primcli 3.0.0-preview.1 → 3.0.0-preview.3

package/dist/oclif/index.js

@@ -1,13 +1,13 @@
-import { $ as followUpCommandPrefix, A as clearConsumedPendingMail, At as ConnectedAgentKeyRequiredError, B as replyInteractionWarning, Bt as fetchCliOrgs, C as serverMuted, Ct as detectRuntimeSession, D as wakeRecipientField, Dt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, E as wakeReadCommand, Et as withFlagSuggestion, F as removePendingMail, Ft as refuseOrgSelectionForProfile, G as apiResultHttpStatus, H as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Ht as switchCurrentOrg, I as interactionHumanLine, It as resolveCliApiRequestConfig, J as buildThrownSendFailureEnvelope, K as assertValidIdempotencyKey, L as interactionNextActions, Lt as selectedOrgFromEnv, M as pendingMailPath, Mt as createAuthenticatedCliApiClient, N as readPendingMail, Nt as createCliApiClient, O as wakeRelationship, Ot as ATTACHMENT_WAIT_MAX_MS, P as recordPendingMail, Pt as refreshStoredCliCredentials, Q as excludeSignalReplies, R as readEmailInteraction, Rt as CliOrgRefusedError, S as sentInThread, St as detectAgentRuntime, Tt as formatAlreadySentNotice, U as MAX_SEND_WAIT_TIMEOUT_MS, Vt as revokeUserLogin, W as SEND_OUTCOME_HELP, X as classifySendError, Y as checkPriorReplies, Z as deriveSendIdempotencyKey, _ as describeWake, a as extractErrorCode, at as priorRepliesThatWentOut, b as latestOwnOutbound, bt as loadSkillLine, c as hasControlCharacter$1, ct as sendOutcomeExitCode, d as readTextFileFlag, dt as serializeErrorPayload, et as formatDeletedEarlierSendNotice, f as runWithTiming, ft as successfulSendOutcome, g as bareAddress, gt as connectNextSteps, h as explainPendingMailNotFound, ht as cliInvocation, i as createOperationCommand, it as formatSendRecordFailureSummary, j as clearReadPendingMail, k as claimPendingMail, kt as withAttachmentWait, l as headerFlagName, lt as sendWaitClampNotice, m as writeErrorWithHints, n as API_ERROR_CODES, nt as formatPriorRepliesWarning, o as extractErrorPayload, ot as reportSendCommandResult, p as surfaceUnauthorizedHint, pt as thrownErrorExitCode, q as buildFollowUpCommand, r as TIME_FLAG_DESCRIPTION, rt as formatSendFailureSummary, s as formatErrorPayload, st as sendIdentityFields, t as API_BASE_URL_FLAG_DESCRIPTION, tt as formatPriorRepliesCheckSkipped, u as isGrantRefusal, ut as sentHistoryWindowStart, v as displayAddress, vt as generatedAgentName, w as serverRelationship, wt as runtimeSessionVariableList, x as readThreadContext, xt as currentMailSessionKey, y as formatMailWakeLine, yt as identitySuggestions, z as replyExpectation, zt as credentialsFromUserLogin } from "../api-command-ctHBqTL5.js";
-import { $ as AutomatedFilterUnsupportedError, A as sleep$3, At as getAccount, B as hasReplyState, Bn as startAgentSignup, Bt as getInboxStatus, C as collectNewAcceptedEmails, Ct as deleteWakeSchedule, D as filtersFromFlags, Dn as replyToEmail, Dt as downloadSentAttachmentArchiveMember, E as fetchEmailSearchPage, En as reorderRoutes, F as assertAwaitingFilterRows, Fn as setFunctionRoute, Ft as getDefaultNetworkAgent, Gn as updateDefaultNetworkMember, Gt as getSentEmail, H as queryUsesAwaiting, Hn as stopRepeatFromEmail, Ht as getOrgRoutingTopology, I as awaitingRejectedError, In as setFunctionSecret, It as getEmail, J as parseWebhookEvent, Jn as updateRoute, K as isEmailReceivedEvent, Kn as updateFunction, Kt as getThread, L as ensureSearchReportsReplyState, Ln as setMemory, Lt as getFunction, M as AWAITING_VALUES, Mn as searchMemories, N as REPLY_STATE_UNSUPPORTED_CODE, Nn as semanticSearch, Nt as getConversation, O as quoteDslValue, On as resendAgentSignupVerification, Ot as downloadSentAttachmentByFilename, P as ReplyStateUnsupportedError, Pn as sendEmail, Pt as getCreditBalance, Q as AUTOMATED_VALUES, Qn as verifyAgentSignup, Qt as listAgentNetworks, R as formatAwaitingCell, Rn as simulateRoute, Rt as getFunctionRouting, S as transientFailure, St as deleteWakeAuthorization, T as encodeReceivedAtSearchCursor, Tn as removeDefaultNetworkMember, Tt as downloadEmailAttachmentByFilename, Un as testFunction, Ut as getOwnGrant, V as isAwaitingRejectedError, Vn as startCliLogin, Vt as getMemory, Wn as unsetFunctionRoute, Wt as getRepeatingSend, X as AUTOMATED_FILTER_UNSUPPORTED_CODE, Xn as updateWakeSchedule, Y as parseFromHeader, Yn as updateWakeAuthorization, Yt as leaveOrganization, Z as AUTOMATED_FLAG_DESCRIPTION, Zn as verifyAgentClaim, Zt as listAgentContacts, _ as describeApiFailure, _n as listWakeDispatches, _t as createWakeSchedule, a as REPEAT_IDLE_MAX_MINUTES, an as listEmails, at as hasAutomatedVerdict, b as retryTransient, bn as pullWebhookEvent, bt as deleteMemory, cn as listFunctions, ct as cancelSentEmail, d as parseRepeatTick, dn as listRepeatingSends, dt as cliLogout, en as listCredentials, et as assertAutomatedVerdict, f as preparePresenceAliveEmail, fn as listRoles, ft as completeWebhookEvent, g as WaitDeadlineReached, gn as listWakeAuthorizations, gt as createWakeAuthorization, hn as listSentEmails, ht as createRoute, i as REPEAT_EVERY_MAX_MINUTES, in as listEmailAttachmentArchiveMembers, j as AWAITING_FLAG_DESCRIPTION, jn as searchEmails, jt as getAgentContactPolicy, k as sinceFromFlags, kn as runWakeSchedule, kt as getAccessMode, l as parseInteractionEnvelope, ln as listGroups, lt as cancelSentEmailByIdempotencyKey, m as repeatStopCommand, mn as listSentAttachmentArchiveMembers, mt as createFunction, nn as listDefaultNetworkMembers, o as REPEAT_MAX_SENDS_MAX, on as listEndpoints, ot as isAutomatedRejectedError, p as prepareSignalEmail, pn as listRoutes, pt as createEndpoint, qn as updateRepeatingSend, qt as getWakeSchedule, rn as listDomains, s as buildRepeatStopBody, sn as listFunctionLogs, st as addDefaultNetworkMember, tn as listDefaultNetworkAgents, tt as automatedRejectedError, u as parsePresenceEnvelope, un as listMailboxAccess, ut as checkDefaultNetworkContactAdmission, vn as listWakeSchedules, w as cursorFromAcceptedRows, wn as redeemCreditCode, wt as downloadEmailAttachmentArchiveMember, x as retryingOperation, xt as deleteRoute, y as pauseForTransientFailure, yn as pollCliLogin, z as formatRepliesCell, zn as startAgentClaim, zt as getFunctionTestRunTrace } from "../repeats-Dj_o6c-X-Bf9G0xds.js";
-import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-BN0JTPZ3.js";
+import { $ as deriveSendIdempotencyKey, A as wakeRelationship, At as ATTACHMENT_WAIT_MAX_MS, B as readEmailInteraction, Bt as CliOrgRefusedError, C as readThreadContext, Ct as currentMailSessionKey, Dt as formatAlreadySentNotice, E as serverRelationship, Et as runtimeSessionVariableList, F as readPendingMail, Ft as createCliApiClient, G as MAX_SEND_WAIT_TIMEOUT_MS, H as replyInteractionWarning, Ht as fetchCliOrgs, I as recordPendingMail, It as refreshStoredCliCredentials, J as assertValidIdempotencyKey, K as SEND_OUTCOME_HELP, L as removePendingMail, Lt as refuseOrgSelectionForProfile, M as clearConsumedPendingMail, Mt as ConnectedAgentKeyRequiredError, N as clearReadPendingMail, O as wakeReadCommand, Ot as withFlagSuggestion, P as pendingMailPath, Pt as createAuthenticatedCliApiClient, Q as classifySendError, R as interactionHumanLine, Rt as resolveCliApiRequestConfig, S as latestOwnOutbound, St as loadSkillLine, T as serverMuted, Tt as detectRuntimeSession, Ut as revokeUserLogin, V as replyExpectation, Vt as credentialsFromUserLogin, W as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Wt as switchCurrentOrg, X as buildThrownSendFailureEnvelope, Y as buildFollowUpCommand, Z as checkPriorReplies, _ as explainPendingMailNotFound, _t as cliInvocation, a as createOperationCommand, at as formatSendFailureSummary, b as displayAddress, bt as generatedAgentName, c as formatErrorPayload, ct as reportSendCommandResult, d as isGrantRefusal, dt as sendWaitClampNotice, et as excludeSignalReplies, f as parameterFlagName, ft as sentHistoryWindowStart, g as writeErrorWithHints, h as surfaceUnauthorizedHint, ht as thrownErrorExitCode, i as TIME_FLAG_DESCRIPTION, it as formatPriorRepliesWarning, j as claimPendingMail, jt as withAttachmentWait, k as wakeRecipientField, kt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, l as hasControlCharacter$1, lt as sendIdentityFields, m as runWithTiming, mt as successfulSendOutcome, n as API_ERROR_CODES, nt as formatDeletedEarlierSendNotice, o as extractErrorCode, ot as formatSendRecordFailureSummary, p as readTextFileFlag, pt as serializeErrorPayload, q as apiResultHttpStatus, r as OPERATION_PATH_FLAGS, rt as formatPriorRepliesCheckSkipped, s as extractErrorPayload, st as priorRepliesThatWentOut, t as API_BASE_URL_FLAG_DESCRIPTION, tt as followUpCommandPrefix, u as headerFlagName, ut as sendOutcomeExitCode, v as bareAddress, vt as connectNextSteps, w as sentInThread, wt as detectAgentRuntime, x as formatMailWakeLine, xt as identitySuggestions, y as describeWake, z as interactionNextActions, zt as selectedOrgFromEnv } from "../api-command-DWjtyqH9.js";
+import { $ as AutomatedFilterUnsupportedError, $n as updateRoute, $t as listAgentContacts, A as sleep$3, An as resendAgentSignupVerification, At as getAccessMode, B as hasReplyState, Bn as setFunctionSecret, Bt as getFunctionTestRunTrace, C as collectNewAcceptedEmails, Ct as deleteWakeAuthorization, D as filtersFromFlags, Dn as removeDefaultNetworkMember, E as fetchEmailSearchPage, En as redeemCreditCode, Et as downloadEmailAttachmentByFilename, F as assertAwaitingFilterRows, Fn as searchEmails, Ft as getCreditBalance, Gn as startCliLogin, Gt as getOwnGrant, H as queryUsesAwaiting, Hn as simulateRoute, Ht as getKey, I as awaitingRejectedError, In as searchMemories, It as getDefaultNetworkAgent, J as parseWebhookEvent, Jn as unsetFunctionRoute, Jt as getThread, K as isEmailReceivedEvent, Kn as stopRepeatFromEmail, Kt as getRepeatingSend, L as ensureSearchReportsReplyState, Ln as semanticSearch, Lt as getEmail, M as AWAITING_VALUES, Mn as rotateKey, Mt as getAgentContactPolicy, N as REPLY_STATE_UNSUPPORTED_CODE, Nn as runWakeSchedule, O as quoteDslValue, On as reorderRoutes, Ot as downloadSentAttachmentArchiveMember, P as ReplyStateUnsupportedError, Pt as getConversation, Q as AUTOMATED_VALUES, Qn as updateRepeatingSend, R as formatAwaitingCell, Rn as sendEmail, Rt as getFunction, S as transientFailure, Sn as pullWebhookEvent, St as deleteRoute, T as encodeReceivedAtSearchCursor, Tt as downloadEmailAttachmentArchiveMember, Un as startAgentClaim, Ut as getMemory, V as isAwaitingRejectedError, Vn as setMemory, Vt as getInboxStatus, Wn as startAgentSignup, Wt as getOrgRoutingTopology, X as AUTOMATED_FILTER_UNSUPPORTED_CODE, Xn as updateFunction, Y as parseFromHeader, Yn as updateDefaultNetworkMember, Yt as getWakeSchedule, Z as AUTOMATED_FLAG_DESCRIPTION, Zn as updateKey, Zt as leaveOrganization, _ as describeApiFailure, _n as listSentEmails, _t as createWakeAuthorization, a as REPEAT_IDLE_MAX_MINUTES, an as listEmailAttachmentArchiveMembers, at as hasAutomatedVerdict, b as retryTransient, bn as listWakeSchedules, cn as listFunctionLogs, ct as cancelSentEmail, d as parseRepeatTick, dn as listKeys, dt as cliLogout, en as listAgentNetworks, er as updateWakeAuthorization, et as assertAutomatedVerdict, f as preparePresenceAliveEmail, fn as listMailboxAccess, ft as completeWebhookEvent, g as WaitDeadlineReached, gn as listSentAttachmentArchiveMembers, gt as createRoute, hn as listRoutes, ht as createKey, i as REPEAT_EVERY_MAX_MINUTES, in as listDomains, j as AWAITING_FLAG_DESCRIPTION, jn as revokeCredential, jt as getAccount, k as sinceFromFlags, kn as replyToEmail, kt as downloadSentAttachmentByFilename, l as parseInteractionEnvelope, ln as listFunctions, lt as cancelSentEmailByIdempotencyKey, m as repeatStopCommand, mn as listRoles, mt as createFunction, nn as listDefaultNetworkAgents, nr as verifyAgentClaim, o as REPEAT_MAX_SENDS_MAX, on as listEmails, ot as isAutomatedRejectedError, p as prepareSignalEmail, pn as listRepeatingSends, pt as createEndpoint, qn as testFunction, qt as getSentEmail, rn as listDefaultNetworkMembers, rr as verifyAgentSignup, s as buildRepeatStopBody, sn as listEndpoints, st as addDefaultNetworkMember, tr as updateWakeSchedule, tt as automatedRejectedError, u as parsePresenceEnvelope, un as listGroups, ut as checkDefaultNetworkContactAdmission, vn as listWakeAuthorizations, vt as createWakeSchedule, w as cursorFromAcceptedRows, wt as deleteWakeSchedule, x as retryingOperation, xn as pollCliLogin, xt as deleteMemory, y as pauseForTransientFailure, yn as listWakeDispatches, z as formatRepliesCell, zn as setFunctionRoute, zt as getFunctionRouting } from "../repeats-Dj_o6c-X-BKHiZsYv.js";
+import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-8Jv4jJzI.js";
 import { A as AGENT_ADDRESS_ENV, C as saveCliCredentials, D as loadActiveChatState, E as deleteChatState, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadChatConversationByLocalId, P as agentProfileName, R as loadConnectedAgentProfile, S as resolveCliAuth, T as chatStatePath, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as loadCliCredentials, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as saveActiveChatState, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveSignupCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-Ms_0vNjq.js";
 import { C as resolveListenSubscription, S as normalizeListenOrigin, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, y as listenIdentity } from "../shared-mail-files-BAQSGxxz.js";
-import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-Cp_eQ9t_.js";
-import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-DZ42V3jq.js";
+import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-BG4getHB.js";
+import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-_AEpylPV.js";
 import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, readWorkingLease, restoreAutoWorking } from "./auto-signals.js";
-import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-CRUMUCNa.js";
-import { n as jsonOutputRequested, r as runStreamingJson, t as guardJsonOutputCommands } from "../json-output-BzSBR-KX.js";
+import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-CBHAR7zj.js";
+import { i as runStreamingJson, n as guardJsonOutputCommands, r as jsonOutputRequested, t as JSON_OUTPUT_FLAG } from "../json-output-DWrJMakZ.js";
 import { c as startBackgroundListen, i as backgroundListenToken, l as stopBackgroundListen, o as runBackgroundListen, r as backgroundListenStatus, u as verifyBackgroundListenTarget } from "../listen-background-C0F9gNDD.js";
 import { ORG_SELECTION_ENV } from "./global-org-flag.js";
 import { n as createConfig, t as createClient } from "../client.gen-6rZvmHfx.js";
@@ -172,7 +172,7 @@ const openapiDocument = {
 		},
 		{
 			"name": "Mailbox access",
-			"description": "Who may read, draft and send for each mailbox, and the groups access can be given to. Readable by people and org-wide API keys; changed by a dashboard session, an org-wide API key, or the person's own Primitive CLI. Other OAuth apps need a session step-up to change it. Answers 404 feature_disabled while mailbox access is not enabled for the organization.",
+			"description": "Who may read, draft and send for each mailbox, and the groups access can be given to. Readable by people and org-wide API keys; changed by a dashboard session, an org-wide API key, or the person's own Primitive CLI. Other OAuth apps need a session step-up to change it. Answers 404 feature_disabled, with details.feature naming the feature (mailbox_access, or roles for groups), while it is not enabled for the organization; only Primitive turns it on.",
 			"x-openapi-spec": "https://api.primitive.dev/v1/openapi/tags/mailbox-access"
 		},
 		{
@@ -187,7 +187,7 @@ const openapiDocument = {
 		},
 		{
 			"name": "Roles and members",
-			"description": "Roles, member roles and removal, the mailbox access mode, break-glass, transfers and suspensions. Reads are open to people; every write is person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up. API keys never reach these. Answers 404 feature_disabled while the feature is not enabled for the organization.",
+			"description": "Roles, member roles and removal, the mailbox access mode, break-glass, transfers and suspensions. Reads are open to people; every write is person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up. API keys never reach these. Answers 404 feature_disabled while the feature is not enabled for the organization, with details.feature naming the feature; only Primitive turns it on.",
 			"x-openapi-spec": "https://api.primitive.dev/v1/openapi/tags/roles-and-members"
 		},
 		{
@@ -20885,7 +20885,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_disabled: interactions (or, for wake.dispatch, Wake dispatch) are not enabled for this organization; grant_forbidden: the credential does not hold the permission",
+						"description": "feature_disabled: interactions (or, for wake.dispatch, Wake dispatch) are not enabled for this organization, and details.feature is interactions or wake_dispatch; only Primitive turns them on. grant_forbidden: the credential does not hold the permission",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"429": {
@@ -20972,7 +20972,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_disabled: interactions (or, for wake.dispatch, Wake dispatch) are not enabled for this organization; grant_forbidden: the credential does not hold the permission",
+						"description": "feature_disabled: interactions (or, for wake.dispatch, Wake dispatch) are not enabled for this organization, and details.feature is interactions or wake_dispatch; only Primitive turns them on. grant_forbidden: the credential does not hold the permission",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"429": {
@@ -21064,7 +21064,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_disabled: interactions (or, for wake.dispatch, Wake dispatch) are not enabled for this organization; grant_forbidden: the credential does not hold the permission",
+					"description": "feature_disabled: interactions (or, for wake.dispatch, Wake dispatch) are not enabled for this organization, and details.feature is interactions or wake_dispatch; only Primitive turns them on. grant_forbidden: the credential does not hold the permission",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -21184,7 +21184,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_disabled: interactions (or, for wake.dispatch, Wake dispatch) are not enabled for this organization; grant_forbidden: the credential does not hold the permission",
+					"description": "feature_disabled: interactions (or, for wake.dispatch, Wake dispatch) are not enabled for this organization, and details.feature is interactions or wake_dispatch; only Primitive turns them on. grant_forbidden: the credential does not hold the permission",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -21648,7 +21648,7 @@ const openapiDocument = {
 		"/email-rules/test": { "post": {
 			"operationId": "testEmailRule",
 			"summary": "Test a rule against received mail",
-			"description": "Runs a rule over received mail and reports what it would decide for each email: matched, near_miss, no_match, unclassified or not_found. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version, run with its author's access). Either way the rule reads only mail its author can read. Without email_ids, the newest emails it can read are tested, at most 200 and none older than 30 days. Emails not classified yet that arrived more than 2 hours ago are classified first and their classification is saved, unless classify_missing is false; newer ones are left to normal classification and reported unclassified with reason pending. The rule itself records nothing and grants nothing. Classification and the rule's own questions stop at about 90 seconds; run the test again to continue where it stopped. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+			"description": "Runs a rule over received mail and reports what it would decide for each email: matched, near_miss, no_match, unclassified or not_found. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version, run with its author's access). Either way the rule reads only mail its author can read, and only what its scope covers; an unsaved tree covers only your own mail unless evaluation_scope names more. Without email_ids, the newest emails it can read are tested, at most 200 and none older than 30 days. Emails not classified yet that arrived more than 2 hours ago are classified first and their classification is saved, unless classify_missing is false; newer ones are left to normal classification and reported unclassified with reason pending. The rule itself records nothing and grants nothing. Classification and the rule's own questions stop at about 90 seconds; run the test again to continue where it stopped. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"requestBody": {
@@ -21671,7 +21671,7 @@ const openapiDocument = {
 					}
 				},
 				"400": {
-					"description": "validation_error: give exactly one of tree and rule_id, at most 200 email_ids, and a tree that is valid for the column contract. A saved rule whose current version no longer renders answers details.reason version_not_renderable.",
+					"description": "validation_error: give exactly one of tree and rule_id, at most 200 email_ids, and a tree that is valid for the column contract. evaluation_scope, scope_selection and kind go only with tree. A saved rule whose current version no longer renders answers details.reason version_not_renderable.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"401": {
@@ -21694,7 +21694,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. grant_forbidden with details.reason mail_depth: your access to mail shows headers only, and a rule decides on what emails say.",
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. grant_forbidden with details.reason mail_depth: your access to mail shows headers only, and a rule decides on what emails say. email_rule_scope_not_readable: scope_selection names something you cannot read.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -21702,7 +21702,7 @@ const openapiDocument = {
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"409": {
-					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree, the caller). details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox or no_shareable_mailbox.",
+					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree, the caller). details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox, no_shareable_mailbox or no_selected_mailbox.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -21745,7 +21745,7 @@ const openapiDocument = {
 		"/email-rules/test-sample": { "post": {
 			"operationId": "testEmailRuleOnSample",
 			"summary": "Test a rule against a made-up email",
-			"description": "Reports what a rule would decide for an email you describe: its sender, recipients, subject, plain text and attachment types, and optionally whether it is automated or from a mailing list and its spam score. The email is classified the way received mail is, and the rule's conditions and its own questions are decided as they would be for received mail with that content and those signals, received now. Without them it is not automated and not from a mailing list; a rule that reads a spam score you gave none for is decided on no score, and spam_score is listed in unset_columns. Nothing is stored: no email, classification or decision. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version). The answer includes what the classifier read from the email. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+			"description": "Reports what a rule would decide for an email you describe: its sender, recipients, subject, plain text and attachment types, and optionally whether it is automated or from a mailing list and its spam score. The email is classified the way received mail is, and the rule's conditions and its own questions are decided as they would be for received mail with that content and those signals, received now. Without them it is not automated and not from a mailing list; a rule that reads a spam score you gave none for is decided on no score, and spam_score is listed in unset_columns. Nothing is stored: no email, classification or decision. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version); an unsaved tree is run as covering only your own mail unless evaluation_scope names more, as on POST /email-rules/test. The answer includes what the classifier read from the email. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"requestBody": {
@@ -21768,7 +21768,7 @@ const openapiDocument = {
 					}
 				},
 				"400": {
-					"description": "validation_error: give exactly one of tree and rule_id, an email with a sender, 1 to 50 To addresses (and up to 50 Cc), and a text body, and a tree that is valid for the column contract and within the size limits for a saved rule. A saved rule whose current version no longer renders answers details.reason version_not_renderable.",
+					"description": "validation_error: give exactly one of tree and rule_id (evaluation_scope, scope_selection and kind only with tree), an email with a sender, 1 to 50 To addresses (and up to 50 Cc), and a text body, and a tree that is valid for the column contract and within the size limits for a saved rule. A saved rule whose current version no longer renders answers details.reason version_not_renderable.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"401": {
@@ -21791,7 +21791,7 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_scope_not_readable: scope_selection names something you cannot read.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
@@ -21799,7 +21799,7 @@ const openapiDocument = {
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"409": {
-					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree, you), so it would decide nothing for real. details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox or no_shareable_mailbox.",
+					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree, you), so it would decide nothing for real. details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox, no_shareable_mailbox or no_selected_mailbox.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -21843,7 +21843,7 @@ const openapiDocument = {
 			"post": {
 				"operationId": "createEmailRule",
 				"summary": "Create a rule",
-				"description": "Saves a rule as version 1, from a compile response or a tree you wrote. The tree is checked against the column contract. New rules start in observe, where what the rule matches is recorded and nothing is granted; draft is not evaluated. The caller is the rule's author, and the rule never reaches mail the author cannot read. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+				"description": "Saves a rule as version 1, from a compile response or a tree you wrote. The tree is checked against the column contract. New rules start in observe, where what the rule matches is recorded and nothing is granted or blocked; draft is not evaluated. The caller is the rule's author, and the rule never reaches mail the author cannot read. evaluation_scope chooses whose mail it runs over: own_mailboxes (only your own mail) when omitted, so any other scope (author for all you can read, or selected) is named; scope_selection may name only what you can read. The answer carries the scope as stored. kind do_not_share makes a rule that blocks sharing: it runs before every other rule, and while it is active no rule shares an email it matches or cannot decide. A key cannot list one (details.reason rule_blocks_sharing on the key). Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"requestBody": {
@@ -21892,7 +21892,11 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_scope_not_readable: scope_selection names something you cannot read (details.addresses, details.domains).",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"409": {
+						"description": "email_rule_author_unresolvable: the rule could not run as you over the chosen scope. details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox or no_shareable_mailbox. With no evaluation_scope it covers only your own mail, so no_own_mailbox or no_shareable_mailbox there means a scope must be named.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"429": {
@@ -21935,7 +21939,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "listEmailRules",
 				"summary": "List rules",
-				"description": "The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. With matched_email_id, only the rules that matched that email. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+				"description": "The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. Each carries its scope (evaluation_scope, and scope_selection for a selected rule). With matched_email_id, only the rules that matched that email. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [
@@ -22055,7 +22059,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "getEmailRule",
 				"summary": "Read a rule",
-				"description": "A rule and its current version. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+				"description": "A rule, its scope (evaluation_scope, and scope_selection for a selected rule) and its current version. What the scope comes to for its author now is GET /email-rules/{id}/scope. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -22170,7 +22174,7 @@ const openapiDocument = {
 			"patch": {
 				"operationId": "updateEmailRule",
 				"summary": "Change a rule",
-				"description": "Renames the rule, saves a new version (english, tree and explanation together; earlier versions are kept unchanged) or changes its state: draft (disabled), observe or active. Only the rule's author may rename it, add a version or move it to observe or active; anyone else who can see it may only disable it (state draft), and while it is shared with another member only if they manage members from the dashboard. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+				"description": "Renames the rule, saves a new version (english, tree and explanation together; earlier versions are kept unchanged), changes its state (draft, disabled; observe; or active) or changes whose mail it runs over (evaluation_scope, with scope_selection when selected). Only the rule's author may rename it, add a version, change its scope or move it to observe or active; anyone else who can see it may only disable it (state draft), and while it is shared with another member only if they manage members from the dashboard. Omit evaluation_scope to keep the current scope. A scope change saves a new version with the same conditions; what was granted stays. A shared rule keeps its scope. A rule's kind never changes. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -22235,7 +22239,7 @@ const openapiDocument = {
 						}
 					},
 					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_author_only: only the rule's author may make this change. forbidden with details.reason rule_shared: the rule is shared with another member, so only its author, or someone who manages members from the dashboard, can turn it off.",
+						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_author_only: only the rule's author may make this change. forbidden with details.reason rule_shared: the rule is shared with another member, so only its author, or someone who manages members from the dashboard, can turn it off. email_rule_scope_not_readable: scope_selection names something you cannot read.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"404": {
@@ -22252,7 +22256,7 @@ const openapiDocument = {
 						} }
 					},
 					"409": {
-						"description": "email_rule_conflict: the rule changed while saving; read it again and retry.",
+						"description": "email_rule_conflict: the rule changed while saving; read it again and retry. email_rule_scope_locked: the rule is shared. email_rule_author_unresolvable: the rule could not run as you over the chosen scope.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"429": {
@@ -22516,252 +22520,17 @@ const openapiDocument = {
 			},
 			"x-primitive-permission": ["mail:read"]
 		} },
-		"/email-rule-requests": {
-			"post": {
-				"operationId": "createEmailRuleRequest",
-				"summary": "Ask a member for a rule",
-				"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address (at most 30 lookups by address an hour). Nothing is evaluated and nothing is shared until they accept, and they may change the rule first; they see the request and can preview what it matches in their own mail. You may have at most 5 pending requests to one member and 50 in all. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
-				"tags": ["Email Rules"],
-				"security": [{ "BearerAuth": [] }],
-				"requestBody": {
-					"required": true,
-					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateEmailRuleRequestRequest" } } }
-				},
-				"responses": {
-					"201": {
-						"description": "Ask a member for a rule",
-						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
-							"type": "object",
-							"required": ["data"],
-							"properties": { "data": { "$ref": "#/components/schemas/CreateEmailRuleRequestResult" } }
-						}] } } }
-					},
-					"400": {
-						"description": "validation_error: give exactly one of target_user_id and target_email and a tree that is valid for the column contract; details.reason self_request when the member named is you.",
-						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-					},
-					"401": {
-						"description": "Invalid or missing API key",
-						"content": { "application/json": {
-							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-							"example": {
-								"success": false,
-								"error": {
-									"code": "unauthorized",
-									"message": "Invalid or missing API key"
-								}
-							}
-						} },
-						"headers": {
-							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
-							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
-							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
-							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
-						}
-					},
-					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
-						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-					},
-					"404": {
-						"description": "not_found: no current member of this organization matches the member named.",
-						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-					},
-					"409": {
-						"description": "email_rule_request_limit: you already have the most pending requests allowed (details.limit, and details.scope target or total).",
-						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-					},
-					"429": {
-						"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
-						"headers": {
-							"Retry-After": {
-								"schema": { "type": "integer" },
-								"description": "Seconds to wait before retrying"
-							},
-							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
-							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
-							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
-							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
-						},
-						"content": { "application/json": {
-							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-							"example": {
-								"success": false,
-								"error": {
-									"code": "rate_limit_exceeded",
-									"message": "Rate limit exceeded"
-								}
-							}
-						} }
-					},
-					"503": {
-						"description": "service_unavailable: looking members up by address is unavailable right now. Try again in a moment, or name them by user id.",
-						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-					}
-				},
-				"x-primitive-permission": ["mail:read"],
-				"parameters": [{
-					"name": "Idempotency-Key",
-					"in": "header",
-					"required": false,
-					"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
-					"schema": {
-						"type": "string",
-						"minLength": 1,
-						"maxLength": 255
-					}
-				}]
-			},
-			"get": {
-				"operationId": "listEmailRuleRequests",
-				"summary": "List rule requests",
-				"description": "Rule requests, newest first: those made to you (box incoming, the default), those you made (outgoing), or every one you can see (all). Pending ones by default; status decided lists accepted, declined and withdrawn ones, and any lists both. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
-				"tags": ["Email Rules"],
-				"security": [{ "BearerAuth": [] }],
-				"parameters": [
-					{
-						"name": "box",
-						"in": "query",
-						"required": false,
-						"description": "incoming, outgoing or all.",
-						"schema": {
-							"default": "incoming",
-							"description": "incoming: requests made to you; outgoing: requests you made; all: every request you can see (owners and admins see the organization's).",
-							"type": "string",
-							"enum": [
-								"incoming",
-								"outgoing",
-								"all"
-							]
-						}
-					},
-					{
-						"name": "status",
-						"in": "query",
-						"required": false,
-						"description": "pending, decided or any.",
-						"schema": {
-							"default": "pending",
-							"type": "string",
-							"enum": [
-								"pending",
-								"decided",
-								"any"
-							]
-						}
-					},
-					{
-						"name": "limit",
-						"in": "query",
-						"required": false,
-						"description": "Maximum number of items to return.",
-						"schema": {
-							"default": 25,
-							"type": "integer",
-							"minimum": 1,
-							"maximum": 100
-						}
-					},
-					{
-						"name": "cursor",
-						"in": "query",
-						"required": false,
-						"description": "Opaque cursor from the previous page's next_cursor. Omit for the first page.",
-						"schema": {
-							"type": "string",
-							"maxLength": 200
-						}
-					}
-				],
-				"responses": {
-					"200": {
-						"description": "List rule requests",
-						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
-							"type": "object",
-							"required": ["data"],
-							"properties": { "data": { "$ref": "#/components/schemas/ListEmailRuleRequestsResult" } }
-						}] } } },
-						"headers": {
-							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
-							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
-							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
-							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
-						}
-					},
-					"400": {
-						"description": "Invalid request parameters",
-						"content": { "application/json": {
-							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-							"example": {
-								"success": false,
-								"error": {
-									"code": "validation_error",
-									"message": "Invalid domain format"
-								}
-							}
-						} }
-					},
-					"401": {
-						"description": "Invalid or missing API key",
-						"content": { "application/json": {
-							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-							"example": {
-								"success": false,
-								"error": {
-									"code": "unauthorized",
-									"message": "Invalid or missing API key"
-								}
-							}
-						} },
-						"headers": {
-							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
-							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
-							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
-							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
-						}
-					},
-					"403": {
-						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
-						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-					},
-					"429": {
-						"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
-						"headers": {
-							"Retry-After": {
-								"schema": { "type": "integer" },
-								"description": "Seconds to wait before retrying"
-							},
-							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
-							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
-							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
-							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
-						},
-						"content": { "application/json": {
-							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
-							"example": {
-								"success": false,
-								"error": {
-									"code": "rate_limit_exceeded",
-									"message": "Rate limit exceeded"
-								}
-							}
-						} }
-					}
-				},
-				"x-primitive-permission": ["mail:read"]
-			}
-		},
-		"/email-rule-requests/{id}": { "get": {
-			"operationId": "getEmailRuleRequest",
-			"summary": "Read a rule request",
-			"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"/emails/{id}/rule-results": { "get": {
+			"operationId": "listEmailRuleResults",
+			"summary": "List every rule's result on an email",
+			"description": "Every rule the caller can see and what it decided about this email: those that matched, those that did not, and those that have not run on it, with what is known about them. A result names the version of the rule that decided and carries that version's conditions and questions. A matched rule with kind do_not_share keeps rules from sharing the email while it is active; anything shared before then stays shared. Only a caller who can read the email gets an answer, and a rule the caller cannot see is left out. At most 50 rules are listed, those with a result first; hidden counts the rest. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
 				"name": "id",
 				"in": "path",
 				"required": true,
-				"description": "The request id.",
+				"description": "The email id.",
 				"schema": {
 					"type": "string",
 					"format": "uuid"
@@ -22769,11 +22538,11 @@ const openapiDocument = {
 			}],
 			"responses": {
 				"200": {
-					"description": "Read a rule request",
+					"description": "List every rule's result on an email",
 					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
 						"type": "object",
 						"required": ["data"],
-						"properties": { "data": { "$ref": "#/components/schemas/GetEmailRuleRequestResult" } }
+						"properties": { "data": { "$ref": "#/components/schemas/ListEmailRuleResultsResult" } }
 					}] } } },
 					"headers": {
 						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
@@ -22806,7 +22575,7 @@ const openapiDocument = {
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
-					"description": "not_found: no request you can see has this id.",
+					"description": "not_found: no such email, or not one the caller can read.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -22835,39 +22604,39 @@ const openapiDocument = {
 			},
 			"x-primitive-permission": ["mail:read"]
 		} },
-		"/email-rule-requests/{id}/decline": { "post": {
-			"operationId": "declineEmailRuleRequest",
-			"summary": "Decline a rule request",
-			"description": "Declines a pending request made to you. Nothing is written but the decision. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"/email-rules/{id}/versions": { "get": {
+			"operationId": "listEmailRuleVersions",
+			"summary": "Read versions of a rule",
+			"description": "The named versions of a rule, as they were written: what each one's conditions and questions were, so a decision can be read against the version that made it. Numbers that are not versions of the rule are left out. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
 				"name": "id",
 				"in": "path",
 				"required": true,
-				"description": "The request id.",
+				"description": "The rule id.",
 				"schema": {
 					"type": "string",
 					"format": "uuid"
 				}
 			}, {
-				"name": "Idempotency-Key",
-				"in": "header",
-				"required": false,
-				"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+				"name": "versions",
+				"in": "query",
+				"required": true,
+				"description": "The version numbers, comma-separated, at most 100.",
 				"schema": {
 					"type": "string",
-					"minLength": 1,
-					"maxLength": 255
+					"pattern": "^[1-9]\\d{0,8}(,[1-9]\\d{0,8}){0,99}$",
+					"description": "The version numbers to read, comma-separated."
 				}
 			}],
 			"responses": {
 				"200": {
-					"description": "Decline a rule request",
+					"description": "Read versions of a rule",
 					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
 						"type": "object",
 						"required": ["data"],
-						"properties": { "data": { "$ref": "#/components/schemas/DeclineEmailRuleRequestResult" } }
+						"properties": { "data": { "$ref": "#/components/schemas/ListEmailRuleVersionsResult" } }
 					}] } } },
 					"headers": {
 						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
@@ -22876,6 +22645,19 @@ const openapiDocument = {
 						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
 					}
 				},
+				"400": {
+					"description": "Invalid request parameters",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "validation_error",
+								"message": "Invalid domain format"
+							}
+						}
+					} }
+				},
 				"401": {
 					"description": "Invalid or missing API key",
 					"content": { "application/json": {
@@ -22896,16 +22678,620 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_request_target_only: only the member the request was made to may decline it.",
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
-					"description": "not_found: no request you can see has this id.",
-					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-				},
-				"409": {
-					"description": "email_rule_request_not_pending: the request was already accepted, declined or withdrawn (details.status).",
-					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					"description": "Resource not found",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "not_found",
+								"message": "Resource not found"
+							}
+						}
+					} }
+				},
+				"429": {
+					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+					"headers": {
+						"Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						},
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+					},
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				}
+			},
+			"x-primitive-permission": ["mail:read"]
+		} },
+		"/email-rules/{id}/scope": { "get": {
+			"operationId": "getEmailRuleScope",
+			"summary": "Read what a rule covers",
+			"description": "Whose mail the rule runs over, and what that comes to now: a rule never reaches further than what its author can read when it runs, so what a selected rule names and its author can no longer read stops matching. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+			"tags": ["Email Rules"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{
+				"name": "id",
+				"in": "path",
+				"required": true,
+				"description": "The rule id.",
+				"schema": {
+					"type": "string",
+					"format": "uuid"
+				}
+			}],
+			"responses": {
+				"200": {
+					"description": "Read what a rule covers",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"required": ["data"],
+						"properties": { "data": { "$ref": "#/components/schemas/GetEmailRuleScopeResult" } }
+					}] } } },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+					}
+				},
+				"401": {
+					"description": "Invalid or missing API key",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
+							}
+						}
+					} },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+					}
+				},
+				"403": {
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"404": {
+					"description": "not_found: no such rule, or not one you can see.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"429": {
+					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+					"headers": {
+						"Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						},
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+					},
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				}
+			},
+			"x-primitive-permission": ["mail:read"]
+		} },
+		"/email-rule-scope-options": { "get": {
+			"operationId": "listEmailRuleScopeOptions",
+			"summary": "List what a rule can cover",
+			"description": "How much the caller can read, and the inboxes and domains the caller can read, which is what they may name when a rule runs over selected inboxes and domains. For a caller who reads the whole organization, addresses lists the inboxes known as someone's (member addresses, members' verified work emails at the organization's domains, agents' addresses and inboxes with shared access), not every address that receives mail: may_name_unlisted says when an address that is not listed, such as an inbox nobody has claimed, may be named too. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+			"tags": ["Email Rules"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{
+				"name": "q",
+				"in": "query",
+				"required": false,
+				"description": "Only inboxes and domains containing this text.",
+				"schema": {
+					"description": "Only inboxes and domains containing this text.",
+					"type": "string",
+					"maxLength": 200
+				}
+			}],
+			"responses": {
+				"200": {
+					"description": "List what a rule can cover",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"required": ["data"],
+						"properties": { "data": { "$ref": "#/components/schemas/ListEmailRuleScopeOptionsResult" } }
+					}] } } },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+					}
+				},
+				"400": {
+					"description": "Invalid request parameters",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "validation_error",
+								"message": "Invalid domain format"
+							}
+						}
+					} }
+				},
+				"401": {
+					"description": "Invalid or missing API key",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
+							}
+						}
+					} },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+					}
+				},
+				"403": {
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"409": {
+					"description": "email_rule_author_unresolvable: rules cannot run as you right now.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"429": {
+					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+					"headers": {
+						"Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						},
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+					},
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				}
+			},
+			"x-primitive-permission": ["mail:read"]
+		} },
+		"/email-rule-requests": {
+			"post": {
+				"operationId": "createEmailRuleRequest",
+				"summary": "Ask a member for a rule",
+				"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address (at most 30 lookups by address an hour). Nothing is evaluated and nothing is shared until they accept, and they may change the rule first; they see the request and can preview what it matches in their own mail. You may have at most 5 pending requests to one member and 50 in all. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+				"tags": ["Email Rules"],
+				"security": [{ "BearerAuth": [] }],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateEmailRuleRequestRequest" } } }
+				},
+				"responses": {
+					"201": {
+						"description": "Ask a member for a rule",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"required": ["data"],
+							"properties": { "data": { "$ref": "#/components/schemas/CreateEmailRuleRequestResult" } }
+						}] } } }
+					},
+					"400": {
+						"description": "validation_error: give exactly one of target_user_id and target_email and a tree that is valid for the column contract; details.reason self_request when the member named is you.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"401": {
+						"description": "Invalid or missing API key",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "unauthorized",
+									"message": "Invalid or missing API key"
+								}
+							}
+						} },
+						"headers": {
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+						}
+					},
+					"403": {
+						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"404": {
+						"description": "not_found: no current member of this organization matches the member named.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"409": {
+						"description": "email_rule_request_limit: you already have the most pending requests allowed (details.limit, and details.scope target or total).",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"429": {
+						"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+						"headers": {
+							"Retry-After": {
+								"schema": { "type": "integer" },
+								"description": "Seconds to wait before retrying"
+							},
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+						},
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "rate_limit_exceeded",
+									"message": "Rate limit exceeded"
+								}
+							}
+						} }
+					},
+					"503": {
+						"description": "service_unavailable: looking members up by address is unavailable right now. Try again in a moment, or name them by user id.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					}
+				},
+				"x-primitive-permission": ["mail:read"],
+				"parameters": [{
+					"name": "Idempotency-Key",
+					"in": "header",
+					"required": false,
+					"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+					"schema": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 255
+					}
+				}]
+			},
+			"get": {
+				"operationId": "listEmailRuleRequests",
+				"summary": "List rule requests",
+				"description": "Rule requests, newest first: those made to you (box incoming, the default), those you made (outgoing), or every one you can see (all). Pending ones by default; status decided lists accepted, declined and withdrawn ones, and any lists both. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+				"tags": ["Email Rules"],
+				"security": [{ "BearerAuth": [] }],
+				"parameters": [
+					{
+						"name": "box",
+						"in": "query",
+						"required": false,
+						"description": "incoming, outgoing or all.",
+						"schema": {
+							"default": "incoming",
+							"description": "incoming: requests made to you; outgoing: requests you made; all: every request you can see (owners and admins see the organization's).",
+							"type": "string",
+							"enum": [
+								"incoming",
+								"outgoing",
+								"all"
+							]
+						}
+					},
+					{
+						"name": "status",
+						"in": "query",
+						"required": false,
+						"description": "pending, decided or any.",
+						"schema": {
+							"default": "pending",
+							"type": "string",
+							"enum": [
+								"pending",
+								"decided",
+								"any"
+							]
+						}
+					},
+					{
+						"name": "limit",
+						"in": "query",
+						"required": false,
+						"description": "Maximum number of items to return.",
+						"schema": {
+							"default": 25,
+							"type": "integer",
+							"minimum": 1,
+							"maximum": 100
+						}
+					},
+					{
+						"name": "cursor",
+						"in": "query",
+						"required": false,
+						"description": "Opaque cursor from the previous page's next_cursor. Omit for the first page.",
+						"schema": {
+							"type": "string",
+							"maxLength": 200
+						}
+					}
+				],
+				"responses": {
+					"200": {
+						"description": "List rule requests",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"required": ["data"],
+							"properties": { "data": { "$ref": "#/components/schemas/ListEmailRuleRequestsResult" } }
+						}] } } },
+						"headers": {
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+						}
+					},
+					"400": {
+						"description": "Invalid request parameters",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "validation_error",
+									"message": "Invalid domain format"
+								}
+							}
+						} }
+					},
+					"401": {
+						"description": "Invalid or missing API key",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "unauthorized",
+									"message": "Invalid or missing API key"
+								}
+							}
+						} },
+						"headers": {
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+						}
+					},
+					"403": {
+						"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"429": {
+						"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+						"headers": {
+							"Retry-After": {
+								"schema": { "type": "integer" },
+								"description": "Seconds to wait before retrying"
+							},
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+						},
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "rate_limit_exceeded",
+									"message": "Rate limit exceeded"
+								}
+							}
+						} }
+					}
+				},
+				"x-primitive-permission": ["mail:read"]
+			}
+		},
+		"/email-rule-requests/{id}": { "get": {
+			"operationId": "getEmailRuleRequest",
+			"summary": "Read a rule request",
+			"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+			"tags": ["Email Rules"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{
+				"name": "id",
+				"in": "path",
+				"required": true,
+				"description": "The request id.",
+				"schema": {
+					"type": "string",
+					"format": "uuid"
+				}
+			}],
+			"responses": {
+				"200": {
+					"description": "Read a rule request",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"required": ["data"],
+						"properties": { "data": { "$ref": "#/components/schemas/GetEmailRuleRequestResult" } }
+					}] } } },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+					}
+				},
+				"401": {
+					"description": "Invalid or missing API key",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
+							}
+						}
+					} },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+					}
+				},
+				"403": {
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"404": {
+					"description": "not_found: no request you can see has this id.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"429": {
+					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+					"headers": {
+						"Retry-After": {
+							"schema": { "type": "integer" },
+							"description": "Seconds to wait before retrying"
+						},
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+					},
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "rate_limit_exceeded",
+								"message": "Rate limit exceeded"
+							}
+						}
+					} }
+				}
+			},
+			"x-primitive-permission": ["mail:read"]
+		} },
+		"/email-rule-requests/{id}/decline": { "post": {
+			"operationId": "declineEmailRuleRequest",
+			"summary": "Decline a rule request",
+			"description": "Declines a pending request made to you. Nothing is written but the decision. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+			"tags": ["Email Rules"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{
+				"name": "id",
+				"in": "path",
+				"required": true,
+				"description": "The request id.",
+				"schema": {
+					"type": "string",
+					"format": "uuid"
+				}
+			}, {
+				"name": "Idempotency-Key",
+				"in": "header",
+				"required": false,
+				"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+				"schema": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 255
+				}
+			}],
+			"responses": {
+				"200": {
+					"description": "Decline a rule request",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"required": ["data"],
+						"properties": { "data": { "$ref": "#/components/schemas/DeclineEmailRuleRequestResult" } }
+					}] } } },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+					}
+				},
+				"401": {
+					"description": "Invalid or missing API key",
+					"content": { "application/json": {
+						"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+						"example": {
+							"success": false,
+							"error": {
+								"code": "unauthorized",
+								"message": "Invalid or missing API key"
+							}
+						}
+					} },
+					"headers": {
+						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+						"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+						"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+					}
+				},
+				"403": {
+					"description": "feature_not_enabled: the email rules feature is not enabled for this organization yet. Permission refusals answer forbidden or grant_forbidden instead. email_rule_request_target_only: only the member the request was made to may decline it.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"404": {
+					"description": "not_found: no request you can see has this id.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
+				"409": {
+					"description": "email_rule_request_not_pending: the request was already accepted, declined or withdrawn (details.status).",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
 					"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
@@ -30954,7 +31340,7 @@ const openapiDocument = {
 			"summary": "List every credential",
 			"tags": ["Credentials"],
 			"security": [{ "BearerAuth": [] }],
-			"description": "Every credential that can act in the organization: API keys, Function keys, agent connection keys, connected apps (OAuth), agent delegates and, where enabled, CLI logins. Secrets are never returned. Filter with kind. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.",
+			"description": "Every credential that can act in the organization: API keys, Function keys, agent connection keys, connected apps (OAuth), agent delegates and, where enabled, CLI logins. Secrets are never returned. Filter with kind. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.",
 			"x-primitive-person-only": { "access": "session" },
 			"parameters": [{
 				"name": "kind",
@@ -31083,7 +31469,7 @@ const openapiDocument = {
 			"summary": "Revoke a credential",
 			"tags": ["Credentials"],
 			"security": [{ "BearerAuth": [] }],
-			"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up keeps working and is listed in standing_objects for review. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
+			"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up keeps working and is listed in standing_objects for review. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
 			"x-primitive-person-only": { "access": "session" },
 			"parameters": [{
 				"name": "Idempotency-Key",
@@ -31223,7 +31609,7 @@ const openapiDocument = {
 			"summary": "Revoke every credential (emergency)",
 			"tags": ["Credentials"],
 			"security": [{ "BearerAuth": [] }],
-			"description": "The emergency response to a leak: revokes every API key, agent connection key and connected app created since a time, rotates the organization Function key and every running Function's own key, and optionally suspends Functions. Owners only, from a dashboard session, and the body must confirm with \"revoke all\". Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session. The person's role must hold credentials:revoke_all. API keys, agent connection keys and agents are refused.",
+			"description": "The emergency response to a leak: revokes every API key, agent connection key and connected app created since a time, rotates the organization Function key and every running Function's own key, and optionally suspends Functions. Owners only, from a dashboard session, and the body must confirm with \"revoke all\". Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session. The person's role must hold credentials:revoke_all. API keys, agent connection keys and agents are refused.",
 			"x-primitive-person-only": { "access": "session" },
 			"parameters": [{
 				"name": "Idempotency-Key",
@@ -31350,7 +31736,7 @@ const openapiDocument = {
 			"summary": "Read the credential audit trail",
 			"tags": ["Credentials"],
 			"security": [{ "BearerAuth": [] }],
-			"description": "Credential events (created, rotated, edited, revoked, used with a step-up, policy changes), newest first, with a cursor. format=csv returns the same page as CSV. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session. The person's role must hold credential_events:read. API keys, agent connection keys and agents are refused.",
+			"description": "Credential events (created, rotated, edited, revoked, used with a step-up, policy changes), newest first, with a cursor. format=csv returns the same page as CSV. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session. The person's role must hold credential_events:read. API keys, agent connection keys and agents are refused.",
 			"x-primitive-person-only": { "access": "session" },
 			"parameters": [
 				{
@@ -31552,7 +31938,7 @@ const openapiDocument = {
 				"summary": "Read the credential policy",
 				"tags": ["Credentials"],
 				"security": [{ "BearerAuth": [] }],
-				"description": "The organization credential policy: key lifetime and expiry rules, who may create super admin keys, whether members may create keys and the other rules every new key is held to. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.",
+				"description": "The organization credential policy: key lifetime and expiry rules, who may create super admin keys, whether members may create keys and the other rules every new key is held to. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.",
 				"x-primitive-person-only": { "access": "session" },
 				"parameters": [],
 				"responses": {
@@ -31665,7 +32051,7 @@ const openapiDocument = {
 				"summary": "Change the credential policy",
 				"tags": ["Credentials"],
 				"security": [{ "BearerAuth": [] }],
-				"description": "Change one or more policy rules. Admins may only tighten the policy; loosening any rule needs an owner. Owners and admins are emailed about every change. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session. The person's role must hold credential_policy:manage. API keys, agent connection keys and agents are refused.",
+				"description": "Change one or more policy rules. Admins may only tighten the policy; loosening any rule needs an owner. Owners and admins are emailed about every change. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session. The person's role must hold credential_policy:manage. API keys, agent connection keys and agents are refused.",
 				"x-primitive-person-only": { "access": "session" },
 				"parameters": [],
 				"responses": {
@@ -31783,7 +32169,7 @@ const openapiDocument = {
 			"summary": "Read the key builder",
 			"tags": ["Credentials"],
 			"security": [{ "BearerAuth": [] }],
-			"description": "The key presets the caller may use (each with whether it is available and why not), the permission matrix for custom keys and the policy in force. An area marked org_wide_only (Members) is listed only to a person who holds its permission, and only a custom key with no addresses or domains may hold it. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
+			"description": "The key presets the caller may use (each with whether it is available and why not), the permission matrix for custom keys and the policy in force. An area marked org_wide_only (Members) is listed only to a person who holds its permission, and only a custom key with no addresses or domains may hold it. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
 			"x-primitive-person-only": { "access": "session" },
 			"parameters": [],
 			"responses": {
@@ -31897,10 +32283,11 @@ const openapiDocument = {
 				"summary": "Create an API key",
 				"tags": ["Credentials"],
 				"security": [{ "BearerAuth": [] }],
-				"description": "Create an API key, super admin or narrowed to a preset or a custom permission set, optionally with an expiry and conditions. The secret is returned once. A key never holds more than the person creating it; the credential policy decides who may create which keys. grant is required: a request without it is refused (400 validation_error, details.reason grant_required), never treated as super admin. A custom key must say which mail it reaches: the addresses and domains it lists (grant.addresses, grant.domains), or every mailbox in the organization with grant.mail_scope \"org\", which cannot be combined with them; one that says neither is refused (400 validation_error, details.reason mail_scope_required). Super admin, Send only and Read only reach every mailbox by definition. members:read is only for an org-wide custom key: naming it with grant.addresses or grant.domains is refused (400). Owners and admins are emailed about every super admin key. Send an Idempotency-Key to retry safely: a second create by the same person under the same key makes no second key and is refused (409 idempotency_key_reused) with the first key's id in error.details.key_id, so a caller whose first answer was lost can revoke that key. The onboarding field is for the dashboard only. The Primitive CLI's token is refused, even with a step-up: keys are created in the dashboard or by an app the person connected. While the organization's keys API is not enabled, this answers 404 feature_disabled, except that a dashboard session may still create a super admin key (the dashboard's own create).\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+				"description": "Create an API key, super admin or narrowed to a preset or a custom permission set, optionally with an expiry and conditions. The secret is returned once. A key never holds more than the person creating it; the credential policy decides who may create which keys. grant is required: a request without it is refused (400 validation_error, details.reason grant_required), never treated as super admin. A custom key must say which mail it reaches: the addresses and domains it lists (grant.addresses, grant.domains), or every mailbox in the organization with grant.mail_scope \"org\", which cannot be combined with them; one that says neither is refused (400 validation_error, details.reason mail_scope_required). Super admin, Send only and Read only reach every mailbox by definition. members:read is only for an org-wide custom key: naming it with grant.addresses or grant.domains is refused (400). Owners and admins are emailed about every super admin key. Send an Idempotency-Key to retry safely: a second create by the same person under the same key makes no second key and is refused (409 idempotency_key_reused) with the first key's id in error.details.key_id, so a caller whose first answer was lost can revoke that key. The onboarding field is for the dashboard only. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules); the Primitive app's token is refused, even with one. While the organization's keys API is not enabled, this answers 404 feature_disabled (details.feature keys_api; only Primitive turns it on), except that a dashboard session may still create a super admin key (the dashboard's own create).\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 				"x-primitive-person-only": {
 					"access": "step_up",
-					"step_up_purpose": "keys.create"
+					"step_up_purpose": "keys.create",
+					"cli_without_step_up": true
 				},
 				"parameters": [
 					{
@@ -31927,7 +32314,7 @@ const openapiDocument = {
 						"name": "Primitive-Step-Up",
 						"in": "header",
 						"required": false,
-						"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive CLI and app are refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`).",
+						"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive app is refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`). The person's own Primitive CLI login needs no token for this purpose while the organization's keys API is on (a token it sends is still checked); while it is off, a token it sends is refused the same way.",
 						"schema": {
 							"type": "string",
 							"pattern": "^pstep_[0-9a-f]{64}$"
@@ -32055,7 +32442,7 @@ const openapiDocument = {
 				"summary": "List API keys",
 				"tags": ["Credentials"],
 				"security": [{ "BearerAuth": [] }],
-				"description": "Key metadata, never a secret: name, prefix, grant, creator, last use, expiry and suspension. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
+				"description": "Key metadata, never a secret: name, prefix, grant, creator, last use, expiry and suspension. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
 				"x-primitive-person-only": { "access": "session_or_cli" },
 				"parameters": [{
 					"name": "cursor",
@@ -32178,10 +32565,11 @@ const openapiDocument = {
 			"summary": "Rotate an API key",
 			"tags": ["Credentials"],
 			"security": [{ "BearerAuth": [] }],
-			"description": "Mint a successor with the same grant and return its secret once. The old key keeps working for overlap_seconds, then stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner created is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The Primitive CLI's token is refused, even with a step-up. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+			"description": "Mint a successor with the same grant and return its secret once. The old key keeps working for overlap_seconds, then stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner created is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules); the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 			"x-primitive-person-only": {
 				"access": "step_up",
-				"step_up_purpose": "keys.create"
+				"step_up_purpose": "keys.create",
+				"cli_without_step_up": true
 			},
 			"parameters": [
 				{
@@ -32198,7 +32586,7 @@ const openapiDocument = {
 					"name": "Primitive-Step-Up",
 					"in": "header",
 					"required": false,
-					"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive CLI and app are refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`).",
+					"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive app is refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`). The person's own Primitive CLI login needs no token for this purpose while the organization's keys API is on (a token it sends is still checked); while it is off, a token it sends is refused the same way.",
 					"schema": {
 						"type": "string",
 						"pattern": "^pstep_[0-9a-f]{64}$"
@@ -32344,10 +32732,11 @@ const openapiDocument = {
 				"summary": "Change an API key",
 				"tags": ["Credentials"],
 				"security": [{ "BearerAuth": [] }],
-				"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. The Primitive CLI's token is refused, even with a step-up. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+				"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules); the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 				"x-primitive-person-only": {
 					"access": "step_up",
-					"step_up_purpose": "keys.create"
+					"step_up_purpose": "keys.create",
+					"cli_without_step_up": true
 				},
 				"parameters": [{
 					"name": "id",
@@ -32362,7 +32751,7 @@ const openapiDocument = {
 					"name": "Primitive-Step-Up",
 					"in": "header",
 					"required": false,
-					"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive CLI and app are refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`).",
+					"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive app is refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`). The person's own Primitive CLI login needs no token for this purpose while the organization's keys API is on (a token it sends is still checked); while it is off, a token it sends is refused the same way.",
 					"schema": {
 						"type": "string",
 						"pattern": "^pstep_[0-9a-f]{64}$"
@@ -32495,7 +32884,7 @@ const openapiDocument = {
 				"summary": "Get an API key",
 				"tags": ["Credentials"],
 				"security": [{ "BearerAuth": [] }],
-				"description": "One key's metadata, never its secret. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
+				"description": "One key's metadata, never its secret. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
 				"x-primitive-person-only": { "access": "session_or_cli" },
 				"parameters": [{
 					"name": "id",
@@ -32618,7 +33007,7 @@ const openapiDocument = {
 			"summary": "Suggest a least-privilege grant for a key",
 			"tags": ["Credentials"],
 			"security": [{ "BearerAuth": [] }],
-			"description": "The permissions a key used over the last 30 days, as a custom grant that would have served every successful call (also as builder areas), the narrowest mail scope its calls support (depth is deprecated: raw when it downloaded raw MIME, otherwise content) (the mailboxes of the messages it named and sent, with notes on what the request log cannot account for), and whether it is unused. Calls to routes only the super admin key can use (groups and mailbox access) derive no permission, since a custom key is refused there; super_admin_only_calls counts them. usage gives the same window anonymized: successful and failed requests per UTC day, the routes called by their declared template (never the called path) with the permission each needed, and how many mailboxes the key read and sent from (counts only, and only for a person with access to the whole organization's mail). Nothing is applied: narrowing is a change to the key (PATCH /v1/keys/:id). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.",
+			"description": "The permissions a key used over the last 30 days, as a custom grant that would have served every successful call (also as builder areas), the narrowest mail scope its calls support (depth is deprecated: raw when it downloaded raw MIME, otherwise content) (the mailboxes of the messages it named and sent, with notes on what the request log cannot account for), and whether it is unused. Calls to routes only the super admin key can use (groups and mailbox access) derive no permission, since a custom key is refused there; super_admin_only_calls counts them. usage gives the same window anonymized: successful and failed requests per UTC day, the routes called by their declared template (never the called path) with the permission each needed, and how many mailboxes the key read and sent from (counts only, and only for a person with access to the whole organization's mail). Nothing is applied: narrowing is a change to the key (PATCH /v1/keys/:id). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.",
 			"x-primitive-person-only": { "access": "session" },
 			"parameters": [{
 				"name": "id",
@@ -36159,7 +36548,7 @@ const openapiDocument = {
 		"/access-suspensions/{id}/decision": { "post": {
 			"operationId": "decideSuspension",
 			"summary": "Decide a suspension",
-			"description": "Keep, narrow or revoke one suspended or flagged item. Keeping it, and revoking an API key, needs the decider to cover it (revoking an uncovered key is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.",
+			"description": "Keep, narrow or revoke one suspended or flagged item. Keeping it, and revoking an API key, needs the decider to cover it (revoking an uncovered key is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. A rule share paused by a role change (`email_rule_share`) takes keep, which leaves it paused, or revoke, which ends the share and needs confirm: true (the person it was shared with loses the emails already shared; without it, 409 `confirmation_required`). Neither of the share's two people may keep it (`grant_forbidden`, `share_decision_forbidden`). Access a person gave on their own mailbox (`mailbox_access`) takes keep or revoke, and both need delegations:manage; revoke removes only what that person gave on that mailbox. Nobody the access reaches, nor the person who gave it, may keep it (`grant_forbidden`, `mailbox_access_decision_forbidden`). Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.",
 			"tags": ["Roles and members"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [
@@ -37851,6 +38240,8 @@ const openapiDocument = {
 									"email_rule_request_party_left",
 									"email_rule_request_proposer_only",
 									"email_rule_request_target_only",
+									"email_rule_scope_locked",
+									"email_rule_scope_not_readable",
 									"email_rule_share_ended",
 									"email_rule_share_limit",
 									"embedding_provider_unavailable",
@@ -38000,6 +38391,7 @@ const openapiDocument = {
 									"signal_not_allowed",
 									"signal_parent_not_ready",
 									"signal_sender_unauthenticated",
+									"signing_secret_unavailable",
 									"signup_failed",
 									"standing_owner_revoked",
 									"step_up_invalid",
@@ -47520,96 +47912,132 @@ const openapiDocument = {
 							"vocabulary",
 							"when",
 							"questions"
-						]
-					},
-					"explanation": {
-						"type": "string",
-						"description": "What the rule matches, in plain English."
-					},
-					"assumptions": {
-						"type": "array",
-						"items": { "type": "string" },
-						"description": "Readings the compiler chose where the description was open to more than one."
-					},
-					"warnings": {
-						"type": "array",
-						"items": { "type": "string" },
-						"description": "Parts of the description the column contract cannot express, and how the rule handles them."
+						]
+					},
+					"explanation": {
+						"type": "string",
+						"description": "What the rule matches, in plain English."
+					},
+					"assumptions": {
+						"type": "array",
+						"items": { "type": "string" },
+						"description": "Readings the compiler chose where the description was open to more than one."
+					},
+					"warnings": {
+						"type": "array",
+						"items": { "type": "string" },
+						"description": "Parts of the description the column contract cannot express, and how the rule handles them."
+					},
+					"compiled_by": {
+						"type": "string",
+						"description": "An opaque name for the version of the rule compiler that produced the rule, such as rule-compiler-v1. Send it back as compiled_by when you save the rule."
+					},
+					"sql": {
+						"description": "Present only when include_sql was true.",
+						"type": "object",
+						"properties": {
+							"expression": {
+								"type": "string",
+								"description": "A parameterized boolean expression over one row per email."
+							},
+							"params": {
+								"type": "array",
+								"items": {},
+								"description": "The values bound to $1, $2 and so on."
+							}
+						},
+						"required": ["expression", "params"]
+					}
+				},
+				"required": [
+					"tree",
+					"explanation",
+					"assumptions",
+					"warnings",
+					"compiled_by"
+				]
+			},
+			"TestEmailRuleRequest": {
+				"type": "object",
+				"properties": {
+					"tree": {
+						"description": "An unsaved rule tree, as POST /email-rules/compile returned it. Give tree or rule_id, not both.",
+						"type": "object",
+						"properties": {
+							"version": {
+								"type": "number",
+								"const": 1
+							},
+							"vocabulary": {
+								"type": "string",
+								"description": "The column contract version the rule is written against, for example v1."
+							},
+							"when": {
+								"type": "object",
+								"propertyNames": { "type": "string" },
+								"additionalProperties": {},
+								"description": "The rule's conditions: a condition ({column, op, value?, min_confidence?}) or a group ({all: [...]}, {any: [...]} or {not: ...})."
+							},
+							"questions": {
+								"type": "array",
+								"items": { "type": "string" },
+								"description": "Yes/no questions of the rule's own, asked about an email only after its conditions match. An email matches only if every answer is yes."
+							}
+						},
+						"required": [
+							"version",
+							"vocabulary",
+							"when",
+							"questions"
+						],
+						"additionalProperties": false
 					},
-					"compiled_by": {
+					"evaluation_scope": {
 						"type": "string",
-						"description": "An opaque name for the version of the rule compiler that produced the rule, such as rule-compiler-v1. Send it back as compiled_by when you save the rule."
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						],
+						"description": "own_mailboxes (the default): mail to your own addresses and agents (for a rule that shares, those you can send from). author: all mail you can read, including inboxes added later. selected: what scope_selection names."
 					},
-					"sql": {
-						"description": "Present only when include_sql was true.",
+					"scope_selection": {
 						"type": "object",
 						"properties": {
-							"expression": {
-								"type": "string",
-								"description": "A parameterized boolean expression over one row per email."
-							},
-							"params": {
+							"addresses": {
+								"maxItems": 100,
 								"type": "array",
-								"items": {},
-								"description": "The values bound to $1, $2 and so on."
-							}
-						},
-						"required": ["expression", "params"]
-					}
-				},
-				"required": [
-					"tree",
-					"explanation",
-					"assumptions",
-					"warnings",
-					"compiled_by"
-				]
-			},
-			"TestEmailRuleRequest": {
-				"type": "object",
-				"properties": {
-					"tree": {
-						"description": "An unsaved rule tree, as POST /email-rules/compile returned it. Give tree or rule_id, not both.",
-						"type": "object",
-						"properties": {
-							"version": {
-								"type": "number",
-								"const": 1
-							},
-							"vocabulary": {
-								"type": "string",
-								"description": "The column contract version the rule is written against, for example v1."
-							},
-							"when": {
-								"type": "object",
-								"propertyNames": { "type": "string" },
-								"additionalProperties": {},
-								"description": "The rule's conditions: a condition ({column, op, value?, min_confidence?}) or a group ({all: [...]}, {any: [...]} or {not: ...})."
+								"items": {
+									"type": "string",
+									"minLength": 3,
+									"maxLength": 320,
+									"pattern": "^[^\\s@]+@[^\\s@]+$"
+								}
 							},
-							"questions": {
+							"domains": {
+								"maxItems": 50,
 								"type": "array",
-								"items": { "type": "string" },
-								"description": "Yes/no questions of the rule's own, asked about an email only after its conditions match. An email matches only if every answer is yes."
+								"items": {
+									"type": "string",
+									"minLength": 1,
+									"maxLength": 253,
+									"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+								}
 							}
 						},
-						"required": [
-							"version",
-							"vocabulary",
-							"when",
-							"questions"
-						],
-						"additionalProperties": false
-					},
-					"evaluation_scope": {
-						"type": "string",
-						"enum": ["author", "own_mailboxes"],
-						"description": "Whose mail an unsaved tree runs over. author, the default: all the mail you can read. own_mailboxes: only mail to your own addresses. Only with tree: a saved rule uses its own."
+						"additionalProperties": false,
+						"description": "Inboxes, and domains (every address at them the author can read), for a selected rule; each one you can read."
 					},
 					"rule_id": {
 						"description": "A saved rule you can see. Its current version is tested, with its author's access.",
 						"type": "string",
 						"format": "uuid"
 					},
+					"kind": {
+						"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+						"type": "string",
+						"enum": ["grant", "do_not_share"]
+					},
 					"email_ids": {
 						"description": "Test exactly these emails. Without it, the newest emails the rule can read are tested, at most 200 and none older than 30 days.",
 						"minItems": 1,
@@ -47874,14 +48302,50 @@ const openapiDocument = {
 					},
 					"evaluation_scope": {
 						"type": "string",
-						"enum": ["author", "own_mailboxes"],
-						"description": "Whose mail an unsaved tree runs over. author, the default: all the mail you can read. own_mailboxes: only mail to your own addresses. Only with tree: a saved rule uses its own."
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						],
+						"description": "own_mailboxes (the default): mail to your own addresses and agents (for a rule that shares, those you can send from). author: all mail you can read, including inboxes added later. selected: what scope_selection names."
+					},
+					"scope_selection": {
+						"type": "object",
+						"properties": {
+							"addresses": {
+								"maxItems": 100,
+								"type": "array",
+								"items": {
+									"type": "string",
+									"minLength": 3,
+									"maxLength": 320,
+									"pattern": "^[^\\s@]+@[^\\s@]+$"
+								}
+							},
+							"domains": {
+								"maxItems": 50,
+								"type": "array",
+								"items": {
+									"type": "string",
+									"minLength": 1,
+									"maxLength": 253,
+									"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+								}
+							}
+						},
+						"additionalProperties": false,
+						"description": "Inboxes, and domains (every address at them the author can read), for a selected rule; each one you can read."
 					},
 					"rule_id": {
 						"description": "A saved rule you can see. Its current version is tested.",
 						"type": "string",
 						"format": "uuid"
 					},
+					"kind": {
+						"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+						"type": "string",
+						"enum": ["grant", "do_not_share"]
+					},
 					"email": {
 						"type": "object",
 						"properties": {
@@ -48105,11 +48569,52 @@ const openapiDocument = {
 						"maxLength": 200,
 						"description": "A short name for the rule."
 					},
+					"kind": {
+						"description": "grant (the default): what the rule matches can be shared. do_not_share: the rule runs before every other rule, and while it is active no rule shares an email it matches; an email it cannot decide counts as matched. Set when the rule is created; it never changes.",
+						"type": "string",
+						"enum": ["grant", "do_not_share"]
+					},
 					"state": {
-						"description": "observe (the default) records what the rule would match and grants nothing; draft is not evaluated.",
+						"description": "observe (the default) records what the rule would match and grants or blocks nothing; draft is not evaluated.",
 						"type": "string",
 						"enum": ["draft", "observe"]
 					},
+					"evaluation_scope": {
+						"type": "string",
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						],
+						"description": "own_mailboxes (the default): mail to your own addresses and agents (for a rule that shares, those you can send from). author: all mail you can read, including inboxes added later. selected: what scope_selection names."
+					},
+					"scope_selection": {
+						"type": "object",
+						"properties": {
+							"addresses": {
+								"maxItems": 100,
+								"type": "array",
+								"items": {
+									"type": "string",
+									"minLength": 3,
+									"maxLength": 320,
+									"pattern": "^[^\\s@]+@[^\\s@]+$"
+								}
+							},
+							"domains": {
+								"maxItems": 50,
+								"type": "array",
+								"items": {
+									"type": "string",
+									"minLength": 1,
+									"maxLength": 253,
+									"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+								}
+							}
+						},
+						"additionalProperties": false,
+						"description": "Inboxes, and domains (every address at them the author can read), for a selected rule; each one you can read."
+					},
 					"english": {
 						"type": "string",
 						"minLength": 1,
@@ -48205,6 +48710,35 @@ const openapiDocument = {
 							"active"
 						]
 					},
+					"kind": {
+						"description": "do_not_share: the rule blocks sharing of what it matches. Absent (or grant) on a rule that shares what it matches.",
+						"type": "string",
+						"enum": ["grant", "do_not_share"]
+					},
+					"evaluation_scope": {
+						"description": "Whose mail the rule runs over, as stored; GET /email-rules/{id}/scope says what that comes to now.",
+						"type": "string",
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						]
+					},
+					"scope_selection": {
+						"type": ["object", "null"],
+						"properties": {
+							"addresses": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"domains": {
+								"type": "array",
+								"items": { "type": "string" }
+							}
+						},
+						"required": ["addresses", "domains"],
+						"description": "What a selected rule names; null for any other scope."
+					},
 					"current_version": {
 						"type": ["integer", "null"],
 						"exclusiveMinimum": 0
@@ -48341,6 +48875,35 @@ const openapiDocument = {
 								"active"
 							]
 						},
+						"kind": {
+							"description": "do_not_share: the rule blocks sharing of what it matches. Absent (or grant) on a rule that shares what it matches.",
+							"type": "string",
+							"enum": ["grant", "do_not_share"]
+						},
+						"evaluation_scope": {
+							"description": "Whose mail the rule runs over, as stored; GET /email-rules/{id}/scope says what that comes to now.",
+							"type": "string",
+							"enum": [
+								"author",
+								"own_mailboxes",
+								"selected"
+							]
+						},
+						"scope_selection": {
+							"type": ["object", "null"],
+							"properties": {
+								"addresses": {
+									"type": "array",
+									"items": { "type": "string" }
+								},
+								"domains": {
+									"type": "array",
+									"items": { "type": "string" }
+								}
+							},
+							"required": ["addresses", "domains"],
+							"description": "What a selected rule names; null for any other scope."
+						},
 						"current_version": {
 							"type": ["integer", "null"],
 							"exclusiveMinimum": 0
@@ -48390,6 +48953,35 @@ const openapiDocument = {
 							"active"
 						]
 					},
+					"kind": {
+						"description": "do_not_share: the rule blocks sharing of what it matches. Absent (or grant) on a rule that shares what it matches.",
+						"type": "string",
+						"enum": ["grant", "do_not_share"]
+					},
+					"evaluation_scope": {
+						"description": "Whose mail the rule runs over, as stored; GET /email-rules/{id}/scope says what that comes to now.",
+						"type": "string",
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						]
+					},
+					"scope_selection": {
+						"type": ["object", "null"],
+						"properties": {
+							"addresses": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"domains": {
+								"type": "array",
+								"items": { "type": "string" }
+							}
+						},
+						"required": ["addresses", "domains"],
+						"description": "What a selected rule names; null for any other scope."
+					},
 					"current_version": {
 						"type": ["integer", "null"],
 						"exclusiveMinimum": 0
@@ -48518,7 +49110,7 @@ const openapiDocument = {
 						"description": "A short name for the rule."
 					},
 					"state": {
-						"description": "draft disables the rule; observe records decisions; active also grants what it matches. Keys read and receive what a rule granted only while it is active: leaving active pauses that, and returning to active restores reads and the delivery of queued mail not yet skipped.",
+						"description": "draft disables the rule; observe records decisions; active also grants what it matches, or for a do_not_share rule keeps it from being shared. Keys read and receive what a rule granted only while it is active: leaving active pauses that, and returning to active restores reads and the delivery of queued mail not yet skipped.",
 						"type": "string",
 						"enum": [
 							"draft",
@@ -48595,6 +49187,42 @@ const openapiDocument = {
 						"type": "string",
 						"minLength": 1,
 						"maxLength": 64
+					},
+					"evaluation_scope": {
+						"type": "string",
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						],
+						"description": "author: all mail its author can read. own_mailboxes: mail to their own addresses. selected: what scope_selection names. Never more than the author can read."
+					},
+					"scope_selection": {
+						"type": "object",
+						"properties": {
+							"addresses": {
+								"maxItems": 100,
+								"type": "array",
+								"items": {
+									"type": "string",
+									"minLength": 3,
+									"maxLength": 320,
+									"pattern": "^[^\\s@]+@[^\\s@]+$"
+								}
+							},
+							"domains": {
+								"maxItems": 50,
+								"type": "array",
+								"items": {
+									"type": "string",
+									"minLength": 1,
+									"maxLength": 253,
+									"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+								}
+							}
+						},
+						"additionalProperties": false,
+						"description": "Inboxes, and domains (every address at them the author can read), for a selected rule; each one you can read."
 					}
 				},
 				"additionalProperties": false
@@ -48615,6 +49243,35 @@ const openapiDocument = {
 							"active"
 						]
 					},
+					"kind": {
+						"description": "do_not_share: the rule blocks sharing of what it matches. Absent (or grant) on a rule that shares what it matches.",
+						"type": "string",
+						"enum": ["grant", "do_not_share"]
+					},
+					"evaluation_scope": {
+						"description": "Whose mail the rule runs over, as stored; GET /email-rules/{id}/scope says what that comes to now.",
+						"type": "string",
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						]
+					},
+					"scope_selection": {
+						"type": ["object", "null"],
+						"properties": {
+							"addresses": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"domains": {
+								"type": "array",
+								"items": { "type": "string" }
+							}
+						},
+						"required": ["addresses", "domains"],
+						"description": "What a selected rule names; null for any other scope."
+					},
 					"current_version": {
 						"type": ["integer", "null"],
 						"exclusiveMinimum": 0
@@ -48792,6 +49449,370 @@ const openapiDocument = {
 					]
 				}
 			},
+			"ListEmailRuleResultsResult": {
+				"type": "object",
+				"properties": {
+					"rules": {
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"id": {
+									"type": "string",
+									"format": "uuid"
+								},
+								"name": { "type": "string" },
+								"state": {
+									"type": "string",
+									"enum": [
+										"draft",
+										"observe",
+										"active"
+									]
+								},
+								"kind": {
+									"description": "do_not_share: the rule blocks sharing of what it matches. While it is active, no rule shares an email it has matched from then on; anything shared before, including while it was in observe, stays shared. Absent on a rule that shares what it matches.",
+									"type": "string",
+									"enum": ["grant", "do_not_share"]
+								},
+								"decision": {
+									"type": ["object", "null"],
+									"properties": {
+										"rule_version": {
+											"type": "integer",
+											"exclusiveMinimum": 0,
+											"description": "The version of the rule that decided."
+										},
+										"matched": { "type": "boolean" },
+										"parts": {
+											"type": "array",
+											"items": {
+												"type": "object",
+												"properties": {
+													"index": {
+														"type": "integer",
+														"minimum": 0
+													},
+													"matched": { "type": "boolean" },
+													"columns": {
+														"type": "array",
+														"items": { "type": "string" }
+													}
+												},
+												"required": [
+													"index",
+													"matched",
+													"columns"
+												]
+											},
+											"description": "How each top-level part of the rule decided. Empty when a fact the rule reads was missing, so it was not evaluated."
+										},
+										"question_answers": {
+											"type": "array",
+											"items": {
+												"type": "object",
+												"properties": {
+													"question": { "type": "string" },
+													"answer": { "type": ["boolean", "null"] },
+													"probability": { "type": ["number", "null"] },
+													"error_class": { "type": "string" }
+												},
+												"required": [
+													"question",
+													"answer",
+													"probability"
+												]
+											},
+											"description": "The answers to the rule's own questions, asked only when its conditions matched."
+										},
+										"tree": {
+											"type": ["object", "null"],
+											"properties": {
+												"version": {
+													"type": "number",
+													"const": 1
+												},
+												"vocabulary": {
+													"type": "string",
+													"description": "The column contract version the rule is written against, for example v1."
+												},
+												"when": {
+													"type": "object",
+													"propertyNames": { "type": "string" },
+													"additionalProperties": {},
+													"description": "The rule's conditions: a condition ({column, op, value?, min_confidence?}) or a group ({all: [...]}, {any: [...]} or {not: ...})."
+												},
+												"questions": {
+													"type": "array",
+													"items": { "type": "string" },
+													"description": "Yes/no questions of the rule's own, asked about an email only after its conditions match. An email matches only if every answer is yes."
+												}
+											},
+											"required": [
+												"version",
+												"vocabulary",
+												"when",
+												"questions"
+											],
+											"description": "The conditions and questions of the version that decided, so the result reads in that version's words."
+										},
+										"created_at": {
+											"type": "string",
+											"format": "date-time"
+										}
+									},
+									"required": [
+										"rule_version",
+										"matched",
+										"parts",
+										"question_answers",
+										"tree",
+										"created_at"
+									],
+									"description": "What the rule most recently decided about this email; null when it has not run on it."
+								},
+								"not_run_reason": {
+									"type": ["string", "null"],
+									"enum": [
+										"draft",
+										"created_after_email",
+										null
+									],
+									"description": "What is known about a rule with no result on this email. draft: the rule is a draft now. created_after_email: the rule was created after the email arrived. Null when it has a result, or when nothing is known."
+								},
+								"author_left": {
+									"description": "On a do-not-share rule whose author is no longer a member of the organization: it blocks nothing now, whatever it decided. Absent otherwise.",
+									"type": "boolean",
+									"const": true
+								}
+							},
+							"required": [
+								"id",
+								"name",
+								"state",
+								"decision",
+								"not_run_reason"
+							]
+						},
+						"description": "Every rule the caller can see: those that matched this email, then those that did not, then those that have not run on it; newest rule first within each."
+					},
+					"hidden": {
+						"type": "integer",
+						"minimum": 0,
+						"description": "How many more rules the caller can see that are not listed."
+					}
+				},
+				"required": ["rules", "hidden"]
+			},
+			"ListEmailRuleVersionsResult": {
+				"type": "array",
+				"items": {
+					"type": "object",
+					"properties": {
+						"version": {
+							"type": "integer",
+							"exclusiveMinimum": 0
+						},
+						"english": { "type": "string" },
+						"tree": {
+							"type": "object",
+							"properties": {
+								"version": {
+									"type": "number",
+									"const": 1
+								},
+								"vocabulary": {
+									"type": "string",
+									"description": "The column contract version the rule is written against, for example v1."
+								},
+								"when": {
+									"type": "object",
+									"propertyNames": { "type": "string" },
+									"additionalProperties": {},
+									"description": "The rule's conditions: a condition ({column, op, value?, min_confidence?}) or a group ({all: [...]}, {any: [...]} or {not: ...})."
+								},
+								"questions": {
+									"type": "array",
+									"items": { "type": "string" },
+									"description": "Yes/no questions of the rule's own, asked about an email only after its conditions match. An email matches only if every answer is yes."
+								}
+							},
+							"required": [
+								"version",
+								"vocabulary",
+								"when",
+								"questions"
+							]
+						},
+						"explanation": { "type": "string" },
+						"assumptions": {
+							"type": "array",
+							"items": { "type": "string" }
+						},
+						"warnings": {
+							"type": "array",
+							"items": { "type": "string" }
+						},
+						"compiled_by": {
+							"type": "string",
+							"description": "Who produced the tree, as the caller stated it when saving (not verified), for example rule-compiler-v1 or member."
+						},
+						"vocabulary": { "type": "string" },
+						"created_at": {
+							"type": "string",
+							"format": "date-time"
+						},
+						"sql": {
+							"description": "Present only when include_sql was true.",
+							"type": "object",
+							"properties": {
+								"expression": {
+									"type": "string",
+									"description": "A parameterized boolean expression over one row per email."
+								},
+								"params": {
+									"type": "array",
+									"items": {},
+									"description": "The values bound to $1, $2 and so on."
+								}
+							},
+							"required": ["expression", "params"]
+						}
+					},
+					"required": [
+						"version",
+						"english",
+						"tree",
+						"explanation",
+						"assumptions",
+						"warnings",
+						"compiled_by",
+						"vocabulary",
+						"created_at"
+					]
+				}
+			},
+			"GetEmailRuleScopeResult": {
+				"type": "object",
+				"properties": {
+					"evaluation_scope": {
+						"type": "string",
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						],
+						"description": "author: all mail its author can read. own_mailboxes: mail to their own addresses. selected: what scope_selection names. Never more than the author can read."
+					},
+					"scope_selection": {
+						"type": ["object", "null"],
+						"properties": {
+							"addresses": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"domains": {
+								"type": "array",
+								"items": { "type": "string" }
+							}
+						},
+						"required": ["addresses", "domains"]
+					},
+					"locked": {
+						"type": "boolean",
+						"description": "Shared, so its scope cannot change."
+					},
+					"author_reach": {
+						"type": ["string", "null"],
+						"enum": [
+							"organization",
+							"limited",
+							"own",
+							null
+						],
+						"description": "How much its author can read now; null when it cannot run as them."
+					},
+					"no_longer_readable": {
+						"type": "object",
+						"properties": {
+							"addresses": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"domains": {
+								"type": "array",
+								"items": { "type": "string" }
+							}
+						},
+						"required": ["addresses", "domains"],
+						"description": "What scope_selection names that its author no longer reads in full."
+					},
+					"still_read": {
+						"description": "Inboxes its author still reads at the domains in no_longer_readable; the rule still covers them.",
+						"type": "array",
+						"items": { "type": "string" }
+					},
+					"stopped_reason": {
+						"description": "Why it cannot run now (a reason as on POST /email-rules/test), or null.",
+						"type": ["string", "null"]
+					}
+				},
+				"required": [
+					"evaluation_scope",
+					"scope_selection",
+					"locked",
+					"author_reach",
+					"no_longer_readable",
+					"stopped_reason"
+				]
+			},
+			"ListEmailRuleScopeOptionsResult": {
+				"type": "object",
+				"properties": {
+					"reach": {
+						"type": "string",
+						"enum": [
+							"organization",
+							"limited",
+							"own"
+						],
+						"description": "organization: all of the organization's mail. own: only your own. limited: some inboxes or domains."
+					},
+					"own_mail": {
+						"type": "boolean",
+						"description": "Whether a rule over only your own mail would run for you."
+					},
+					"own_mail_to_block": {
+						"description": "Whether a do_not_share rule over only your own mail would run for you: it covers every own mailbox you read, including ones you could not share.",
+						"type": "boolean"
+					},
+					"addresses": {
+						"type": "array",
+						"items": { "type": "string" },
+						"description": "Inboxes you can read, matching q. For someone who reads the whole organization, the inboxes known as someone's: member addresses, members' verified work emails at the organization's domains, agents' addresses and inboxes with shared access. Otherwise the inboxes your access lists (search with q for those past the first page). See may_name_unlisted for what else you may name."
+					},
+					"domains": {
+						"type": "array",
+						"items": { "type": "string" },
+						"description": "Domains you can read, matching q."
+					},
+					"more": {
+						"type": "boolean",
+						"description": "More match than are listed."
+					},
+					"may_name_unlisted": {
+						"description": "Whether you may also name an inbox this list never shows, however it is searched (more only says whether a search would show further ones): true when you read the whole organization (any address, such as an inbox at its domains nobody has claimed yet) or read a domain (any address there your access does not leave out). Name it in scope_selection.addresses as you would a listed one. Absent from a server that predates it.",
+						"type": "boolean"
+					}
+				},
+				"required": [
+					"reach",
+					"own_mail",
+					"addresses",
+					"domains",
+					"more"
+				]
+			},
 			"CreateEmailRuleRequestRequest": {
 				"type": "object",
 				"properties": {
@@ -49974,6 +50995,35 @@ const openapiDocument = {
 									"active"
 								]
 							},
+							"kind": {
+								"description": "do_not_share: the rule blocks sharing of what it matches. Absent (or grant) on a rule that shares what it matches.",
+								"type": "string",
+								"enum": ["grant", "do_not_share"]
+							},
+							"evaluation_scope": {
+								"description": "Whose mail the rule runs over, as stored; GET /email-rules/{id}/scope says what that comes to now.",
+								"type": "string",
+								"enum": [
+									"author",
+									"own_mailboxes",
+									"selected"
+								]
+							},
+							"scope_selection": {
+								"type": ["object", "null"],
+								"properties": {
+									"addresses": {
+										"type": "array",
+										"items": { "type": "string" }
+									},
+									"domains": {
+										"type": "array",
+										"items": { "type": "string" }
+									}
+								},
+								"required": ["addresses", "domains"],
+								"description": "What a selected rule names; null for any other scope."
+							},
 							"current_version": {
 								"type": ["integer", "null"],
 								"exclusiveMinimum": 0
@@ -67819,7 +68869,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "create-key",
-		"description": "Create an API key, super admin or narrowed to a preset or a custom permission set, optionally with an expiry and conditions. The secret is returned once. A key never holds more than the person creating it; the credential policy decides who may create which keys. grant is required: a request without it is refused (400 validation_error, details.reason grant_required), never treated as super admin. A custom key must say which mail it reaches: the addresses and domains it lists (grant.addresses, grant.domains), or every mailbox in the organization with grant.mail_scope \"org\", which cannot be combined with them; one that says neither is refused (400 validation_error, details.reason mail_scope_required). Super admin, Send only and Read only reach every mailbox by definition. members:read is only for an org-wide custom key: naming it with grant.addresses or grant.domains is refused (400). Owners and admins are emailed about every super admin key. Send an Idempotency-Key to retry safely: a second create by the same person under the same key makes no second key and is refused (409 idempotency_key_reused) with the first key's id in error.details.key_id, so a caller whose first answer was lost can revoke that key. The onboarding field is for the dashboard only. The Primitive CLI's token is refused, even with a step-up: keys are created in the dashboard or by an app the person connected. While the organization's keys API is not enabled, this answers 404 feature_disabled, except that a dashboard session may still create a super admin key (the dashboard's own create).\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+		"description": "Create an API key, super admin or narrowed to a preset or a custom permission set, optionally with an expiry and conditions. The secret is returned once. A key never holds more than the person creating it; the credential policy decides who may create which keys. grant is required: a request without it is refused (400 validation_error, details.reason grant_required), never treated as super admin. A custom key must say which mail it reaches: the addresses and domains it lists (grant.addresses, grant.domains), or every mailbox in the organization with grant.mail_scope \"org\", which cannot be combined with them; one that says neither is refused (400 validation_error, details.reason mail_scope_required). Super admin, Send only and Read only reach every mailbox by definition. members:read is only for an org-wide custom key: naming it with grant.addresses or grant.domains is refused (400). Owners and admins are emailed about every super admin key. Send an Idempotency-Key to retry safely: a second create by the same person under the same key makes no second key and is refused (409 idempotency_key_reused) with the first key's id in error.details.key_id, so a caller whose first answer was lost can revoke that key. The onboarding field is for the dashboard only. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules); the Primitive app's token is refused, even with one. While the organization's keys API is not enabled, this answers 404 feature_disabled (details.feature keys_api; only Primitive turns it on), except that a dashboard session may still create a super admin key (the dashboard's own create).\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "createKey",
@@ -67842,7 +68892,7 @@ const operationManifest = [
 				"type": "string"
 			},
 			{
-				"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive CLI and app are refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`).",
+				"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive app is refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`). The person's own Primitive CLI login needs no token for this purpose while the organization's keys API is on (a token it sends is still checked); while it is off, a token it sends is refused the same way.",
 				"enum": null,
 				"name": "Primitive-Step-Up",
 				"required": false,
@@ -68071,7 +69121,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-credential-policy",
-		"description": "The organization credential policy: key lifetime and expiry rules, who may create super admin keys, whether members may create keys and the other rules every new key is held to. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.",
+		"description": "The organization credential policy: key lifetime and expiry rules, who may create super admin keys, whether members may create keys and the other rules every new key is held to. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getCredentialPolicy",
@@ -68130,7 +69180,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-key",
-		"description": "One key's metadata, never its secret. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
+		"description": "One key's metadata, never its secret. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getKey",
@@ -68208,7 +69258,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-key-builder",
-		"description": "The key presets the caller may use (each with whether it is available and why not), the permission matrix for custom keys and the policy in force. An area marked org_wide_only (Members) is listed only to a person who holds its permission, and only a custom key with no addresses or domains may hold it. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
+		"description": "The key presets the caller may use (each with whether it is available and why not), the permission matrix for custom keys and the policy in force. An area marked org_wide_only (Members) is listed only to a person who holds its permission, and only a custom key with no addresses or domains may hold it. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getKeyBuilder",
@@ -68341,7 +69391,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-key-suggestion",
-		"description": "The permissions a key used over the last 30 days, as a custom grant that would have served every successful call (also as builder areas), the narrowest mail scope its calls support (depth is deprecated: raw when it downloaded raw MIME, otherwise content) (the mailboxes of the messages it named and sent, with notes on what the request log cannot account for), and whether it is unused. Calls to routes only the super admin key can use (groups and mailbox access) derive no permission, since a custom key is refused there; super_admin_only_calls counts them. usage gives the same window anonymized: successful and failed requests per UTC day, the routes called by their declared template (never the called path) with the permission each needed, and how many mailboxes the key read and sent from (counts only, and only for a person with access to the whole organization's mail). Nothing is applied: narrowing is a change to the key (PATCH /v1/keys/:id). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.",
+		"description": "The permissions a key used over the last 30 days, as a custom grant that would have served every successful call (also as builder areas), the narrowest mail scope its calls support (depth is deprecated: raw when it downloaded raw MIME, otherwise content) (the mailboxes of the messages it named and sent, with notes on what the request log cannot account for), and whether it is unused. Calls to routes only the super admin key can use (groups and mailbox access) derive no permission, since a custom key is refused there; super_admin_only_calls counts them. usage gives the same window anonymized: successful and failed requests per UTC day, the routes called by their declared template (never the called path) with the permission each needed, and how many mailboxes the key read and sent from (counts only, and only for a person with access to the whole organization's mail). Nothing is applied: narrowing is a change to the key (PATCH /v1/keys/:id). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getKeySuggestion",
@@ -68585,7 +69635,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-credential-events",
-		"description": "Credential events (created, rotated, edited, revoked, used with a step-up, policy changes), newest first, with a cursor. format=csv returns the same page as CSV. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session. The person's role must hold credential_events:read. API keys, agent connection keys and agents are refused.",
+		"description": "Credential events (created, rotated, edited, revoked, used with a step-up, policy changes), newest first, with a cursor. format=csv returns the same page as CSV. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session. The person's role must hold credential_events:read. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listCredentialEvents",
@@ -68714,7 +69764,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-credentials",
-		"description": "Every credential that can act in the organization: API keys, Function keys, agent connection keys, connected apps (OAuth), agent delegates and, where enabled, CLI logins. Secrets are never returned. Filter with kind. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.",
+		"description": "Every credential that can act in the organization: API keys, Function keys, agent connection keys, connected apps (OAuth), agent delegates and, where enabled, CLI logins. Secrets are never returned. Filter with kind. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listCredentials",
@@ -68950,7 +70000,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-keys",
-		"description": "Key metadata, never a secret: name, prefix, grant, creator, last use, expiry and suspension. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
+		"description": "Key metadata, never a secret: name, prefix, grant, creator, last use, expiry and suspension. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listKeys",
@@ -69039,7 +70089,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "revoke-all-credentials",
-		"description": "The emergency response to a leak: revokes every API key, agent connection key and connected app created since a time, rotates the organization Function key and every running Function's own key, and optionally suspends Functions. Owners only, from a dashboard session, and the body must confirm with \"revoke all\". Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session. The person's role must hold credentials:revoke_all. API keys, agent connection keys and agents are refused.",
+		"description": "The emergency response to a leak: revokes every API key, agent connection key and connected app created since a time, rotates the organization Function key and every running Function's own key, and optionally suspends Functions. Owners only, from a dashboard session, and the body must confirm with \"revoke all\". Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session. The person's role must hold credentials:revoke_all. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "revokeAllCredentials",
@@ -69124,7 +70174,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "revoke-credential",
-		"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up keeps working and is listed in standing_objects for review. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
+		"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up keeps working and is listed in standing_objects for review. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "revokeCredential",
@@ -69246,7 +70296,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "rotate-key",
-		"description": "Mint a successor with the same grant and return its secret once. The old key keeps working for overlap_seconds, then stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner created is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The Primitive CLI's token is refused, even with a step-up. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+		"description": "Mint a successor with the same grant and return its secret once. The old key keeps working for overlap_seconds, then stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner created is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules); the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "rotateKey",
@@ -69260,7 +70310,7 @@ const operationManifest = [
 		}],
 		"queryParams": [],
 		"headerParams": [{
-			"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive CLI and app are refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`).",
+			"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive app is refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`). The person's own Primitive CLI login needs no token for this purpose while the organization's keys API is on (a token it sends is still checked); while it is off, a token it sends is refused the same way.",
 			"enum": null,
 			"name": "Primitive-Step-Up",
 			"required": false,
@@ -69318,7 +70368,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "update-credential-policy",
-		"description": "Change one or more policy rules. Admins may only tighten the policy; loosening any rule needs an owner. Owners and admins are emailed about every change. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session. The person's role must hold credential_policy:manage. API keys, agent connection keys and agents are refused.",
+		"description": "Change one or more policy rules. Admins may only tighten the policy; loosening any rule needs an owner. Owners and admins are emailed about every change. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session. The person's role must hold credential_policy:manage. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": true,
 		"method": "PATCH",
 		"operationId": "updateCredentialPolicy",
@@ -69406,7 +70456,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "update-key",
-		"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. The Primitive CLI's token is refused, even with a step-up. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+		"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules); the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 		"hasJsonBody": true,
 		"method": "PATCH",
 		"operationId": "updateKey",
@@ -69420,7 +70470,7 @@ const operationManifest = [
 		}],
 		"queryParams": [],
 		"headerParams": [{
-			"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive CLI and app are refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`).",
+			"description": "A single-use step-up token of purpose `keys.create` (Create, rotate or change an API key), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session. The Primitive app is refused for this purpose even with a token (403 `grant_forbidden`, `details.reason` `dashboard_only`). The person's own Primitive CLI login needs no token for this purpose while the organization's keys API is on (a token it sends is still checked); while it is off, a token it sends is refused the same way.",
 			"enum": null,
 			"name": "Primitive-Step-Up",
 			"required": false,
@@ -71684,6 +72734,35 @@ const operationManifest = [
 								"active"
 							]
 						},
+						"kind": {
+							"description": "do_not_share: the rule blocks sharing of what it matches. Absent (or grant) on a rule that shares what it matches.",
+							"type": "string",
+							"enum": ["grant", "do_not_share"]
+						},
+						"evaluation_scope": {
+							"description": "Whose mail the rule runs over, as stored; GET /email-rules/{id}/scope says what that comes to now.",
+							"type": "string",
+							"enum": [
+								"author",
+								"own_mailboxes",
+								"selected"
+							]
+						},
+						"scope_selection": {
+							"type": ["object", "null"],
+							"properties": {
+								"addresses": {
+									"type": "array",
+									"items": { "type": "string" }
+								},
+								"domains": {
+									"type": "array",
+									"items": { "type": "string" }
+								}
+							},
+							"required": ["addresses", "domains"],
+							"description": "What a selected rule names; null for any other scope."
+						},
 						"current_version": {
 							"type": ["integer", "null"],
 							"exclusiveMinimum": 0
@@ -72090,7 +73169,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "create-email-rule",
-		"description": "Saves a rule as version 1, from a compile response or a tree you wrote. The tree is checked against the column contract. New rules start in observe, where what the rule matches is recorded and nothing is granted; draft is not evaluated. The caller is the rule's author, and the rule never reaches mail the author cannot read. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"description": "Saves a rule as version 1, from a compile response or a tree you wrote. The tree is checked against the column contract. New rules start in observe, where what the rule matches is recorded and nothing is granted or blocked; draft is not evaluated. The caller is the rule's author, and the rule never reaches mail the author cannot read. evaluation_scope chooses whose mail it runs over: own_mailboxes (only your own mail) when omitted, so any other scope (author for all you can read, or selected) is named; scope_selection may name only what you can read. The answer carries the scope as stored. kind do_not_share makes a rule that blocks sharing: it runs before every other rule, and while it is active no rule shares an email it matches or cannot decide. A key cannot list one (details.reason rule_blocks_sharing on the key). Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "createEmailRule",
@@ -72114,11 +73193,52 @@ const operationManifest = [
 					"maxLength": 200,
 					"description": "A short name for the rule."
 				},
+				"kind": {
+					"description": "grant (the default): what the rule matches can be shared. do_not_share: the rule runs before every other rule, and while it is active no rule shares an email it matches; an email it cannot decide counts as matched. Set when the rule is created; it never changes.",
+					"type": "string",
+					"enum": ["grant", "do_not_share"]
+				},
 				"state": {
-					"description": "observe (the default) records what the rule would match and grants nothing; draft is not evaluated.",
+					"description": "observe (the default) records what the rule would match and grants or blocks nothing; draft is not evaluated.",
 					"type": "string",
 					"enum": ["draft", "observe"]
 				},
+				"evaluation_scope": {
+					"type": "string",
+					"enum": [
+						"author",
+						"own_mailboxes",
+						"selected"
+					],
+					"description": "own_mailboxes (the default): mail to your own addresses and agents (for a rule that shares, those you can send from). author: all mail you can read, including inboxes added later. selected: what scope_selection names."
+				},
+				"scope_selection": {
+					"type": "object",
+					"properties": {
+						"addresses": {
+							"maxItems": 100,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 3,
+								"maxLength": 320,
+								"pattern": "^[^\\s@]+@[^\\s@]+$"
+							}
+						},
+						"domains": {
+							"maxItems": 50,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 253,
+								"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+							}
+						}
+					},
+					"additionalProperties": false,
+					"description": "Inboxes, and domains (every address at them the author can read), for a selected rule; each one you can read."
+				},
 				"english": {
 					"type": "string",
 					"minLength": 1,
@@ -72214,6 +73334,35 @@ const operationManifest = [
 						"active"
 					]
 				},
+				"kind": {
+					"description": "do_not_share: the rule blocks sharing of what it matches. Absent (or grant) on a rule that shares what it matches.",
+					"type": "string",
+					"enum": ["grant", "do_not_share"]
+				},
+				"evaluation_scope": {
+					"description": "Whose mail the rule runs over, as stored; GET /email-rules/{id}/scope says what that comes to now.",
+					"type": "string",
+					"enum": [
+						"author",
+						"own_mailboxes",
+						"selected"
+					]
+				},
+				"scope_selection": {
+					"type": ["object", "null"],
+					"properties": {
+						"addresses": {
+							"type": "array",
+							"items": { "type": "string" }
+						},
+						"domains": {
+							"type": "array",
+							"items": { "type": "string" }
+						}
+					},
+					"required": ["addresses", "domains"],
+					"description": "What a selected rule names; null for any other scope."
+				},
 				"current_version": {
 					"type": ["integer", "null"],
 					"exclusiveMinimum": 0
@@ -72882,7 +74031,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-email-rule",
-		"description": "A rule and its current version. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"description": "A rule, its scope (evaluation_scope, and scope_selection for a selected rule) and its current version. What the scope comes to for its author now is GET /email-rules/{id}/scope. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getEmailRule",
@@ -72920,6 +74069,35 @@ const operationManifest = [
 						"active"
 					]
 				},
+				"kind": {
+					"description": "do_not_share: the rule blocks sharing of what it matches. Absent (or grant) on a rule that shares what it matches.",
+					"type": "string",
+					"enum": ["grant", "do_not_share"]
+				},
+				"evaluation_scope": {
+					"description": "Whose mail the rule runs over, as stored; GET /email-rules/{id}/scope says what that comes to now.",
+					"type": "string",
+					"enum": [
+						"author",
+						"own_mailboxes",
+						"selected"
+					]
+				},
+				"scope_selection": {
+					"type": ["object", "null"],
+					"properties": {
+						"addresses": {
+							"type": "array",
+							"items": { "type": "string" }
+						},
+						"domains": {
+							"type": "array",
+							"items": { "type": "string" }
+						}
+					},
+					"required": ["addresses", "domains"],
+					"description": "What a selected rule names; null for any other scope."
+				},
 				"current_version": {
 					"type": ["integer", "null"],
 					"exclusiveMinimum": 0
@@ -73231,6 +74409,105 @@ const operationManifest = [
 		"tag": "Email Rules",
 		"tagCommand": "email-rules"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-email-rule-scope",
+		"description": "Whose mail the rule runs over, and what that comes to now: a rule never reaches further than what its author can read when it runs, so what a selected rule names and its author can no longer read stops matching. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getEmailRuleScope",
+		"path": "/email-rules/{id}/scope",
+		"pathParams": [{
+			"description": "The rule id.",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"headerParams": [],
+		"permissions": ["mail:read"],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"evaluation_scope": {
+					"type": "string",
+					"enum": [
+						"author",
+						"own_mailboxes",
+						"selected"
+					],
+					"description": "author: all mail its author can read. own_mailboxes: mail to their own addresses. selected: what scope_selection names. Never more than the author can read."
+				},
+				"scope_selection": {
+					"type": ["object", "null"],
+					"properties": {
+						"addresses": {
+							"type": "array",
+							"items": { "type": "string" }
+						},
+						"domains": {
+							"type": "array",
+							"items": { "type": "string" }
+						}
+					},
+					"required": ["addresses", "domains"]
+				},
+				"locked": {
+					"type": "boolean",
+					"description": "Shared, so its scope cannot change."
+				},
+				"author_reach": {
+					"type": ["string", "null"],
+					"enum": [
+						"organization",
+						"limited",
+						"own",
+						null
+					],
+					"description": "How much its author can read now; null when it cannot run as them."
+				},
+				"no_longer_readable": {
+					"type": "object",
+					"properties": {
+						"addresses": {
+							"type": "array",
+							"items": { "type": "string" }
+						},
+						"domains": {
+							"type": "array",
+							"items": { "type": "string" }
+						}
+					},
+					"required": ["addresses", "domains"],
+					"description": "What scope_selection names that its author no longer reads in full."
+				},
+				"still_read": {
+					"description": "Inboxes its author still reads at the domains in no_longer_readable; the rule still covers them.",
+					"type": "array",
+					"items": { "type": "string" }
+				},
+				"stopped_reason": {
+					"description": "Why it cannot run now (a reason as on POST /email-rules/test), or null.",
+					"type": ["string", "null"]
+				}
+			},
+			"required": [
+				"evaluation_scope",
+				"scope_selection",
+				"locked",
+				"author_reach",
+				"no_longer_readable",
+				"stopped_reason"
+			]
+		},
+		"sdkName": "getEmailRuleScope",
+		"summary": "Read what a rule covers",
+		"tag": "Email Rules",
+		"tagCommand": "email-rules"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -73742,6 +75019,258 @@ const operationManifest = [
 		"tag": "Email Rules",
 		"tagCommand": "email-rules"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-email-rule-results",
+		"description": "Every rule the caller can see and what it decided about this email: those that matched, those that did not, and those that have not run on it, with what is known about them. A result names the version of the rule that decided and carries that version's conditions and questions. A matched rule with kind do_not_share keeps rules from sharing the email while it is active; anything shared before then stays shared. Only a caller who can read the email gets an answer, and a rule the caller cannot see is left out. At most 50 rules are listed, those with a result first; hidden counts the rest. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listEmailRuleResults",
+		"path": "/emails/{id}/rule-results",
+		"pathParams": [{
+			"description": "The email id.",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"headerParams": [],
+		"permissions": ["mail:read"],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"rules": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"name": { "type": "string" },
+							"state": {
+								"type": "string",
+								"enum": [
+									"draft",
+									"observe",
+									"active"
+								]
+							},
+							"kind": {
+								"description": "do_not_share: the rule blocks sharing of what it matches. While it is active, no rule shares an email it has matched from then on; anything shared before, including while it was in observe, stays shared. Absent on a rule that shares what it matches.",
+								"type": "string",
+								"enum": ["grant", "do_not_share"]
+							},
+							"decision": {
+								"type": ["object", "null"],
+								"properties": {
+									"rule_version": {
+										"type": "integer",
+										"exclusiveMinimum": 0,
+										"description": "The version of the rule that decided."
+									},
+									"matched": { "type": "boolean" },
+									"parts": {
+										"type": "array",
+										"items": {
+											"type": "object",
+											"properties": {
+												"index": {
+													"type": "integer",
+													"minimum": 0
+												},
+												"matched": { "type": "boolean" },
+												"columns": {
+													"type": "array",
+													"items": { "type": "string" }
+												}
+											},
+											"required": [
+												"index",
+												"matched",
+												"columns"
+											]
+										},
+										"description": "How each top-level part of the rule decided. Empty when a fact the rule reads was missing, so it was not evaluated."
+									},
+									"question_answers": {
+										"type": "array",
+										"items": {
+											"type": "object",
+											"properties": {
+												"question": { "type": "string" },
+												"answer": { "type": ["boolean", "null"] },
+												"probability": { "type": ["number", "null"] },
+												"error_class": { "type": "string" }
+											},
+											"required": [
+												"question",
+												"answer",
+												"probability"
+											]
+										},
+										"description": "The answers to the rule's own questions, asked only when its conditions matched."
+									},
+									"tree": {
+										"type": ["object", "null"],
+										"properties": {
+											"version": {
+												"type": "number",
+												"const": 1
+											},
+											"vocabulary": {
+												"type": "string",
+												"description": "The column contract version the rule is written against, for example v1."
+											},
+											"when": {
+												"type": "object",
+												"propertyNames": { "type": "string" },
+												"additionalProperties": {},
+												"description": "The rule's conditions: a condition ({column, op, value?, min_confidence?}) or a group ({all: [...]}, {any: [...]} or {not: ...})."
+											},
+											"questions": {
+												"type": "array",
+												"items": { "type": "string" },
+												"description": "Yes/no questions of the rule's own, asked about an email only after its conditions match. An email matches only if every answer is yes."
+											}
+										},
+										"required": [
+											"version",
+											"vocabulary",
+											"when",
+											"questions"
+										],
+										"description": "The conditions and questions of the version that decided, so the result reads in that version's words."
+									},
+									"created_at": {
+										"type": "string",
+										"format": "date-time"
+									}
+								},
+								"required": [
+									"rule_version",
+									"matched",
+									"parts",
+									"question_answers",
+									"tree",
+									"created_at"
+								],
+								"description": "What the rule most recently decided about this email; null when it has not run on it."
+							},
+							"not_run_reason": {
+								"type": ["string", "null"],
+								"enum": [
+									"draft",
+									"created_after_email",
+									null
+								],
+								"description": "What is known about a rule with no result on this email. draft: the rule is a draft now. created_after_email: the rule was created after the email arrived. Null when it has a result, or when nothing is known."
+							},
+							"author_left": {
+								"description": "On a do-not-share rule whose author is no longer a member of the organization: it blocks nothing now, whatever it decided. Absent otherwise.",
+								"type": "boolean",
+								"const": true
+							}
+						},
+						"required": [
+							"id",
+							"name",
+							"state",
+							"decision",
+							"not_run_reason"
+						]
+					},
+					"description": "Every rule the caller can see: those that matched this email, then those that did not, then those that have not run on it; newest rule first within each."
+				},
+				"hidden": {
+					"type": "integer",
+					"minimum": 0,
+					"description": "How many more rules the caller can see that are not listed."
+				}
+			},
+			"required": ["rules", "hidden"]
+		},
+		"sdkName": "listEmailRuleResults",
+		"summary": "List every rule's result on an email",
+		"tag": "Email Rules",
+		"tagCommand": "email-rules"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-email-rule-scope-options",
+		"description": "How much the caller can read, and the inboxes and domains the caller can read, which is what they may name when a rule runs over selected inboxes and domains. For a caller who reads the whole organization, addresses lists the inboxes known as someone's (member addresses, members' verified work emails at the organization's domains, agents' addresses and inboxes with shared access), not every address that receives mail: may_name_unlisted says when an address that is not listed, such as an inbox nobody has claimed, may be named too. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listEmailRuleScopeOptions",
+		"path": "/email-rule-scope-options",
+		"pathParams": [],
+		"queryParams": [{
+			"description": "Only inboxes and domains containing this text.",
+			"enum": null,
+			"name": "q",
+			"required": false,
+			"type": "string"
+		}],
+		"headerParams": [],
+		"permissions": ["mail:read"],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"reach": {
+					"type": "string",
+					"enum": [
+						"organization",
+						"limited",
+						"own"
+					],
+					"description": "organization: all of the organization's mail. own: only your own. limited: some inboxes or domains."
+				},
+				"own_mail": {
+					"type": "boolean",
+					"description": "Whether a rule over only your own mail would run for you."
+				},
+				"own_mail_to_block": {
+					"description": "Whether a do_not_share rule over only your own mail would run for you: it covers every own mailbox you read, including ones you could not share.",
+					"type": "boolean"
+				},
+				"addresses": {
+					"type": "array",
+					"items": { "type": "string" },
+					"description": "Inboxes you can read, matching q. For someone who reads the whole organization, the inboxes known as someone's: member addresses, members' verified work emails at the organization's domains, agents' addresses and inboxes with shared access. Otherwise the inboxes your access lists (search with q for those past the first page). See may_name_unlisted for what else you may name."
+				},
+				"domains": {
+					"type": "array",
+					"items": { "type": "string" },
+					"description": "Domains you can read, matching q."
+				},
+				"more": {
+					"type": "boolean",
+					"description": "More match than are listed."
+				},
+				"may_name_unlisted": {
+					"description": "Whether you may also name an inbox this list never shows, however it is searched (more only says whether a search would show further ones): true when you read the whole organization (any address, such as an inbox at its domains nobody has claimed yet) or read a domain (any address there your access does not leave out). Name it in scope_selection.addresses as you would a listed one. Absent from a server that predates it.",
+					"type": "boolean"
+				}
+			},
+			"required": [
+				"reach",
+				"own_mail",
+				"addresses",
+				"domains",
+				"more"
+			]
+		},
+		"sdkName": "listEmailRuleScopeOptions",
+		"summary": "List what a rule can cover",
+		"tag": "Email Rules",
+		"tagCommand": "email-rules"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -74266,11 +75795,130 @@ const operationManifest = [
 		"tag": "Email Rules",
 		"tagCommand": "email-rules"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-email-rule-versions",
+		"description": "The named versions of a rule, as they were written: what each one's conditions and questions were, so a decision can be read against the version that made it. Numbers that are not versions of the rule are left out. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listEmailRuleVersions",
+		"path": "/email-rules/{id}/versions",
+		"pathParams": [{
+			"description": "The rule id.",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [{
+			"description": "The version numbers, comma-separated, at most 100.",
+			"enum": null,
+			"name": "versions",
+			"required": true,
+			"type": "string"
+		}],
+		"headerParams": [],
+		"permissions": ["mail:read"],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"properties": {
+					"version": {
+						"type": "integer",
+						"exclusiveMinimum": 0
+					},
+					"english": { "type": "string" },
+					"tree": {
+						"type": "object",
+						"properties": {
+							"version": {
+								"type": "number",
+								"const": 1
+							},
+							"vocabulary": {
+								"type": "string",
+								"description": "The column contract version the rule is written against, for example v1."
+							},
+							"when": {
+								"type": "object",
+								"propertyNames": { "type": "string" },
+								"additionalProperties": {},
+								"description": "The rule's conditions: a condition ({column, op, value?, min_confidence?}) or a group ({all: [...]}, {any: [...]} or {not: ...})."
+							},
+							"questions": {
+								"type": "array",
+								"items": { "type": "string" },
+								"description": "Yes/no questions of the rule's own, asked about an email only after its conditions match. An email matches only if every answer is yes."
+							}
+						},
+						"required": [
+							"version",
+							"vocabulary",
+							"when",
+							"questions"
+						]
+					},
+					"explanation": { "type": "string" },
+					"assumptions": {
+						"type": "array",
+						"items": { "type": "string" }
+					},
+					"warnings": {
+						"type": "array",
+						"items": { "type": "string" }
+					},
+					"compiled_by": {
+						"type": "string",
+						"description": "Who produced the tree, as the caller stated it when saving (not verified), for example rule-compiler-v1 or member."
+					},
+					"vocabulary": { "type": "string" },
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"sql": {
+						"description": "Present only when include_sql was true.",
+						"type": "object",
+						"properties": {
+							"expression": {
+								"type": "string",
+								"description": "A parameterized boolean expression over one row per email."
+							},
+							"params": {
+								"type": "array",
+								"items": {},
+								"description": "The values bound to $1, $2 and so on."
+							}
+						},
+						"required": ["expression", "params"]
+					}
+				},
+				"required": [
+					"version",
+					"english",
+					"tree",
+					"explanation",
+					"assumptions",
+					"warnings",
+					"compiled_by",
+					"vocabulary",
+					"created_at"
+				]
+			}
+		},
+		"sdkName": "listEmailRuleVersions",
+		"summary": "Read versions of a rule",
+		"tag": "Email Rules",
+		"tagCommand": "email-rules"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rules",
-		"description": "The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. With matched_email_id, only the rules that matched that email. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"description": "The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. Each carries its scope (evaluation_scope, and scope_selection for a selected rule). With matched_email_id, only the rules that matched that email. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRules",
@@ -74323,6 +75971,35 @@ const operationManifest = [
 							"active"
 						]
 					},
+					"kind": {
+						"description": "do_not_share: the rule blocks sharing of what it matches. Absent (or grant) on a rule that shares what it matches.",
+						"type": "string",
+						"enum": ["grant", "do_not_share"]
+					},
+					"evaluation_scope": {
+						"description": "Whose mail the rule runs over, as stored; GET /email-rules/{id}/scope says what that comes to now.",
+						"type": "string",
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						]
+					},
+					"scope_selection": {
+						"type": ["object", "null"],
+						"properties": {
+							"addresses": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"domains": {
+								"type": "array",
+								"items": { "type": "string" }
+							}
+						},
+						"required": ["addresses", "domains"],
+						"description": "What a selected rule names; null for any other scope."
+					},
 					"current_version": {
 						"type": ["integer", "null"],
 						"exclusiveMinimum": 0
@@ -74572,7 +76249,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "test-email-rule",
-		"description": "Runs a rule over received mail and reports what it would decide for each email: matched, near_miss, no_match, unclassified or not_found. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version, run with its author's access). Either way the rule reads only mail its author can read. Without email_ids, the newest emails it can read are tested, at most 200 and none older than 30 days. Emails not classified yet that arrived more than 2 hours ago are classified first and their classification is saved, unless classify_missing is false; newer ones are left to normal classification and reported unclassified with reason pending. The rule itself records nothing and grants nothing. Classification and the rule's own questions stop at about 90 seconds; run the test again to continue where it stopped. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"description": "Runs a rule over received mail and reports what it would decide for each email: matched, near_miss, no_match, unclassified or not_found. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version, run with its author's access). Either way the rule reads only mail its author can read, and only what its scope covers; an unsaved tree covers only your own mail unless evaluation_scope names more. Without email_ids, the newest emails it can read are tested, at most 200 and none older than 30 days. Emails not classified yet that arrived more than 2 hours ago are classified first and their classification is saved, unless classify_missing is false; newer ones are left to normal classification and reported unclassified with reason pending. The rule itself records nothing and grants nothing. Classification and the rule's own questions stop at about 90 seconds; run the test again to continue where it stopped. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "testEmailRule",
@@ -74624,14 +76301,50 @@ const operationManifest = [
 				},
 				"evaluation_scope": {
 					"type": "string",
-					"enum": ["author", "own_mailboxes"],
-					"description": "Whose mail an unsaved tree runs over. author, the default: all the mail you can read. own_mailboxes: only mail to your own addresses. Only with tree: a saved rule uses its own."
+					"enum": [
+						"author",
+						"own_mailboxes",
+						"selected"
+					],
+					"description": "own_mailboxes (the default): mail to your own addresses and agents (for a rule that shares, those you can send from). author: all mail you can read, including inboxes added later. selected: what scope_selection names."
+				},
+				"scope_selection": {
+					"type": "object",
+					"properties": {
+						"addresses": {
+							"maxItems": 100,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 3,
+								"maxLength": 320,
+								"pattern": "^[^\\s@]+@[^\\s@]+$"
+							}
+						},
+						"domains": {
+							"maxItems": 50,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 253,
+								"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+							}
+						}
+					},
+					"additionalProperties": false,
+					"description": "Inboxes, and domains (every address at them the author can read), for a selected rule; each one you can read."
 				},
 				"rule_id": {
 					"description": "A saved rule you can see. Its current version is tested, with its author's access.",
 					"type": "string",
 					"format": "uuid"
 				},
+				"kind": {
+					"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+					"type": "string",
+					"enum": ["grant", "do_not_share"]
+				},
 				"email_ids": {
 					"description": "Test exactly these emails. Without it, the newest emails the rule can read are tested, at most 200 and none older than 30 days.",
 					"minItems": 1,
@@ -74868,7 +76581,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "test-email-rule-on-sample",
-		"description": "Reports what a rule would decide for an email you describe: its sender, recipients, subject, plain text and attachment types, and optionally whether it is automated or from a mailing list and its spam score. The email is classified the way received mail is, and the rule's conditions and its own questions are decided as they would be for received mail with that content and those signals, received now. Without them it is not automated and not from a mailing list; a rule that reads a spam score you gave none for is decided on no score, and spam_score is listed in unset_columns. Nothing is stored: no email, classification or decision. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version). The answer includes what the classifier read from the email. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"description": "Reports what a rule would decide for an email you describe: its sender, recipients, subject, plain text and attachment types, and optionally whether it is automated or from a mailing list and its spam score. The email is classified the way received mail is, and the rule's conditions and its own questions are decided as they would be for received mail with that content and those signals, received now. Without them it is not automated and not from a mailing list; a rule that reads a spam score you gave none for is decided on no score, and spam_score is listed in unset_columns. Nothing is stored: no email, classification or decision. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version); an unsaved tree is run as covering only your own mail unless evaluation_scope names more, as on POST /email-rules/test. The answer includes what the classifier read from the email. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "testEmailRuleOnSample",
@@ -74920,14 +76633,50 @@ const operationManifest = [
 				},
 				"evaluation_scope": {
 					"type": "string",
-					"enum": ["author", "own_mailboxes"],
-					"description": "Whose mail an unsaved tree runs over. author, the default: all the mail you can read. own_mailboxes: only mail to your own addresses. Only with tree: a saved rule uses its own."
+					"enum": [
+						"author",
+						"own_mailboxes",
+						"selected"
+					],
+					"description": "own_mailboxes (the default): mail to your own addresses and agents (for a rule that shares, those you can send from). author: all mail you can read, including inboxes added later. selected: what scope_selection names."
+				},
+				"scope_selection": {
+					"type": "object",
+					"properties": {
+						"addresses": {
+							"maxItems": 100,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 3,
+								"maxLength": 320,
+								"pattern": "^[^\\s@]+@[^\\s@]+$"
+							}
+						},
+						"domains": {
+							"maxItems": 50,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 253,
+								"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+							}
+						}
+					},
+					"additionalProperties": false,
+					"description": "Inboxes, and domains (every address at them the author can read), for a selected rule; each one you can read."
 				},
 				"rule_id": {
 					"description": "A saved rule you can see. Its current version is tested.",
 					"type": "string",
 					"format": "uuid"
 				},
+				"kind": {
+					"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+					"type": "string",
+					"enum": ["grant", "do_not_share"]
+				},
 				"email": {
 					"type": "object",
 					"properties": {
@@ -75151,7 +76900,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "update-email-rule",
-		"description": "Renames the rule, saves a new version (english, tree and explanation together; earlier versions are kept unchanged) or changes its state: draft (disabled), observe or active. Only the rule's author may rename it, add a version or move it to observe or active; anyone else who can see it may only disable it (state draft), and while it is shared with another member only if they manage members from the dashboard. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
+		"description": "Renames the rule, saves a new version (english, tree and explanation together; earlier versions are kept unchanged), changes its state (draft, disabled; observe; or active) or changes whose mail it runs over (evaluation_scope, with scope_selection when selected). Only the rule's author may rename it, add a version, change its scope or move it to observe or active; anyone else who can see it may only disable it (state draft), and while it is shared with another member only if they manage members from the dashboard. Omit evaluation_scope to keep the current scope. A scope change saves a new version with the same conditions; what was granted stays. A shared rule keeps its scope. A rule's kind never changes. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.",
 		"hasJsonBody": true,
 		"method": "PATCH",
 		"operationId": "updateEmailRule",
@@ -75176,7 +76925,7 @@ const operationManifest = [
 					"description": "A short name for the rule."
 				},
 				"state": {
-					"description": "draft disables the rule; observe records decisions; active also grants what it matches. Keys read and receive what a rule granted only while it is active: leaving active pauses that, and returning to active restores reads and the delivery of queued mail not yet skipped.",
+					"description": "draft disables the rule; observe records decisions; active also grants what it matches, or for a do_not_share rule keeps it from being shared. Keys read and receive what a rule granted only while it is active: leaving active pauses that, and returning to active restores reads and the delivery of queued mail not yet skipped.",
 					"type": "string",
 					"enum": [
 						"draft",
@@ -75253,6 +77002,42 @@ const operationManifest = [
 					"type": "string",
 					"minLength": 1,
 					"maxLength": 64
+				},
+				"evaluation_scope": {
+					"type": "string",
+					"enum": [
+						"author",
+						"own_mailboxes",
+						"selected"
+					],
+					"description": "author: all mail its author can read. own_mailboxes: mail to their own addresses. selected: what scope_selection names. Never more than the author can read."
+				},
+				"scope_selection": {
+					"type": "object",
+					"properties": {
+						"addresses": {
+							"maxItems": 100,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 3,
+								"maxLength": 320,
+								"pattern": "^[^\\s@]+@[^\\s@]+$"
+							}
+						},
+						"domains": {
+							"maxItems": 50,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 253,
+								"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+							}
+						}
+					},
+					"additionalProperties": false,
+					"description": "Inboxes, and domains (every address at them the author can read), for a selected rule; each one you can read."
 				}
 			},
 			"additionalProperties": false
@@ -75273,6 +77058,35 @@ const operationManifest = [
 						"active"
 					]
 				},
+				"kind": {
+					"description": "do_not_share: the rule blocks sharing of what it matches. Absent (or grant) on a rule that shares what it matches.",
+					"type": "string",
+					"enum": ["grant", "do_not_share"]
+				},
+				"evaluation_scope": {
+					"description": "Whose mail the rule runs over, as stored; GET /email-rules/{id}/scope says what that comes to now.",
+					"type": "string",
+					"enum": [
+						"author",
+						"own_mailboxes",
+						"selected"
+					]
+				},
+				"scope_selection": {
+					"type": ["object", "null"],
+					"properties": {
+						"addresses": {
+							"type": "array",
+							"items": { "type": "string" }
+						},
+						"domains": {
+							"type": "array",
+							"items": { "type": "string" }
+						}
+					},
+					"required": ["addresses", "domains"],
+					"description": "What a selected rule names; null for any other scope."
+				},
 				"current_version": {
 					"type": ["integer", "null"],
 					"exclusiveMinimum": 0
@@ -90750,7 +92564,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "decide-suspension",
-		"description": "Keep, narrow or revoke one suspended or flagged item. Keeping it, and revoking an API key, needs the decider to cover it (revoking an uncovered key is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.",
+		"description": "Keep, narrow or revoke one suspended or flagged item. Keeping it, and revoking an API key, needs the decider to cover it (revoking an uncovered key is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. A rule share paused by a role change (`email_rule_share`) takes keep, which leaves it paused, or revoke, which ends the share and needs confirm: true (the person it was shared with loses the emails already shared; without it, 409 `confirmation_required`). Neither of the share's two people may keep it (`grant_forbidden`, `share_decision_forbidden`). Access a person gave on their own mailbox (`mailbox_access`) takes keep or revoke, and both need delegations:manage; revoke removes only what that person gave on that mailbox. Nobody the access reaches, nor the person who gave it, may keep it (`grant_forbidden`, `mailbox_access_decision_forbidden`). Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "decideSuspension",
@@ -102204,14 +104018,14 @@ function isMemoryJsonValue(value, seen = /* @__PURE__ */ new Set()) {
 	}
 }
 // src/oclif/cli-operations.ts
-const DASHBOARD_ONLY_OPERATION_IDS = /* @__PURE__ */ new Set([
+const KEY_WRITE_OPERATION_IDS = /* @__PURE__ */ new Set([
 	"credentials:create-key",
 	"credentials:rotate-key",
 	"credentials:update-key",
 	"credentials:revoke-credential"
 ]);
-/** The operations the CLI offers: the manifest without the dashboard-only ones. */
-const cliOperationManifest = operationManifest.filter((operation) => !DASHBOARD_ONLY_OPERATION_IDS.has(`${operation.tagCommand}:${operation.command}`));
+/** The operations the CLI generates commands for: the manifest without the key writes. */
+const cliOperationManifest = operationManifest.filter((operation) => !KEY_WRITE_OPERATION_IDS.has(`${operation.tagCommand}:${operation.command}`));
 // src/oclif/agent-mail-check.ts
 /**
 * One check for mail that arrived since this profile's previous check. It is
@@ -108882,7 +110696,7 @@ async function checkAccount(client) {
 			outcome: {
 				status: "fail",
 				message: `API rejected the key (${typeof apiError === "object" && apiError !== null ? JSON.stringify(apiError).slice(0, 300) : String(apiError).slice(0, 300)})`,
-				hint: "Run `primitive whoami` for the full error envelope. If the key was rotated, regenerate it in the dashboard."
+				hint: "Run `primitive whoami` for the full error envelope. If the key was rotated, use its new secret; if it was revoked, create a key with `primitive keys create` or in the dashboard."
 			},
 			account: null
 		};
@@ -111816,8 +113630,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^3.0.0-preview.1";
-const CLI_VERSION_RANGE = "^3.0.0-preview.1";
+const SDK_VERSION_RANGE = "^3.0.0-preview.3";
+const CLI_VERSION_RANGE = "^3.0.0-preview.3";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -112945,6 +114759,7 @@ var FunctionsRouteGetCommand = class FunctionsRouteGetCommand extends Command {
 	static summary = "Show a function's current route binding";
 	static examples = ["<%= config.bin %> functions route-get --id <fn-id>"];
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -113007,6 +114822,7 @@ var FunctionsRouteSetCommand = class FunctionsRouteSetCommand extends Command {
 		"<%= config.bin %> functions route-set --id <fn-id> --domain <domain-id> --takeover"
 	];
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -113079,6 +114895,7 @@ var FunctionsRouteUnsetCommand = class FunctionsRouteUnsetCommand extends Comman
 	static summary = "Unbind any route from a function";
 	static examples = ["<%= config.bin %> functions route-unset --id <fn-id>"];
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -113129,6 +114946,7 @@ var FunctionsRoutingTopologyCommand = class FunctionsRoutingTopologyCommand exte
 	static summary = "Show the org-wide function routing topology";
 	static examples = ["<%= config.bin %> functions routing-topology"];
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -113255,6 +115073,7 @@ var FunctionsSetSecretCommand = class FunctionsSetSecretCommand extends Command
 		"printf '%s' \"$MY_API_KEY\" | <%= config.bin %> functions set-secret --id <fn-id> --key MY_API_KEY --stdin --redeploy"
 	];
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -114577,7 +116396,10 @@ var InboxSetupCommand = class InboxSetupCommand extends Command {
 	}
 };
 // src/oclif/commands/keys.ts
-const KEYS_MANAGED_IN_DASHBOARD = "API keys are created, rotated and revoked in the dashboard for now. CLI commands for this are planned.";
+const STORE_SECRET_NOTICE = "Store this key now. It is shown only once, and the CLI does not save it.";
+const HELD_REQUEST_NOTICE = "A request already held open with this key, such as a long poll or a wait, ends once because the key's permissions changed. Run it again to use the new permissions.";
+const STEP_UP_HEADER$1 = "Primitive-Step-Up";
+const LIST_PAGE_LIMIT = 50;
 const API_KEY_FLAG$1 = Flags.string({
 	description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved login credentials).",
 	env: "PRIMITIVE_API_KEY",
@@ -114588,68 +116410,695 @@ const API_BASE_URL_FLAG$2 = Flags.string({
 	env: "PRIMITIVE_API_BASE_URL",
 	hidden: true
 });
-/** Print a refusal and set a failing exit code. */
-function reportKeysError(error, context, json) {
-	const payload = extractErrorPayload(error);
-	if (json) process.stderr.write(`${JSON.stringify(payload)}\n`);
-	else {
-		writeErrorWithHints(payload);
-		if (payload?.code === "forbidden") process.stderr.write("Listing keys needs an owner or admin. Some of it is available only in the dashboard.\n");
+const APPROVAL_FLAGS = {
+	"step-up-token": Flags.string({ description: "One-time token from the approval page, for a request you already approved in the browser. Sent in the Primitive-Step-Up header." }),
+	browser: Flags.boolean({
+		allowNo: true,
+		default: true,
+		description: "Open the approval page in your browser. Use --no-browser to only print its link."
+	})
+};
+function unwrap(data) {
+	return data?.data ?? data;
+}
+async function call(request) {
+	try {
+		const result = await request;
+		if (result.error !== void 0 || !result.response?.ok) return {
+			ok: false,
+			payload: result.error === void 0 || result.error === null || typeof result.error === "string" ? {
+				code: "http_error",
+				message: typeof result.error === "string" && result.error.trim() || `HTTP ${result.response?.status ?? ""}`.trim()
+			} : extractErrorPayload(result.error)
+		};
+		return {
+			ok: true,
+			data: unwrap(result.data)
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			payload: extractErrorPayload(error)
+		};
 	}
-	surfaceUnauthorizedHint({
-		...context,
-		payload
+}
+/** The approval link of a `step_up_required` refusal, if that is what it is. */
+function stepUpUrlOf$1(payload) {
+	if (extractErrorCode(payload) !== "step_up_required") return void 0;
+	if (!payload || typeof payload !== "object") return void 0;
+	const details = payload.details;
+	if (!details || typeof details !== "object") return void 0;
+	const url = details.step_up_url;
+	return typeof url === "string" && url.length > 0 ? url : void 0;
+}
+/**
+* Send a request, and when the server asks the person to approve it, show
+* the approval link, open it where possible, wait for the token the page
+* shows, and send the request once more with it. Without a terminal to wait
+* in, the refusal is returned with its link, to rerun with --step-up-token.
+*/
+async function withApproval(attempt, io) {
+	const first = await attempt(io.stepUpToken);
+	if (first.ok) return first;
+	const stepUpUrl = stepUpUrlOf$1(first.payload);
+	if (!stepUpUrl || io.stepUpToken || !io.interactive) return {
+		...first,
+		...stepUpUrl ? { stepUpUrl } : {}
+	};
+	io.write(`Approve this request in your browser: ${stepUpUrl}\n`);
+	if (io.openBrowser) io.open(stepUpUrl);
+	io.write("After you confirm, the page shows a one-time token. Paste it here to finish.\n");
+	const token = (await io.prompt("Token: ")).trim();
+	if (!token) return {
+		...first,
+		stepUpUrl
+	};
+	return attempt(token);
+}
+async function promptLine$2(question) {
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stderr
 	});
-	process.exitCode = 1;
+	try {
+		return await rl.question(question);
+	} finally {
+		rl.close();
+	}
 }
-function unwrap(data) {
-	return data?.data ?? null;
+function approvalIo(flags) {
+	return {
+		stepUpToken: flags["step-up-token"],
+		interactive: !flags.json && Boolean(process.stdin.isTTY && process.stderr.isTTY),
+		openBrowser: flags.browser,
+		open: openBrowser,
+		prompt: promptLine$2,
+		write: (text) => process.stderr.write(text)
+	};
+}
+/** Comma-separated and repeated values, trimmed, without duplicates. */
+function listFlag(values) {
+	const out = [];
+	for (const value of values ?? []) for (const part of value.split(",")) {
+		const item = part.trim();
+		if (item && !out.includes(item)) out.push(item);
+	}
+	return out;
+}
+function stringList(value) {
+	return Array.isArray(value) && value.every((v) => typeof v === "string") ? [...value] : null;
+}
+/** Which mail a key reaches, in words. */
+function describeMailScope(grant) {
+	if (grant.template === "super_admin") return "every mailbox";
+	if (grant.template === "connected_agent") return "its agent's address";
+	const scope = grant.mail_scope;
+	if (scope === "org") return "every mailbox";
+	if (!scope || typeof scope !== "object" || Array.isArray(scope)) return "unknown";
+	const record = scope;
+	const parts = [];
+	const addresses = stringList(record.addresses) ?? [];
+	const domains = stringList(record.domains) ?? [];
+	const rules = stringList(record.rules) ?? [];
+	if (addresses.length > 0) parts.push(`addresses ${addresses.join(", ")}`);
+	if (domains.length > 0) parts.push(`domains ${domains.join(", ")}`);
+	if (rules.length > 0) parts.push(`rules ${rules.join(", ")}`);
+	return parts.length > 0 ? parts.join("; ") : "no mailbox";
+}
+/** What a key may do, in words. */
+function describePermissions(grant) {
+	if (grant.template === "super_admin") return "super admin (every permission)";
+	if (grant.template) return grant.template;
+	const permissions = grant.permissions ?? [];
+	return permissions.length > 0 ? permissions.join(", ") : "none";
 }
 function formatKeyRows(rows) {
 	if (rows.length === 0) return "No API keys.";
 	return rows.map((row) => {
-		const grant = row.grant.template ? row.grant.template : `${row.grant.permissions?.length ?? 0} permissions`;
-		const flags = row.flags.length > 0 ? ` [${row.flags.join(", ")}]` : "";
-		return `${row.id}  ${row.prefix ?? ""}  ${row.name ?? "(unnamed)"}  ${grant}  expires ${row.expires_at ?? "never"}  last used ${row.last_used_at ?? "never"}${flags}`;
+		const suspended = row.suspended ? " [suspended]" : "";
+		return `${row.id}  ${row.key_prefix}  ${row.name ?? "(unnamed)"}  ${describePermissions(row.grant)}  mail: ${describeMailScope(row.grant)}  expires ${row.expires_at ?? "never"}  last used ${row.last_used_at ?? "never"}${suspended}`;
 	}).join("\n");
 }
+function formatKeyDetail(key) {
+	const lines = [
+		`Name:         ${key.name ?? "(unnamed)"}`,
+		`Id:           ${key.id}`,
+		`Prefix:       ${key.key_prefix}`,
+		`Kind:         ${key.kind}`,
+		`Mail:         ${describeMailScope(key.grant)}`,
+		`Created:      ${key.created_at ?? "unknown"}`,
+		`Expires:      ${key.expires_at ?? "never"}`,
+		`Last used:    ${key.last_used_at ?? "never"}`,
+		`Suspended:    ${key.suspended ? "yes" : "no"}`
+	];
+	if (key.agent_address) lines.push(`Agent:        ${key.agent_address}`);
+	if (key.grant.template) lines.push(`Permissions:  ${describePermissions(key.grant)}`);
+	else {
+		lines.push("Permissions:");
+		for (const permission of key.grant.permissions ?? []) lines.push(`  ${permission}`);
+	}
+	return lines.join("\n");
+}
+const EVERY_MAILBOX_PRESETS = /* @__PURE__ */ new Set([
+	"super_admin",
+	"read_only",
+	"send_only"
+]);
+const LISTED_PRESETS = /* @__PURE__ */ new Set(["own_addresses", "own_addresses_read_only"]);
+const KEY_PRESETS = [...EVERY_MAILBOX_PRESETS, ...LISTED_PRESETS];
+/**
+* The grant a new key asks for. There is no default: the caller names a
+* preset or the permissions, and a key with chosen permissions also says
+* which mail it reaches (addresses, domains, email rules, or every mailbox).
+*/
+function buildCreateGrant(choice) {
+	const listed = choice.addresses.length > 0 || choice.domains.length > 0 || choice.rules.length > 0;
+	const scope = {
+		...choice.addresses.length > 0 ? { addresses: choice.addresses } : {},
+		...choice.domains.length > 0 ? { domains: choice.domains } : {},
+		...choice.rules.length > 0 ? { rules: choice.rules } : {}
+	};
+	if (choice.permissions.length > 0) {
+		if (choice.preset) return {
+			ok: false,
+			message: "Pass either --preset or --permission, not both."
+		};
+		if (listed === choice.allMailboxes) return {
+			ok: false,
+			message: choice.allMailboxes ? "--all-mailboxes reaches every mailbox, so it cannot be combined with --address, --domain or --rule." : "Say which mail the key reaches: --address, --domain or --rule (each repeatable), or --all-mailboxes."
+		};
+		return {
+			ok: true,
+			grant: {
+				preset: "custom",
+				permissions: choice.permissions,
+				...choice.allMailboxes ? { mail_scope: "org" } : scope
+			}
+		};
+	}
+	if (!choice.preset) return {
+		ok: false,
+		message: "Say what the key can do: pass --preset or --permission. There is no default."
+	};
+	if (choice.allMailboxes) return {
+		ok: false,
+		message: "--all-mailboxes is only for a key with --permission."
+	};
+	if (EVERY_MAILBOX_PRESETS.has(choice.preset)) {
+		if (listed) return {
+			ok: false,
+			message: `${choice.preset} reaches every mailbox, so it takes no --address, --domain or --rule.`
+		};
+		return {
+			ok: true,
+			grant: choice.preset
+		};
+	}
+	if (LISTED_PRESETS.has(choice.preset)) {
+		if (!listed) return {
+			ok: false,
+			message: `${choice.preset} needs --address, --domain or --rule.`
+		};
+		return {
+			ok: true,
+			grant: {
+				preset: choice.preset,
+				...scope
+			}
+		};
+	}
+	return {
+		ok: false,
+		message: `--preset must be one of ${KEY_PRESETS.join(", ")}.`
+	};
+}
+/** The mail scope fields a change can send back unchanged. */
+const RESTATABLE_SCOPE_FIELDS = /* @__PURE__ */ new Set([
+	"addresses",
+	"domains",
+	"rules",
+	"depth"
+]);
+/**
+* The grant that restates a key's current grant with permissions added or
+* removed, or its email rules replaced, and everything else as it is. Only a
+* key with a permission list and a mail scope the CLI can restate exactly;
+* anything else is changed in the dashboard.
+*/
+function buildUpdatedGrant(current, change) {
+	if (current.template === "super_admin") return {
+		ok: false,
+		message: "This is a super admin key: it holds every permission already. To narrow it, create a key with only what you need, then revoke this one."
+	};
+	if (current.template) return {
+		ok: false,
+		message: `This key's permissions come from its template (${current.template}) and are not changed here.`
+	};
+	const resources = current.resources;
+	if (resources !== void 0 && resources !== null && (typeof resources !== "object" || Object.keys(resources).length > 0)) return {
+		ok: false,
+		message: "This key is limited to selected resources, which the CLI cannot restate. Change it in the dashboard."
+	};
+	const held = stringList(current.permissions);
+	if (!held) return {
+		ok: false,
+		message: "This key's permissions could not be read."
+	};
+	const permissions = [.../* @__PURE__ */ new Set([...held, ...change.add])].filter((p) => !change.remove.includes(p)).sort();
+	if (permissions.length === 0) return {
+		ok: false,
+		message: "A key needs at least one permission. To stop it working, revoke it."
+	};
+	const scope = current.mail_scope;
+	if (scope === "org") {
+		if (change.rules) return {
+			ok: false,
+			message: "This key reaches every mailbox, so email rules cannot be set on it. Create a key limited to the rules instead."
+		};
+		return {
+			ok: true,
+			grant: {
+				preset: "custom",
+				permissions,
+				mail_scope: "org"
+			},
+			permissions
+		};
+	}
+	if (!scope || typeof scope !== "object" || Array.isArray(scope)) return {
+		ok: false,
+		message: "This key's mail scope could not be read. Change it in the dashboard."
+	};
+	const record = scope;
+	const addresses = stringList(record.addresses ?? []);
+	const domains = stringList(record.domains ?? []);
+	const rules = change.rules ?? stringList(record.rules ?? []);
+	if (!addresses || !domains || !rules || Object.keys(record).some((field) => !RESTATABLE_SCOPE_FIELDS.has(field))) return {
+		ok: false,
+		message: "This key's mail scope has settings the CLI cannot restate. Change it in the dashboard."
+	};
+	if (addresses.length === 0 && domains.length === 0 && rules.length === 0) return {
+		ok: false,
+		message: "The key would reach no mail. Keep at least one address, domain or rule."
+	};
+	return {
+		ok: true,
+		grant: {
+			preset: "custom",
+			permissions,
+			...addresses.length > 0 ? { addresses } : {},
+			...domains.length > 0 ? { domains } : {},
+			...rules.length > 0 ? { rules } : {}
+		},
+		permissions
+	};
+}
+async function authenticate(command, flags) {
+	return createAuthenticatedCliApiClient({
+		apiKey: flags["api-key"],
+		apiBaseUrl: flags["api-base-url"],
+		configDir: command.config.configDir
+	});
+}
+/** Print a refusal and set a failing exit code. */
+function reportKeysError(command, outcome, auth, json) {
+	if (json) process.stderr.write(`${JSON.stringify(outcome.payload)}\n`);
+	else writeErrorWithHints(outcome.payload);
+	if (outcome.stepUpUrl) process.stderr.write(`Approve this request in your browser: ${outcome.stepUpUrl}\nThen run the same command again with --step-up-token <token from the page>.\n`);
+	surfaceUnauthorizedHint({
+		auth: auth.auth,
+		baseUrlOverridden: auth.baseUrlOverridden,
+		configDir: command.config.configDir,
+		payload: outcome.payload
+	});
+	process.exitCode = 1;
+}
+function writeWarnings(warnings) {
+	for (const warning of warnings ?? []) if (typeof warning.description === "string") process.stderr.write(`Note: ${warning.description}\n`);
+}
 var KeysListCommand = class KeysListCommand extends Command {
-	static description = `List the organization's API keys from the credential inventory, with grant, expiry and last use. Only metadata is shown, never a secret.
+	static description = `List the organization's API keys with their permissions, mail scope, expiry and last use. Only metadata is shown, never a secret.
 
-  ${KEYS_MANAGED_IN_DASHBOARD} The server answers this list only for an owner or admin in a dashboard session; from a CLI login it shows the server's refusal.`;
+  You see your own keys, and every key if your role may read them all, as in the dashboard.`;
 	static summary = "List API keys";
 	static examples = ["<%= config.bin %> keys list", "<%= config.bin %> keys list --json"];
 	static flags = {
 		"api-key": API_KEY_FLAG$1,
 		"api-base-url": API_BASE_URL_FLAG$2,
-		json: Flags.boolean({ description: "Print the inventory rows as JSON." })
+		json: Flags.boolean({ description: "Print the keys as JSON." })
 	};
 	async run() {
 		const { flags } = await this.parse(KeysListCommand);
-		const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
-			apiKey: flags["api-key"],
-			apiBaseUrl: flags["api-base-url"],
-			configDir: this.config.configDir
-		});
-		const result = await listCredentials({
-			client: apiClient.client,
-			query: { kind: "org_key" },
-			responseStyle: "fields"
+		const auth = await authenticate(this, flags);
+		const items = [];
+		let cursor;
+		for (let page = 0; page < LIST_PAGE_LIMIT; page += 1) {
+			const result = await call(listKeys({
+				client: auth.apiClient.client,
+				...cursor ? { query: { cursor } } : {}
+			}));
+			if (!result.ok) {
+				reportKeysError(this, result, auth, Boolean(flags.json));
+				return;
+			}
+			items.push(...result.data.items);
+			cursor = result.data.next_cursor ?? void 0;
+			if (!cursor) break;
+		}
+		if (flags.json) {
+			this.log(JSON.stringify(items, null, 2));
+			return;
+		}
+		this.log(formatKeyRows(items));
+	}
+};
+var KeysGetCommand = class KeysGetCommand extends Command {
+	static description = "Show one API key: its permissions, the mail it reaches, expiry and last use. Never a secret.";
+	static summary = "Show an API key";
+	static examples = ["<%= config.bin %> keys get 0f0e0d0c-0b0a-4908-8706-050403020100", "<%= config.bin %> keys get 0f0e0d0c-0b0a-4908-8706-050403020100 --json"];
+	static args = { id: Args.string({
+		description: "The key's id.",
+		required: true
+	}) };
+	static flags = {
+		"api-key": API_KEY_FLAG$1,
+		"api-base-url": API_BASE_URL_FLAG$2,
+		json: Flags.boolean({ description: "Print the key as JSON." })
+	};
+	async run() {
+		const { args, flags } = await this.parse(KeysGetCommand);
+		const auth = await authenticate(this, flags);
+		const result = await call(getKey({
+			client: auth.apiClient.client,
+			path: { id: args.id }
+		}));
+		if (!result.ok) {
+			reportKeysError(this, result, auth, Boolean(flags.json));
+			return;
+		}
+		this.log(flags.json ? JSON.stringify(result.data, null, 2) : formatKeyDetail(result.data));
+	}
+};
+/** The new secret on stdout alone, everything else on stderr. */
+function printSecret(command, json, document, secret, summary) {
+	if (json) {
+		command.log(JSON.stringify({
+			...document,
+			notice: STORE_SECRET_NOTICE
+		}, null, 2));
+		return;
+	}
+	process.stderr.write(`${summary}\n\n`);
+	command.log(secret);
+	process.stderr.write(`\n${STORE_SECRET_NOTICE}\n`);
+}
+var KeysCreateCommand = class KeysCreateCommand extends Command {
+	static description = `Create an API key. Say what it can do with --preset or --permission; there is no default.
+
+  The key is created directly. If your organization requires approval, the command prints the approval link, opens it where it can, and waits for the one-time token the page shows. In a script it prints the link and exits: approve, then run it again with --step-up-token. The key never holds more than you do, and your organization's credential policy applies.
+
+  The secret is printed once, on its own line on stdout (in the JSON with --json). Store it right away: it is not shown again and the CLI does not save it.
+
+  A key limited to email rules (--rule, repeatable) reaches only the mail those rules match. Give it mail:read with --permission, or use --preset own_addresses_read_only.`;
+	static summary = "Create an API key";
+	static examples = [
+		"<%= config.bin %> keys create --name reader --preset read_only",
+		"<%= config.bin %> keys create --name orders --permission mail:read --rule 3b0f6a1e-6c7a-4f43-9d8e-2a1b5c4d3e2f",
+		"<%= config.bin %> keys create --name support --permission mail:read,mail:reply --address support@example.com --expires-in-days 90",
+		"<%= config.bin %> keys create --name everything --preset super_admin"
+	];
+	static flags = {
+		"api-key": API_KEY_FLAG$1,
+		"api-base-url": API_BASE_URL_FLAG$2,
+		name: Flags.string({ description: "A name for the key." }),
+		preset: Flags.string({
+			description: "A preset grant.",
+			options: [...KEY_PRESETS]
+		}),
+		permission: Flags.string({
+			description: "A permission the key holds (repeatable, or comma-separated), for a custom key.",
+			multiple: true
+		}),
+		address: Flags.string({
+			description: "An address the key reaches (repeatable).",
+			multiple: true
+		}),
+		domain: Flags.string({
+			description: "A domain the key reaches (repeatable).",
+			multiple: true
+		}),
+		rule: Flags.string({
+			description: "An email rule id whose matching mail the key reaches (repeatable).",
+			multiple: true
+		}),
+		"all-mailboxes": Flags.boolean({ description: "A key with --permission that reaches every mailbox." }),
+		"expires-in-days": Flags.integer({
+			description: "Expire the key after this many days.",
+			min: 1
+		}),
+		"expires-at": Flags.string({
+			description: "Expire the key at this ISO 8601 time.",
+			exclusive: ["expires-in-days"]
+		}),
+		...APPROVAL_FLAGS,
+		json: Flags.boolean({ description: "Print the new key, its secret included, as JSON." })
+	};
+	async run() {
+		const { flags } = await this.parse(KeysCreateCommand);
+		const grant = buildCreateGrant({
+			preset: flags.preset,
+			permissions: listFlag(flags.permission),
+			addresses: listFlag(flags.address),
+			domains: listFlag(flags.domain),
+			rules: listFlag(flags.rule),
+			allMailboxes: flags["all-mailboxes"]
 		});
-		if (result.error) {
-			reportKeysError(result.error, {
-				auth,
-				baseUrlOverridden,
-				configDir: this.config.configDir
-			}, Boolean(flags.json));
+		if (!grant.ok) this.error(grant.message, { exit: 2 });
+		const auth = await authenticate(this, flags);
+		const body = {
+			grant: grant.grant,
+			...flags.name ? { name: flags.name } : {},
+			...flags["expires-in-days"] ? { expires_in_days: flags["expires-in-days"] } : {},
+			...flags["expires-at"] ? { expires_at: flags["expires-at"] } : {}
+		};
+		const idempotencyKey = `cli-${randomUUID()}`;
+		const result = await withApproval((token) => call(createKey({
+			client: auth.apiClient.client,
+			body,
+			headers: {
+				"Idempotency-Key": idempotencyKey,
+				...token ? { [STEP_UP_HEADER$1]: token } : {}
+			}
+		})), approvalIo(flags));
+		if (!result.ok) {
+			reportKeysError(this, result, auth, Boolean(flags.json));
+			return;
+		}
+		const key = result.data;
+		if (!flags.json) writeWarnings(key.warnings);
+		printSecret(this, Boolean(flags.json), key, key.key, [
+			`Created API key ${key.name ?? "(unnamed)"} (${key.id}), prefix ${key.key_prefix}.`,
+			`Permissions: ${describePermissions({
+				template: key.grant.template,
+				permissions: key.grant.permissions,
+				mail_scope: key.grant.mail_scope
+			})}`,
+			`Mail: ${describeMailScope({
+				template: key.grant.template,
+				permissions: key.grant.permissions,
+				mail_scope: key.grant.mail_scope
+			})}`,
+			`Expires: ${key.expires_at ?? "never"}`
+		].join("\n"));
+	}
+};
+var KeysRotateCommand = class KeysRotateCommand extends Command {
+	static description = `Rotate an API key: make a successor with the same permissions and print its secret once. The old key keeps working for the overlap, then stops.
+
+  The rotation runs directly; if your organization requires approval, the command prints the approval link and takes --step-up-token, as for a new key. Store the new secret right away: it is not shown again and the CLI does not save it.`;
+	static summary = "Rotate an API key";
+	static examples = ["<%= config.bin %> keys rotate 0f0e0d0c-0b0a-4908-8706-050403020100", "<%= config.bin %> keys rotate 0f0e0d0c-0b0a-4908-8706-050403020100 --overlap-seconds 0"];
+	static args = { id: Args.string({
+		description: "The key's id.",
+		required: true
+	}) };
+	static flags = {
+		"api-key": API_KEY_FLAG$1,
+		"api-base-url": API_BASE_URL_FLAG$2,
+		"overlap-seconds": Flags.integer({
+			description: "How long the old key keeps working, in seconds. 0 stops it now.",
+			min: 0
+		}),
+		...APPROVAL_FLAGS,
+		json: Flags.boolean({ description: "Print the new key, its secret included, as JSON." })
+	};
+	async run() {
+		const { args, flags } = await this.parse(KeysRotateCommand);
+		const auth = await authenticate(this, flags);
+		const body = flags["overlap-seconds"] === void 0 ? {} : { overlap_seconds: flags["overlap-seconds"] };
+		const result = await withApproval((token) => call(rotateKey({
+			client: auth.apiClient.client,
+			path: { id: args.id },
+			body,
+			...token ? { headers: { [STEP_UP_HEADER$1]: token } } : {}
+		})), approvalIo(flags));
+		if (!result.ok) {
+			reportKeysError(this, result, auth, Boolean(flags.json));
+			return;
+		}
+		const rotated = result.data;
+		printSecret(this, Boolean(flags.json), rotated, rotated.key, `Rotated key ${rotated.previous_key_id}. The new key is ${rotated.id}, prefix ${rotated.key_prefix}. The old key works until ${rotated.previous_key_expires_at}.`);
+	}
+};
+var KeysUpdateCommand = class KeysUpdateCommand extends Command {
+	static description = `Change an API key's permissions, email rules or name. It keeps its id and secret.
+
+  --add and --remove take permissions (repeatable, or comma-separated). --rule sets the email rules the key reaches, replacing the ones it has. Everything else about the key stays as it is.
+
+  The change runs directly; if your organization requires approval, the command prints the approval link and takes --step-up-token, as for a new key. A key never holds more than you do.`;
+	static summary = "Change an API key";
+	static examples = [
+		"<%= config.bin %> keys update 0f0e0d0c-0b0a-4908-8706-050403020100 --add mail:send,mail:reply",
+		"<%= config.bin %> keys update 0f0e0d0c-0b0a-4908-8706-050403020100 --remove mail:send",
+		"<%= config.bin %> keys update 0f0e0d0c-0b0a-4908-8706-050403020100 --rule 3b0f6a1e-6c7a-4f43-9d8e-2a1b5c4d3e2f"
+	];
+	static args = { id: Args.string({
+		description: "The key's id.",
+		required: true
+	}) };
+	static flags = {
+		"api-key": API_KEY_FLAG$1,
+		"api-base-url": API_BASE_URL_FLAG$2,
+		add: Flags.string({
+			description: "Permissions to add (repeatable, or comma-separated).",
+			multiple: true
+		}),
+		remove: Flags.string({
+			description: "Permissions to remove (repeatable, or comma-separated).",
+			multiple: true
+		}),
+		rule: Flags.string({
+			description: "An email rule id the key reaches (repeatable). Replaces the key's rules.",
+			multiple: true
+		}),
+		name: Flags.string({ description: "A new name for the key." }),
+		...APPROVAL_FLAGS,
+		json: Flags.boolean({ description: "Print the result as JSON." })
+	};
+	async run() {
+		const { args, flags } = await this.parse(KeysUpdateCommand);
+		const add = listFlag(flags.add);
+		const remove = listFlag(flags.remove);
+		const rules = flags.rule ? listFlag(flags.rule) : void 0;
+		const both = add.filter((p) => remove.includes(p));
+		if (both.length > 0) this.error(`Both added and removed: ${both.join(", ")}.`, { exit: 2 });
+		const changesGrant = add.length > 0 || remove.length > 0 || !!rules;
+		if (!changesGrant && flags.name === void 0) this.error("Nothing to change: pass --add, --remove, --rule or --name.", { exit: 2 });
+		const auth = await authenticate(this, flags);
+		const body = { ...flags.name !== void 0 ? { name: flags.name } : {} };
+		if (changesGrant) {
+			const current = await call(getKey({
+				client: auth.apiClient.client,
+				path: { id: args.id }
+			}));
+			if (!current.ok) {
+				reportKeysError(this, current, auth, Boolean(flags.json));
+				return;
+			}
+			const next = buildUpdatedGrant(current.data.grant, {
+				add,
+				remove,
+				...rules ? { rules } : {}
+			});
+			if (!next.ok) this.error(next.message, { exit: 2 });
+			body.grant = next.grant;
+			const ref = current.data.grant.ref;
+			if (typeof ref === "string") body.expected_grant_ref = ref;
+		}
+		const result = await withApproval((token) => call(updateKey({
+			client: auth.apiClient.client,
+			path: { id: args.id },
+			body,
+			...token ? { headers: { [STEP_UP_HEADER$1]: token } } : {}
+		})), approvalIo(flags));
+		if (!result.ok) {
+			reportKeysError(this, result, auth, Boolean(flags.json));
 			return;
 		}
-		const rows = unwrap(result.data)?.items ?? [];
+		const grantChanged = result.data.changed.includes("grant");
+		const after = grantChanged ? await call(getKey({
+			client: auth.apiClient.client,
+			path: { id: args.id }
+		})) : null;
 		if (flags.json) {
-			this.log(JSON.stringify(rows, null, 2));
+			this.log(JSON.stringify({
+				...result.data,
+				...after?.ok ? { key: after.data } : {},
+				...grantChanged ? { notice: HELD_REQUEST_NOTICE } : {}
+			}, null, 2));
 			return;
 		}
-		this.log(formatKeyRows(rows));
+		writeWarnings(result.data.warnings);
+		const changed = result.data.changed;
+		this.log(changed.length > 0 ? `Updated key ${args.id}: ${changed.join(", ")}.` : `Key ${args.id} already matched; nothing changed.`);
+		if (after?.ok) {
+			this.log(`Permissions: ${describePermissions(after.data.grant)}`);
+			this.log(`Mail: ${describeMailScope(after.data.grant)}`);
+		}
+		if (grantChanged) process.stderr.write(`${HELD_REQUEST_NOTICE}\n`);
+	}
+};
+var KeysRevokeCommand = class KeysRevokeCommand extends Command {
+	static description = `Revoke an API key. It stops working at once; what it set up keeps working and is listed for review.
+
+  Asks for confirmation first; pass --yes to skip the prompt in scripts.`;
+	static summary = "Revoke an API key";
+	static examples = ["<%= config.bin %> keys revoke 0f0e0d0c-0b0a-4908-8706-050403020100", "<%= config.bin %> keys revoke 0f0e0d0c-0b0a-4908-8706-050403020100 --yes"];
+	static args = { id: Args.string({
+		description: "The key's id.",
+		required: true
+	}) };
+	static flags = {
+		"api-key": API_KEY_FLAG$1,
+		"api-base-url": API_BASE_URL_FLAG$2,
+		yes: Flags.boolean({
+			char: "y",
+			description: "Revoke without asking for confirmation."
+		}),
+		reason: Flags.string({ description: "Why, recorded with the revocation." }),
+		json: Flags.boolean({ description: "Print the result as JSON." })
+	};
+	async run() {
+		const { args, flags } = await this.parse(KeysRevokeCommand);
+		if (!flags.yes) {
+			if (flags.json || !(process.stdin.isTTY && process.stderr.isTTY)) this.error("Not revoking: no terminal to confirm in. Pass --yes to revoke without a prompt.", { exit: 2 });
+			const answer = await promptLine$2(`Revoke key ${args.id}? It stops working at once. [y/N] `);
+			if (!/^y(es)?$/i.test(answer.trim())) {
+				process.stderr.write("Cancelled. The key still works.\n");
+				process.exitCode = 1;
+				return;
+			}
+		}
+		const auth = await authenticate(this, flags);
+		const result = await call(revokeCredential({
+			client: auth.apiClient.client,
+			body: {
+				kind: "org_key",
+				id: args.id,
+				...flags.reason ? { reason: flags.reason } : {}
+			}
+		}));
+		if (!result.ok) {
+			reportKeysError(this, result, auth, Boolean(flags.json));
+			return;
+		}
+		if (flags.json) {
+			this.log(JSON.stringify(result.data, null, 2));
+			return;
+		}
+		this.log(`Revoked key ${args.id}.`);
+		const standing = result.data.standing_objects;
+		if (Array.isArray(standing) && standing.length > 0) this.log(`It set up ${standing.length} item(s) that keep working. Review them with --json.`);
 	}
 };
 const hash = (value) => createHash("sha256").update(value).digest("hex");
@@ -119864,6 +122313,16 @@ function printData(command, responseData) {
 	const data = responseData?.data ?? null;
 	command.log(JSON.stringify(data, null, 2));
 }
+const CONTROL_CHARACTERS = new RegExp(`[${String.fromCharCode(0)}-${String.fromCharCode(31)}]`);
+/**
+* The stderr line naming the next page's cursor. A memory key can hold a line
+* break or another control character, which would split or garble the line,
+* so such a cursor is printed JSON-encoded, with a note on how to pass it.
+*/
+function nextCursorLine(cursor) {
+	if (!CONTROL_CHARACTERS.test(cursor)) return `next cursor: ${cursor}\n`;
+	return `next cursor (JSON-encoded, it holds control characters; decode it before passing it to --cursor, or read meta.cursor with --json --envelope): ${JSON.stringify(cursor)}\n`;
+}
 function handleMemoryInputError(error) {
 	if (!(error instanceof MemoryCliInputError)) return false;
 	process.stderr.write(`${error.message}\n`);
@@ -120003,6 +122462,7 @@ var MemoriesSetCommand = class MemoriesSetCommand extends Command {
 		value: Args.string({ description: "JSON value. Strings must be quoted as JSON strings." })
 	};
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": API_KEY_FLAG,
 		"api-base-url": API_BASE_URL_FLAG$1,
 		...SCOPE_FLAGS,
@@ -120094,6 +122554,7 @@ var MemoriesGetCommand = class MemoriesGetCommand extends Command {
 		required: true
 	}) };
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": API_KEY_FLAG,
 		"api-base-url": API_BASE_URL_FLAG$1,
 		...SCOPE_FLAGS,
@@ -120147,6 +122608,7 @@ var MemoriesDeleteCommand = class MemoriesDeleteCommand extends Command {
 		required: true
 	}) };
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": API_KEY_FLAG,
 		"api-base-url": API_BASE_URL_FLAG$1,
 		...SCOPE_FLAGS,
@@ -120201,6 +122663,7 @@ var MemoriesSearchCommand = class MemoriesSearchCommand extends Command {
 	];
 	static args = { prefix: Args.string({ description: "Key prefix. Omit to list all active memories in scope." }) };
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": API_KEY_FLAG,
 		"api-base-url": API_BASE_URL_FLAG$1,
 		...SCOPE_FLAGS,
@@ -120210,7 +122673,8 @@ var MemoriesSearchCommand = class MemoriesSearchCommand extends Command {
 			min: 1,
 			max: 100
 		}),
-		cursor: Flags.string({ description: "Key cursor from a previous response's meta.cursor." }),
+		cursor: Flags.string({ description: "Key cursor from the previous page. The next page's cursor is meta.cursor, null on the last page: without --json it is printed on stderr as `next cursor: <value>` (JSON-encoded, with a note, when it holds control characters); with --json, add --envelope to get it, the reliable way for a script to page." }),
+		envelope: Flags.boolean({ description: "Print the full response envelope, including meta.cursor for the next page. Defaults to printing only the data payload." }),
 		"metadata-only": Flags.boolean({ description: "Omit memory values and return metadata only." }),
 		"updated-after": Flags.string({ description: "Only include memories updated at or after this ISO timestamp." }),
 		"updated-before": Flags.string({ description: "Only include memories updated at or before this ISO timestamp." }),
@@ -120247,7 +122711,11 @@ var MemoriesSearchCommand = class MemoriesSearchCommand extends Command {
 				});
 				return;
 			}
-			printData(this, result.data);
+			const envelope = result.data;
+			const cursor = envelope?.meta?.cursor;
+			if (cursor && !flags.json) process.stderr.write(nextCursorLine(cursor));
+			if (flags.envelope) this.log(JSON.stringify(envelope ?? null, null, 2));
+			else printData(this, result.data);
 		});
 	}
 };
@@ -120767,6 +123235,7 @@ var OrgSecretsListCommand = class OrgSecretsListCommand extends Command {
 	static summary = "List global secrets (keys only; values never returned)";
 	static examples = ["<%= config.bin %> org secrets list"];
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -120812,6 +123281,7 @@ var OrgSecretsRemoveCommand = class OrgSecretsRemoveCommand extends Command {
 	static aliases = ["org:secrets:delete"];
 	static examples = ["<%= config.bin %> org secrets remove --key MY_API_KEY"];
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -120872,6 +123342,7 @@ var OrgSecretsSetCommand = class OrgSecretsSetCommand extends Command {
 		"printf '%s' \"$MY_API_KEY\" | <%= config.bin %> org secrets set --key MY_API_KEY --stdin"
 	];
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -122224,6 +124695,7 @@ var RoutesAddCommand = class RoutesAddCommand extends Command {
 		required: true
 	}) };
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -122303,6 +124775,7 @@ var RoutesListCommand = class RoutesListCommand extends Command {
 	static summary = "List recipient routes";
 	static examples = ["<%= config.bin %> routes list"];
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -122352,6 +124825,7 @@ var RoutesRemoveCommand = class RoutesRemoveCommand extends Command {
 		required: true
 	}) };
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -122418,6 +124892,7 @@ var RoutesReorderCommand = class RoutesReorderCommand extends Command {
 	static summary = "Reorder recipient routes";
 	static examples = ["<%= config.bin %> routes reorder --set <route-id>=10", "<%= config.bin %> routes reorder --set <id-a>=10 --set <id-b>=20"];
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -122483,6 +124958,7 @@ var RoutesTestCommand = class RoutesTestCommand extends Command {
 		required: true
 	}) };
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -122555,6 +125031,7 @@ var RoutesUpdateCommand = class RoutesUpdateCommand extends Command {
 		required: true
 	}) };
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -124800,6 +127277,7 @@ var WakeAuthorizationsCreateCommand = class WakeAuthorizationsCreateCommand exte
 	static summary = "Create a wake authorization";
 	static examples = ["<%= config.bin %> wake authorizations create --endpoint <endpoint-id> --domain agents.acme.dev --command process_inbox"];
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -124870,6 +127348,7 @@ var WakeAuthorizationsDeleteCommand = class WakeAuthorizationsDeleteCommand exte
 		required: true
 	}) };
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -124916,6 +127395,7 @@ var WakeAuthorizationsListCommand = class WakeAuthorizationsListCommand extends
 	static summary = "List wake authorizations";
 	static examples = ["<%= config.bin %> wake authorizations list", "<%= config.bin %> wake authorizations list --endpoint <endpoint-id>"];
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -124967,6 +127447,7 @@ var WakeAuthorizationsUpdateCommand = class WakeAuthorizationsUpdateCommand exte
 		required: true
 	}) };
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -125019,6 +127500,7 @@ var WakeDispatchesListCommand = class WakeDispatchesListCommand extends Command
 	static summary = "List recent wake dispatches";
 	static examples = ["<%= config.bin %> wake dispatches list", "<%= config.bin %> wake dispatches list --limit 20"];
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -125066,6 +127548,7 @@ var WakeSchedulesCreateCommand = class WakeSchedulesCreateCommand extends Comman
 	static summary = "Create a wake schedule";
 	static examples = ["<%= config.bin %> wake schedules create --from scheduler@acme.dev --to alice@acme.dev --command process_inbox --cron \"0 9 * * *\" --timezone America/New_York"];
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -125151,6 +127634,7 @@ var WakeSchedulesDeleteCommand = class WakeSchedulesDeleteCommand extends Comman
 		required: true
 	}) };
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -125201,6 +127685,7 @@ var WakeSchedulesGetCommand = class WakeSchedulesGetCommand extends Command {
 		required: true
 	}) };
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -125247,6 +127732,7 @@ var WakeSchedulesListCommand = class WakeSchedulesListCommand extends Command {
 	static summary = "List wake schedules";
 	static examples = ["<%= config.bin %> wake schedules list"];
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -125296,6 +127782,7 @@ var WakeSchedulesRunCommand = class WakeSchedulesRunCommand extends Command {
 		required: true
 	}) };
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -125346,6 +127833,7 @@ var WakeSchedulesUpdateCommand = class WakeSchedulesUpdateCommand extends Comman
 		required: true
 	}) };
 	static flags = {
+		json: JSON_OUTPUT_FLAG,
 		"api-key": Flags.string({
 			description: "Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)",
 			env: "PRIMITIVE_API_KEY"
@@ -125708,7 +128196,7 @@ function renderFishCompletion(binName) {
 		const topicOperations = cliOperationManifest.filter((operation) => operation.tagCommand === topic);
 		for (const operation of topicOperations) {
 			lines.push(`complete -c ${binName} -f -n '__fish_${binName}_topic_needs_subcommand ${fishEscape(topic)}' -a '${fishEscape(operation.command)}' -d '${fishEscape(operation.summary ?? `${operation.method} ${operation.path}`)}'`);
-			for (const parameter of [...operation.pathParams, ...operation.queryParams]) lines.push(`complete -c ${binName} -n '${operationCondition(operation).replace(BIN_PLACEHOLDER, binName)}' -l '${fishEscape(parameter.name.replace(/_/g, "-"))}' -r -d '${fishEscape(parameter.description ?? parameter.name)}'`);
+			for (const parameter of [...operation.pathParams, ...operation.queryParams]) lines.push(`complete -c ${binName} -n '${operationCondition(operation).replace(BIN_PLACEHOLDER, binName)}' -l '${fishEscape(parameterFlagName(operation.sdkName, parameter.name))}' -r -d '${fishEscape(OPERATION_PATH_FLAGS[operation.sdkName]?.[parameter.name]?.description ?? parameter.description ?? parameter.name)}'`);
 			for (const parameter of operation.headerParams) lines.push(`complete -c ${binName} -n '${operationCondition(operation).replace(BIN_PLACEHOLDER, binName)}' -l '${fishEscape(headerFlagName(parameter.name))}' -r -d '${fishEscape(parameter.description ?? parameter.name)}'`);
 			lines.push(`complete -c ${binName} -n '${operationCondition(operation).replace(BIN_PLACEHOLDER, binName)}' -l 'api-key' -r -d 'Primitive API key override (defaults to PRIMITIVE_API_KEY or saved OAuth login credentials)'`);
 			if (!operation.binaryResponse) lines.push(`complete -c ${binName} -n '${operationCondition(operation).replace(BIN_PLACEHOLDER, binName)}' -l 'envelope' -d 'Print the full response envelope, including pagination metadata'`);
@@ -125759,6 +128247,7 @@ function readCompletionFunction(cacheDir, bin, shell) {
 var ListOperationsCommand = class extends Command {
 	static description = "List all generated API operations as JSON. Useful for piping to `jq` to discover available commands, their request/response schemas, and per-field descriptions. For inspecting a single operation in detail, prefer `primitive describe <command-or-operation-name>`.";
 	static summary = "List all generated API operations (JSON)";
+	static flags = { json: JSON_OUTPUT_FLAG };
 	async run() {
 		this.log(JSON.stringify(cliOperationManifest, null, 2));
 	}
@@ -125854,6 +128343,7 @@ var DescribeCommand = class DescribeCommand extends Command {
 		"<%= config.bin %> describe emails:get",
 		"<%= config.bin %> describe sent:get"
 	];
+	static flags = { json: JSON_OUTPUT_FLAG };
 	async run() {
 		const { args } = await this.parse(DescribeCommand);
 		const { match, candidates } = lookupOperation(args.command);
@@ -126092,6 +128582,11 @@ const COMMANDS = {
 	"org:use": OrgUseCommand,
 	"cli:list-cli-orgs": OrgsCommand,
 	"keys:list": KeysListCommand,
+	"keys:get": KeysGetCommand,
+	"keys:create": KeysCreateCommand,
+	"keys:rotate": KeysRotateCommand,
+	"keys:update": KeysUpdateCommand,
+	"keys:revoke": KeysRevokeCommand,
 	"roles:list": RolesListCommand,
 	"roles:groups": RolesGroupsCommand,
 	"roles:mailbox-access": RolesMailboxAccessCommand,