primcli 3.0.0-preview.1 → 3.0.0-preview.2

package/dist/oclif/index.js

@@ -1,12 +1,12 @@
-import { $ as followUpCommandPrefix, A as clearConsumedPendingMail, At as ConnectedAgentKeyRequiredError, B as replyInteractionWarning, Bt as fetchCliOrgs, C as serverMuted, Ct as detectRuntimeSession, D as wakeRecipientField, Dt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, E as wakeReadCommand, Et as withFlagSuggestion, F as removePendingMail, Ft as refuseOrgSelectionForProfile, G as apiResultHttpStatus, H as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Ht as switchCurrentOrg, I as interactionHumanLine, It as resolveCliApiRequestConfig, J as buildThrownSendFailureEnvelope, K as assertValidIdempotencyKey, L as interactionNextActions, Lt as selectedOrgFromEnv, M as pendingMailPath, Mt as createAuthenticatedCliApiClient, N as readPendingMail, Nt as createCliApiClient, O as wakeRelationship, Ot as ATTACHMENT_WAIT_MAX_MS, P as recordPendingMail, Pt as refreshStoredCliCredentials, Q as excludeSignalReplies, R as readEmailInteraction, Rt as CliOrgRefusedError, S as sentInThread, St as detectAgentRuntime, Tt as formatAlreadySentNotice, U as MAX_SEND_WAIT_TIMEOUT_MS, Vt as revokeUserLogin, W as SEND_OUTCOME_HELP, X as classifySendError, Y as checkPriorReplies, Z as deriveSendIdempotencyKey, _ as describeWake, a as extractErrorCode, at as priorRepliesThatWentOut, b as latestOwnOutbound, bt as loadSkillLine, c as hasControlCharacter$1, ct as sendOutcomeExitCode, d as readTextFileFlag, dt as serializeErrorPayload, et as formatDeletedEarlierSendNotice, f as runWithTiming, ft as successfulSendOutcome, g as bareAddress, gt as connectNextSteps, h as explainPendingMailNotFound, ht as cliInvocation, i as createOperationCommand, it as formatSendRecordFailureSummary, j as clearReadPendingMail, k as claimPendingMail, kt as withAttachmentWait, l as headerFlagName, lt as sendWaitClampNotice, m as writeErrorWithHints, n as API_ERROR_CODES, nt as formatPriorRepliesWarning, o as extractErrorPayload, ot as reportSendCommandResult, p as surfaceUnauthorizedHint, pt as thrownErrorExitCode, q as buildFollowUpCommand, r as TIME_FLAG_DESCRIPTION, rt as formatSendFailureSummary, s as formatErrorPayload, st as sendIdentityFields, t as API_BASE_URL_FLAG_DESCRIPTION, tt as formatPriorRepliesCheckSkipped, u as isGrantRefusal, ut as sentHistoryWindowStart, v as displayAddress, vt as generatedAgentName, w as serverRelationship, wt as runtimeSessionVariableList, x as readThreadContext, xt as currentMailSessionKey, y as formatMailWakeLine, yt as identitySuggestions, z as replyExpectation, zt as credentialsFromUserLogin } from "../api-command-ctHBqTL5.js";
-import { $ as AutomatedFilterUnsupportedError, A as sleep$3, At as getAccount, B as hasReplyState, Bn as startAgentSignup, Bt as getInboxStatus, C as collectNewAcceptedEmails, Ct as deleteWakeSchedule, D as filtersFromFlags, Dn as replyToEmail, Dt as downloadSentAttachmentArchiveMember, E as fetchEmailSearchPage, En as reorderRoutes, F as assertAwaitingFilterRows, Fn as setFunctionRoute, Ft as getDefaultNetworkAgent, Gn as updateDefaultNetworkMember, Gt as getSentEmail, H as queryUsesAwaiting, Hn as stopRepeatFromEmail, Ht as getOrgRoutingTopology, I as awaitingRejectedError, In as setFunctionSecret, It as getEmail, J as parseWebhookEvent, Jn as updateRoute, K as isEmailReceivedEvent, Kn as updateFunction, Kt as getThread, L as ensureSearchReportsReplyState, Ln as setMemory, Lt as getFunction, M as AWAITING_VALUES, Mn as searchMemories, N as REPLY_STATE_UNSUPPORTED_CODE, Nn as semanticSearch, Nt as getConversation, O as quoteDslValue, On as resendAgentSignupVerification, Ot as downloadSentAttachmentByFilename, P as ReplyStateUnsupportedError, Pn as sendEmail, Pt as getCreditBalance, Q as AUTOMATED_VALUES, Qn as verifyAgentSignup, Qt as listAgentNetworks, R as formatAwaitingCell, Rn as simulateRoute, Rt as getFunctionRouting, S as transientFailure, St as deleteWakeAuthorization, T as encodeReceivedAtSearchCursor, Tn as removeDefaultNetworkMember, Tt as downloadEmailAttachmentByFilename, Un as testFunction, Ut as getOwnGrant, V as isAwaitingRejectedError, Vn as startCliLogin, Vt as getMemory, Wn as unsetFunctionRoute, Wt as getRepeatingSend, X as AUTOMATED_FILTER_UNSUPPORTED_CODE, Xn as updateWakeSchedule, Y as parseFromHeader, Yn as updateWakeAuthorization, Yt as leaveOrganization, Z as AUTOMATED_FLAG_DESCRIPTION, Zn as verifyAgentClaim, Zt as listAgentContacts, _ as describeApiFailure, _n as listWakeDispatches, _t as createWakeSchedule, a as REPEAT_IDLE_MAX_MINUTES, an as listEmails, at as hasAutomatedVerdict, b as retryTransient, bn as pullWebhookEvent, bt as deleteMemory, cn as listFunctions, ct as cancelSentEmail, d as parseRepeatTick, dn as listRepeatingSends, dt as cliLogout, en as listCredentials, et as assertAutomatedVerdict, f as preparePresenceAliveEmail, fn as listRoles, ft as completeWebhookEvent, g as WaitDeadlineReached, gn as listWakeAuthorizations, gt as createWakeAuthorization, hn as listSentEmails, ht as createRoute, i as REPEAT_EVERY_MAX_MINUTES, in as listEmailAttachmentArchiveMembers, j as AWAITING_FLAG_DESCRIPTION, jn as searchEmails, jt as getAgentContactPolicy, k as sinceFromFlags, kn as runWakeSchedule, kt as getAccessMode, l as parseInteractionEnvelope, ln as listGroups, lt as cancelSentEmailByIdempotencyKey, m as repeatStopCommand, mn as listSentAttachmentArchiveMembers, mt as createFunction, nn as listDefaultNetworkMembers, o as REPEAT_MAX_SENDS_MAX, on as listEndpoints, ot as isAutomatedRejectedError, p as prepareSignalEmail, pn as listRoutes, pt as createEndpoint, qn as updateRepeatingSend, qt as getWakeSchedule, rn as listDomains, s as buildRepeatStopBody, sn as listFunctionLogs, st as addDefaultNetworkMember, tn as listDefaultNetworkAgents, tt as automatedRejectedError, u as parsePresenceEnvelope, un as listMailboxAccess, ut as checkDefaultNetworkContactAdmission, vn as listWakeSchedules, w as cursorFromAcceptedRows, wn as redeemCreditCode, wt as downloadEmailAttachmentArchiveMember, x as retryingOperation, xt as deleteRoute, y as pauseForTransientFailure, yn as pollCliLogin, z as formatRepliesCell, zn as startAgentClaim, zt as getFunctionTestRunTrace } from "../repeats-Dj_o6c-X-Bf9G0xds.js";
-import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-BN0JTPZ3.js";
+import { $ as followUpCommandPrefix, A as clearConsumedPendingMail, At as ConnectedAgentKeyRequiredError, B as replyInteractionWarning, Bt as fetchCliOrgs, C as serverMuted, Ct as detectRuntimeSession, D as wakeRecipientField, Dt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, E as wakeReadCommand, Et as withFlagSuggestion, F as removePendingMail, Ft as refuseOrgSelectionForProfile, G as apiResultHttpStatus, H as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Ht as switchCurrentOrg, I as interactionHumanLine, It as resolveCliApiRequestConfig, J as buildThrownSendFailureEnvelope, K as assertValidIdempotencyKey, L as interactionNextActions, Lt as selectedOrgFromEnv, M as pendingMailPath, Mt as createAuthenticatedCliApiClient, N as readPendingMail, Nt as createCliApiClient, O as wakeRelationship, Ot as ATTACHMENT_WAIT_MAX_MS, P as recordPendingMail, Pt as refreshStoredCliCredentials, Q as excludeSignalReplies, R as readEmailInteraction, Rt as CliOrgRefusedError, S as sentInThread, St as detectAgentRuntime, Tt as formatAlreadySentNotice, U as MAX_SEND_WAIT_TIMEOUT_MS, Vt as revokeUserLogin, W as SEND_OUTCOME_HELP, X as classifySendError, Y as checkPriorReplies, Z as deriveSendIdempotencyKey, _ as describeWake, a as extractErrorCode, at as priorRepliesThatWentOut, b as latestOwnOutbound, bt as loadSkillLine, c as hasControlCharacter$1, ct as sendOutcomeExitCode, d as readTextFileFlag, dt as serializeErrorPayload, et as formatDeletedEarlierSendNotice, f as runWithTiming, ft as successfulSendOutcome, g as bareAddress, gt as connectNextSteps, h as explainPendingMailNotFound, ht as cliInvocation, i as createOperationCommand, it as formatSendRecordFailureSummary, j as clearReadPendingMail, k as claimPendingMail, kt as withAttachmentWait, l as headerFlagName, lt as sendWaitClampNotice, m as writeErrorWithHints, n as API_ERROR_CODES, nt as formatPriorRepliesWarning, o as extractErrorPayload, ot as reportSendCommandResult, p as surfaceUnauthorizedHint, pt as thrownErrorExitCode, q as buildFollowUpCommand, r as TIME_FLAG_DESCRIPTION, rt as formatSendFailureSummary, s as formatErrorPayload, st as sendIdentityFields, t as API_BASE_URL_FLAG_DESCRIPTION, tt as formatPriorRepliesCheckSkipped, u as isGrantRefusal, ut as sentHistoryWindowStart, v as displayAddress, vt as generatedAgentName, w as serverRelationship, wt as runtimeSessionVariableList, x as readThreadContext, xt as currentMailSessionKey, y as formatMailWakeLine, yt as identitySuggestions, z as replyExpectation, zt as credentialsFromUserLogin } from "../api-command-B37DPKFA.js";
+import { $ as AutomatedFilterUnsupportedError, $n as updateRoute, $t as listAgentContacts, A as sleep$3, An as resendAgentSignupVerification, At as getAccessMode, B as hasReplyState, Bn as setFunctionSecret, Bt as getFunctionTestRunTrace, C as collectNewAcceptedEmails, Ct as deleteWakeAuthorization, D as filtersFromFlags, Dn as removeDefaultNetworkMember, E as fetchEmailSearchPage, En as redeemCreditCode, Et as downloadEmailAttachmentByFilename, F as assertAwaitingFilterRows, Fn as searchEmails, Ft as getCreditBalance, Gn as startCliLogin, Gt as getOwnGrant, H as queryUsesAwaiting, Hn as simulateRoute, Ht as getKey, I as awaitingRejectedError, In as searchMemories, It as getDefaultNetworkAgent, J as parseWebhookEvent, Jn as unsetFunctionRoute, Jt as getThread, K as isEmailReceivedEvent, Kn as stopRepeatFromEmail, Kt as getRepeatingSend, L as ensureSearchReportsReplyState, Ln as semanticSearch, Lt as getEmail, M as AWAITING_VALUES, Mn as rotateKey, Mt as getAgentContactPolicy, N as REPLY_STATE_UNSUPPORTED_CODE, Nn as runWakeSchedule, O as quoteDslValue, On as reorderRoutes, Ot as downloadSentAttachmentArchiveMember, P as ReplyStateUnsupportedError, Pt as getConversation, Q as AUTOMATED_VALUES, Qn as updateRepeatingSend, R as formatAwaitingCell, Rn as sendEmail, Rt as getFunction, S as transientFailure, Sn as pullWebhookEvent, St as deleteRoute, T as encodeReceivedAtSearchCursor, Tt as downloadEmailAttachmentArchiveMember, Un as startAgentClaim, Ut as getMemory, V as isAwaitingRejectedError, Vn as setMemory, Vt as getInboxStatus, Wn as startAgentSignup, Wt as getOrgRoutingTopology, X as AUTOMATED_FILTER_UNSUPPORTED_CODE, Xn as updateFunction, Y as parseFromHeader, Yn as updateDefaultNetworkMember, Yt as getWakeSchedule, Z as AUTOMATED_FLAG_DESCRIPTION, Zn as updateKey, Zt as leaveOrganization, _ as describeApiFailure, _n as listSentEmails, _t as createWakeAuthorization, a as REPEAT_IDLE_MAX_MINUTES, an as listEmailAttachmentArchiveMembers, at as hasAutomatedVerdict, b as retryTransient, bn as listWakeSchedules, cn as listFunctionLogs, ct as cancelSentEmail, d as parseRepeatTick, dn as listKeys, dt as cliLogout, en as listAgentNetworks, er as updateWakeAuthorization, et as assertAutomatedVerdict, f as preparePresenceAliveEmail, fn as listMailboxAccess, ft as completeWebhookEvent, g as WaitDeadlineReached, gn as listSentAttachmentArchiveMembers, gt as createRoute, hn as listRoutes, ht as createKey, i as REPEAT_EVERY_MAX_MINUTES, in as listDomains, j as AWAITING_FLAG_DESCRIPTION, jn as revokeCredential, jt as getAccount, k as sinceFromFlags, kn as replyToEmail, kt as downloadSentAttachmentByFilename, l as parseInteractionEnvelope, ln as listFunctions, lt as cancelSentEmailByIdempotencyKey, m as repeatStopCommand, mn as listRoles, mt as createFunction, nn as listDefaultNetworkAgents, nr as verifyAgentClaim, o as REPEAT_MAX_SENDS_MAX, on as listEmails, ot as isAutomatedRejectedError, p as prepareSignalEmail, pn as listRepeatingSends, pt as createEndpoint, qn as testFunction, qt as getSentEmail, rn as listDefaultNetworkMembers, rr as verifyAgentSignup, s as buildRepeatStopBody, sn as listEndpoints, st as addDefaultNetworkMember, tr as updateWakeSchedule, tt as automatedRejectedError, u as parsePresenceEnvelope, un as listGroups, ut as checkDefaultNetworkContactAdmission, vn as listWakeAuthorizations, vt as createWakeSchedule, w as cursorFromAcceptedRows, wt as deleteWakeSchedule, x as retryingOperation, xn as pollCliLogin, xt as deleteMemory, y as pauseForTransientFailure, yn as listWakeDispatches, z as formatRepliesCell, zn as setFunctionRoute, zt as getFunctionRouting } from "../repeats-Dj_o6c-X-BzXj5ICh.js";
+import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-Bo8WgG3q.js";
 import { A as AGENT_ADDRESS_ENV, C as saveCliCredentials, D as loadActiveChatState, E as deleteChatState, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadChatConversationByLocalId, P as agentProfileName, R as loadConnectedAgentProfile, S as resolveCliAuth, T as chatStatePath, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as loadCliCredentials, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as saveActiveChatState, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveSignupCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-Ms_0vNjq.js";
 import { C as resolveListenSubscription, S as normalizeListenOrigin, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, y as listenIdentity } from "../shared-mail-files-BAQSGxxz.js";
-import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-Cp_eQ9t_.js";
-import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-DZ42V3jq.js";
+import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-g-xPd3X0.js";
+import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-TJlyUTi7.js";
 import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, readWorkingLease, restoreAutoWorking } from "./auto-signals.js";
-import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-CRUMUCNa.js";
+import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-BO93dM2Q.js";
 import { n as jsonOutputRequested, r as runStreamingJson, t as guardJsonOutputCommands } from "../json-output-BzSBR-KX.js";
 import { c as startBackgroundListen, i as backgroundListenToken, l as stopBackgroundListen, o as runBackgroundListen, r as backgroundListenStatus, u as verifyBackgroundListenTarget } from "../listen-background-C0F9gNDD.js";
 import { ORG_SELECTION_ENV } from "./global-org-flag.js";
@@ -21648,7 +21648,7 @@ const openapiDocument = {
 		"/email-rules/test": { "post": {
 			"operationId": "testEmailRule",
 			"summary": "Test a rule against received mail",
-			"description": "Runs a rule over received mail and reports what it would decide for each email: matched, near_miss, no_match, unclassified or not_found. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version, run with its author's access). Either way the rule reads only mail its author can read. Without email_ids, the newest emails it can read are tested, at most 200 and none older than 30 days. Emails not classified yet that arrived more than 2 hours ago are classified first and their classification is saved, unless classify_missing is false; newer ones are left to normal classification and reported unclassified with reason pending. The rule itself records nothing and grants nothing. Classification and the rule's own questions stop at about 90 seconds; run the test again to continue where it stopped. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+			"description": "Runs a rule over received mail and reports what it would decide for each email: matched, near_miss, no_match, unclassified or not_found. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version, run with its author's access). Either way the rule reads only mail its author can read, and only what its scope covers. Without email_ids, the newest emails it can read are tested, at most 200 and none older than 30 days. Emails not classified yet that arrived more than 2 hours ago are classified first and their classification is saved, unless classify_missing is false; newer ones are left to normal classification and reported unclassified with reason pending. The rule itself records nothing and grants nothing. Classification and the rule's own questions stop at about 90 seconds; run the test again to continue where it stopped. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"requestBody": {
@@ -21671,7 +21671,7 @@ const openapiDocument = {
 					}
 				},
 				"400": {
-					"description": "validation_error: give exactly one of tree and rule_id, at most 200 email_ids, and a tree that is valid for the column contract. A saved rule whose current version no longer renders answers details.reason version_not_renderable.",
+					"description": "validation_error: give exactly one of tree and rule_id, at most 200 email_ids, and a tree that is valid for the column contract. evaluation_scope and scope_selection go only with tree. A saved rule whose current version no longer renders answers details.reason version_not_renderable.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"401": {
@@ -21694,7 +21694,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. grant_forbidden with details.reason mail_depth: your access to mail shows headers only, and a rule decides on what emails say.",
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. grant_forbidden with details.reason mail_depth: your access to mail shows headers only, and a rule decides on what emails say. email_rule_scope_not_readable: scope_selection names something you cannot read.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -21702,7 +21702,7 @@ const openapiDocument = {
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"409": {
-					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree, the caller). details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox or no_shareable_mailbox.",
+					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree, the caller). details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox, no_shareable_mailbox or no_selected_mailbox.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -21768,7 +21768,7 @@ const openapiDocument = {
 					}
 				},
 				"400": {
-					"description": "validation_error: give exactly one of tree and rule_id, an email with a sender, 1 to 50 To addresses (and up to 50 Cc), and a text body, and a tree that is valid for the column contract and within the size limits for a saved rule. A saved rule whose current version no longer renders answers details.reason version_not_renderable.",
+					"description": "validation_error: give exactly one of tree and rule_id (evaluation_scope and scope_selection only with tree), an email with a sender, 1 to 50 To addresses (and up to 50 Cc), and a text body, and a tree that is valid for the column contract and within the size limits for a saved rule. A saved rule whose current version no longer renders answers details.reason version_not_renderable.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"401": {
@@ -21799,7 +21799,7 @@ const openapiDocument = {
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"409": {
-					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree, you), so it would decide nothing for real. details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox or no_shareable_mailbox.",
+					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree, you), so it would decide nothing for real. details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox, no_shareable_mailbox or no_selected_mailbox.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -21843,7 +21843,7 @@ const openapiDocument = {
 			"post": {
 				"operationId": "createEmailRule",
 				"summary": "Create a rule",
-				"description": "Saves a rule as version 1, from a compile response or a tree you wrote. The tree is checked against the column contract. New rules start in observe, where what the rule matches is recorded and nothing is granted; draft is not evaluated. The caller is the rule's author, and the rule never reaches mail the author cannot read. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+				"description": "Saves a rule as version 1, from a compile response or a tree you wrote. The tree is checked against the column contract. New rules start in observe, where what the rule matches is recorded and nothing is granted; draft is not evaluated. The caller is the rule's author, and the rule never reaches mail the author cannot read. evaluation_scope (author when omitted) chooses whose mail it runs over; scope_selection may name only what you can read. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"requestBody": {
@@ -21892,7 +21892,11 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_scope_not_readable: scope_selection names something you cannot read (details.addresses, details.domains).",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"409": {
+						"description": "email_rule_author_unresolvable: the rule could not run as you over the chosen scope.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"429": {
@@ -22170,7 +22174,7 @@ const openapiDocument = {
 			"patch": {
 				"operationId": "updateEmailRule",
 				"summary": "Change a rule",
-				"description": "Renames the rule, saves a new version (english, tree and explanation together; earlier versions are kept unchanged) or changes its state: draft (disabled), observe or active. Only the rule's author may rename it, add a version or move it to observe or active; anyone else who can see it may only disable it (state draft), and while it is shared with another member only if they manage members from the dashboard. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+				"description": "Renames the rule, saves a new version (english, tree and explanation together; earlier versions are kept unchanged), changes its state (draft, disabled; observe; or active) or changes whose mail it runs over (evaluation_scope, with scope_selection when selected). Only the rule's author may rename it, add a version, change its scope or move it to observe or active; anyone else who can see it may only disable it (state draft), and while it is shared with another member only if they manage members from the dashboard. Omit evaluation_scope to keep the current scope. A scope change saves a new version with the same conditions; what was granted stays. A shared rule keeps its scope. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -22235,7 +22239,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_author_only: only the rule's author may make this change. forbidden with details.reason rule_shared: the rule is shared with another member, so only its author, or someone who manages members from the dashboard, can turn it off.",
+						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_author_only: only the rule's author may make this change. forbidden with details.reason rule_shared: the rule is shared with another member, so only its author, or someone who manages members from the dashboard, can turn it off. email_rule_scope_not_readable: scope_selection names something you cannot read.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"404": {
@@ -22252,7 +22256,7 @@ const openapiDocument = {
 						} }
 					},
 					"409": {
-						"description": "email_rule_conflict: the rule changed while saving; read it again and retry.",
+						"description": "email_rule_conflict: the rule changed while saving; read it again and retry. email_rule_scope_locked: the rule is shared. email_rule_author_unresolvable: the rule could not run as you over the chosen scope.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"429": {
@@ -22516,252 +22520,17 @@ const openapiDocument = {
 			},
 			"x-primitive-permission": ["mail:read"]
 		} },
-		"/email-rule-requests": {
-			"post": {
-				"operationId": "createEmailRuleRequest",
-				"summary": "Ask a member for a rule",
-				"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address (at most 30 lookups by address an hour). Nothing is evaluated and nothing is shared until they accept, and they may change the rule first; they see the request and can preview what it matches in their own mail. You may have at most 5 pending requests to one member and 50 in all. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
-				"tags": ["Email Rules"],
-				"security": [{ "BearerAuth": [] }],
-				"requestBody": {
-					"required": true,
-					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateEmailRuleRequestRequest" } } }
-				},
-				"responses": {
-					"201": {
-						"description": "Ask a member for a rule",
-						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
-							"type": "object",
-							"required": ["data"],
-							"properties": { "data": { "$ref": "#/components/schemas/CreateEmailRuleRequestResult" } }
-						}] } } }
-					},
-					"400": {
-						"description": "validation_error: give exactly one of target_user_id and target_email and a tree that is valid for the column contract; details.reason self_request when the member named is you.",
-						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-					},
-					"401": {
-						"description": "Invalid or missing API key",
-						"content": { "application/json": {
-							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-							"example": {
-								"success": false,
-								"error": {
-									"code": "unauthorized",
-									"message": "Invalid or missing API key"
-								}
-							}
-						} },
-						"headers": {
-							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
-							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
-							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
-							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
-						}
-					},
-					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
-						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-					},
-					"404": {
-						"description": "not_found: no current member of this organization matches the member named.",
-						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-					},
-					"409": {
-						"description": "email_rule_request_limit: you already have the most pending requests allowed (details.limit, and details.scope target or total).",
-						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-					},
-					"429": {
-						"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
-						"headers": {
-							"Retry-After": {
-								"schema": { "type": "integer" },
-								"description": "Seconds to wait before retrying"
-							},
-							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
-							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
-							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
-							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
-						},
-						"content": { "application/json": {
-							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-							"example": {
-								"success": false,
-								"error": {
-									"code": "rate_limit_exceeded",
-									"message": "Rate limit exceeded"
-								}
-							}
-						} }
-					},
-					"503": {
-						"description": "service_unavailable: looking members up by address is unavailable right now. Try again in a moment, or name them by user id.",
-						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-					}
-				},
-				"x-primitive-permission": ["mail:read"],
-				"parameters": [{
-					"name": "Idempotency-Key",
-					"in": "header",
-					"required": false,
-					"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
-					"schema": {
-						"type": "string",
-						"minLength": 1,
-						"maxLength": 255
-					}
-				}]
-			},
-			"get": {
-				"operationId": "listEmailRuleRequests",
-				"summary": "List rule requests",
-				"description": "Rule requests, newest first: those made to you (box incoming, the default), those you made (outgoing), or every one you can see (all). Pending ones by default; status decided lists accepted, declined and withdrawn ones, and any lists both. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
-				"tags": ["Email Rules"],
-				"security": [{ "BearerAuth": [] }],
-				"parameters": [
-					{
-						"name": "box",
-						"in": "query",
-						"required": false,
-						"description": "incoming, outgoing or all.",
-						"schema": {
-							"default": "incoming",
-							"description": "incoming: requests made to you; outgoing: requests you made; all: every request you can see (owners and admins see the organization's).",
-							"type": "string",
-							"enum": [
-								"incoming",
-								"outgoing",
-								"all"
-							]
-						}
-					},
-					{
-						"name": "status",
-						"in": "query",
-						"required": false,
-						"description": "pending, decided or any.",
-						"schema": {
-							"default": "pending",
-							"type": "string",
-							"enum": [
-								"pending",
-								"decided",
-								"any"
-							]
-						}
-					},
-					{
-						"name": "limit",
-						"in": "query",
-						"required": false,
-						"description": "Maximum number of items to return.",
-						"schema": {
-							"default": 25,
-							"type": "integer",
-							"minimum": 1,
-							"maximum": 100
-						}
-					},
-					{
-						"name": "cursor",
-						"in": "query",
-						"required": false,
-						"description": "Opaque cursor from the previous page's next_cursor. Omit for the first page.",
-						"schema": {
-							"type": "string",
-							"maxLength": 200
-						}
-					}
-				],
-				"responses": {
-					"200": {
-						"description": "List rule requests",
-						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
-							"type": "object",
-							"required": ["data"],
-							"properties": { "data": { "$ref": "#/components/schemas/ListEmailRuleRequestsResult" } }
-						}] } } },
-						"headers": {
-							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
-							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
-							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
-							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
-						}
-					},
-					"400": {
-						"description": "Invalid request parameters",
-						"content": { "application/json": {
-							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-							"example": {
-								"success": false,
-								"error": {
-									"code": "validation_error",
-									"message": "Invalid domain format"
-								}
-							}
-						} }
-					},
-					"401": {
-						"description": "Invalid or missing API key",
-						"content": { "application/json": {
-							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-							"example": {
-								"success": false,
-								"error": {
-									"code": "unauthorized",
-									"message": "Invalid or missing API key"
-								}
-							}
-						} },
-						"headers": {
-							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
-							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
-							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
-							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
-						}
-					},
-					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
-						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-					},
-					"429": {
-						"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
-						"headers": {
-							"Retry-After": {
-								"schema": { "type": "integer" },
-								"description": "Seconds to wait before retrying"
-							},
-							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
-							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
-							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
-							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
-						},
-						"content": { "application/json": {
-							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-							"example": {
-								"success": false,
-								"error": {
-									"code": "rate_limit_exceeded",
-									"message": "Rate limit exceeded"
-								}
-							}
-						} }
-					}
-				},
-				"x-primitive-permission": ["mail:read"]
-			}
-		},
-		"/email-rule-requests/{id}": { "get": {
-			"operationId": "getEmailRuleRequest",
-			"summary": "Read a rule request",
-			"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"/emails/{id}/rule-results": { "get": {
+			"operationId": "listEmailRuleResults",
+			"summary": "List every rule's result on an email",
+			"description": "Every rule the caller can see and what it decided about this email: those that matched, those that did not, and those that have not run on it, with what is known about them. A result names the version of the rule that decided and carries that version's conditions and questions. Only a caller who can read the email gets an answer, and a rule the caller cannot see is left out. At most 50 rules are listed, those with a result first; hidden counts the rest. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
 				"name": "id",
 				"in": "path",
 				"required": true,
-				"description": "The request id.",
+				"description": "The email id.",
 				"schema": {
 					"type": "string",
 					"format": "uuid"
@@ -22769,11 +22538,11 @@ const openapiDocument = {
 			}],
 			"responses": {
 				"200": {
-					"description": "Read a rule request",
+					"description": "List every rule's result on an email",
 					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
 						"type": "object",
 						"required": ["data"],
-						"properties": { "data": { "$ref": "#/components/schemas/GetEmailRuleRequestResult" } }
+						"properties": { "data": { "$ref": "#/components/schemas/ListEmailRuleResultsResult" } }
 					}] } } },
 					"headers": {
 						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
@@ -22806,7 +22575,7 @@ const openapiDocument = {
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
-					"description": "not_found: no request you can see has this id.",
+					"description": "not_found: no such email, or not one the caller can read.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -22835,39 +22604,39 @@ const openapiDocument = {
 			},
 			"x-primitive-permission": ["mail:read"]
 		} },
-		"/email-rule-requests/{id}/decline": { "post": {
-			"operationId": "declineEmailRuleRequest",
-			"summary": "Decline a rule request",
-			"description": "Declines a pending request made to you. Nothing is written but the decision. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"/email-rules/{id}/versions": { "get": {
+			"operationId": "listEmailRuleVersions",
+			"summary": "Read versions of a rule",
+			"description": "The named versions of a rule, as they were written: what each one's conditions and questions were, so a decision can be read against the version that made it. Numbers that are not versions of the rule are left out. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
 				"name": "id",
 				"in": "path",
 				"required": true,
-				"description": "The request id.",
+				"description": "The rule id.",
 				"schema": {
 					"type": "string",
 					"format": "uuid"
 				}
 			}, {
-				"name": "Idempotency-Key",
-				"in": "header",
-				"required": false,
-				"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+				"name": "versions",
+				"in": "query",
+				"required": true,
+				"description": "The version numbers, comma-separated, at most 100.",
 				"schema": {
 					"type": "string",
-					"minLength": 1,
-					"maxLength": 255
+					"pattern": "^[1-9]\\d{0,8}(,[1-9]\\d{0,8}){0,99}$",
+					"description": "The version numbers to read, comma-separated."
 				}
 			}],
 			"responses": {
 				"200": {
-					"description": "Decline a rule request",
+					"description": "Read versions of a rule",
 					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
 						"type": "object",
 						"required": ["data"],
-						"properties": { "data": { "$ref": "#/components/schemas/DeclineEmailRuleRequestResult" } }
+						"properties": { "data": { "$ref": "#/components/schemas/ListEmailRuleVersionsResult" } }
 					}] } } },
 					"headers": {
 						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
@@ -22876,6 +22645,19 @@ const openapiDocument = {
 						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
 					}
 				},
+				"400": {
+					"description": "Invalid request parameters",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "validation_error",
+								"message": "Invalid domain format"
+							}
+						}
+					} }
+				},
 				"401": {
 					"description": "Invalid or missing API key",
 					"content": { "application/json": {
@@ -22896,16 +22678,620 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_request_target_only: only the member the request was made to may decline it.",
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
-					"description": "not_found: no request you can see has this id.",
-					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-				},
-				"409": {
-					"description": "email_rule_request_not_pending: the request was already accepted, declined or withdrawn (details.status).",
-					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					"description": "Resource not found",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "not_found",
+								"message": "Resource not found"
+							}
+						}
+					} }
+				},
+				"429": {
+					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+					"headers": {
+						"Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						},
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+					},
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				}
+			},
+			"x-primitive-permission": ["mail:read"]
+		} },
+		"/email-rules/{id}/scope": { "get": {
+			"operationId": "getEmailRuleScope",
+			"summary": "Read what a rule covers",
+			"description": "Whose mail the rule runs over, and what that comes to now: a rule never reaches further than what its author can read when it runs, so what a selected rule names and its author can no longer read stops matching. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+			"tags": ["Email Rules"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{
+				"name": "id",
+				"in": "path",
+				"required": true,
+				"description": "The rule id.",
+				"schema": {
+					"type": "string",
+					"format": "uuid"
+				}
+			}],
+			"responses": {
+				"200": {
+					"description": "Read what a rule covers",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"required": ["data"],
+						"properties": { "data": { "$ref": "#/components/schemas/GetEmailRuleScopeResult" } }
+					}] } } },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+					}
+				},
+				"401": {
+					"description": "Invalid or missing API key",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
+							}
+						}
+					} },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+					}
+				},
+				"403": {
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"404": {
+					"description": "not_found: no such rule, or not one you can see.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"429": {
+					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+					"headers": {
+						"Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						},
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+					},
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				}
+			},
+			"x-primitive-permission": ["mail:read"]
+		} },
+		"/email-rule-scope-options": { "get": {
+			"operationId": "listEmailRuleScopeOptions",
+			"summary": "List what a rule can cover",
+			"description": "How much the caller can read, and the inboxes and domains the caller can read, which is what they may name when a rule runs over selected inboxes and domains. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+			"tags": ["Email Rules"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{
+				"name": "q",
+				"in": "query",
+				"required": false,
+				"description": "Only inboxes and domains containing this text.",
+				"schema": {
+					"description": "Only inboxes and domains containing this text.",
+					"type": "string",
+					"maxLength": 200
+				}
+			}],
+			"responses": {
+				"200": {
+					"description": "List what a rule can cover",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"required": ["data"],
+						"properties": { "data": { "$ref": "#/components/schemas/ListEmailRuleScopeOptionsResult" } }
+					}] } } },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+					}
+				},
+				"400": {
+					"description": "Invalid request parameters",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "validation_error",
+								"message": "Invalid domain format"
+							}
+						}
+					} }
+				},
+				"401": {
+					"description": "Invalid or missing API key",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
+							}
+						}
+					} },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+					}
+				},
+				"403": {
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"409": {
+					"description": "email_rule_author_unresolvable: rules cannot run as you right now.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"429": {
+					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+					"headers": {
+						"Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						},
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+					},
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				}
+			},
+			"x-primitive-permission": ["mail:read"]
+		} },
+		"/email-rule-requests": {
+			"post": {
+				"operationId": "createEmailRuleRequest",
+				"summary": "Ask a member for a rule",
+				"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address (at most 30 lookups by address an hour). Nothing is evaluated and nothing is shared until they accept, and they may change the rule first; they see the request and can preview what it matches in their own mail. You may have at most 5 pending requests to one member and 50 in all. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+				"tags": ["Email Rules"],
+				"security": [{ "BearerAuth": [] }],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateEmailRuleRequestRequest" } } }
+				},
+				"responses": {
+					"201": {
+						"description": "Ask a member for a rule",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"required": ["data"],
+							"properties": { "data": { "$ref": "#/components/schemas/CreateEmailRuleRequestResult" } }
+						}] } } }
+					},
+					"400": {
+						"description": "validation_error: give exactly one of target_user_id and target_email and a tree that is valid for the column contract; details.reason self_request when the member named is you.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"401": {
+						"description": "Invalid or missing API key",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "unauthorized",
+									"message": "Invalid or missing API key"
+								}
+							}
+						} },
+						"headers": {
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+						}
+					},
+					"403": {
+						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"404": {
+						"description": "not_found: no current member of this organization matches the member named.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"409": {
+						"description": "email_rule_request_limit: you already have the most pending requests allowed (details.limit, and details.scope target or total).",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"429": {
+						"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+						"headers": {
+							"Retry-After": {
+								"schema": { "type": "integer" },
+								"description": "Seconds to wait before retrying"
+							},
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+						},
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "rate_limit_exceeded",
+									"message": "Rate limit exceeded"
+								}
+							}
+						} }
+					},
+					"503": {
+						"description": "service_unavailable: looking members up by address is unavailable right now. Try again in a moment, or name them by user id.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					}
+				},
+				"x-primitive-permission": ["mail:read"],
+				"parameters": [{
+					"name": "Idempotency-Key",
+					"in": "header",
+					"required": false,
+					"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+					"schema": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 255
+					}
+				}]
+			},
+			"get": {
+				"operationId": "listEmailRuleRequests",
+				"summary": "List rule requests",
+				"description": "Rule requests, newest first: those made to you (box incoming, the default), those you made (outgoing), or every one you can see (all). Pending ones by default; status decided lists accepted, declined and withdrawn ones, and any lists both. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+				"tags": ["Email Rules"],
+				"security": [{ "BearerAuth": [] }],
+				"parameters": [
+					{
+						"name": "box",
+						"in": "query",
+						"required": false,
+						"description": "incoming, outgoing or all.",
+						"schema": {
+							"default": "incoming",
+							"description": "incoming: requests made to you; outgoing: requests you made; all: every request you can see (owners and admins see the organization's).",
+							"type": "string",
+							"enum": [
+								"incoming",
+								"outgoing",
+								"all"
+							]
+						}
+					},
+					{
+						"name": "status",
+						"in": "query",
+						"required": false,
+						"description": "pending, decided or any.",
+						"schema": {
+							"default": "pending",
+							"type": "string",
+							"enum": [
+								"pending",
+								"decided",
+								"any"
+							]
+						}
+					},
+					{
+						"name": "limit",
+						"in": "query",
+						"required": false,
+						"description": "Maximum number of items to return.",
+						"schema": {
+							"default": 25,
+							"type": "integer",
+							"minimum": 1,
+							"maximum": 100
+						}
+					},
+					{
+						"name": "cursor",
+						"in": "query",
+						"required": false,
+						"description": "Opaque cursor from the previous page's next_cursor. Omit for the first page.",
+						"schema": {
+							"type": "string",
+							"maxLength": 200
+						}
+					}
+				],
+				"responses": {
+					"200": {
+						"description": "List rule requests",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"required": ["data"],
+							"properties": { "data": { "$ref": "#/components/schemas/ListEmailRuleRequestsResult" } }
+						}] } } },
+						"headers": {
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+						}
+					},
+					"400": {
+						"description": "Invalid request parameters",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "validation_error",
+									"message": "Invalid domain format"
+								}
+							}
+						} }
+					},
+					"401": {
+						"description": "Invalid or missing API key",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "unauthorized",
+									"message": "Invalid or missing API key"
+								}
+							}
+						} },
+						"headers": {
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+						}
+					},
+					"403": {
+						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"429": {
+						"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+						"headers": {
+							"Retry-After": {
+								"schema": { "type": "integer" },
+								"description": "Seconds to wait before retrying"
+							},
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+						},
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "rate_limit_exceeded",
+									"message": "Rate limit exceeded"
+								}
+							}
+						} }
+					}
+				},
+				"x-primitive-permission": ["mail:read"]
+			}
+		},
+		"/email-rule-requests/{id}": { "get": {
+			"operationId": "getEmailRuleRequest",
+			"summary": "Read a rule request",
+			"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+			"tags": ["Email Rules"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{
+				"name": "id",
+				"in": "path",
+				"required": true,
+				"description": "The request id.",
+				"schema": {
+					"type": "string",
+					"format": "uuid"
+				}
+			}],
+			"responses": {
+				"200": {
+					"description": "Read a rule request",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"required": ["data"],
+						"properties": { "data": { "$ref": "#/components/schemas/GetEmailRuleRequestResult" } }
+					}] } } },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+					}
+				},
+				"401": {
+					"description": "Invalid or missing API key",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
+							}
+						}
+					} },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+					}
+				},
+				"403": {
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"404": {
+					"description": "not_found: no request you can see has this id.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"429": {
+					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+					"headers": {
+						"Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						},
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+					},
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				}
+			},
+			"x-primitive-permission": ["mail:read"]
+		} },
+		"/email-rule-requests/{id}/decline": { "post": {
+			"operationId": "declineEmailRuleRequest",
+			"summary": "Decline a rule request",
+			"description": "Declines a pending request made to you. Nothing is written but the decision. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+			"tags": ["Email Rules"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{
+				"name": "id",
+				"in": "path",
+				"required": true,
+				"description": "The request id.",
+				"schema": {
+					"type": "string",
+					"format": "uuid"
+				}
+			}, {
+				"name": "Idempotency-Key",
+				"in": "header",
+				"required": false,
+				"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+				"schema": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 255
+				}
+			}],
+			"responses": {
+				"200": {
+					"description": "Decline a rule request",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"required": ["data"],
+						"properties": { "data": { "$ref": "#/components/schemas/DeclineEmailRuleRequestResult" } }
+					}] } } },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+					}
+				},
+				"401": {
+					"description": "Invalid or missing API key",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
+							}
+						}
+					} },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+					}
+				},
+				"403": {
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_request_target_only: only the member the request was made to may decline it.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"404": {
+					"description": "not_found: no request you can see has this id.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"409": {
+					"description": "email_rule_request_not_pending: the request was already accepted, declined or withdrawn (details.status).",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
 					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
@@ -31897,7 +32283,7 @@ const openapiDocument = {
 				"summary": "Create an API key",
 				"tags": ["Credentials"],
 				"security": [{ "BearerAuth": [] }],
-				"description": "Create an API key, super admin or narrowed to a preset or a custom permission set, optionally with an expiry and conditions. The secret is returned once. A key never holds more than the person creating it; the credential policy decides who may create which keys. grant is required: a request without it is refused (400 validation_error, details.reason grant_required), never treated as super admin. A custom key must say which mail it reaches: the addresses and domains it lists (grant.addresses, grant.domains), or every mailbox in the organization with grant.mail_scope \"org\", which cannot be combined with them; one that says neither is refused (400 validation_error, details.reason mail_scope_required). Super admin, Send only and Read only reach every mailbox by definition. members:read is only for an org-wide custom key: naming it with grant.addresses or grant.domains is refused (400). Owners and admins are emailed about every super admin key. Send an Idempotency-Key to retry safely: a second create by the same person under the same key makes no second key and is refused (409 idempotency_key_reused) with the first key's id in error.details.key_id, so a caller whose first answer was lost can revoke that key. The onboarding field is for the dashboard only. The Primitive CLI's token is refused, even with a step-up: keys are created in the dashboard or by an app the person connected. While the organization's keys API is not enabled, this answers 404 feature_disabled, except that a dashboard session may still create a super admin key (the dashboard's own create).\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+				"description": "Create an API key, super admin or narrowed to a preset or a custom permission set, optionally with an expiry and conditions. The secret is returned once. A key never holds more than the person creating it; the credential policy decides who may create which keys. grant is required: a request without it is refused (400 validation_error, details.reason grant_required), never treated as super admin. A custom key must say which mail it reaches: the addresses and domains it lists (grant.addresses, grant.domains), or every mailbox in the organization with grant.mail_scope \"org\", which cannot be combined with them; one that says neither is refused (400 validation_error, details.reason mail_scope_required). Super admin, Send only and Read only reach every mailbox by definition. members:read is only for an org-wide custom key: naming it with grant.addresses or grant.domains is refused (400). Owners and admins are emailed about every super admin key. Send an Idempotency-Key to retry safely: a second create by the same person under the same key makes no second key and is refused (409 idempotency_key_reused) with the first key's id in error.details.key_id, so a caller whose first answer was lost can revoke that key. The onboarding field is for the dashboard only. The Primitive CLI takes the same step-up; the Primitive app's token is refused, even with one. While the organization's keys API is not enabled, this answers 404 feature_disabled, except that a dashboard session may still create a super admin key (the dashboard's own create).\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 				"x-primitive-person-only": {
 					"access": "step_up",
 					"step_up_purpose": "keys.create"
@@ -31927,7 +32313,7 @@ const openapiDocument = {
 						"name": "Primitive-Step-Up",
 						"in": "header",
 						"required": false,
-						"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive CLI and app are refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`).",
+						"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive app is refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`). The Primitive CLI uses one like any app while the organization's keys API is on, and is refused the same way while it is off.",
 						"schema": {
 							"type": "string",
 							"pattern": "^pstep_[0-9a-f]{64}$"
@@ -32178,7 +32564,7 @@ const openapiDocument = {
 			"summary": "Rotate an API key",
 			"tags": ["Credentials"],
 			"security": [{ "BearerAuth": [] }],
-			"description": "Mint a successor with the same grant and return its secret once. The old key keeps working for overlap_seconds, then stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner created is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The Primitive CLI's token is refused, even with a step-up. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+			"description": "Mint a successor with the same grant and return its secret once. The old key keeps working for overlap_seconds, then stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner created is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The Primitive CLI takes the same step-up; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 			"x-primitive-person-only": {
 				"access": "step_up",
 				"step_up_purpose": "keys.create"
@@ -32198,7 +32584,7 @@ const openapiDocument = {
 					"name": "Primitive-Step-Up",
 					"in": "header",
 					"required": false,
-					"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive CLI and app are refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`).",
+					"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive app is refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`). The Primitive CLI uses one like any app while the organization's keys API is on, and is refused the same way while it is off.",
 					"schema": {
 						"type": "string",
 						"pattern": "^pstep_[0-9a-f]{64}$"
@@ -32344,7 +32730,7 @@ const openapiDocument = {
 				"summary": "Change an API key",
 				"tags": ["Credentials"],
 				"security": [{ "BearerAuth": [] }],
-				"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. The Primitive CLI's token is refused, even with a step-up. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+				"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. The Primitive CLI takes the same step-up; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 				"x-primitive-person-only": {
 					"access": "step_up",
 					"step_up_purpose": "keys.create"
@@ -32362,7 +32748,7 @@ const openapiDocument = {
 					"name": "Primitive-Step-Up",
 					"in": "header",
 					"required": false,
-					"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive CLI and app are refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`).",
+					"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive app is refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`). The Primitive CLI uses one like any app while the organization's keys API is on, and is refused the same way while it is off.",
 					"schema": {
 						"type": "string",
 						"pattern": "^pstep_[0-9a-f]{64}$"
@@ -37851,6 +38237,8 @@ const openapiDocument = {
 									"email_rule_request_party_left",
 									"email_rule_request_proposer_only",
 									"email_rule_request_target_only",
+									"email_rule_scope_locked",
+									"email_rule_scope_not_readable",
 									"email_rule_share_ended",
 									"email_rule_share_limit",
 									"embedding_provider_unavailable",
@@ -47602,280 +47990,342 @@ const openapiDocument = {
 					},
 					"evaluation_scope": {
 						"type": "string",
-						"enum": ["author", "own_mailboxes"],
-						"description": "Whose mail an unsaved tree runs over. author, the default: all the mail you can read. own_mailboxes: only mail to your own addresses. Only with tree: a saved rule uses its own."
-					},
-					"rule_id": {
-						"description": "A saved rule you can see. Its current version is tested, with its author's access.",
-						"type": "string",
-						"format": "uuid"
-					},
-					"email_ids": {
-						"description": "Test exactly these emails. Without it, the newest emails the rule can read are tested, at most 200 and none older than 30 days.",
-						"minItems": 1,
-						"maxItems": 200,
-						"type": "array",
-						"items": {
-							"type": "string",
-							"format": "uuid"
-						}
-					},
-					"classify_missing": {
-						"description": "Classify emails in the set that have not been classified yet and arrived more than 2 hours ago, and save their classification. Defaults to true. Newer ones are left to the normal classification and reported pending. The rule is never evaluated on them for real.",
-						"type": "boolean"
-					}
-				},
-				"additionalProperties": false
-			},
-			"TestEmailRuleResult": {
-				"type": "object",
-				"properties": {
-					"rule": {
-						"type": "object",
-						"properties": {
-							"id": {
-								"type": ["string", "null"],
-								"format": "uuid"
-							},
-							"version": {
-								"type": ["integer", "null"],
-								"exclusiveMinimum": 0
-							},
-							"vocabulary": { "type": "string" }
-						},
-						"required": [
-							"id",
-							"version",
-							"vocabulary"
-						]
-					},
-					"window": {
-						"type": "object",
-						"properties": {
-							"mode": {
-								"type": "string",
-								"enum": ["recent", "ids"]
-							},
-							"since": {
-								"type": ["string", "null"],
-								"format": "date-time",
-								"description": "The oldest arrival the recent window reaches; null when email_ids were given."
-							},
-							"limit": {
-								"type": "integer",
-								"minimum": 0
-							}
-						},
-						"required": [
-							"mode",
-							"since",
-							"limit"
-						]
-					},
-					"counts": {
-						"type": "object",
-						"properties": {
-							"emails": {
-								"type": "integer",
-								"minimum": 0
-							},
-							"matched": {
-								"type": "integer",
-								"minimum": 0
-							},
-							"near_miss": {
-								"type": "integer",
-								"minimum": 0
-							},
-							"no_match": {
-								"type": "integer",
-								"minimum": 0
-							},
-							"unclassified": {
-								"type": "integer",
-								"minimum": 0
-							},
-							"not_found": {
-								"type": "integer",
-								"minimum": 0
-							}
-						},
-						"required": [
-							"emails",
-							"matched",
-							"near_miss",
-							"no_match",
-							"unclassified",
-							"not_found"
-						]
-					},
-					"classification": {
-						"type": "object",
-						"properties": {
-							"classified_now": {
-								"type": "integer",
-								"minimum": 0,
-								"description": "Emails this test classified and saved."
-							},
-							"still_unclassified": {
-								"type": "integer",
-								"minimum": 0,
-								"description": "Emails left without a classification."
-							}
-						},
-						"required": ["classified_now", "still_unclassified"]
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						],
+						"description": "author: all mail its author can read. own_mailboxes: mail to their own addresses. selected: what scope_selection names. Never more than the author can read."
+					},
+					"scope_selection": {
+						"type": "object",
+						"properties": {
+							"addresses": {
+								"maxItems": 100,
+								"type": "array",
+								"items": {
+									"type": "string",
+									"minLength": 3,
+									"maxLength": 320,
+									"pattern": "^[^\\s@]+@[^\\s@]+$"
+								}
+							},
+							"domains": {
+								"maxItems": 50,
+								"type": "array",
+								"items": {
+									"type": "string",
+									"minLength": 1,
+									"maxLength": 253,
+									"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+								}
+							}
+						},
+						"additionalProperties": false,
+						"description": "Inboxes, and domains (every address at them the author can read), for a selected rule; each one you can read."
+					},
+					"rule_id": {
+						"description": "A saved rule you can see. Its current version is tested, with its author's access.",
+						"type": "string",
+						"format": "uuid"
+					},
+					"email_ids": {
+						"description": "Test exactly these emails. Without it, the newest emails the rule can read are tested, at most 200 and none older than 30 days.",
+						"minItems": 1,
+						"maxItems": 200,
+						"type": "array",
+						"items": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"classify_missing": {
+						"description": "Classify emails in the set that have not been classified yet and arrived more than 2 hours ago, and save their classification. Defaults to true. Newer ones are left to the normal classification and reported pending. The rule is never evaluated on them for real.",
+						"type": "boolean"
+					}
+				},
+				"additionalProperties": false
+			},
+			"TestEmailRuleResult": {
+				"type": "object",
+				"properties": {
+					"rule": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": ["string", "null"],
+								"format": "uuid"
+							},
+							"version": {
+								"type": ["integer", "null"],
+								"exclusiveMinimum": 0
+							},
+							"vocabulary": { "type": "string" }
+						},
+						"required": [
+							"id",
+							"version",
+							"vocabulary"
+						]
+					},
+					"window": {
+						"type": "object",
+						"properties": {
+							"mode": {
+								"type": "string",
+								"enum": ["recent", "ids"]
+							},
+							"since": {
+								"type": ["string", "null"],
+								"format": "date-time",
+								"description": "The oldest arrival the recent window reaches; null when email_ids were given."
+							},
+							"limit": {
+								"type": "integer",
+								"minimum": 0
+							}
+						},
+						"required": [
+							"mode",
+							"since",
+							"limit"
+						]
+					},
+					"counts": {
+						"type": "object",
+						"properties": {
+							"emails": {
+								"type": "integer",
+								"minimum": 0
+							},
+							"matched": {
+								"type": "integer",
+								"minimum": 0
+							},
+							"near_miss": {
+								"type": "integer",
+								"minimum": 0
+							},
+							"no_match": {
+								"type": "integer",
+								"minimum": 0
+							},
+							"unclassified": {
+								"type": "integer",
+								"minimum": 0
+							},
+							"not_found": {
+								"type": "integer",
+								"minimum": 0
+							}
+						},
+						"required": [
+							"emails",
+							"matched",
+							"near_miss",
+							"no_match",
+							"unclassified",
+							"not_found"
+						]
+					},
+					"classification": {
+						"type": "object",
+						"properties": {
+							"classified_now": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Emails this test classified and saved."
+							},
+							"still_unclassified": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Emails left without a classification."
+							}
+						},
+						"required": ["classified_now", "still_unclassified"]
+					},
+					"questions": {
+						"type": "object",
+						"properties": {
+							"asked": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Calls made to answer the rule's questions, one per matching email."
+							},
+							"capped": {
+								"type": "boolean",
+								"description": "Whether the per-test limit on those calls was reached."
+							}
+						},
+						"required": ["asked", "capped"]
+					},
+					"results": {
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"email_id": {
+									"type": "string",
+									"format": "uuid"
+								},
+								"outcome": {
+									"type": "string",
+									"enum": [
+										"matched",
+										"near_miss",
+										"no_match",
+										"unclassified",
+										"not_found"
+									],
+									"description": "not_found: no such email, or not one the rule can read (or not settled, held back, or being removed)."
+								},
+								"received_at": {
+									"type": "string",
+									"format": "date-time"
+								},
+								"from_address": { "type": ["string", "null"] },
+								"subject": { "type": ["string", "null"] },
+								"parts": {
+									"description": "How each top-level part of the rule decided. Present for matched, near_miss and no_match.",
+									"type": "array",
+									"items": {
+										"type": "object",
+										"properties": {
+											"index": {
+												"type": "integer",
+												"minimum": 0
+											},
+											"matched": { "type": "boolean" },
+											"columns": {
+												"type": "array",
+												"items": { "type": "string" }
+											}
+										},
+										"required": [
+											"index",
+											"matched",
+											"columns"
+										]
+									}
+								},
+								"missing_facts": {
+									"description": "Facts the rule reads that this email's classification left out, so the rule did not match.",
+									"type": "array",
+									"items": { "type": "string" }
+								},
+								"question_answers": {
+									"description": "The answers to the rule's own questions, asked only when its conditions matched.",
+									"type": "array",
+									"items": {
+										"type": "object",
+										"properties": {
+											"question": { "type": "string" },
+											"answer": { "type": ["boolean", "null"] },
+											"probability": { "type": ["number", "null"] },
+											"error_class": { "type": "string" }
+										},
+										"required": [
+											"question",
+											"answer",
+											"probability"
+										]
+									}
+								},
+								"unclassified_reason": {
+									"description": "Why an unclassified email has no classification. pending: not reached before the test stopped, or not classified here (it arrived within the last 2 hours and normal classification has not finished with it, or classify_missing was false); run the test again later.",
+									"type": "string",
+									"enum": [
+										"pending",
+										"classifier_unavailable",
+										"classification_failed",
+										"not_classifiable"
+									]
+								}
+							},
+							"required": ["email_id", "outcome"]
+						},
+						"description": "Newest first; with email_ids, the ids not found follow in the order given."
+					}
+				},
+				"required": [
+					"rule",
+					"window",
+					"counts",
+					"classification",
+					"questions",
+					"results"
+				]
+			},
+			"TestEmailRuleOnSampleRequest": {
+				"type": "object",
+				"properties": {
+					"tree": {
+						"description": "An unsaved rule tree, as POST /email-rules/compile returned it. Give tree or rule_id, not both.",
+						"type": "object",
+						"properties": {
+							"version": {
+								"type": "number",
+								"const": 1
+							},
+							"vocabulary": {
+								"type": "string",
+								"description": "The column contract version the rule is written against, for example v1."
+							},
+							"when": {
+								"type": "object",
+								"propertyNames": { "type": "string" },
+								"additionalProperties": {},
+								"description": "The rule's conditions: a condition ({column, op, value?, min_confidence?}) or a group ({all: [...]}, {any: [...]} or {not: ...})."
+							},
+							"questions": {
+								"type": "array",
+								"items": { "type": "string" },
+								"description": "Yes/no questions of the rule's own, asked about an email only after its conditions match. An email matches only if every answer is yes."
+							}
+						},
+						"required": [
+							"version",
+							"vocabulary",
+							"when",
+							"questions"
+						],
+						"additionalProperties": false
+					},
+					"evaluation_scope": {
+						"type": "string",
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						],
+						"description": "author: all mail its author can read. own_mailboxes: mail to their own addresses. selected: what scope_selection names. Never more than the author can read."
 					},
-					"questions": {
+					"scope_selection": {
 						"type": "object",
 						"properties": {
-							"asked": {
-								"type": "integer",
-								"minimum": 0,
-								"description": "Calls made to answer the rule's questions, one per matching email."
-							},
-							"capped": {
-								"type": "boolean",
-								"description": "Whether the per-test limit on those calls was reached."
-							}
-						},
-						"required": ["asked", "capped"]
-					},
-					"results": {
-						"type": "array",
-						"items": {
-							"type": "object",
-							"properties": {
-								"email_id": {
-									"type": "string",
-									"format": "uuid"
-								},
-								"outcome": {
-									"type": "string",
-									"enum": [
-										"matched",
-										"near_miss",
-										"no_match",
-										"unclassified",
-										"not_found"
-									],
-									"description": "not_found: no such email, or not one the rule can read (or not settled, held back, or being removed)."
-								},
-								"received_at": {
-									"type": "string",
-									"format": "date-time"
-								},
-								"from_address": { "type": ["string", "null"] },
-								"subject": { "type": ["string", "null"] },
-								"parts": {
-									"description": "How each top-level part of the rule decided. Present for matched, near_miss and no_match.",
-									"type": "array",
-									"items": {
-										"type": "object",
-										"properties": {
-											"index": {
-												"type": "integer",
-												"minimum": 0
-											},
-											"matched": { "type": "boolean" },
-											"columns": {
-												"type": "array",
-												"items": { "type": "string" }
-											}
-										},
-										"required": [
-											"index",
-											"matched",
-											"columns"
-										]
-									}
-								},
-								"missing_facts": {
-									"description": "Facts the rule reads that this email's classification left out, so the rule did not match.",
-									"type": "array",
-									"items": { "type": "string" }
-								},
-								"question_answers": {
-									"description": "The answers to the rule's own questions, asked only when its conditions matched.",
-									"type": "array",
-									"items": {
-										"type": "object",
-										"properties": {
-											"question": { "type": "string" },
-											"answer": { "type": ["boolean", "null"] },
-											"probability": { "type": ["number", "null"] },
-											"error_class": { "type": "string" }
-										},
-										"required": [
-											"question",
-											"answer",
-											"probability"
-										]
-									}
-								},
-								"unclassified_reason": {
-									"description": "Why an unclassified email has no classification. pending: not reached before the test stopped, or not classified here (it arrived within the last 2 hours and normal classification has not finished with it, or classify_missing was false); run the test again later.",
+							"addresses": {
+								"maxItems": 100,
+								"type": "array",
+								"items": {
 									"type": "string",
-									"enum": [
-										"pending",
-										"classifier_unavailable",
-										"classification_failed",
-										"not_classifiable"
-									]
+									"minLength": 3,
+									"maxLength": 320,
+									"pattern": "^[^\\s@]+@[^\\s@]+$"
 								}
 							},
-							"required": ["email_id", "outcome"]
-						},
-						"description": "Newest first; with email_ids, the ids not found follow in the order given."
-					}
-				},
-				"required": [
-					"rule",
-					"window",
-					"counts",
-					"classification",
-					"questions",
-					"results"
-				]
-			},
-			"TestEmailRuleOnSampleRequest": {
-				"type": "object",
-				"properties": {
-					"tree": {
-						"description": "An unsaved rule tree, as POST /email-rules/compile returned it. Give tree or rule_id, not both.",
-						"type": "object",
-						"properties": {
-							"version": {
-								"type": "number",
-								"const": 1
-							},
-							"vocabulary": {
-								"type": "string",
-								"description": "The column contract version the rule is written against, for example v1."
-							},
-							"when": {
-								"type": "object",
-								"propertyNames": { "type": "string" },
-								"additionalProperties": {},
-								"description": "The rule's conditions: a condition ({column, op, value?, min_confidence?}) or a group ({all: [...]}, {any: [...]} or {not: ...})."
-							},
-							"questions": {
+							"domains": {
+								"maxItems": 50,
 								"type": "array",
-								"items": { "type": "string" },
-								"description": "Yes/no questions of the rule's own, asked about an email only after its conditions match. An email matches only if every answer is yes."
+								"items": {
+									"type": "string",
+									"minLength": 1,
+									"maxLength": 253,
+									"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+								}
 							}
 						},
-						"required": [
-							"version",
-							"vocabulary",
-							"when",
-							"questions"
-						],
-						"additionalProperties": false
-					},
-					"evaluation_scope": {
-						"type": "string",
-						"enum": ["author", "own_mailboxes"],
-						"description": "Whose mail an unsaved tree runs over. author, the default: all the mail you can read. own_mailboxes: only mail to your own addresses. Only with tree: a saved rule uses its own."
+						"additionalProperties": false,
+						"description": "Inboxes, and domains (every address at them the author can read), for a selected rule; each one you can read."
 					},
 					"rule_id": {
 						"description": "A saved rule you can see. Its current version is tested.",
@@ -48110,6 +48560,42 @@ const openapiDocument = {
 						"type": "string",
 						"enum": ["draft", "observe"]
 					},
+					"evaluation_scope": {
+						"type": "string",
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						],
+						"description": "author: all mail its author can read. own_mailboxes: mail to their own addresses. selected: what scope_selection names. Never more than the author can read."
+					},
+					"scope_selection": {
+						"type": "object",
+						"properties": {
+							"addresses": {
+								"maxItems": 100,
+								"type": "array",
+								"items": {
+									"type": "string",
+									"minLength": 3,
+									"maxLength": 320,
+									"pattern": "^[^\\s@]+@[^\\s@]+$"
+								}
+							},
+							"domains": {
+								"maxItems": 50,
+								"type": "array",
+								"items": {
+									"type": "string",
+									"minLength": 1,
+									"maxLength": 253,
+									"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+								}
+							}
+						},
+						"additionalProperties": false,
+						"description": "Inboxes, and domains (every address at them the author can read), for a selected rule; each one you can read."
+					},
 					"english": {
 						"type": "string",
 						"minLength": 1,
@@ -48595,6 +49081,42 @@ const openapiDocument = {
 						"type": "string",
 						"minLength": 1,
 						"maxLength": 64
+					},
+					"evaluation_scope": {
+						"type": "string",
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						],
+						"description": "author: all mail its author can read. own_mailboxes: mail to their own addresses. selected: what scope_selection names. Never more than the author can read."
+					},
+					"scope_selection": {
+						"type": "object",
+						"properties": {
+							"addresses": {
+								"maxItems": 100,
+								"type": "array",
+								"items": {
+									"type": "string",
+									"minLength": 3,
+									"maxLength": 320,
+									"pattern": "^[^\\s@]+@[^\\s@]+$"
+								}
+							},
+							"domains": {
+								"maxItems": 50,
+								"type": "array",
+								"items": {
+									"type": "string",
+									"minLength": 1,
+									"maxLength": 253,
+									"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+								}
+							}
+						},
+						"additionalProperties": false,
+						"description": "Inboxes, and domains (every address at them the author can read), for a selected rule; each one you can read."
 					}
 				},
 				"additionalProperties": false
@@ -48792,6 +49314,347 @@ const openapiDocument = {
 					]
 				}
 			},
+			"ListEmailRuleResultsResult": {
+				"type": "object",
+				"properties": {
+					"rules": {
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"id": {
+									"type": "string",
+									"format": "uuid"
+								},
+								"name": { "type": "string" },
+								"state": {
+									"type": "string",
+									"enum": [
+										"draft",
+										"observe",
+										"active"
+									]
+								},
+								"decision": {
+									"type": ["object", "null"],
+									"properties": {
+										"rule_version": {
+											"type": "integer",
+											"exclusiveMinimum": 0,
+											"description": "The version of the rule that decided."
+										},
+										"matched": { "type": "boolean" },
+										"parts": {
+											"type": "array",
+											"items": {
+												"type": "object",
+												"properties": {
+													"index": {
+														"type": "integer",
+														"minimum": 0
+													},
+													"matched": { "type": "boolean" },
+													"columns": {
+														"type": "array",
+														"items": { "type": "string" }
+													}
+												},
+												"required": [
+													"index",
+													"matched",
+													"columns"
+												]
+											},
+											"description": "How each top-level part of the rule decided. Empty when a fact the rule reads was missing, so it was not evaluated."
+										},
+										"question_answers": {
+											"type": "array",
+											"items": {
+												"type": "object",
+												"properties": {
+													"question": { "type": "string" },
+													"answer": { "type": ["boolean", "null"] },
+													"probability": { "type": ["number", "null"] },
+													"error_class": { "type": "string" }
+												},
+												"required": [
+													"question",
+													"answer",
+													"probability"
+												]
+											},
+											"description": "The answers to the rule's own questions, asked only when its conditions matched."
+										},
+										"tree": {
+											"type": ["object", "null"],
+											"properties": {
+												"version": {
+													"type": "number",
+													"const": 1
+												},
+												"vocabulary": {
+													"type": "string",
+													"description": "The column contract version the rule is written against, for example v1."
+												},
+												"when": {
+													"type": "object",
+													"propertyNames": { "type": "string" },
+													"additionalProperties": {},
+													"description": "The rule's conditions: a condition ({column, op, value?, min_confidence?}) or a group ({all: [...]}, {any: [...]} or {not: ...})."
+												},
+												"questions": {
+													"type": "array",
+													"items": { "type": "string" },
+													"description": "Yes/no questions of the rule's own, asked about an email only after its conditions match. An email matches only if every answer is yes."
+												}
+											},
+											"required": [
+												"version",
+												"vocabulary",
+												"when",
+												"questions"
+											],
+											"description": "The conditions and questions of the version that decided, so the result reads in that version's words."
+										},
+										"created_at": {
+											"type": "string",
+											"format": "date-time"
+										}
+									},
+									"required": [
+										"rule_version",
+										"matched",
+										"parts",
+										"question_answers",
+										"tree",
+										"created_at"
+									],
+									"description": "What the rule most recently decided about this email; null when it has not run on it."
+								},
+								"not_run_reason": {
+									"type": ["string", "null"],
+									"enum": [
+										"draft",
+										"created_after_email",
+										null
+									],
+									"description": "What is known about a rule with no result on this email. draft: the rule is a draft now. created_after_email: the rule was created after the email arrived. Null when it has a result, or when nothing is known."
+								}
+							},
+							"required": [
+								"id",
+								"name",
+								"state",
+								"decision",
+								"not_run_reason"
+							]
+						},
+						"description": "Every rule the caller can see: those that matched this email, then those that did not, then those that have not run on it; newest rule first within each."
+					},
+					"hidden": {
+						"type": "integer",
+						"minimum": 0,
+						"description": "How many more rules the caller can see that are not listed."
+					}
+				},
+				"required": ["rules", "hidden"]
+			},
+			"ListEmailRuleVersionsResult": {
+				"type": "array",
+				"items": {
+					"type": "object",
+					"properties": {
+						"version": {
+							"type": "integer",
+							"exclusiveMinimum": 0
+						},
+						"english": { "type": "string" },
+						"tree": {
+							"type": "object",
+							"properties": {
+								"version": {
+									"type": "number",
+									"const": 1
+								},
+								"vocabulary": {
+									"type": "string",
+									"description": "The column contract version the rule is written against, for example v1."
+								},
+								"when": {
+									"type": "object",
+									"propertyNames": { "type": "string" },
+									"additionalProperties": {},
+									"description": "The rule's conditions: a condition ({column, op, value?, min_confidence?}) or a group ({all: [...]}, {any: [...]} or {not: ...})."
+								},
+								"questions": {
+									"type": "array",
+									"items": { "type": "string" },
+									"description": "Yes/no questions of the rule's own, asked about an email only after its conditions match. An email matches only if every answer is yes."
+								}
+							},
+							"required": [
+								"version",
+								"vocabulary",
+								"when",
+								"questions"
+							]
+						},
+						"explanation": { "type": "string" },
+						"assumptions": {
+							"type": "array",
+							"items": { "type": "string" }
+						},
+						"warnings": {
+							"type": "array",
+							"items": { "type": "string" }
+						},
+						"compiled_by": {
+							"type": "string",
+							"description": "Who produced the tree, as the caller stated it when saving (not verified), for example rule-compiler-v1 or member."
+						},
+						"vocabulary": { "type": "string" },
+						"created_at": {
+							"type": "string",
+							"format": "date-time"
+						},
+						"sql": {
+							"description": "Present only when include_sql was true.",
+							"type": "object",
+							"properties": {
+								"expression": {
+									"type": "string",
+									"description": "A parameterized boolean expression over one row per email."
+								},
+								"params": {
+									"type": "array",
+									"items": {},
+									"description": "The values bound to $1, $2 and so on."
+								}
+							},
+							"required": ["expression", "params"]
+						}
+					},
+					"required": [
+						"version",
+						"english",
+						"tree",
+						"explanation",
+						"assumptions",
+						"warnings",
+						"compiled_by",
+						"vocabulary",
+						"created_at"
+					]
+				}
+			},
+			"GetEmailRuleScopeResult": {
+				"type": "object",
+				"properties": {
+					"evaluation_scope": {
+						"type": "string",
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						],
+						"description": "author: all mail its author can read. own_mailboxes: mail to their own addresses. selected: what scope_selection names. Never more than the author can read."
+					},
+					"scope_selection": {
+						"type": ["object", "null"],
+						"properties": {
+							"addresses": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"domains": {
+								"type": "array",
+								"items": { "type": "string" }
+							}
+						},
+						"required": ["addresses", "domains"]
+					},
+					"locked": {
+						"type": "boolean",
+						"description": "Shared, so its scope cannot change."
+					},
+					"author_reach": {
+						"type": ["string", "null"],
+						"enum": [
+							"organization",
+							"limited",
+							"own",
+							null
+						],
+						"description": "How much its author can read now; null when it cannot run as them."
+					},
+					"no_longer_readable": {
+						"type": "object",
+						"properties": {
+							"addresses": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"domains": {
+								"type": "array",
+								"items": { "type": "string" }
+							}
+						},
+						"required": ["addresses", "domains"],
+						"description": "What scope_selection names that its author no longer reads in full."
+					},
+					"stopped_reason": {
+						"description": "Why it cannot run now (a reason as on POST /email-rules/test), or null.",
+						"type": ["string", "null"]
+					}
+				},
+				"required": [
+					"evaluation_scope",
+					"scope_selection",
+					"locked",
+					"author_reach",
+					"no_longer_readable",
+					"stopped_reason"
+				]
+			},
+			"ListEmailRuleScopeOptionsResult": {
+				"type": "object",
+				"properties": {
+					"reach": {
+						"type": "string",
+						"enum": [
+							"organization",
+							"limited",
+							"own"
+						],
+						"description": "organization: all of the organization's mail. own: only your own. limited: some inboxes or domains."
+					},
+					"own_mail": {
+						"type": "boolean",
+						"description": "Whether a rule over only your own mail would run for you."
+					},
+					"addresses": {
+						"type": "array",
+						"items": { "type": "string" },
+						"description": "Inboxes you can read, matching q."
+					},
+					"domains": {
+						"type": "array",
+						"items": { "type": "string" },
+						"description": "Domains you can read, matching q."
+					},
+					"more": {
+						"type": "boolean",
+						"description": "More match than are listed."
+					}
+				},
+				"required": [
+					"reach",
+					"own_mail",
+					"addresses",
+					"domains",
+					"more"
+				]
+			},
 			"CreateEmailRuleRequestRequest": {
 				"type": "object",
 				"properties": {
@@ -67819,7 +68682,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "create-key",
-		"description": "Create an API key, super admin or narrowed to a preset or a custom permission set, optionally with an expiry and conditions. The secret is returned once. A key never holds more than the person creating it; the credential policy decides who may create which keys. grant is required: a request without it is refused (400 validation_error, details.reason grant_required), never treated as super admin. A custom key must say which mail it reaches: the addresses and domains it lists (grant.addresses, grant.domains), or every mailbox in the organization with grant.mail_scope \"org\", which cannot be combined with them; one that says neither is refused (400 validation_error, details.reason mail_scope_required). Super admin, Send only and Read only reach every mailbox by definition. members:read is only for an org-wide custom key: naming it with grant.addresses or grant.domains is refused (400). Owners and admins are emailed about every super admin key. Send an Idempotency-Key to retry safely: a second create by the same person under the same key makes no second key and is refused (409 idempotency_key_reused) with the first key's id in error.details.key_id, so a caller whose first answer was lost can revoke that key. The onboarding field is for the dashboard only. The Primitive CLI's token is refused, even with a step-up: keys are created in the dashboard or by an app the person connected. While the organization's keys API is not enabled, this answers 404 feature_disabled, except that a dashboard session may still create a super admin key (the dashboard's own create).\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+		"description": "Create an API key, super admin or narrowed to a preset or a custom permission set, optionally with an expiry and conditions. The secret is returned once. A key never holds more than the person creating it; the credential policy decides who may create which keys. grant is required: a request without it is refused (400 validation_error, details.reason grant_required), never treated as super admin. A custom key must say which mail it reaches: the addresses and domains it lists (grant.addresses, grant.domains), or every mailbox in the organization with grant.mail_scope \"org\", which cannot be combined with them; one that says neither is refused (400 validation_error, details.reason mail_scope_required). Super admin, Send only and Read only reach every mailbox by definition. members:read is only for an org-wide custom key: naming it with grant.addresses or grant.domains is refused (400). Owners and admins are emailed about every super admin key. Send an Idempotency-Key to retry safely: a second create by the same person under the same key makes no second key and is refused (409 idempotency_key_reused) with the first key's id in error.details.key_id, so a caller whose first answer was lost can revoke that key. The onboarding field is for the dashboard only. The Primitive CLI takes the same step-up; the Primitive app's token is refused, even with one. While the organization's keys API is not enabled, this answers 404 feature_disabled, except that a dashboard session may still create a super admin key (the dashboard's own create).\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "createKey",
@@ -67842,7 +68705,7 @@ const operationManifest = [
 				"type": "string"
 			},
 			{
-				"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive CLI and app are refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`).",
+				"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive app is refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`). The Primitive CLI uses one like any app while the organization's keys API is on, and is refused the same way while it is off.",
 				"enum": null,
 				"name": "Primitive-Step-Up",
 				"required": false,
@@ -69246,7 +70109,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "rotate-key",
-		"description": "Mint a successor with the same grant and return its secret once. The old key keeps working for overlap_seconds, then stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner created is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The Primitive CLI's token is refused, even with a step-up. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+		"description": "Mint a successor with the same grant and return its secret once. The old key keeps working for overlap_seconds, then stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner created is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The Primitive CLI takes the same step-up; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "rotateKey",
@@ -69260,7 +70123,7 @@ const operationManifest = [
 		}],
 		"queryParams": [],
 		"headerParams": [{
-			"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive CLI and app are refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`).",
+			"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive app is refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`). The Primitive CLI uses one like any app while the organization's keys API is on, and is refused the same way while it is off.",
 			"enum": null,
 			"name": "Primitive-Step-Up",
 			"required": false,
@@ -69406,7 +70269,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "update-key",
-		"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. The Primitive CLI's token is refused, even with a step-up. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+		"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. The Primitive CLI takes the same step-up; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 		"hasJsonBody": true,
 		"method": "PATCH",
 		"operationId": "updateKey",
@@ -69420,7 +70283,7 @@ const operationManifest = [
 		}],
 		"queryParams": [],
 		"headerParams": [{
-			"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive CLI and app are refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`).",
+			"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive app is refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`). The Primitive CLI uses one like any app while the organization's keys API is on, and is refused the same way while it is off.",
 			"enum": null,
 			"name": "Primitive-Step-Up",
 			"required": false,
@@ -72090,7 +72953,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "create-email-rule",
-		"description": "Saves a rule as version 1, from a compile response or a tree you wrote. The tree is checked against the column contract. New rules start in observe, where what the rule matches is recorded and nothing is granted; draft is not evaluated. The caller is the rule's author, and the rule never reaches mail the author cannot read. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"description": "Saves a rule as version 1, from a compile response or a tree you wrote. The tree is checked against the column contract. New rules start in observe, where what the rule matches is recorded and nothing is granted; draft is not evaluated. The caller is the rule's author, and the rule never reaches mail the author cannot read. evaluation_scope (author when omitted) chooses whose mail it runs over; scope_selection may name only what you can read. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "createEmailRule",
@@ -72119,6 +72982,42 @@ const operationManifest = [
 					"type": "string",
 					"enum": ["draft", "observe"]
 				},
+				"evaluation_scope": {
+					"type": "string",
+					"enum": [
+						"author",
+						"own_mailboxes",
+						"selected"
+					],
+					"description": "author: all mail its author can read. own_mailboxes: mail to their own addresses. selected: what scope_selection names. Never more than the author can read."
+				},
+				"scope_selection": {
+					"type": "object",
+					"properties": {
+						"addresses": {
+							"maxItems": 100,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 3,
+								"maxLength": 320,
+								"pattern": "^[^\\s@]+@[^\\s@]+$"
+							}
+						},
+						"domains": {
+							"maxItems": 50,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 253,
+								"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+							}
+						}
+					},
+					"additionalProperties": false,
+					"description": "Inboxes, and domains (every address at them the author can read), for a selected rule; each one you can read."
+				},
 				"english": {
 					"type": "string",
 					"minLength": 1,
@@ -73231,6 +74130,100 @@ const operationManifest = [
 		"tag": "Email Rules",
 		"tagCommand": "email-rules"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-email-rule-scope",
+		"description": "Whose mail the rule runs over, and what that comes to now: a rule never reaches further than what its author can read when it runs, so what a selected rule names and its author can no longer read stops matching. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getEmailRuleScope",
+		"path": "/email-rules/{id}/scope",
+		"pathParams": [{
+			"description": "The rule id.",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"headerParams": [],
+		"permissions": ["mail:read"],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"evaluation_scope": {
+					"type": "string",
+					"enum": [
+						"author",
+						"own_mailboxes",
+						"selected"
+					],
+					"description": "author: all mail its author can read. own_mailboxes: mail to their own addresses. selected: what scope_selection names. Never more than the author can read."
+				},
+				"scope_selection": {
+					"type": ["object", "null"],
+					"properties": {
+						"addresses": {
+							"type": "array",
+							"items": { "type": "string" }
+						},
+						"domains": {
+							"type": "array",
+							"items": { "type": "string" }
+						}
+					},
+					"required": ["addresses", "domains"]
+				},
+				"locked": {
+					"type": "boolean",
+					"description": "Shared, so its scope cannot change."
+				},
+				"author_reach": {
+					"type": ["string", "null"],
+					"enum": [
+						"organization",
+						"limited",
+						"own",
+						null
+					],
+					"description": "How much its author can read now; null when it cannot run as them."
+				},
+				"no_longer_readable": {
+					"type": "object",
+					"properties": {
+						"addresses": {
+							"type": "array",
+							"items": { "type": "string" }
+						},
+						"domains": {
+							"type": "array",
+							"items": { "type": "string" }
+						}
+					},
+					"required": ["addresses", "domains"],
+					"description": "What scope_selection names that its author no longer reads in full."
+				},
+				"stopped_reason": {
+					"description": "Why it cannot run now (a reason as on POST /email-rules/test), or null.",
+					"type": ["string", "null"]
+				}
+			},
+			"required": [
+				"evaluation_scope",
+				"scope_selection",
+				"locked",
+				"author_reach",
+				"no_longer_readable",
+				"stopped_reason"
+			]
+		},
+		"sdkName": "getEmailRuleScope",
+		"summary": "Read what a rule covers",
+		"tag": "Email Rules",
+		"tagCommand": "email-rules"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -73742,6 +74735,240 @@ const operationManifest = [
 		"tag": "Email Rules",
 		"tagCommand": "email-rules"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-email-rule-results",
+		"description": "Every rule the caller can see and what it decided about this email: those that matched, those that did not, and those that have not run on it, with what is known about them. A result names the version of the rule that decided and carries that version's conditions and questions. Only a caller who can read the email gets an answer, and a rule the caller cannot see is left out. At most 50 rules are listed, those with a result first; hidden counts the rest. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listEmailRuleResults",
+		"path": "/emails/{id}/rule-results",
+		"pathParams": [{
+			"description": "The email id.",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"headerParams": [],
+		"permissions": ["mail:read"],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"rules": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"name": { "type": "string" },
+							"state": {
+								"type": "string",
+								"enum": [
+									"draft",
+									"observe",
+									"active"
+								]
+							},
+							"decision": {
+								"type": ["object", "null"],
+								"properties": {
+									"rule_version": {
+										"type": "integer",
+										"exclusiveMinimum": 0,
+										"description": "The version of the rule that decided."
+									},
+									"matched": { "type": "boolean" },
+									"parts": {
+										"type": "array",
+										"items": {
+											"type": "object",
+											"properties": {
+												"index": {
+													"type": "integer",
+													"minimum": 0
+												},
+												"matched": { "type": "boolean" },
+												"columns": {
+													"type": "array",
+													"items": { "type": "string" }
+												}
+											},
+											"required": [
+												"index",
+												"matched",
+												"columns"
+											]
+										},
+										"description": "How each top-level part of the rule decided. Empty when a fact the rule reads was missing, so it was not evaluated."
+									},
+									"question_answers": {
+										"type": "array",
+										"items": {
+											"type": "object",
+											"properties": {
+												"question": { "type": "string" },
+												"answer": { "type": ["boolean", "null"] },
+												"probability": { "type": ["number", "null"] },
+												"error_class": { "type": "string" }
+											},
+											"required": [
+												"question",
+												"answer",
+												"probability"
+											]
+										},
+										"description": "The answers to the rule's own questions, asked only when its conditions matched."
+									},
+									"tree": {
+										"type": ["object", "null"],
+										"properties": {
+											"version": {
+												"type": "number",
+												"const": 1
+											},
+											"vocabulary": {
+												"type": "string",
+												"description": "The column contract version the rule is written against, for example v1."
+											},
+											"when": {
+												"type": "object",
+												"propertyNames": { "type": "string" },
+												"additionalProperties": {},
+												"description": "The rule's conditions: a condition ({column, op, value?, min_confidence?}) or a group ({all: [...]}, {any: [...]} or {not: ...})."
+											},
+											"questions": {
+												"type": "array",
+												"items": { "type": "string" },
+												"description": "Yes/no questions of the rule's own, asked about an email only after its conditions match. An email matches only if every answer is yes."
+											}
+										},
+										"required": [
+											"version",
+											"vocabulary",
+											"when",
+											"questions"
+										],
+										"description": "The conditions and questions of the version that decided, so the result reads in that version's words."
+									},
+									"created_at": {
+										"type": "string",
+										"format": "date-time"
+									}
+								},
+								"required": [
+									"rule_version",
+									"matched",
+									"parts",
+									"question_answers",
+									"tree",
+									"created_at"
+								],
+								"description": "What the rule most recently decided about this email; null when it has not run on it."
+							},
+							"not_run_reason": {
+								"type": ["string", "null"],
+								"enum": [
+									"draft",
+									"created_after_email",
+									null
+								],
+								"description": "What is known about a rule with no result on this email. draft: the rule is a draft now. created_after_email: the rule was created after the email arrived. Null when it has a result, or when nothing is known."
+							}
+						},
+						"required": [
+							"id",
+							"name",
+							"state",
+							"decision",
+							"not_run_reason"
+						]
+					},
+					"description": "Every rule the caller can see: those that matched this email, then those that did not, then those that have not run on it; newest rule first within each."
+				},
+				"hidden": {
+					"type": "integer",
+					"minimum": 0,
+					"description": "How many more rules the caller can see that are not listed."
+				}
+			},
+			"required": ["rules", "hidden"]
+		},
+		"sdkName": "listEmailRuleResults",
+		"summary": "List every rule's result on an email",
+		"tag": "Email Rules",
+		"tagCommand": "email-rules"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-email-rule-scope-options",
+		"description": "How much the caller can read, and the inboxes and domains the caller can read, which is what they may name when a rule runs over selected inboxes and domains. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listEmailRuleScopeOptions",
+		"path": "/email-rule-scope-options",
+		"pathParams": [],
+		"queryParams": [{
+			"description": "Only inboxes and domains containing this text.",
+			"enum": null,
+			"name": "q",
+			"required": false,
+			"type": "string"
+		}],
+		"headerParams": [],
+		"permissions": ["mail:read"],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"reach": {
+					"type": "string",
+					"enum": [
+						"organization",
+						"limited",
+						"own"
+					],
+					"description": "organization: all of the organization's mail. own: only your own. limited: some inboxes or domains."
+				},
+				"own_mail": {
+					"type": "boolean",
+					"description": "Whether a rule over only your own mail would run for you."
+				},
+				"addresses": {
+					"type": "array",
+					"items": { "type": "string" },
+					"description": "Inboxes you can read, matching q."
+				},
+				"domains": {
+					"type": "array",
+					"items": { "type": "string" },
+					"description": "Domains you can read, matching q."
+				},
+				"more": {
+					"type": "boolean",
+					"description": "More match than are listed."
+				}
+			},
+			"required": [
+				"reach",
+				"own_mail",
+				"addresses",
+				"domains",
+				"more"
+			]
+		},
+		"sdkName": "listEmailRuleScopeOptions",
+		"summary": "List what a rule can cover",
+		"tag": "Email Rules",
+		"tagCommand": "email-rules"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -74266,6 +75493,125 @@ const operationManifest = [
 		"tag": "Email Rules",
 		"tagCommand": "email-rules"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-email-rule-versions",
+		"description": "The named versions of a rule, as they were written: what each one's conditions and questions were, so a decision can be read against the version that made it. Numbers that are not versions of the rule are left out. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listEmailRuleVersions",
+		"path": "/email-rules/{id}/versions",
+		"pathParams": [{
+			"description": "The rule id.",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [{
+			"description": "The version numbers, comma-separated, at most 100.",
+			"enum": null,
+			"name": "versions",
+			"required": true,
+			"type": "string"
+		}],
+		"headerParams": [],
+		"permissions": ["mail:read"],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"properties": {
+					"version": {
+						"type": "integer",
+						"exclusiveMinimum": 0
+					},
+					"english": { "type": "string" },
+					"tree": {
+						"type": "object",
+						"properties": {
+							"version": {
+								"type": "number",
+								"const": 1
+							},
+							"vocabulary": {
+								"type": "string",
+								"description": "The column contract version the rule is written against, for example v1."
+							},
+							"when": {
+								"type": "object",
+								"propertyNames": { "type": "string" },
+								"additionalProperties": {},
+								"description": "The rule's conditions: a condition ({column, op, value?, min_confidence?}) or a group ({all: [...]}, {any: [...]} or {not: ...})."
+							},
+							"questions": {
+								"type": "array",
+								"items": { "type": "string" },
+								"description": "Yes/no questions of the rule's own, asked about an email only after its conditions match. An email matches only if every answer is yes."
+							}
+						},
+						"required": [
+							"version",
+							"vocabulary",
+							"when",
+							"questions"
+						]
+					},
+					"explanation": { "type": "string" },
+					"assumptions": {
+						"type": "array",
+						"items": { "type": "string" }
+					},
+					"warnings": {
+						"type": "array",
+						"items": { "type": "string" }
+					},
+					"compiled_by": {
+						"type": "string",
+						"description": "Who produced the tree, as the caller stated it when saving (not verified), for example rule-compiler-v1 or member."
+					},
+					"vocabulary": { "type": "string" },
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"sql": {
+						"description": "Present only when include_sql was true.",
+						"type": "object",
+						"properties": {
+							"expression": {
+								"type": "string",
+								"description": "A parameterized boolean expression over one row per email."
+							},
+							"params": {
+								"type": "array",
+								"items": {},
+								"description": "The values bound to $1, $2 and so on."
+							}
+						},
+						"required": ["expression", "params"]
+					}
+				},
+				"required": [
+					"version",
+					"english",
+					"tree",
+					"explanation",
+					"assumptions",
+					"warnings",
+					"compiled_by",
+					"vocabulary",
+					"created_at"
+				]
+			}
+		},
+		"sdkName": "listEmailRuleVersions",
+		"summary": "Read versions of a rule",
+		"tag": "Email Rules",
+		"tagCommand": "email-rules"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -74572,7 +75918,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "test-email-rule",
-		"description": "Runs a rule over received mail and reports what it would decide for each email: matched, near_miss, no_match, unclassified or not_found. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version, run with its author's access). Either way the rule reads only mail its author can read. Without email_ids, the newest emails it can read are tested, at most 200 and none older than 30 days. Emails not classified yet that arrived more than 2 hours ago are classified first and their classification is saved, unless classify_missing is false; newer ones are left to normal classification and reported unclassified with reason pending. The rule itself records nothing and grants nothing. Classification and the rule's own questions stop at about 90 seconds; run the test again to continue where it stopped. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"description": "Runs a rule over received mail and reports what it would decide for each email: matched, near_miss, no_match, unclassified or not_found. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version, run with its author's access). Either way the rule reads only mail its author can read, and only what its scope covers. Without email_ids, the newest emails it can read are tested, at most 200 and none older than 30 days. Emails not classified yet that arrived more than 2 hours ago are classified first and their classification is saved, unless classify_missing is false; newer ones are left to normal classification and reported unclassified with reason pending. The rule itself records nothing and grants nothing. Classification and the rule's own questions stop at about 90 seconds; run the test again to continue where it stopped. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "testEmailRule",
@@ -74624,8 +75970,39 @@ const operationManifest = [
 				},
 				"evaluation_scope": {
 					"type": "string",
-					"enum": ["author", "own_mailboxes"],
-					"description": "Whose mail an unsaved tree runs over. author, the default: all the mail you can read. own_mailboxes: only mail to your own addresses. Only with tree: a saved rule uses its own."
+					"enum": [
+						"author",
+						"own_mailboxes",
+						"selected"
+					],
+					"description": "author: all mail its author can read. own_mailboxes: mail to their own addresses. selected: what scope_selection names. Never more than the author can read."
+				},
+				"scope_selection": {
+					"type": "object",
+					"properties": {
+						"addresses": {
+							"maxItems": 100,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 3,
+								"maxLength": 320,
+								"pattern": "^[^\\s@]+@[^\\s@]+$"
+							}
+						},
+						"domains": {
+							"maxItems": 50,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 253,
+								"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+							}
+						}
+					},
+					"additionalProperties": false,
+					"description": "Inboxes, and domains (every address at them the author can read), for a selected rule; each one you can read."
 				},
 				"rule_id": {
 					"description": "A saved rule you can see. Its current version is tested, with its author's access.",
@@ -74920,8 +76297,39 @@ const operationManifest = [
 				},
 				"evaluation_scope": {
 					"type": "string",
-					"enum": ["author", "own_mailboxes"],
-					"description": "Whose mail an unsaved tree runs over. author, the default: all the mail you can read. own_mailboxes: only mail to your own addresses. Only with tree: a saved rule uses its own."
+					"enum": [
+						"author",
+						"own_mailboxes",
+						"selected"
+					],
+					"description": "author: all mail its author can read. own_mailboxes: mail to their own addresses. selected: what scope_selection names. Never more than the author can read."
+				},
+				"scope_selection": {
+					"type": "object",
+					"properties": {
+						"addresses": {
+							"maxItems": 100,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 3,
+								"maxLength": 320,
+								"pattern": "^[^\\s@]+@[^\\s@]+$"
+							}
+						},
+						"domains": {
+							"maxItems": 50,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 253,
+								"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+							}
+						}
+					},
+					"additionalProperties": false,
+					"description": "Inboxes, and domains (every address at them the author can read), for a selected rule; each one you can read."
 				},
 				"rule_id": {
 					"description": "A saved rule you can see. Its current version is tested.",
@@ -75151,7 +76559,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "update-email-rule",
-		"description": "Renames the rule, saves a new version (english, tree and explanation together; earlier versions are kept unchanged) or changes its state: draft (disabled), observe or active. Only the rule's author may rename it, add a version or move it to observe or active; anyone else who can see it may only disable it (state draft), and while it is shared with another member only if they manage members from the dashboard. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"description": "Renames the rule, saves a new version (english, tree and explanation together; earlier versions are kept unchanged), changes its state (draft, disabled; observe; or active) or changes whose mail it runs over (evaluation_scope, with scope_selection when selected). Only the rule's author may rename it, add a version, change its scope or move it to observe or active; anyone else who can see it may only disable it (state draft), and while it is shared with another member only if they manage members from the dashboard. Omit evaluation_scope to keep the current scope. A scope change saves a new version with the same conditions; what was granted stays. A shared rule keeps its scope. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 		"hasJsonBody": true,
 		"method": "PATCH",
 		"operationId": "updateEmailRule",
@@ -75253,6 +76661,42 @@ const operationManifest = [
 					"type": "string",
 					"minLength": 1,
 					"maxLength": 64
+				},
+				"evaluation_scope": {
+					"type": "string",
+					"enum": [
+						"author",
+						"own_mailboxes",
+						"selected"
+					],
+					"description": "author: all mail its author can read. own_mailboxes: mail to their own addresses. selected: what scope_selection names. Never more than the author can read."
+				},
+				"scope_selection": {
+					"type": "object",
+					"properties": {
+						"addresses": {
+							"maxItems": 100,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 3,
+								"maxLength": 320,
+								"pattern": "^[^\\s@]+@[^\\s@]+$"
+							}
+						},
+						"domains": {
+							"maxItems": 50,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 253,
+								"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+							}
+						}
+					},
+					"additionalProperties": false,
+					"description": "Inboxes, and domains (every address at them the author can read), for a selected rule; each one you can read."
 				}
 			},
 			"additionalProperties": false
@@ -102204,14 +103648,14 @@ function isMemoryJsonValue(value, seen = /* @__PURE__ */ new Set()) {
 	}
 }
 // src/oclif/cli-operations.ts
-const DASHBOARD_ONLY_OPERATION_IDS = /* @__PURE__ */ new Set([
+const KEY_WRITE_OPERATION_IDS = /* @__PURE__ */ new Set([
 	"credentials:create-key",
 	"credentials:rotate-key",
 	"credentials:update-key",
 	"credentials:revoke-credential"
 ]);
-/** The operations the CLI offers: the manifest without the dashboard-only ones. */
-const cliOperationManifest = operationManifest.filter((operation) => !DASHBOARD_ONLY_OPERATION_IDS.has(`${operation.tagCommand}:${operation.command}`));
+/** The operations the CLI generates commands for: the manifest without the key writes. */
+const cliOperationManifest = operationManifest.filter((operation) => !KEY_WRITE_OPERATION_IDS.has(`${operation.tagCommand}:${operation.command}`));
 // src/oclif/agent-mail-check.ts
 /**
 * One check for mail that arrived since this profile's previous check. It is
@@ -108882,7 +110326,7 @@ async function checkAccount(client) {
 			outcome: {
 				status: "fail",
 				message: `API rejected the key (${typeof apiError === "object" && apiError !== null ? JSON.stringify(apiError).slice(0, 300) : String(apiError).slice(0, 300)})`,
-				hint: "Run `primitive whoami` for the full error envelope. If the key was rotated, regenerate it in the dashboard."
+				hint: "Run `primitive whoami` for the full error envelope. If the key was rotated, use its new secret; if it was revoked, create a key with `primitive keys create` or in the dashboard."
 			},
 			account: null
 		};
@@ -111816,8 +113260,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^3.0.0-preview.1";
-const CLI_VERSION_RANGE = "^3.0.0-preview.1";
+const SDK_VERSION_RANGE = "^3.0.0-preview.2";
+const CLI_VERSION_RANGE = "^3.0.0-preview.2";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -114577,7 +116021,10 @@ var InboxSetupCommand = class InboxSetupCommand extends Command {
 	}
 };
 // src/oclif/commands/keys.ts
-const KEYS_MANAGED_IN_DASHBOARD = "API keys are created, rotated and revoked in the dashboard for now. CLI commands for this are planned.";
+const STORE_SECRET_NOTICE = "Store this key now. It is shown only once, and the CLI does not save it.";
+const HELD_REQUEST_NOTICE = "A request already held open with this key, such as a long poll or a wait, ends once because the key's permissions changed. Run it again to use the new permissions.";
+const STEP_UP_HEADER$1 = "Primitive-Step-Up";
+const LIST_PAGE_LIMIT = 50;
 const API_KEY_FLAG$1 = Flags.string({
 	description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved login credentials).",
 	env: "PRIMITIVE_API_KEY",
@@ -114588,68 +116035,695 @@ const API_BASE_URL_FLAG$2 = Flags.string({
 	env: "PRIMITIVE_API_BASE_URL",
 	hidden: true
 });
-/** Print a refusal and set a failing exit code. */
-function reportKeysError(error, context, json) {
-	const payload = extractErrorPayload(error);
-	if (json) process.stderr.write(`${JSON.stringify(payload)}\n`);
-	else {
-		writeErrorWithHints(payload);
-		if (payload?.code === "forbidden") process.stderr.write("Listing keys needs an owner or admin. Some of it is available only in the dashboard.\n");
+const APPROVAL_FLAGS = {
+	"step-up-token": Flags.string({ description: "One-time token from the approval page, for a request you already approved in the browser. Sent in the Primitive-Step-Up header." }),
+	browser: Flags.boolean({
+		allowNo: true,
+		default: true,
+		description: "Open the approval page in your browser. Use --no-browser to only print its link."
+	})
+};
+function unwrap(data) {
+	return data?.data ?? data;
+}
+async function call(request) {
+	try {
+		const result = await request;
+		if (result.error !== void 0 || !result.response?.ok) return {
+			ok: false,
+			payload: result.error === void 0 || result.error === null || typeof result.error === "string" ? {
+				code: "http_error",
+				message: typeof result.error === "string" && result.error.trim() || `HTTP ${result.response?.status ?? ""}`.trim()
+			} : extractErrorPayload(result.error)
+		};
+		return {
+			ok: true,
+			data: unwrap(result.data)
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			payload: extractErrorPayload(error)
+		};
 	}
-	surfaceUnauthorizedHint({
-		...context,
-		payload
+}
+/** The approval link of a `step_up_required` refusal, if that is what it is. */
+function stepUpUrlOf$1(payload) {
+	if (extractErrorCode(payload) !== "step_up_required") return void 0;
+	if (!payload || typeof payload !== "object") return void 0;
+	const details = payload.details;
+	if (!details || typeof details !== "object") return void 0;
+	const url = details.step_up_url;
+	return typeof url === "string" && url.length > 0 ? url : void 0;
+}
+/**
+* Send a request, and when the server asks the person to approve it, show
+* the approval link, open it where possible, wait for the token the page
+* shows, and send the request once more with it. Without a terminal to wait
+* in, the refusal is returned with its link, to rerun with --step-up-token.
+*/
+async function withApproval(attempt, io) {
+	const first = await attempt(io.stepUpToken);
+	if (first.ok) return first;
+	const stepUpUrl = stepUpUrlOf$1(first.payload);
+	if (!stepUpUrl || io.stepUpToken || !io.interactive) return {
+		...first,
+		...stepUpUrl ? { stepUpUrl } : {}
+	};
+	io.write(`Approve this request in your browser: ${stepUpUrl}\n`);
+	if (io.openBrowser) io.open(stepUpUrl);
+	io.write("After you confirm, the page shows a one-time token. Paste it here to finish.\n");
+	const token = (await io.prompt("Token: ")).trim();
+	if (!token) return {
+		...first,
+		stepUpUrl
+	};
+	return attempt(token);
+}
+async function promptLine$2(question) {
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stderr
 	});
-	process.exitCode = 1;
+	try {
+		return await rl.question(question);
+	} finally {
+		rl.close();
+	}
 }
-function unwrap(data) {
-	return data?.data ?? null;
+function approvalIo(flags) {
+	return {
+		stepUpToken: flags["step-up-token"],
+		interactive: !flags.json && Boolean(process.stdin.isTTY && process.stderr.isTTY),
+		openBrowser: flags.browser,
+		open: openBrowser,
+		prompt: promptLine$2,
+		write: (text) => process.stderr.write(text)
+	};
+}
+/** Comma-separated and repeated values, trimmed, without duplicates. */
+function listFlag(values) {
+	const out = [];
+	for (const value of values ?? []) for (const part of value.split(",")) {
+		const item = part.trim();
+		if (item && !out.includes(item)) out.push(item);
+	}
+	return out;
+}
+function stringList(value) {
+	return Array.isArray(value) && value.every((v) => typeof v === "string") ? [...value] : null;
+}
+/** Which mail a key reaches, in words. */
+function describeMailScope(grant) {
+	if (grant.template === "super_admin") return "every mailbox";
+	if (grant.template === "connected_agent") return "its agent's address";
+	const scope = grant.mail_scope;
+	if (scope === "org") return "every mailbox";
+	if (!scope || typeof scope !== "object" || Array.isArray(scope)) return "unknown";
+	const record = scope;
+	const parts = [];
+	const addresses = stringList(record.addresses) ?? [];
+	const domains = stringList(record.domains) ?? [];
+	const rules = stringList(record.rules) ?? [];
+	if (addresses.length > 0) parts.push(`addresses ${addresses.join(", ")}`);
+	if (domains.length > 0) parts.push(`domains ${domains.join(", ")}`);
+	if (rules.length > 0) parts.push(`rules ${rules.join(", ")}`);
+	return parts.length > 0 ? parts.join("; ") : "no mailbox";
+}
+/** What a key may do, in words. */
+function describePermissions(grant) {
+	if (grant.template === "super_admin") return "super admin (every permission)";
+	if (grant.template) return grant.template;
+	const permissions = grant.permissions ?? [];
+	return permissions.length > 0 ? permissions.join(", ") : "none";
 }
 function formatKeyRows(rows) {
 	if (rows.length === 0) return "No API keys.";
 	return rows.map((row) => {
-		const grant = row.grant.template ? row.grant.template : `${row.grant.permissions?.length ?? 0} permissions`;
-		const flags = row.flags.length > 0 ? ` [${row.flags.join(", ")}]` : "";
-		return `${row.id}  ${row.prefix ?? ""}  ${row.name ?? "(unnamed)"}  ${grant}  expires ${row.expires_at ?? "never"}  last used ${row.last_used_at ?? "never"}${flags}`;
+		const suspended = row.suspended ? " [suspended]" : "";
+		return `${row.id}  ${row.key_prefix}  ${row.name ?? "(unnamed)"}  ${describePermissions(row.grant)}  mail: ${describeMailScope(row.grant)}  expires ${row.expires_at ?? "never"}  last used ${row.last_used_at ?? "never"}${suspended}`;
 	}).join("\n");
 }
+function formatKeyDetail(key) {
+	const lines = [
+		`Name:         ${key.name ?? "(unnamed)"}`,
+		`Id:           ${key.id}`,
+		`Prefix:       ${key.key_prefix}`,
+		`Kind:         ${key.kind}`,
+		`Mail:         ${describeMailScope(key.grant)}`,
+		`Created:      ${key.created_at ?? "unknown"}`,
+		`Expires:      ${key.expires_at ?? "never"}`,
+		`Last used:    ${key.last_used_at ?? "never"}`,
+		`Suspended:    ${key.suspended ? "yes" : "no"}`
+	];
+	if (key.agent_address) lines.push(`Agent:        ${key.agent_address}`);
+	if (key.grant.template) lines.push(`Permissions:  ${describePermissions(key.grant)}`);
+	else {
+		lines.push("Permissions:");
+		for (const permission of key.grant.permissions ?? []) lines.push(`  ${permission}`);
+	}
+	return lines.join("\n");
+}
+const EVERY_MAILBOX_PRESETS = /* @__PURE__ */ new Set([
+	"super_admin",
+	"read_only",
+	"send_only"
+]);
+const LISTED_PRESETS = /* @__PURE__ */ new Set(["own_addresses", "own_addresses_read_only"]);
+const KEY_PRESETS = [...EVERY_MAILBOX_PRESETS, ...LISTED_PRESETS];
+/**
+* The grant a new key asks for. There is no default: the caller names a
+* preset or the permissions, and a key with chosen permissions also says
+* which mail it reaches (addresses, domains, email rules, or every mailbox).
+*/
+function buildCreateGrant(choice) {
+	const listed = choice.addresses.length > 0 || choice.domains.length > 0 || choice.rules.length > 0;
+	const scope = {
+		...choice.addresses.length > 0 ? { addresses: choice.addresses } : {},
+		...choice.domains.length > 0 ? { domains: choice.domains } : {},
+		...choice.rules.length > 0 ? { rules: choice.rules } : {}
+	};
+	if (choice.permissions.length > 0) {
+		if (choice.preset) return {
+			ok: false,
+			message: "Pass either --preset or --permission, not both."
+		};
+		if (listed === choice.allMailboxes) return {
+			ok: false,
+			message: choice.allMailboxes ? "--all-mailboxes reaches every mailbox, so it cannot be combined with --address, --domain or --rule." : "Say which mail the key reaches: --address, --domain or --rule (each repeatable), or --all-mailboxes."
+		};
+		return {
+			ok: true,
+			grant: {
+				preset: "custom",
+				permissions: choice.permissions,
+				...choice.allMailboxes ? { mail_scope: "org" } : scope
+			}
+		};
+	}
+	if (!choice.preset) return {
+		ok: false,
+		message: "Say what the key can do: pass --preset or --permission. There is no default."
+	};
+	if (choice.allMailboxes) return {
+		ok: false,
+		message: "--all-mailboxes is only for a key with --permission."
+	};
+	if (EVERY_MAILBOX_PRESETS.has(choice.preset)) {
+		if (listed) return {
+			ok: false,
+			message: `${choice.preset} reaches every mailbox, so it takes no --address, --domain or --rule.`
+		};
+		return {
+			ok: true,
+			grant: choice.preset
+		};
+	}
+	if (LISTED_PRESETS.has(choice.preset)) {
+		if (!listed) return {
+			ok: false,
+			message: `${choice.preset} needs --address, --domain or --rule.`
+		};
+		return {
+			ok: true,
+			grant: {
+				preset: choice.preset,
+				...scope
+			}
+		};
+	}
+	return {
+		ok: false,
+		message: `--preset must be one of ${KEY_PRESETS.join(", ")}.`
+	};
+}
+/** The mail scope fields a change can send back unchanged. */
+const RESTATABLE_SCOPE_FIELDS = /* @__PURE__ */ new Set([
+	"addresses",
+	"domains",
+	"rules",
+	"depth"
+]);
+/**
+* The grant that restates a key's current grant with permissions added or
+* removed, or its email rules replaced, and everything else as it is. Only a
+* key with a permission list and a mail scope the CLI can restate exactly;
+* anything else is changed in the dashboard.
+*/
+function buildUpdatedGrant(current, change) {
+	if (current.template === "super_admin") return {
+		ok: false,
+		message: "This is a super admin key: it holds every permission already. To narrow it, create a key with only what you need, then revoke this one."
+	};
+	if (current.template) return {
+		ok: false,
+		message: `This key's permissions come from its template (${current.template}) and are not changed here.`
+	};
+	const resources = current.resources;
+	if (resources !== void 0 && resources !== null && (typeof resources !== "object" || Object.keys(resources).length > 0)) return {
+		ok: false,
+		message: "This key is limited to selected resources, which the CLI cannot restate. Change it in the dashboard."
+	};
+	const held = stringList(current.permissions);
+	if (!held) return {
+		ok: false,
+		message: "This key's permissions could not be read."
+	};
+	const permissions = [.../* @__PURE__ */ new Set([...held, ...change.add])].filter((p) => !change.remove.includes(p)).sort();
+	if (permissions.length === 0) return {
+		ok: false,
+		message: "A key needs at least one permission. To stop it working, revoke it."
+	};
+	const scope = current.mail_scope;
+	if (scope === "org") {
+		if (change.rules) return {
+			ok: false,
+			message: "This key reaches every mailbox, so email rules cannot be set on it. Create a key limited to the rules instead."
+		};
+		return {
+			ok: true,
+			grant: {
+				preset: "custom",
+				permissions,
+				mail_scope: "org"
+			},
+			permissions
+		};
+	}
+	if (!scope || typeof scope !== "object" || Array.isArray(scope)) return {
+		ok: false,
+		message: "This key's mail scope could not be read. Change it in the dashboard."
+	};
+	const record = scope;
+	const addresses = stringList(record.addresses ?? []);
+	const domains = stringList(record.domains ?? []);
+	const rules = change.rules ?? stringList(record.rules ?? []);
+	if (!addresses || !domains || !rules || Object.keys(record).some((field) => !RESTATABLE_SCOPE_FIELDS.has(field))) return {
+		ok: false,
+		message: "This key's mail scope has settings the CLI cannot restate. Change it in the dashboard."
+	};
+	if (addresses.length === 0 && domains.length === 0 && rules.length === 0) return {
+		ok: false,
+		message: "The key would reach no mail. Keep at least one address, domain or rule."
+	};
+	return {
+		ok: true,
+		grant: {
+			preset: "custom",
+			permissions,
+			...addresses.length > 0 ? { addresses } : {},
+			...domains.length > 0 ? { domains } : {},
+			...rules.length > 0 ? { rules } : {}
+		},
+		permissions
+	};
+}
+async function authenticate(command, flags) {
+	return createAuthenticatedCliApiClient({
+		apiKey: flags["api-key"],
+		apiBaseUrl: flags["api-base-url"],
+		configDir: command.config.configDir
+	});
+}
+/** Print a refusal and set a failing exit code. */
+function reportKeysError(command, outcome, auth, json) {
+	if (json) process.stderr.write(`${JSON.stringify(outcome.payload)}\n`);
+	else writeErrorWithHints(outcome.payload);
+	if (outcome.stepUpUrl) process.stderr.write(`Approve this request in your browser: ${outcome.stepUpUrl}\nThen run the same command again with --step-up-token <token from the page>.\n`);
+	surfaceUnauthorizedHint({
+		auth: auth.auth,
+		baseUrlOverridden: auth.baseUrlOverridden,
+		configDir: command.config.configDir,
+		payload: outcome.payload
+	});
+	process.exitCode = 1;
+}
+function writeWarnings(warnings) {
+	for (const warning of warnings ?? []) if (typeof warning.description === "string") process.stderr.write(`Note: ${warning.description}\n`);
+}
 var KeysListCommand = class KeysListCommand extends Command {
-	static description = `List the organization's API keys from the credential inventory, with grant, expiry and last use. Only metadata is shown, never a secret.
+	static description = `List the organization's API keys with their permissions, mail scope, expiry and last use. Only metadata is shown, never a secret.
 
-  ${KEYS_MANAGED_IN_DASHBOARD} The server answers this list only for an owner or admin in a dashboard session; from a CLI login it shows the server's refusal.`;
+  You see your own keys, and every key if your role may read them all, as in the dashboard.`;
 	static summary = "List API keys";
 	static examples = ["<%= config.bin %> keys list", "<%= config.bin %> keys list --json"];
 	static flags = {
 		"api-key": API_KEY_FLAG$1,
 		"api-base-url": API_BASE_URL_FLAG$2,
-		json: Flags.boolean({ description: "Print the inventory rows as JSON." })
+		json: Flags.boolean({ description: "Print the keys as JSON." })
 	};
 	async run() {
 		const { flags } = await this.parse(KeysListCommand);
-		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
-			apiKey: flags["api-key"],
-			apiBaseUrl: flags["api-base-url"],
-			configDir: this.config.configDir
-		});
-		const result = await listCredentials({
-			client: apiClient.client,
-			query: { kind: "org_key" },
-			responseStyle: "fields"
+		const auth = await authenticate(this, flags);
+		const items = [];
+		let cursor;
+		for (let page = 0; page < LIST_PAGE_LIMIT; page += 1) {
+			const result = await call(listKeys({
+				client: auth.apiClient.client,
+				...cursor ? { query: { cursor } } : {}
+			}));
+			if (!result.ok) {
+				reportKeysError(this, result, auth, Boolean(flags.json));
+				return;
+			}
+			items.push(...result.data.items);
+			cursor = result.data.next_cursor ?? void 0;
+			if (!cursor) break;
+		}
+		if (flags.json) {
+			this.log(JSON.stringify(items, null, 2));
+			return;
+		}
+		this.log(formatKeyRows(items));
+	}
+};
+var KeysGetCommand = class KeysGetCommand extends Command {
+	static description = "Show one API key: its permissions, the mail it reaches, expiry and last use. Never a secret.";
+	static summary = "Show an API key";
+	static examples = ["<%= config.bin %> keys get 0f0e0d0c-0b0a-4908-8706-050403020100", "<%= config.bin %> keys get 0f0e0d0c-0b0a-4908-8706-050403020100 --json"];
+	static args = { id: Args.string({
+		description: "The key's id.",
+		required: true
+	}) };
+	static flags = {
+		"api-key": API_KEY_FLAG$1,
+		"api-base-url": API_BASE_URL_FLAG$2,
+		json: Flags.boolean({ description: "Print the key as JSON." })
+	};
+	async run() {
+		const { args, flags } = await this.parse(KeysGetCommand);
+		const auth = await authenticate(this, flags);
+		const result = await call(getKey({
+			client: auth.apiClient.client,
+			path: { id: args.id }
+		}));
+		if (!result.ok) {
+			reportKeysError(this, result, auth, Boolean(flags.json));
+			return;
+		}
+		this.log(flags.json ? JSON.stringify(result.data, null, 2) : formatKeyDetail(result.data));
+	}
+};
+/** The new secret on stdout alone, everything else on stderr. */
+function printSecret(command, json, document, secret, summary) {
+	if (json) {
+		command.log(JSON.stringify({
+			...document,
+			notice: STORE_SECRET_NOTICE
+		}, null, 2));
+		return;
+	}
+	process.stderr.write(`${summary}\n\n`);
+	command.log(secret);
+	process.stderr.write(`\n${STORE_SECRET_NOTICE}\n`);
+}
+var KeysCreateCommand = class KeysCreateCommand extends Command {
+	static description = `Create an API key. Say what it can do with --preset or --permission; there is no default.
+
+  You approve each new key in your browser: the command prints the approval link, opens it where it can, and waits for the one-time token the page shows. In a script, approve first and pass that token with --step-up-token. The key never holds more than you do, and your organization's credential policy applies.
+
+  The secret is printed once, on its own line on stdout (in the JSON with --json). Store it right away: it is not shown again and the CLI does not save it.
+
+  A key limited to email rules (--rule, repeatable) reaches only the mail those rules match. Give it mail:read with --permission, or use --preset own_addresses_read_only.`;
+	static summary = "Create an API key";
+	static examples = [
+		"<%= config.bin %> keys create --name reader --preset read_only",
+		"<%= config.bin %> keys create --name orders --permission mail:read --rule 3b0f6a1e-6c7a-4f43-9d8e-2a1b5c4d3e2f",
+		"<%= config.bin %> keys create --name support --permission mail:read,mail:reply --address support@example.com --expires-in-days 90",
+		"<%= config.bin %> keys create --name everything --preset super_admin"
+	];
+	static flags = {
+		"api-key": API_KEY_FLAG$1,
+		"api-base-url": API_BASE_URL_FLAG$2,
+		name: Flags.string({ description: "A name for the key." }),
+		preset: Flags.string({
+			description: "A preset grant.",
+			options: [...KEY_PRESETS]
+		}),
+		permission: Flags.string({
+			description: "A permission the key holds (repeatable, or comma-separated), for a custom key.",
+			multiple: true
+		}),
+		address: Flags.string({
+			description: "An address the key reaches (repeatable).",
+			multiple: true
+		}),
+		domain: Flags.string({
+			description: "A domain the key reaches (repeatable).",
+			multiple: true
+		}),
+		rule: Flags.string({
+			description: "An email rule id whose matching mail the key reaches (repeatable).",
+			multiple: true
+		}),
+		"all-mailboxes": Flags.boolean({ description: "A key with --permission that reaches every mailbox." }),
+		"expires-in-days": Flags.integer({
+			description: "Expire the key after this many days.",
+			min: 1
+		}),
+		"expires-at": Flags.string({
+			description: "Expire the key at this ISO 8601 time.",
+			exclusive: ["expires-in-days"]
+		}),
+		...APPROVAL_FLAGS,
+		json: Flags.boolean({ description: "Print the new key, its secret included, as JSON." })
+	};
+	async run() {
+		const { flags } = await this.parse(KeysCreateCommand);
+		const grant = buildCreateGrant({
+			preset: flags.preset,
+			permissions: listFlag(flags.permission),
+			addresses: listFlag(flags.address),
+			domains: listFlag(flags.domain),
+			rules: listFlag(flags.rule),
+			allMailboxes: flags["all-mailboxes"]
 		});
-		if (result.error) {
-			reportKeysError(result.error, {
-				auth,
-				baseUrlOverridden,
-				configDir: this.config.configDir
-			}, Boolean(flags.json));
+		if (!grant.ok) this.error(grant.message, { exit: 2 });
+		const auth = await authenticate(this, flags);
+		const body = {
+			grant: grant.grant,
+			...flags.name ? { name: flags.name } : {},
+			...flags["expires-in-days"] ? { expires_in_days: flags["expires-in-days"] } : {},
+			...flags["expires-at"] ? { expires_at: flags["expires-at"] } : {}
+		};
+		const idempotencyKey = `cli-${randomUUID()}`;
+		const result = await withApproval((token) => call(createKey({
+			client: auth.apiClient.client,
+			body,
+			headers: {
+				"Idempotency-Key": idempotencyKey,
+				...token ? { [STEP_UP_HEADER$1]: token } : {}
+			}
+		})), approvalIo(flags));
+		if (!result.ok) {
+			reportKeysError(this, result, auth, Boolean(flags.json));
+			return;
+		}
+		const key = result.data;
+		if (!flags.json) writeWarnings(key.warnings);
+		printSecret(this, Boolean(flags.json), key, key.key, [
+			`Created API key ${key.name ?? "(unnamed)"} (${key.id}), prefix ${key.key_prefix}.`,
+			`Permissions: ${describePermissions({
+				template: key.grant.template,
+				permissions: key.grant.permissions,
+				mail_scope: key.grant.mail_scope
+			})}`,
+			`Mail: ${describeMailScope({
+				template: key.grant.template,
+				permissions: key.grant.permissions,
+				mail_scope: key.grant.mail_scope
+			})}`,
+			`Expires: ${key.expires_at ?? "never"}`
+		].join("\n"));
+	}
+};
+var KeysRotateCommand = class KeysRotateCommand extends Command {
+	static description = `Rotate an API key: make a successor with the same permissions and print its secret once. The old key keeps working for the overlap, then stops.
+
+  You approve the rotation in your browser, as for a new key. Store the new secret right away: it is not shown again and the CLI does not save it.`;
+	static summary = "Rotate an API key";
+	static examples = ["<%= config.bin %> keys rotate 0f0e0d0c-0b0a-4908-8706-050403020100", "<%= config.bin %> keys rotate 0f0e0d0c-0b0a-4908-8706-050403020100 --overlap-seconds 0"];
+	static args = { id: Args.string({
+		description: "The key's id.",
+		required: true
+	}) };
+	static flags = {
+		"api-key": API_KEY_FLAG$1,
+		"api-base-url": API_BASE_URL_FLAG$2,
+		"overlap-seconds": Flags.integer({
+			description: "How long the old key keeps working, in seconds. 0 stops it now.",
+			min: 0
+		}),
+		...APPROVAL_FLAGS,
+		json: Flags.boolean({ description: "Print the new key, its secret included, as JSON." })
+	};
+	async run() {
+		const { args, flags } = await this.parse(KeysRotateCommand);
+		const auth = await authenticate(this, flags);
+		const body = flags["overlap-seconds"] === void 0 ? {} : { overlap_seconds: flags["overlap-seconds"] };
+		const result = await withApproval((token) => call(rotateKey({
+			client: auth.apiClient.client,
+			path: { id: args.id },
+			body,
+			...token ? { headers: { [STEP_UP_HEADER$1]: token } } : {}
+		})), approvalIo(flags));
+		if (!result.ok) {
+			reportKeysError(this, result, auth, Boolean(flags.json));
+			return;
+		}
+		const rotated = result.data;
+		printSecret(this, Boolean(flags.json), rotated, rotated.key, `Rotated key ${rotated.previous_key_id}. The new key is ${rotated.id}, prefix ${rotated.key_prefix}. The old key works until ${rotated.previous_key_expires_at}.`);
+	}
+};
+var KeysUpdateCommand = class KeysUpdateCommand extends Command {
+	static description = `Change an API key's permissions, email rules or name. It keeps its id and secret.
+
+  --add and --remove take permissions (repeatable, or comma-separated). --rule sets the email rules the key reaches, replacing the ones it has. Everything else about the key stays as it is.
+
+  When the server asks for it, you approve the change in your browser, as for a new key. A key never holds more than you do.`;
+	static summary = "Change an API key";
+	static examples = [
+		"<%= config.bin %> keys update 0f0e0d0c-0b0a-4908-8706-050403020100 --add mail:send,mail:reply",
+		"<%= config.bin %> keys update 0f0e0d0c-0b0a-4908-8706-050403020100 --remove mail:send",
+		"<%= config.bin %> keys update 0f0e0d0c-0b0a-4908-8706-050403020100 --rule 3b0f6a1e-6c7a-4f43-9d8e-2a1b5c4d3e2f"
+	];
+	static args = { id: Args.string({
+		description: "The key's id.",
+		required: true
+	}) };
+	static flags = {
+		"api-key": API_KEY_FLAG$1,
+		"api-base-url": API_BASE_URL_FLAG$2,
+		add: Flags.string({
+			description: "Permissions to add (repeatable, or comma-separated).",
+			multiple: true
+		}),
+		remove: Flags.string({
+			description: "Permissions to remove (repeatable, or comma-separated).",
+			multiple: true
+		}),
+		rule: Flags.string({
+			description: "An email rule id the key reaches (repeatable). Replaces the key's rules.",
+			multiple: true
+		}),
+		name: Flags.string({ description: "A new name for the key." }),
+		...APPROVAL_FLAGS,
+		json: Flags.boolean({ description: "Print the result as JSON." })
+	};
+	async run() {
+		const { args, flags } = await this.parse(KeysUpdateCommand);
+		const add = listFlag(flags.add);
+		const remove = listFlag(flags.remove);
+		const rules = flags.rule ? listFlag(flags.rule) : void 0;
+		const both = add.filter((p) => remove.includes(p));
+		if (both.length > 0) this.error(`Both added and removed: ${both.join(", ")}.`, { exit: 2 });
+		const changesGrant = add.length > 0 || remove.length > 0 || !!rules;
+		if (!changesGrant && flags.name === void 0) this.error("Nothing to change: pass --add, --remove, --rule or --name.", { exit: 2 });
+		const auth = await authenticate(this, flags);
+		const body = { ...flags.name !== void 0 ? { name: flags.name } : {} };
+		if (changesGrant) {
+			const current = await call(getKey({
+				client: auth.apiClient.client,
+				path: { id: args.id }
+			}));
+			if (!current.ok) {
+				reportKeysError(this, current, auth, Boolean(flags.json));
+				return;
+			}
+			const next = buildUpdatedGrant(current.data.grant, {
+				add,
+				remove,
+				...rules ? { rules } : {}
+			});
+			if (!next.ok) this.error(next.message, { exit: 2 });
+			body.grant = next.grant;
+			const ref = current.data.grant.ref;
+			if (typeof ref === "string") body.expected_grant_ref = ref;
+		}
+		const result = await withApproval((token) => call(updateKey({
+			client: auth.apiClient.client,
+			path: { id: args.id },
+			body,
+			...token ? { headers: { [STEP_UP_HEADER$1]: token } } : {}
+		})), approvalIo(flags));
+		if (!result.ok) {
+			reportKeysError(this, result, auth, Boolean(flags.json));
+			return;
+		}
+		const grantChanged = result.data.changed.includes("grant");
+		const after = grantChanged ? await call(getKey({
+			client: auth.apiClient.client,
+			path: { id: args.id }
+		})) : null;
+		if (flags.json) {
+			this.log(JSON.stringify({
+				...result.data,
+				...after?.ok ? { key: after.data } : {},
+				...grantChanged ? { notice: HELD_REQUEST_NOTICE } : {}
+			}, null, 2));
+			return;
+		}
+		writeWarnings(result.data.warnings);
+		const changed = result.data.changed;
+		this.log(changed.length > 0 ? `Updated key ${args.id}: ${changed.join(", ")}.` : `Key ${args.id} already matched; nothing changed.`);
+		if (after?.ok) {
+			this.log(`Permissions: ${describePermissions(after.data.grant)}`);
+			this.log(`Mail: ${describeMailScope(after.data.grant)}`);
+		}
+		if (grantChanged) process.stderr.write(`${HELD_REQUEST_NOTICE}\n`);
+	}
+};
+var KeysRevokeCommand = class KeysRevokeCommand extends Command {
+	static description = `Revoke an API key. It stops working at once; what it set up keeps working and is listed for review.
+
+  Asks for confirmation first; pass --yes to skip the prompt in scripts.`;
+	static summary = "Revoke an API key";
+	static examples = ["<%= config.bin %> keys revoke 0f0e0d0c-0b0a-4908-8706-050403020100", "<%= config.bin %> keys revoke 0f0e0d0c-0b0a-4908-8706-050403020100 --yes"];
+	static args = { id: Args.string({
+		description: "The key's id.",
+		required: true
+	}) };
+	static flags = {
+		"api-key": API_KEY_FLAG$1,
+		"api-base-url": API_BASE_URL_FLAG$2,
+		yes: Flags.boolean({
+			char: "y",
+			description: "Revoke without asking for confirmation."
+		}),
+		reason: Flags.string({ description: "Why, recorded with the revocation." }),
+		json: Flags.boolean({ description: "Print the result as JSON." })
+	};
+	async run() {
+		const { args, flags } = await this.parse(KeysRevokeCommand);
+		if (!flags.yes) {
+			if (flags.json || !(process.stdin.isTTY && process.stderr.isTTY)) this.error("Not revoking: no terminal to confirm in. Pass --yes to revoke without a prompt.", { exit: 2 });
+			const answer = await promptLine$2(`Revoke key ${args.id}? It stops working at once. [y/N] `);
+			if (!/^y(es)?$/i.test(answer.trim())) {
+				process.stderr.write("Cancelled. The key still works.\n");
+				process.exitCode = 1;
+				return;
+			}
+		}
+		const auth = await authenticate(this, flags);
+		const result = await call(revokeCredential({
+			client: auth.apiClient.client,
+			body: {
+				kind: "org_key",
+				id: args.id,
+				...flags.reason ? { reason: flags.reason } : {}
+			}
+		}));
+		if (!result.ok) {
+			reportKeysError(this, result, auth, Boolean(flags.json));
 			return;
 		}
-		const rows = unwrap(result.data)?.items ?? [];
 		if (flags.json) {
-			this.log(JSON.stringify(rows, null, 2));
+			this.log(JSON.stringify(result.data, null, 2));
 			return;
 		}
-		this.log(formatKeyRows(rows));
+		this.log(`Revoked key ${args.id}.`);
+		const standing = result.data.standing_objects;
+		if (Array.isArray(standing) && standing.length > 0) this.log(`It set up ${standing.length} item(s) that keep working. Review them with --json.`);
 	}
 };
 const hash = (value) => createHash("sha256").update(value).digest("hex");
@@ -126092,6 +128166,11 @@ const COMMANDS = {
 	"org:use": OrgUseCommand,
 	"cli:list-cli-orgs": OrgsCommand,
 	"keys:list": KeysListCommand,
+	"keys:get": KeysGetCommand,
+	"keys:create": KeysCreateCommand,
+	"keys:rotate": KeysRotateCommand,
+	"keys:update": KeysUpdateCommand,
+	"keys:revoke": KeysRevokeCommand,
 	"roles:list": RolesListCommand,
 	"roles:groups": RolesGroupsCommand,
 	"roles:mailbox-access": RolesMailboxAccessCommand,