carrying either `data` (on success) or `error` (on failure), with the original `index`.
@@ -6879,7 +7204,7 @@ function parseFromHeader(header) {
 		value: { address: address.toLowerCase() }
 	};
 }
-// ../sdk-node/dist/trust-BNsucxtE.js
+// ../sdk-node/dist/understanding-DHr3v7Qh.js
 /**
 * AUTO-GENERATED - DO NOT EDIT
 * Run `pnpm generate:validator` to regenerate.
@@ -7017,9 +7342,12 @@ const schema12 = {
 				},
 				"content": {
 					"type": "object",
-					"if": { "properties": { "raw": { "type": "null" } } },
-					"then": { "properties": { "download": { "type": "null" } } },
-					"else": { "properties": { "download": { "type": "object" } } },
+					"if": { "required": ["raw"] },
+					"then": {
+						"if": { "properties": { "raw": { "type": "null" } } },
+						"then": { "properties": { "download": { "type": "null" } } },
+						"else": { "properties": { "download": { "type": "object" } } }
+					},
 					"properties": {
 						"raw": {
 							"anyOf": [{ "$ref": "#/definitions/RawContent" }, { "type": "null" }],
@@ -15344,13 +15672,11 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 					let valid10 = true;
 					const _errs64 = errors;
 					if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
-						if (data29.raw !== void 0) {
-							if (data29.raw !== null) {
-								const err65 = {};
-								if (vErrors === null) vErrors = [err65];
-								else vErrors.push(err65);
-								errors++;
-							}
+						if (data29.raw === void 0 && "raw") {
+							const err65 = {};
+							if (vErrors === null) vErrors = [err65];
+							else vErrors.push(err65);
+							errors++;
 						}
 					}
 					var _valid0 = _errs64 === errors;
@@ -15359,93 +15685,129 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 						if (_errs63) vErrors.length = _errs63;
 						else vErrors = null;
 					}
-					let ifClause0;
 					if (_valid0) {
+						const _errs65 = errors;
+						const _errs66 = errors;
+						let valid11 = true;
 						const _errs67 = errors;
 						if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
-							if (data29.download !== void 0) {
-								if (data29.download !== null) {
-									const err66 = {
-										instancePath: instancePath + "/email/content/download",
-										schemaPath: "#/properties/email/properties/content/then/properties/download/type",
-										keyword: "type",
-										params: { type: "null" },
-										message: "must be null"
-									};
+							if (data29.raw !== void 0) {
+								if (data29.raw !== null) {
+									const err66 = {};
 									if (vErrors === null) vErrors = [err66];
 									else vErrors.push(err66);
 									errors++;
 								}
 							}
 						}
-						var _valid0 = _errs67 === errors;
-						valid10 = _valid0;
-						ifClause0 = "then";
-					} else {
-						const _errs70 = errors;
-						if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
-							if (data29.download !== void 0) {
-								let data32 = data29.download;
-								if (!(data32 && typeof data32 == "object" && !Array.isArray(data32))) {
-									const err67 = {
-										instancePath: instancePath + "/email/content/download",
-										schemaPath: "#/properties/email/properties/content/else/properties/download/type",
-										keyword: "type",
-										params: { type: "object" },
-										message: "must be object"
-									};
-									if (vErrors === null) vErrors = [err67];
-									else vErrors.push(err67);
-									errors++;
+						var _valid1 = _errs67 === errors;
+						errors = _errs66;
+						if (vErrors !== null) {
+							if (_errs66) vErrors.length = _errs66;
+							else vErrors = null;
+						}
+						let ifClause0;
+						if (_valid1) {
+							const _errs70 = errors;
+							if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
+								if (data29.download !== void 0) {
+									if (data29.download !== null) {
+										const err67 = {
+											instancePath: instancePath + "/email/content/download",
+											schemaPath: "#/properties/email/properties/content/then/then/properties/download/type",
+											keyword: "type",
+											params: { type: "null" },
+											message: "must be null"
+										};
+										if (vErrors === null) vErrors = [err67];
+										else vErrors.push(err67);
+										errors++;
+									}
+								}
+							}
+							var _valid1 = _errs70 === errors;
+							valid11 = _valid1;
+							ifClause0 = "then";
+						} else {
+							const _errs73 = errors;
+							if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
+								if (data29.download !== void 0) {
+									let data32 = data29.download;
+									if (!(data32 && typeof data32 == "object" && !Array.isArray(data32))) {
+										const err68 = {
+											instancePath: instancePath + "/email/content/download",
+											schemaPath: "#/properties/email/properties/content/then/else/properties/download/type",
+											keyword: "type",
+											params: { type: "object" },
+											message: "must be object"
+										};
+										if (vErrors === null) vErrors = [err68];
+										else vErrors.push(err68);
+										errors++;
+									}
 								}
 							}
+							var _valid1 = _errs73 === errors;
+							valid11 = _valid1;
+							ifClause0 = "else";
+						}
+						if (!valid11) {
+							const err69 = {
+								instancePath: instancePath + "/email/content",
+								schemaPath: "#/properties/email/properties/content/then/if",
+								keyword: "if",
+								params: { failingKeyword: ifClause0 },
+								message: "must match \"" + ifClause0 + "\" schema"
+							};
+							if (vErrors === null) vErrors = [err69];
+							else vErrors.push(err69);
+							errors++;
 						}
-						var _valid0 = _errs70 === errors;
+						var _valid0 = _errs65 === errors;
 						valid10 = _valid0;
-						ifClause0 = "else";
 					}
 					if (!valid10) {
-						const err68 = {
+						const err70 = {
 							instancePath: instancePath + "/email/content",
 							schemaPath: "#/properties/email/properties/content/if",
 							keyword: "if",
-							params: { failingKeyword: ifClause0 },
-							message: "must match \"" + ifClause0 + "\" schema"
+							params: { failingKeyword: "then" },
+							message: "must match \"then\" schema"
 						};
-						if (vErrors === null) vErrors = [err68];
-						else vErrors.push(err68);
+						if (vErrors === null) vErrors = [err70];
+						else vErrors.push(err70);
 						errors++;
 					}
 					if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
 						if (data29.raw === void 0) {
-							const err69 = {
+							const err71 = {
 								instancePath: instancePath + "/email/content",
 								schemaPath: "#/properties/email/properties/content/required",
 								keyword: "required",
 								params: { missingProperty: "raw" },
 								message: "must have required property 'raw'"
 							};
-							if (vErrors === null) vErrors = [err69];
-							else vErrors.push(err69);
+							if (vErrors === null) vErrors = [err71];
+							else vErrors.push(err71);
 							errors++;
 						}
 						if (data29.download === void 0) {
-							const err70 = {
+							const err72 = {
 								instancePath: instancePath + "/email/content",
 								schemaPath: "#/properties/email/properties/content/required",
 								keyword: "required",
 								params: { missingProperty: "download" },
 								message: "must have required property 'download'"
 							};
-							if (vErrors === null) vErrors = [err70];
-							else vErrors.push(err70);
+							if (vErrors === null) vErrors = [err72];
+							else vErrors.push(err72);
 							errors++;
 						}
 						if (data29.raw !== void 0) {
 							let data33 = data29.raw;
-							const _errs74 = errors;
-							let valid15 = false;
-							const _errs75 = errors;
+							const _errs77 = errors;
+							let valid16 = false;
+							const _errs78 = errors;
 							if (!validate12$1(data33, {
 								instancePath: instancePath + "/email/content/raw",
 								parentData: data29,
@@ -15455,40 +15817,40 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 								vErrors = vErrors === null ? validate12$1.errors : vErrors.concat(validate12$1.errors);
 								errors = vErrors.length;
 							}
-							var _valid1 = _errs75 === errors;
-							valid15 = valid15 || _valid1;
-							if (!valid15) {
-								const _errs76 = errors;
+							var _valid2 = _errs78 === errors;
+							valid16 = valid16 || _valid2;
+							if (!valid16) {
+								const _errs79 = errors;
 								if (data33 !== null) {
-									const err71 = {
+									const err73 = {
 										instancePath: instancePath + "/email/content/raw",
 										schemaPath: "#/properties/email/properties/content/properties/raw/anyOf/1/type",
 										keyword: "type",
 										params: { type: "null" },
 										message: "must be null"
 									};
-									if (vErrors === null) vErrors = [err71];
-									else vErrors.push(err71);
+									if (vErrors === null) vErrors = [err73];
+									else vErrors.push(err73);
 									errors++;
 								}
-								var _valid1 = _errs76 === errors;
-								valid15 = valid15 || _valid1;
+								var _valid2 = _errs79 === errors;
+								valid16 = valid16 || _valid2;
 							}
-							if (!valid15) {
-								const err72 = {
+							if (!valid16) {
+								const err74 = {
 									instancePath: instancePath + "/email/content/raw",
 									schemaPath: "#/properties/email/properties/content/properties/raw/anyOf",
 									keyword: "anyOf",
 									params: {},
 									message: "must match a schema in anyOf"
 								};
-								if (vErrors === null) vErrors = [err72];
-								else vErrors.push(err72);
+								if (vErrors === null) vErrors = [err74];
+								else vErrors.push(err74);
 								errors++;
 							} else {
-								errors = _errs74;
+								errors = _errs77;
 								if (vErrors !== null) {
-									if (_errs74) vErrors.length = _errs74;
+									if (_errs77) vErrors.length = _errs77;
 									else vErrors = null;
 								}
 							}
@@ -15496,79 +15858,79 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 						if (data29.download !== void 0) {
 							let data34 = data29.download;
 							if (!(data34 && typeof data34 == "object" && !Array.isArray(data34)) && data34 !== null) {
-								const err73 = {
+								const err75 = {
 									instancePath: instancePath + "/email/content/download",
 									schemaPath: "#/properties/email/properties/content/properties/download/type",
 									keyword: "type",
 									params: { type: schema12.properties.email.properties.content.properties.download.type },
 									message: "must be object,null"
 								};
-								if (vErrors === null) vErrors = [err73];
-								else vErrors.push(err73);
+								if (vErrors === null) vErrors = [err75];
+								else vErrors.push(err75);
 								errors++;
 							}
 							if (data34 && typeof data34 == "object" && !Array.isArray(data34)) {
 								if (data34.url === void 0) {
-									const err74 = {
+									const err76 = {
 										instancePath: instancePath + "/email/content/download",
 										schemaPath: "#/properties/email/properties/content/properties/download/required",
 										keyword: "required",
 										params: { missingProperty: "url" },
 										message: "must have required property 'url'"
 									};
-									if (vErrors === null) vErrors = [err74];
-									else vErrors.push(err74);
+									if (vErrors === null) vErrors = [err76];
+									else vErrors.push(err76);
 									errors++;
 								}
 								if (data34.expires_at === void 0) {
-									const err75 = {
+									const err77 = {
 										instancePath: instancePath + "/email/content/download",
 										schemaPath: "#/properties/email/properties/content/properties/download/required",
 										keyword: "required",
 										params: { missingProperty: "expires_at" },
 										message: "must have required property 'expires_at'"
 									};
-									if (vErrors === null) vErrors = [err75];
-									else vErrors.push(err75);
+									if (vErrors === null) vErrors = [err77];
+									else vErrors.push(err77);
 									errors++;
 								}
 								if (data34.url !== void 0) {
 									let data35 = data34.url;
 									if (typeof data35 === "string") {
 										if (!pattern4.test(data35)) {
-											const err76 = {
+											const err78 = {
 												instancePath: instancePath + "/email/content/download/url",
 												schemaPath: "#/properties/email/properties/content/properties/download/properties/url/pattern",
 												keyword: "pattern",
 												params: { pattern: "^https?://" },
 												message: "must match pattern \"^https?://\""
 											};
-											if (vErrors === null) vErrors = [err76];
-											else vErrors.push(err76);
+											if (vErrors === null) vErrors = [err78];
+											else vErrors.push(err78);
 											errors++;
 										}
 										if (!formats4.test(data35)) {
-											const err77 = {
+											const err79 = {
 												instancePath: instancePath + "/email/content/download/url",
 												schemaPath: "#/properties/email/properties/content/properties/download/properties/url/format",
 												keyword: "format",
 												params: { format: "uri" },
 												message: "must match format \"uri\""
 											};
-											if (vErrors === null) vErrors = [err77];
-											else vErrors.push(err77);
+											if (vErrors === null) vErrors = [err79];
+											else vErrors.push(err79);
 											errors++;
 										}
 									} else {
-										const err78 = {
+										const err80 = {
 											instancePath: instancePath + "/email/content/download/url",
 											schemaPath: "#/properties/email/properties/content/properties/download/properties/url/type",
 											keyword: "type",
 											params: { type: "string" },
 											message: "must be string"
 										};
-										if (vErrors === null) vErrors = [err78];
-										else vErrors.push(err78);
+										if (vErrors === null) vErrors = [err80];
+										else vErrors.push(err80);
 										errors++;
 									}
 								}
@@ -15576,42 +15938,42 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 									let data36 = data34.expires_at;
 									if (typeof data36 === "string") {
 										if (!formats0$1.test(data36)) {
-											const err79 = {
+											const err81 = {
 												instancePath: instancePath + "/email/content/download/expires_at",
 												schemaPath: "#/properties/email/properties/content/properties/download/properties/expires_at/format",
 												keyword: "format",
 												params: { format: "date-time" },
 												message: "must match format \"date-time\""
 											};
-											if (vErrors === null) vErrors = [err79];
-											else vErrors.push(err79);
+											if (vErrors === null) vErrors = [err81];
+											else vErrors.push(err81);
 											errors++;
 										}
 									} else {
-										const err80 = {
+										const err82 = {
 											instancePath: instancePath + "/email/content/download/expires_at",
 											schemaPath: "#/properties/email/properties/content/properties/download/properties/expires_at/type",
 											keyword: "type",
 											params: { type: "string" },
 											message: "must be string"
 										};
-										if (vErrors === null) vErrors = [err80];
-										else vErrors.push(err80);
+										if (vErrors === null) vErrors = [err82];
+										else vErrors.push(err82);
 										errors++;
 									}
 								}
 							}
 						}
 					} else {
-						const err81 = {
+						const err83 = {
 							instancePath: instancePath + "/email/content",
 							schemaPath: "#/properties/email/properties/content/type",
 							keyword: "type",
 							params: { type: "object" },
 							message: "must be object"
 						};
-						if (vErrors === null) vErrors = [err81];
-						else vErrors.push(err81);
+						if (vErrors === null) vErrors = [err83];
+						else vErrors.push(err83);
 						errors++;
 					}
 				}
@@ -15650,123 +16012,123 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 				}
 				if (data14.relay !== void 0) {
 					let data40 = data14.relay;
-					const _errs88 = errors;
-					let valid17 = false;
-					const _errs89 = errors;
+					const _errs91 = errors;
+					let valid18 = false;
+					const _errs92 = errors;
 					if (data40 && typeof data40 == "object" && !Array.isArray(data40)) {
 						if (data40.hostname === void 0) {
-							const err82 = {
+							const err84 = {
 								instancePath: instancePath + "/email/relay",
 								schemaPath: "#/definitions/EmailRelay/required",
 								keyword: "required",
 								params: { missingProperty: "hostname" },
 								message: "must have required property 'hostname'"
 							};
-							if (vErrors === null) vErrors = [err82];
-							else vErrors.push(err82);
+							if (vErrors === null) vErrors = [err84];
+							else vErrors.push(err84);
 							errors++;
 						}
 						if (data40.via === void 0) {
-							const err83 = {
+							const err85 = {
 								instancePath: instancePath + "/email/relay",
 								schemaPath: "#/definitions/EmailRelay/required",
 								keyword: "required",
 								params: { missingProperty: "via" },
 								message: "must have required property 'via'"
 							};
-							if (vErrors === null) vErrors = [err83];
-							else vErrors.push(err83);
+							if (vErrors === null) vErrors = [err85];
+							else vErrors.push(err85);
 							errors++;
 						}
 						if (data40.hostname !== void 0) {
 							if (typeof data40.hostname !== "string") {
-								const err84 = {
+								const err86 = {
 									instancePath: instancePath + "/email/relay/hostname",
 									schemaPath: "#/definitions/EmailRelay/properties/hostname/type",
 									keyword: "type",
 									params: { type: "string" },
 									message: "must be string"
 								};
-								if (vErrors === null) vErrors = [err84];
-								else vErrors.push(err84);
+								if (vErrors === null) vErrors = [err86];
+								else vErrors.push(err86);
 								errors++;
 							}
 						}
 						if (data40.via !== void 0) {
 							if (typeof data40.via !== "string") {
-								const err85 = {
+								const err87 = {
 									instancePath: instancePath + "/email/relay/via",
 									schemaPath: "#/definitions/EmailRelay/properties/via/type",
 									keyword: "type",
 									params: { type: "string" },
 									message: "must be string"
 								};
-								if (vErrors === null) vErrors = [err85];
-								else vErrors.push(err85);
+								if (vErrors === null) vErrors = [err87];
+								else vErrors.push(err87);
 								errors++;
 							}
 						}
 					} else {
-						const err86 = {
+						const err88 = {
 							instancePath: instancePath + "/email/relay",
 							schemaPath: "#/definitions/EmailRelay/type",
 							keyword: "type",
 							params: { type: "object" },
 							message: "must be object"
 						};
-						if (vErrors === null) vErrors = [err86];
-						else vErrors.push(err86);
+						if (vErrors === null) vErrors = [err88];
+						else vErrors.push(err88);
 						errors++;
 					}
-					var _valid2 = _errs89 === errors;
-					valid17 = valid17 || _valid2;
-					if (!valid17) {
-						const _errs96 = errors;
+					var _valid3 = _errs92 === errors;
+					valid18 = valid18 || _valid3;
+					if (!valid18) {
+						const _errs99 = errors;
 						if (data40 !== null) {
-							const err87 = {
+							const err89 = {
 								instancePath: instancePath + "/email/relay",
 								schemaPath: "#/properties/email/properties/relay/anyOf/1/type",
 								keyword: "type",
 								params: { type: "null" },
 								message: "must be null"
 							};
-							if (vErrors === null) vErrors = [err87];
-							else vErrors.push(err87);
+							if (vErrors === null) vErrors = [err89];
+							else vErrors.push(err89);
 							errors++;
 						}
-						var _valid2 = _errs96 === errors;
-						valid17 = valid17 || _valid2;
+						var _valid3 = _errs99 === errors;
+						valid18 = valid18 || _valid3;
 					}
-					if (!valid17) {
-						const err88 = {
+					if (!valid18) {
+						const err90 = {
 							instancePath: instancePath + "/email/relay",
 							schemaPath: "#/properties/email/properties/relay/anyOf",
 							keyword: "anyOf",
 							params: {},
 							message: "must match a schema in anyOf"
 						};
-						if (vErrors === null) vErrors = [err88];
-						else vErrors.push(err88);
+						if (vErrors === null) vErrors = [err90];
+						else vErrors.push(err90);
 						errors++;
 					} else {
-						errors = _errs88;
+						errors = _errs91;
 						if (vErrors !== null) {
-							if (_errs88) vErrors.length = _errs88;
+							if (_errs91) vErrors.length = _errs91;
 							else vErrors = null;
 						}
 					}
 				}
 				if (data14.automated !== void 0) {
 					if (typeof data14.automated !== "boolean") {
-						const err89 = {
+						const err91 = {
 							instancePath: instancePath + "/email/automated",
 							schemaPath: "#/properties/email/properties/automated/type",
 							keyword: "type",
 							params: { type: "boolean" },
 							message: "must be boolean"
 						};
-						if (vErrors === null) vErrors = [err89];
-						else vErrors.push(err89);
+						if (vErrors === null) vErrors = [err91];
+						else vErrors.push(err91);
 						errors++;
 					}
 				}
@@ -15775,53 +16137,53 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 					if (Array.isArray(data44)) {
 						const len1 = data44.length;
 						for (let i1 = 0; i1 < len1; i1++) if (typeof data44[i1] !== "string") {
-							const err90 = {
+							const err92 = {
 								instancePath: instancePath + "/email/automated_reasons/" + i1,
 								schemaPath: "#/properties/email/properties/automated_reasons/items/type",
 								keyword: "type",
 								params: { type: "string" },
 								message: "must be string"
 							};
-							if (vErrors === null) vErrors = [err90];
-							else vErrors.push(err90);
+							if (vErrors === null) vErrors = [err92];
+							else vErrors.push(err92);
 							errors++;
 						}
 					} else {
-						const err91 = {
+						const err93 = {
 							instancePath: instancePath + "/email/automated_reasons",
 							schemaPath: "#/properties/email/properties/automated_reasons/type",
 							keyword: "type",
 							params: { type: "array" },
 							message: "must be array"
 						};
-						if (vErrors === null) vErrors = [err91];
-						else vErrors.push(err91);
+						if (vErrors === null) vErrors = [err93];
+						else vErrors.push(err93);
 						errors++;
 					}
 				}
 			} else {
-				const err92 = {
+				const err94 = {
 					instancePath: instancePath + "/email",
 					schemaPath: "#/properties/email/type",
 					keyword: "type",
 					params: { type: "object" },
 					message: "must be object"
 				};
-				if (vErrors === null) vErrors = [err92];
-				else vErrors.push(err92);
+				if (vErrors === null) vErrors = [err94];
+				else vErrors.push(err94);
 				errors++;
 			}
 		}
 	} else {
-		const err93 = {
+		const err95 = {
 			instancePath,
 			schemaPath: "#/type",
 			keyword: "type",
 			params: { type: "object" },
 			message: "must be object"
 		};
-		if (vErrors === null) vErrors = [err93];
-		else vErrors.push(err93);
+		if (vErrors === null) vErrors = [err95];
+		else vErrors.push(err95);
 		errors++;
 	}
 	validate11$1.errors = vErrors;
@@ -16028,10 +16390,10 @@ function formatValidationIssue(error, input) {
 	switch (error.keyword) {
 		case "required": {
 			const missing = String(error.params.missingProperty ?? "unknown");
-			const prefix = field === "payload" ? "payload" : field;
+			const missingField = field === "payload" ? missing : `${field}.${missing}`;
 			return {
-				field: prefix === "payload" ? missing : `${prefix}.${missing}`,
-				message: `Missing required field: ${missing}`,
+				field: missingField,
+				message: `Missing required field: ${missingField}`,
 				suggestion: `Add the required field "${missing}" to the webhook payload.`
 			};
 		}
@@ -23679,13 +24041,42 @@ const INTERACTION_EVENT_TYPES = [
 	"interaction.ack.requested"
 ];
 /**
+* The rule request events (subject = a request one member made to another for
+* an email rule over the other's own mail). Each goes to the person who did
+* not act: `created` and `withdrawn` to the member asked, `accepted` and
+* `declined` to the member who asked. They are opt-in, and only a webhook that
+* person made for them receives them.
+*/
+const EMAIL_RULE_REQUEST_EVENT_TYPES = [
+	"email_rule_request.created",
+	"email_rule_request.accepted",
+	"email_rule_request.declined",
+	"email_rule_request.withdrawn"
+];
+/**
+* The rule objection events (subject = an objection: a member asked the
+* author of a rule over their own mail to turn it off). Each goes to the
+* person who did not act: `created` and `withdrawn` to the rule's author,
+* `accepted` and `declined` to the member who objected. They are opt-in, and
+* only a webhook that person made for them receives them.
+*/
+const EMAIL_RULE_OBJECTION_EVENT_TYPES = [
+	"email_rule_objection.created",
+	"email_rule_objection.accepted",
+	"email_rule_objection.declined",
+	"email_rule_objection.withdrawn"
+];
+/**
 * The full enumerated catalog of every current webhook event type: the five
-* email.*, the four opt-in sent_email.*, and every
+* email.*, the four opt-in sent_email.*, the four opt-in
+* email_rule_request.*, the four opt-in email_rule_objection.*, and every
 * interaction.<protocol>.<suffix>.
 */
 const WEBHOOK_EVENT_TYPES = [
 	...EMAIL_EVENT_TYPES,
 	...SENT_EMAIL_EVENT_TYPES,
+	...EMAIL_RULE_REQUEST_EVENT_TYPES,
+	...EMAIL_RULE_OBJECTION_EVENT_TYPES,
 	...INTERACTION_EVENT_TYPES
 ];
 const WEBHOOK_EVENT_TYPE_SET = new Set(WEBHOOK_EVENT_TYPES);
@@ -24224,7 +24615,6 @@ function ensureSearchReportsReplyState(apiClient) {
 	}
 	return probe;
 }
-// src/oclif/commands/emails-poll.ts
 function quoteDslValue(value) {
 	if (/^[^\s"]+$/.test(value)) return value;
 	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
@@ -24233,11 +24623,6 @@ function combineQ(q, domain) {
 	const parts = [q?.trim(), domain ? `domain:${quoteDslValue(domain.trim())}` : void 0].filter((part) => Boolean(part));
 	return parts.length > 0 ? parts.join(" ") : void 0;
 }
-function normalizeIsoDate(value, label) {
-	const parsed = new Date(value);
-	if (Number.isNaN(parsed.getTime())) throw new Error(`${label} must be a valid date or ISO-8601 timestamp.`);
-	return parsed.toISOString();
-}
 function filtersFromFlags(flags) {
 	if (flags.automated !== void 0 && !AUTOMATED_VALUES.includes(flags.automated)) throw new Error("--automated must be true or false.");
 	return {
@@ -24256,16 +24641,37 @@ function filtersFromFlags(flags) {
 		to: flags.to
 	};
 }
-function sinceFromFlags(flags) {
-	if (flags.since) return normalizeIsoDate(flags.since, "--since");
-	return flags["include-existing"] ? void 0 : (/* @__PURE__ */ new Date()).toISOString();
+const SINCE_DURATION = /^(\d+)\s*(s|m|h|d)$/i;
+const SINCE_UNIT_MS = {
+	s: 1e3,
+	m: 6e4,
+	h: 36e5,
+	d: 864e5
+};
+/** How --since reads: a date or timestamp, or a duration ago (`15m`). */
+const SINCE_VALUE_HELP = "an ISO-8601 timestamp or date, or a duration ago such as 30s, 15m, 2h or 1d";
+/**
+* Read --since: an ISO-8601 timestamp or date, or a duration before `now`
+* (`30s`, `15m`, `2h`, `1d`).
+*/
+function parseSince(value, now = Date.now()) {
+	if (/^\s*\d+\s*$/.test(value)) throw new Error(`--since needs a unit on a duration, for example ${value.trim()}m; it takes ${SINCE_VALUE_HELP}.`);
+	const duration = SINCE_DURATION.exec(value.trim());
+	const unit = duration ? SINCE_UNIT_MS[duration[2].toLowerCase()] : void 0;
+	const parsed = duration && unit !== void 0 ? new Date(now - Number(duration[1]) * unit) : new Date(value);
+	if (Number.isNaN(parsed.getTime()) || parsed.getTime() < 0) throw new Error(`--since must be ${SINCE_VALUE_HELP}.`);
+	return parsed.toISOString();
+}
+function sinceFromFlags(flags, now = Date.now()) {
+	if (flags.since) return parseSince(flags.since, now);
+	return flags["include-existing"] ? void 0 : new Date(now).toISOString();
 }
 function buildEmailSearchQuery(params) {
 	const query = {
 		include_facets: "false",
 		limit: params.pageSize,
 		snippet: "false",
-		sort: "received_at_asc"
+		sort: params.order ?? "received_at_asc"
 	};
 	const q = combineQ(params.filters.q, params.filters.domain);
 	if (q) query.q = q;
@@ -24282,6 +24688,7 @@ function buildEmailSearchQuery(params) {
 	if (params.filters.to) query.to = params.filters.to;
 	if (params.since) query.date_from = params.since;
 	if (params.cursor) query.cursor = params.cursor;
+	if (params.count === false) query.count = "false";
 	return query;
 }
 function encodeReceivedAtSearchCursor(email) {
@@ -24309,12 +24716,126 @@ function collectNewAcceptedEmails(rows, seenIds) {
 	}
 	return fresh;
 }
+/**
+* How long after arriving an email may become readable and still be reported
+* by an idle poll's re-read; how often a re-read comes; and the most pages, of
+* MAX_EMAIL_POLL_PAGE_SIZE each, one re-read reads.
+*/
+const LATE_MAIL_WINDOW_MS = 6e5;
+const LATE_MAIL_REREAD_MS = 15e3;
+/** How far a re-read reads back at most, however long re-reads have been cut short, unless its interval needs more. */
+const LATE_MAIL_MAX_LOOKBACK_MS = 36e5;
+/** Read back this much further, as this clock may run ahead of the server's. */
+const LATE_MAIL_CLOCK_SLACK_MS = 6e4;
+/**
+* Mail received from `from` (LATE_MAIL_WINDOW_MS ago when not given, and
+* never before `since`), oldest first. Pages come in order of when an email
+* was received, but an email can become readable to this credential after one
+* received later: it was accepted more slowly, held while its sender was
+* checked, or granted to a key by an email rule once classified. By then the
+* cursor is past its place, so an idle poll re-reads recent mail and keeps
+* only rows it has not seen. It reads newest first, where late mail mostly
+* is, so a busy stretch that holds more than the pages read loses its oldest
+* part rather than its newest. Best effort: a page that fails ends the
+* re-read with what it has, and the poll goes on; so does reaching
+* `deadline`. `cutShort` says it did not reach as far back as it would have:
+* a page failed, the deadline came, or a search the server stopped early for
+* time returned short pages up to the page limit. `failed` is the page that
+* failed, so the caller can wait as long as the server asked (Retry-After).
+*/
+async function fetchRecentEmails(params) {
+	const fetchPage = params.fetchPage ?? fetchEmailSearchPage;
+	const now = params.now ?? Date.now();
+	const sinceMs = params.since ? Date.parse(params.since) : NaN;
+	const wanted = params.from ?? now - 6e5;
+	const from = Number.isNaN(sinceMs) ? wanted : Math.max(wanted, sinceMs);
+	const newestFirst = [];
+	const result = (cutShort) => ({
+		rows: newestFirst.reverse(),
+		cutShort
+	});
+	let cursor = null;
+	for (let pages = 0; pages < 3; pages += 1) {
+		if (params.deadline !== void 0 && params.deadline !== null && Date.now() >= params.deadline) return result(true);
+		let page;
+		try {
+			page = await fetchPage({
+				apiClient: params.apiClient,
+				count: false,
+				cursor,
+				filters: params.filters,
+				order: "received_at_desc",
+				pageSize: 100,
+				since: new Date(from).toISOString()
+			});
+		} catch {
+			return result(true);
+		}
+		if (!page.ok) return {
+			...result(true),
+			failed: page
+		};
+		newestFirst.push(...page.rows);
+		if (!page.more || !page.cursor) return result(false);
+		cursor = page.cursor;
+	}
+	return result(newestFirst.length < 300);
+}
+/**
+* An idle poll's re-reads of recent mail (fetchRecentEmails), made once the
+* poll's cursor has passed some mail, with `start` when the poll that first
+* moved it was made.
+*
+* One is due an interval after `start`, as until then the poll has read the
+* same mail itself, and then an interval after the last one ended, so a slow
+* re-read is not followed straight away by another. The interval is
+* LATE_MAIL_REREAD_MS, or LATE_MAIL_REREAD_POLLS poll intervals when that is
+* longer. A re-read is made only on a poll that brought nothing new once it
+* is due, so a wait that ends before the next one is made does not report
+* mail that became readable since the last. `deadline` stops a re-read's
+* paging (fetchRecentEmails).
+*
+* Each re-read reads from LATE_MAIL_WINDOW_MS (and LATE_MAIL_CLOCK_SLACK_MS)
+* before the last one that was not cut short began (before `start`, at
+* first), so an email that becomes readable within LATE_MAIL_WINDOW_MS of
+* arriving is read however far apart re-reads come. That holds while it is
+* among the most one re-read reads, and while a re-read that is not cut short
+* comes within the look-back limit (LATE_MAIL_MAX_LOOKBACK_MS, or more for a
+* long interval) less LATE_MAIL_WINDOW_MS of it becoming readable.
+*/
+function lateMailReread(options) {
+	const { pollIntervalMs, deadline, start } = options;
+	const intervalMs = Math.max(LATE_MAIL_REREAD_MS, 3 * pollIntervalMs);
+	const maxLookBackMs = Math.max(LATE_MAIL_MAX_LOOKBACK_MS, LATE_MAIL_WINDOW_MS + 2 * intervalMs);
+	let covered = start;
+	let ended = start;
+	return {
+		due: (now = Date.now()) => now - ended >= intervalMs,
+		read: async (params) => {
+			const begun = Date.now();
+			const { rows, cutShort, failed } = await fetchRecentEmails({
+				...params,
+				deadline,
+				from: Math.max(covered - LATE_MAIL_WINDOW_MS, begun - maxLookBackMs) - LATE_MAIL_CLOCK_SLACK_MS,
+				now: begun
+			});
+			if (!cutShort) covered = begun;
+			ended = Date.now();
+			return {
+				rows,
+				failed
+			};
+		}
+	};
+}
 async function fetchEmailSearchPage(params) {
 	const result = await searchEmails({
 		client: params.apiClient.client,
 		query: buildEmailSearchQuery({
+			count: params.count,
 			cursor: params.cursor,
 			filters: params.filters,
+			order: params.order,
 			pageSize: params.pageSize,
 			since: params.since
 		}),
@@ -24344,6 +24865,7 @@ async function fetchEmailSearchPage(params) {
 	return {
 		ok: true,
 		cursor: envelope?.meta.cursor ?? cursorFromRows(rows),
+		more: Boolean(envelope?.meta.cursor),
 		rows
 	};
 }
@@ -24438,6 +24960,16 @@ async function pauseForTransientFailure(failure, attempt, options) {
 	return deadline === null || Date.now() < deadline;
 }
 /**
+* After a failed read the caller does not retry, wait as long as the server
+* asked (Retry-After), if it did, before the caller's next request. False when
+* the deadline came first.
+*/
+async function waitOutRetryAfter(result, options) {
+	const failure = transientFailure(result);
+	if (failure?.retryAfterMs === void 0) return true;
+	return pauseForTransientFailure(failure, 0, options);
+}
+/**
 * Run an idempotent read, retrying transient failures until the deadline.
 * Resolves the first result that is not transient, or null when the
 * deadline passes first (or the read itself resolved null).
@@ -25280,4 +25812,4 @@ function repeatStopCommand(emailId) {
 	if (!UUID.test(emailId)) throw new TypeError("emailId must be an email UUID");
 	return `primitive repeat stop --id ${emailId.toLowerCase()}`;
 }
-export { AutomatedFilterUnsupportedError as $, __exportAll as $n, listContacts as $t, sleep as A, sdk_gen_exports as An, getAccount as At, hasReplyState as B, startAgentSignup as Bn, getInboxStatus as Bt, collectNewAcceptedEmails as C, putContact as Cn, deleteWakeSchedule as Ct, filtersFromFlags as D, replyToEmail as Dn, downloadSentAttachmentArchiveMember as Dt, fetchEmailSearchPage as E, reorderRoutes as En, downloadEmailAttachmentPart as Et, assertAwaitingFilterRows as F, setFunctionRoute as Fn, getDefaultNetworkAgent as Ft, WEBHOOK_EVENT_TYPES as G, updateDefaultNetworkMember as Gn, getSentEmail as Gt, queryUsesAwaiting as H, stopRepeatFromEmail as Hn, getOrgRoutingTopology as Ht, awaitingRejectedError as I, setFunctionSecret as In, getEmail as It, parseWebhookEvent as J, updateRoute as Jn, inviteAgentConnection as Jt, isEmailReceivedEvent as K, updateFunction as Kn, getThread as Kt, ensureSearchReportsReplyState as L, setMemory as Ln, getFunction as Lt, AWAITING_VALUES as M, searchMemories as Mn, getContact as Mt, REPLY_STATE_UNSUPPORTED_CODE as N, semanticSearch as Nn, getConversation as Nt, quoteDslValue as O, resendAgentSignupVerification as On, downloadSentAttachmentByFilename as Ot, ReplyStateUnsupportedError as P, sendEmail as Pn, getCreditBalance as Pt, AUTOMATED_VALUES as Q, verifyAgentSignup as Qn, listAgentNetworks as Qt, formatAwaitingCell as R, simulateRoute as Rn, getFunctionRouting as Rt, transientFailure as S, putAgentContactPolicy as Sn, deleteWakeAuthorization as St, encodeReceivedAtSearchCursor as T, removeDefaultNetworkMember as Tn, downloadEmailAttachmentByFilename as Tt, replyStateSurfaceForOperation as U, testFunction as Un, getOwnGrant as Ut, isAwaitingRejectedError as V, startCliLogin as Vn, getMemory as Vt, SENT_EMAIL_EVENT_TYPES as W, unsetFunctionRoute as Wn, getRepeatingSend as Wt, AUTOMATED_FILTER_UNSUPPORTED_CODE as X, updateWakeSchedule as Xn, listAgentConnections as Xt, parseFromHeader as Y, updateWakeAuthorization as Yn, leaveOrganization as Yt, AUTOMATED_FLAG_DESCRIPTION as Z, verifyAgentClaim as Zn, listAgentContacts as Zt, describeApiFailure as _, listWakeDispatches as _n, createWakeSchedule as _t, REPEAT_IDLE_MAX_MINUTES as a, listEmails as an, hasAutomatedVerdict as at, retryTransient as b, pullWebhookEvent as bn, deleteMemory as bt, classifySignalContent as c, listFunctions as cn, cancelSentEmail as ct, parseRepeatTick as d, listRepeatingSends as dn, cliLogout as dt, listCredentials as en, assertAutomatedVerdict as et, preparePresenceAliveEmail as f, listRoles as fn, completeWebhookEvent as ft, WaitDeadlineReached as g, listWakeAuthorizations as gn, createWakeAuthorization as gt, sendPreparedSignal as h, listSentEmails as hn, createRoute as ht, REPEAT_EVERY_MAX_MINUTES as i, listEmailAttachmentArchiveMembers as in, expectedAutomatedVerdicts as it, AWAITING_FLAG_DESCRIPTION as j, searchEmails as jn, getAgentContactPolicy as jt, sinceFromFlags as k, runWakeSchedule as kn, getAccessMode as kt, parseInteractionEnvelope as l, listGroups as ln, cancelSentEmailByIdempotencyKey as lt, repeatStopCommand as m, listSentAttachmentArchiveMembers as mn, createFunction as mt, MAX_PRESENCE_ENVELOPE_BYTES as n, listDefaultNetworkMembers as nn, automatedSurfaceForOperation as nt, REPEAT_MAX_SENDS_MAX as o, listEndpoints as on, isAutomatedRejectedError as ot, prepareSignalEmail as p, listRoutes as pn, createEndpoint as pt, isTrustedSender as q, updateRepeatingSend as qn, getWakeSchedule as qt, PRESENCE_PROBE_TEXT as r, listDomains as rn, ensureSearchReportsAutomated as rt, buildRepeatStopBody as s, listFunctionLogs as sn, addDefaultNetworkMember as st, MAX_INTERACTION_BYTES as t, listDefaultNetworkAgents as tn, automatedRejectedError as tt, parsePresenceEnvelope as u, listMailboxAccess as un, checkDefaultNetworkContactAdmission as ut, parseRetryAfter as v, listWakeSchedules as vn, deleteAgentContact as vt, cursorFromAcceptedRows as w, redeemCreditCode as wn, downloadEmailAttachmentArchiveMember as wt, retryingOperation as x, putAgentContact as xn, deleteRoute as xt, pauseForTransientFailure as y, pollCliLogin as yn, deleteContact as yt, formatRepliesCell as z, startAgentClaim as zn, getFunctionTestRunTrace as zt };
+export { parseWebhookEvent as $, simulateRoute as $n, getRepeatingSend as $t, lateMailReread as A, listWakeDispatches as An, deleteWakeSchedule as At, ensureSearchReportsReplyState as B, replyToEmail as Bn, getConversation as Bt, waitOutRetryAfter as C, listOrganizationPeople as Cn, createWakeAuthorization as Ct, encodeReceivedAtSearchCursor as D, listSentAttachmentArchiveMembers as Dn, deleteMemory as Dt, cursorFromAcceptedRows as E, listRoutes as En, deleteContact as Et, AWAITING_VALUES as F, putAgentContactPolicy as Fn, downloadSentAttachmentByFilename as Ft, queryUsesAwaiting as G, sdk_gen_exports as Gn, getFunctionRouting as Gt, formatRepliesCell as H, revokeCredential as Hn, getDefaultNetworkAgent as Ht, REPLY_STATE_UNSUPPORTED_CODE as I, putContact as In, getAccessMode as It, EMAIL_RULE_REQUEST_EVENT_TYPES as J, semanticSearch as Jn, getKey as Jt, replyStateSurfaceForOperation as K, searchEmails as Kn, getFunctionTestRunTrace as Kt, ReplyStateUnsupportedError as L, redeemCreditCode as Ln, getAccount as Lt, sinceFromFlags as M, pollCliLogin as Mn, downloadEmailAttachmentByFilename as Mt, sleep as N, pullWebhookEvent as Nn, downloadEmailAttachmentPart as Nt, fetchEmailSearchPage as O, listSentEmails as On, deleteRoute as Ot, AWAITING_FLAG_DESCRIPTION as P, putAgentContact as Pn, downloadSentAttachmentArchiveMember as Pt, isTrustedSender as Q, setMemory as Qn, getOwnGrant as Qt, assertAwaitingFilterRows as R, removeDefaultNetworkMember as Rn, getAgentContactPolicy as Rt, transientFailure as S, listMailboxAccess as Sn, createRoute as St, collectNewAcceptedEmails as T, listRoles as Tn, deleteAgentContact as Tt, hasReplyState as U, rotateKey as Un, getEmail as Ut, formatAwaitingCell as V, resendAgentSignupVerification as Vn, getCreditBalance as Vt, isAwaitingRejectedError as W, runWakeSchedule as Wn, getFunction as Wt, WEBHOOK_EVENT_TYPES as X, setFunctionRoute as Xn, getOrgRoutingTopology as Xt, SENT_EMAIL_EVENT_TYPES as Y, sendEmail as Yn, getMemory as Yt, isEmailReceivedEvent as Z, setFunctionSecret as Zn, getOutboundStatus as Zt, describeApiFailure as _, listEndpoints as _n, cliLogout as _t, REPEAT_IDLE_MAX_MINUTES as a, leaveOrganization as an, unsetFunctionRoute as ar, assertAutomatedVerdict as at, retryTransient as b, listGroups as bn, createFunction as bt, classifySignalContent as c, listAgentContacts as cn, updateKey as cr, ensureSearchReportsAutomated as ct, parseRepeatTick as d, listDefaultNetworkAgents as dn, updateWakeAuthorization as dr, isAutomatedRejectedError as dt, getSendFrom as en, startAgentClaim as er, parseFromHeader as et, preparePresenceAliveEmail as f, listDefaultNetworkMembers as fn, updateWakeSchedule as fr, addDefaultNetworkMember as ft, WaitDeadlineReached as g, listEmails as gn, __exportAll as gr, checkSendability as gt, sendPreparedSignal as h, listEmailRuleResults as hn, whoami as hr, checkDefaultNetworkContactAdmission as ht, REPEAT_EVERY_MAX_MINUTES as i, inviteAgentConnection as in, testFunction as ir, AutomatedFilterUnsupportedError as it, quoteDslValue as j, listWakeSchedules as jn, downloadEmailAttachmentArchiveMember as jt, filtersFromFlags as k, listWakeAuthorizations as kn, deleteWakeAuthorization as kt, parseInteractionEnvelope as l, listAgentNetworks as ln, updateRepeatingSend as lr, expectedAutomatedVerdicts as lt, repeatStopCommand as m, listEmailAttachmentArchiveMembers as mn, verifyAgentSignup as mr, cancelSentEmailByIdempotencyKey as mt, MAX_PRESENCE_ENVELOPE_BYTES as n, getThread as nn, startCliLogin as nr, AUTOMATED_FLAG_DESCRIPTION as nt, REPEAT_MAX_SENDS_MAX as o, listActivityObjects as on, updateDefaultNetworkMember as or, automatedRejectedError as ot, prepareSignalEmail as p, listDomains as pn, verifyAgentClaim as pr, cancelSentEmail as pt, EMAIL_RULE_OBJECTION_EVENT_TYPES as q, searchMemories as qn, getInboxStatus as qt, PRESENCE_PROBE_TEXT as r, getWakeSchedule as rn, stopRepeatFromEmail as rr, AUTOMATED_VALUES as rt, buildRepeatStopBody as s, listAgentConnections as sn, updateFunction as sr, automatedSurfaceForOperation as st, MAX_INTERACTION_BYTES as t, getSentEmail as tn, startAgentSignup as tr, AUTOMATED_FILTER_UNSUPPORTED_CODE as tt, parsePresenceEnvelope as u, listContacts as un, updateRoute as ur, hasAutomatedVerdict as ut, parseRetryAfter as v, listFunctionLogs as vn, completeWebhookEvent as vt, SINCE_VALUE_HELP as w, listRepeatingSends as wn, createWakeSchedule as wt, retryingOperation as x, listKeys as xn, createKey as xt, pauseForTransientFailure as y, listFunctions as yn, createEndpoint as yt, awaitingRejectedError as z, reorderRoutes as zn, getContact as zt };