primcli 3.0.0-preview.10 → 3.0.0-preview.11

package/dist/oclif/index.js

@@ -1,12 +1,12 @@
-import { $ as readEmailInteraction, A as explainPendingMailNotFound, At as cliInvocation, Bt as formatAlreadySentNotice, C as promptLine$2, Ct as sendOutcomeExitCode, D as formatBrowserLoginInstructions, Dt as successfulSendOutcome, E as canOfferCopyHotkey, Et as serializeErrorPayload, F as latestOwnOutbound, Ft as loadSkillLine, G as clearConsumedPendingMail, Gt as classificationFactLines, H as wakeRecipientField, Ht as emptyEmailListHint, I as readThreadContext, It as currentMailSessionKey, J as readPendingMail, Jt as noFactsMessage, K as clearReadPendingMail, Kt as classificationOf, L as sentInThread, Lt as detectAgentRuntime, M as describeWake, N as displayAddress, Nt as generatedAgentName, O as listenForCopyHotkey, Ot as thrownErrorExitCode, P as formatMailWakeLine, Pt as identitySuggestions, Q as interactionNextActions, Qt as ConnectedAgentKeyRequiredError, R as serverMuted, Rt as detectRuntimeSession, S as approveThenRerunHint, St as sendIdentityFields, T as withApproval, Tt as sentHistoryWindowStart, U as wakeRelationship, Ut as mailReach, V as wakeReadCommand, Vt as withFlagSuggestion, W as claimPendingMail, Wt as readCallerMailFor, X as removePendingMail, Xt as ATTACHMENT_WAIT_MAX_MS, Y as recordPendingMail, Yt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, Z as interactionHumanLine, Zt as withAttachmentWait, _ as takesStepUp, _n as setKnownCommands, _t as formatPriorRepliesWarning, a as createOperationCommand, an as selectedOrgFromEnv, at as SEND_OUTCOME_HELP, b as STEP_UP_HEADER$1, bt as priorRepliesThatWentOut, c as formatErrorPayload, cn as credentialsFromUserLogin, ct as buildFollowUpCommand, d as isGrantRefusal, dn as revokeUserLogin, dt as classifySendError, en as createAuthenticatedCliApiClient, et as replyExpectation, f as parameterFlagName, fn as roleKeyLabel, ft as deriveSendIdempotencyKey, g as surfaceUnauthorizedHint, gn as sanitizeForTerminal, gt as formatPriorRepliesCheckSkipped, h as runWithTiming, hn as routeWarningLines, ht as formatDeletedEarlierSendNotice, i as TIME_FLAG_DESCRIPTION, in as resolveCliApiRequestConfig, it as MAX_SEND_WAIT_TIMEOUT_MS, j as bareAddress, jt as connectNextSteps, k as openBrowser, l as hasControlCharacter$1, ln as fetchCliOrgs, lt as buildThrownSendFailureEnvelope, m as refusalDetails, mn as switchCurrentOrg, mt as followUpCommandPrefix, n as API_ERROR_CODES, nn as refreshStoredCliCredentials, o as extractErrorCode, on as CliOrgRefusedError, ot as apiResultHttpStatus, p as readTextFileFlag, pn as roleKeyText, pt as excludeSignalReplies, q as pendingMailPath, qt as isEmailId, r as OPERATION_PATH_FLAGS, rn as refuseOrgSelectionForProfile, rt as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, s as extractErrorPayload, sn as RESTRICTED_ROLE_NOTE, st as assertValidIdempotencyKey, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createCliApiClient, tt as replyInteractionWarning, u as headerFlagName, un as isBuiltInRoleKey, ut as checkPriorReplies, v as writeErrorWithHints, vn as operationManifest, vt as formatSendFailureSummary, w as terminalApprovalIo, wt as sendWaitClampNotice, x as STEP_UP_TOKEN_FLAG_DESCRIPTION, xt as reportSendCommandResult, y as BROWSER_FLAG_DESCRIPTION, yt as formatSendRecordFailureSummary, z as serverRelationship, zt as runtimeSessionVariableList } from "../api-command-D0KHkqhA.js";
-import { $ as parseFromHeader, $n as startAgentClaim, $t as getSendFrom, A as lateMailReread, An as listWakeSchedules, At as downloadEmailAttachmentArchiveMember, B as ensureSearchReportsReplyState, Bn as resendAgentSignupVerification, Bt as getCreditBalance, C as waitOutRetryAfter, Cn as listRepeatingSends, Ct as createWakeSchedule, D as encodeReceivedAtSearchCursor, Dn as listSentEmails, Dt as deleteRoute, E as cursorFromAcceptedRows, En as listSentAttachmentArchiveMembers, Et as deleteMemory, F as AWAITING_VALUES, Ft as getAccessMode, G as queryUsesAwaiting, Gn as searchEmails, Gt as getFunctionTestRunTrace, H as formatRepliesCell, Hn as rotateKey, Ht as getEmail, I as REPLY_STATE_UNSUPPORTED_CODE, In as redeemCreditCode, It as getAccount, Jn as sendEmail, Jt as getMemory, Kn as searchMemories, Kt as getInboxStatus, L as ReplyStateUnsupportedError, Ln as removeDefaultNetworkMember, Lt as getAgentContactPolicy, M as sinceFromFlags, Mn as pullWebhookEvent, N as sleep$3, Nt as downloadSentAttachmentArchiveMember, O as fetchEmailSearchPage, On as listWakeAuthorizations, Ot as deleteWakeAuthorization, P as AWAITING_FLAG_DESCRIPTION, Pt as downloadSentAttachmentByFilename, Q as parseWebhookEvent, Qn as simulateRoute, Qt as getRepeatingSend, R as assertAwaitingFilterRows, Rn as reorderRoutes, S as transientFailure, Sn as listOrganizationPeople, St as createWakeAuthorization, T as collectNewAcceptedEmails, Tn as listRoutes, U as hasReplyState, Un as runWakeSchedule, Ut as getFunction, V as formatAwaitingCell, Vn as revokeCredential, Vt as getDefaultNetworkAgent, W as isAwaitingRejectedError, Wt as getFunctionRouting, X as isEmailReceivedEvent, Xn as setFunctionSecret, Xt as getOutboundStatus, Yn as setFunctionRoute, Yt as getOrgRoutingTopology, Zn as setMemory, Zt as getOwnGrant, _ as describeApiFailure, _n as listFunctionLogs, _t as completeWebhookEvent, a as REPEAT_IDLE_MAX_MINUTES, an as listActivityObjects, ar as updateDefaultNetworkMember, at as automatedRejectedError, b as retryTransient, bn as listKeys, bt as createKey, cn as listAgentNetworks, cr as updateRepeatingSend, d as parseRepeatTick, dn as listDefaultNetworkMembers, dr as updateWakeSchedule, dt as addDefaultNetworkMember, en as getSentEmail, er as startAgentSignup, et as AUTOMATED_FILTER_UNSUPPORTED_CODE, f as preparePresenceAliveEmail, fn as listDomains, fr as verifyAgentClaim, ft as cancelSentEmail, g as WaitDeadlineReached, gn as listEndpoints, gt as cliLogout, hn as listEmails, ht as checkSendability, i as REPEAT_EVERY_MAX_MINUTES, in as leaveOrganization, ir as unsetFunctionRoute, it as assertAutomatedVerdict, j as quoteDslValue, jn as pollCliLogin, jt as downloadEmailAttachmentByFilename, k as filtersFromFlags, kn as listWakeDispatches, kt as deleteWakeSchedule, l as parseInteractionEnvelope, lr as updateRoute, lt as hasAutomatedVerdict, m as repeatStopCommand, mn as listEmailRuleResults, mr as whoami, mt as checkDefaultNetworkContactAdmission, nn as getWakeSchedule, nr as stopRepeatFromEmail, nt as AUTOMATED_VALUES, o as REPEAT_MAX_SENDS_MAX, or as updateFunction, p as prepareSignalEmail, pn as listEmailAttachmentArchiveMembers, pr as verifyAgentSignup, pt as cancelSentEmailByIdempotencyKey, qn as semanticSearch, qt as getKey, rr as testFunction, rt as AutomatedFilterUnsupportedError, s as buildRepeatStopBody, sn as listAgentContacts, sr as updateKey, tn as getThread, tr as startCliLogin, tt as AUTOMATED_FLAG_DESCRIPTION, u as parsePresenceEnvelope, un as listDefaultNetworkAgents, ur as updateWakeAuthorization, ut as isAutomatedRejectedError, vn as listFunctions, vt as createEndpoint, w as SINCE_VALUE_HELP, wn as listRoles, x as retryingOperation, xn as listMailboxAccess, xt as createRoute, y as pauseForTransientFailure, yn as listGroups, yt as createFunction, z as awaitingRejectedError, zn as replyToEmail, zt as getConversation } from "../repeats-Dj_o6c-X-CDaE-kdZ.js";
-import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-DN8tSfAi.js";
+import { $ as readEmailInteraction, A as explainPendingMailNotFound, At as cliInvocation, Bt as formatAlreadySentNotice, C as promptLine$2, Ct as sendOutcomeExitCode, D as formatBrowserLoginInstructions, Dt as successfulSendOutcome, E as canOfferCopyHotkey, Et as serializeErrorPayload, F as latestOwnOutbound, Ft as loadSkillLine, G as clearConsumedPendingMail, Gt as classificationFactLines, H as wakeRecipientField, Ht as emptyEmailListHint, I as readThreadContext, It as currentMailSessionKey, J as readPendingMail, Jt as noFactsMessage, K as clearReadPendingMail, Kt as classificationOf, L as sentInThread, Lt as detectAgentRuntime, M as describeWake, N as displayAddress, Nt as generatedAgentName, O as listenForCopyHotkey, Ot as thrownErrorExitCode, P as formatMailWakeLine, Pt as identitySuggestions, Q as interactionNextActions, Qt as ConnectedAgentKeyRequiredError, R as serverMuted, Rt as detectRuntimeSession, S as approveThenRerunHint, St as sendIdentityFields, T as withApproval, Tt as sentHistoryWindowStart, U as wakeRelationship, Ut as mailReach, V as wakeReadCommand, Vt as withFlagSuggestion, W as claimPendingMail, Wt as readCallerMailFor, X as removePendingMail, Xt as ATTACHMENT_WAIT_MAX_MS, Y as recordPendingMail, Yt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, Z as interactionHumanLine, Zt as withAttachmentWait, _ as takesStepUp, _n as setKnownCommands, _t as formatPriorRepliesWarning, a as createOperationCommand, an as selectedOrgFromEnv, at as SEND_OUTCOME_HELP, b as STEP_UP_HEADER$1, bt as priorRepliesThatWentOut, c as formatErrorPayload, cn as credentialsFromUserLogin, ct as buildFollowUpCommand, d as isGrantRefusal, dn as revokeUserLogin, dt as classifySendError, en as createAuthenticatedCliApiClient, et as replyExpectation, f as parameterFlagName, fn as roleKeyLabel, ft as deriveSendIdempotencyKey, g as surfaceUnauthorizedHint, gn as sanitizeForTerminal, gt as formatPriorRepliesCheckSkipped, h as runWithTiming, hn as routeWarningLines, ht as formatDeletedEarlierSendNotice, i as TIME_FLAG_DESCRIPTION, in as resolveCliApiRequestConfig, it as MAX_SEND_WAIT_TIMEOUT_MS, j as bareAddress, jt as connectNextSteps, k as openBrowser, l as hasControlCharacter$1, ln as fetchCliOrgs, lt as buildThrownSendFailureEnvelope, m as refusalDetails, mn as switchCurrentOrg, mt as followUpCommandPrefix, n as API_ERROR_CODES, nn as refreshStoredCliCredentials, o as extractErrorCode, on as CliOrgRefusedError, ot as apiResultHttpStatus, p as readTextFileFlag, pn as roleKeyText, pt as excludeSignalReplies, q as pendingMailPath, qt as isEmailId, r as OPERATION_PATH_FLAGS, rn as refuseOrgSelectionForProfile, rt as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, s as extractErrorPayload, sn as RESTRICTED_ROLE_NOTE, st as assertValidIdempotencyKey, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createCliApiClient, tt as replyInteractionWarning, u as headerFlagName, un as isBuiltInRoleKey, ut as checkPriorReplies, v as writeErrorWithHints, vn as operationManifest, vt as formatSendFailureSummary, w as terminalApprovalIo, wt as sendWaitClampNotice, x as STEP_UP_TOKEN_FLAG_DESCRIPTION, xt as reportSendCommandResult, y as BROWSER_FLAG_DESCRIPTION, yt as formatSendRecordFailureSummary, z as serverRelationship, zt as runtimeSessionVariableList } from "../api-command-CkMEFiBL.js";
+import { $ as parseWebhookEvent, $n as simulateRoute, $t as getRepeatingSend, A as lateMailReread, An as listWakeDispatches, At as deleteWakeSchedule, B as ensureSearchReportsReplyState, Bn as replyToEmail, Bt as getConversation, C as waitOutRetryAfter, Cn as listOrganizationPeople, Ct as createWakeAuthorization, D as encodeReceivedAtSearchCursor, Dn as listSentAttachmentArchiveMembers, Dt as deleteMemory, E as cursorFromAcceptedRows, En as listRoutes, F as AWAITING_VALUES, Ft as downloadSentAttachmentByFilename, G as queryUsesAwaiting, Gt as getFunctionRouting, H as formatRepliesCell, Hn as revokeCredential, Ht as getDefaultNetworkAgent, I as REPLY_STATE_UNSUPPORTED_CODE, It as getAccessMode, Jn as semanticSearch, Jt as getKey, Kn as searchEmails, Kt as getFunctionTestRunTrace, L as ReplyStateUnsupportedError, Ln as redeemCreditCode, Lt as getAccount, M as sinceFromFlags, Mn as pollCliLogin, Mt as downloadEmailAttachmentByFilename, N as sleep$3, Nn as pullWebhookEvent, O as fetchEmailSearchPage, On as listSentEmails, Ot as deleteRoute, P as AWAITING_FLAG_DESCRIPTION, Pt as downloadSentAttachmentArchiveMember, Qn as setMemory, Qt as getOwnGrant, R as assertAwaitingFilterRows, Rn as removeDefaultNetworkMember, Rt as getAgentContactPolicy, S as transientFailure, Sn as listMailboxAccess, St as createRoute, T as collectNewAcceptedEmails, Tn as listRoles, U as hasReplyState, Un as rotateKey, Ut as getEmail, V as formatAwaitingCell, Vn as resendAgentSignupVerification, Vt as getCreditBalance, W as isAwaitingRejectedError, Wn as runWakeSchedule, Wt as getFunction, Xn as setFunctionRoute, Xt as getOrgRoutingTopology, Yn as sendEmail, Yt as getMemory, Z as isEmailReceivedEvent, Zn as setFunctionSecret, Zt as getOutboundStatus, _ as describeApiFailure, _n as listEndpoints, _t as cliLogout, a as REPEAT_IDLE_MAX_MINUTES, an as leaveOrganization, ar as unsetFunctionRoute, at as assertAutomatedVerdict, b as retryTransient, bn as listGroups, bt as createFunction, cn as listAgentContacts, cr as updateKey, d as parseRepeatTick, dn as listDefaultNetworkAgents, dr as updateWakeAuthorization, dt as isAutomatedRejectedError, en as getSendFrom, er as startAgentClaim, et as parseFromHeader, f as preparePresenceAliveEmail, fn as listDefaultNetworkMembers, fr as updateWakeSchedule, ft as addDefaultNetworkMember, g as WaitDeadlineReached, gn as listEmails, gt as checkSendability, hn as listEmailRuleResults, hr as whoami, ht as checkDefaultNetworkContactAdmission, i as REPEAT_EVERY_MAX_MINUTES, ir as testFunction, it as AutomatedFilterUnsupportedError, j as quoteDslValue, jn as listWakeSchedules, jt as downloadEmailAttachmentArchiveMember, k as filtersFromFlags, kn as listWakeAuthorizations, kt as deleteWakeAuthorization, l as parseInteractionEnvelope, ln as listAgentNetworks, lr as updateRepeatingSend, m as repeatStopCommand, mn as listEmailAttachmentArchiveMembers, mr as verifyAgentSignup, mt as cancelSentEmailByIdempotencyKey, nn as getThread, nr as startCliLogin, nt as AUTOMATED_FLAG_DESCRIPTION, o as REPEAT_MAX_SENDS_MAX, on as listActivityObjects, or as updateDefaultNetworkMember, ot as automatedRejectedError, p as prepareSignalEmail, pn as listDomains, pr as verifyAgentClaim, pt as cancelSentEmail, qn as searchMemories, qt as getInboxStatus, rn as getWakeSchedule, rr as stopRepeatFromEmail, rt as AUTOMATED_VALUES, s as buildRepeatStopBody, sr as updateFunction, tn as getSentEmail, tr as startAgentSignup, tt as AUTOMATED_FILTER_UNSUPPORTED_CODE, u as parsePresenceEnvelope, ur as updateRoute, ut as hasAutomatedVerdict, vn as listFunctionLogs, vt as completeWebhookEvent, w as SINCE_VALUE_HELP, wn as listRepeatingSends, wt as createWakeSchedule, x as retryingOperation, xn as listKeys, xt as createKey, y as pauseForTransientFailure, yn as listFunctions, yt as createEndpoint, z as awaitingRejectedError, zn as reorderRoutes } from "../repeats-Dj_o6c-X-ChTwFlyB.js";
+import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-DcFHxUL9.js";
 import { A as AGENT_ADDRESS_ENV, C as saveCliCredentials, D as loadActiveChatState, E as deleteChatState, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadChatConversationByLocalId, P as agentProfileName, R as loadConnectedAgentProfile, S as resolveCliAuth, T as chatStatePath, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as loadCliCredentials, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as saveActiveChatState, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveSignupCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-Ms_0vNjq.js";
 import { C as resolveListenSubscription, S as normalizeListenOrigin, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, y as listenIdentity } from "../shared-mail-files-BAQSGxxz.js";
-import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-CI8tnGzz.js";
-import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-C4TDfZND.js";
+import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-D39TUEGF.js";
+import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-DVhJu-DF.js";
 import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, readWorkingLease, restoreAutoWorking } from "./auto-signals.js";
-import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-f5QeK45s.js";
+import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-CGgHQ_po.js";
 import { a as thrownErrorBody, i as runStreamingJson, n as guardJsonOutputCommands, r as jsonOutputRequested, t as JSON_OUTPUT_FLAG } from "../json-output-ch756TXV.js";
 import { a as backgroundListenStatus, c as runBackgroundListen, d as stopBackgroundListen, f as verifyBackgroundListenTarget, o as backgroundListenToken, r as backgroundListenConfiguration, u as startBackgroundListen } from "../listen-background-DyBYca28.js";
 import { ORG_SELECTION_ENV } from "./global-org-flag.js";
@@ -21769,7 +21769,7 @@ const openapiDocument = {
 		"/activity/objects": { "get": {
 			"operationId": "listActivityObjects",
 			"summary": "List what you created, or what you were asked",
-			"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules, rule requests and objections to rules over their mail (objections only on the dashboard or the Primitive CLI). Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, and the objections to rules they wrote, under their current membership, each naming the member who asked or objected in created_through. A key, an app or an agent has none, and gets both kinds in withheld.",
+			"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules, rule requests and objections to rules over their mail (objections only on the dashboard or the Primitive CLI). Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, and the objections to rules they wrote, under their current membership, each naming the member who asked or objected in created_through. A key, an app or an agent has none, and gets both kinds in withheld. With relation=concerning it lists instead what other members did that concerns the person's own mail: each time a rule started covering one of their mailboxes or saved a new version while covering it, named as the rule was then, naming its author in created_through, under their current membership; only on the dashboard or the Primitive CLI. A key, an app or an agent has none, and gets email_rule_coverage in withheld. A notice never reads as ended.",
 			"tags": ["Activity"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [
@@ -21777,19 +21777,23 @@ const openapiDocument = {
 					"name": "relation",
 					"in": "query",
 					"required": false,
-					"description": "created (the default) or asked.",
+					"description": "created (the default), asked or concerning.",
 					"schema": {
 						"default": "created",
-						"description": "created (the default): what you created. asked: what other members asked of you, open or answered: rule requests made to you, and objections to rules you wrote. asked is for a person's own view only, and kind may then name only email_rule_request and email_rule_objection.",
+						"description": "created (the default): what you created. asked: what other members asked of you, open or answered: rule requests made to you, and objections to rules you wrote; kind may then name only email_rule_request and email_rule_objection. concerning: what other members did that concerns your own mail: a rule that started covering one of your mailboxes, or saved a new version while covering it (email_rule_coverage, the only kind it takes). asked and concerning are for a person's own view only.",
 						"type": "string",
-						"enum": ["created", "asked"]
+						"enum": [
+							"created",
+							"asked",
+							"concerning"
+						]
 					}
 				},
 				{
 					"name": "kind",
 					"in": "query",
 					"required": false,
-					"description": "Only these kinds, comma-separated: function, endpoint, function_trigger, pull_subscription, recipient_route, filter_rule, wake_schedule, repeating_send, scheduled_send, api_key, agent_connection, email_rule, email_rule_request, email_rule_objection. Defaults to every kind the caller can have created (a person's own kinds only for a person). With relation=asked, only email_rule_request and email_rule_objection, which are also the default.",
+					"description": "Only these kinds, comma-separated: function, endpoint, function_trigger, pull_subscription, recipient_route, filter_rule, wake_schedule, repeating_send, scheduled_send, api_key, agent_connection, email_rule, email_rule_request, email_rule_objection, email_rule_coverage. Defaults to every kind the caller can have created (a person's own kinds only for a person). With relation=asked, only email_rule_request and email_rule_objection, which are also the default; with relation=concerning, only email_rule_coverage, the default. email_rule_coverage is listed only with relation=concerning.",
 					"schema": {
 						"type": "string",
 						"minLength": 1,
@@ -23067,7 +23071,7 @@ const openapiDocument = {
 		"/emails/{id}/rule-results": { "get": {
 			"operationId": "listEmailRuleResults",
 			"summary": "List every rule's result on an email",
-			"description": "What each rule you can see decided about this email (matched, not matched, or not run), in the words of the deciding version. A do_not_share rule that matched it blocks sharing while active; earlier shares stay. Only a caller who can read the email gets an answer. classification is every fact the classifier read, as rule conditions read it. At most 50 rules are listed, results first; not_listed counts the rest. Another member's rule that decided on your own mail is listed read_only (dashboard and CLI only); hidden counts deciding rules you cannot see. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "What each rule you can see decided about this email (matched, not matched, or not run), in the words of the deciding version. A do_not_share rule that matched it blocks sharing while active; earlier shares stay. Only a caller who can read the email gets an answer. classification is every fact the classifier read, as rule conditions read it. At most 50 rules are listed, results first; not_listed counts the rest. Another member's rule that decided on your own mail is listed read_only (dashboard and CLI only), with who receives what it shares (receivers) while it covers you; hidden counts deciding rules you cannot see. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -24841,7 +24845,7 @@ const openapiDocument = {
 		"/email-rules/covering-me": { "get": {
 			"operationId": "listEmailRulesCoveringMe",
 			"summary": "List the rules over your mail",
-			"description": "Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). You do not see the other inboxes and domains its scope names, its saved expectations, or the keys, shares and webhooks that use it. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+			"description": "Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, and the member each belongs to, or the organization. You do not see which keys, webhooks or shares they are (no ids, names, prefixes or URLs), the other inboxes and domains its scope names, or its saved expectations. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
 			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -24939,7 +24943,7 @@ const openapiDocument = {
 		"/email-rules/covering-me/{id}": { "get": {
 			"operationId": "getEmailRuleCoveringMe",
 			"summary": "Get a rule over your mail",
-			"description": "One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). You do not see the other inboxes and domains its scope names, its saved expectations, or the keys, shares and webhooks that use it. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+			"description": "One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, and the member each belongs to, or the organization. You do not see which keys, webhooks or shares they are (no ids, names, prefixes or URLs), the other inboxes and domains its scope names, or its saved expectations. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
 			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -46444,8 +46448,8 @@ const openapiDocument = {
 						"description": "HTTP status code returned by the endpoint"
 					},
 					"body": {
-						"type": "string",
-						"description": "Response body (truncated to 1000 characters)"
+						"description": "The receiver response text, only with organization-wide mail.raw:read. Null without that access because a receiver can echo a raw download link.",
+						"type": ["string", "null"]
 					},
 					"signature": {
 						"type": "string",
@@ -50223,16 +50227,16 @@ const openapiDocument = {
 							"properties": {
 								"kind": {
 									"type": "string",
-									"description": "One of: function, endpoint, function_trigger, pull_subscription, recipient_route, filter_rule, wake_schedule, repeating_send, scheduled_send, api_key, agent_connection, email_rule, email_rule_request, email_rule_objection."
+									"description": "One of: function, endpoint, function_trigger, pull_subscription, recipient_route, filter_rule, wake_schedule, repeating_send, scheduled_send, api_key, agent_connection, email_rule, email_rule_request, email_rule_objection, email_rule_coverage."
 								},
 								"id": { "type": "string" },
 								"name": {
-									"description": "The name the object is known by: an endpoint's display name, a route's or filter's pattern, a Function's name, a send's From address, a wake schedule's command and the address it wakes, an API key's name, an agent's address, a rule's or rule request's name, and for an objection the name its rule had when the objection was made. Never a webhook URL and never mail content.",
+									"description": "The name the object is known by: an endpoint's display name, a route's or filter's pattern, a Function's name, a send's From address, a wake schedule's command and the address it wakes, an API key's name, an agent's address, a rule's or rule request's name, and for an objection or a coverage notice the name its rule had then. Never a webhook URL and never mail content.",
 									"type": ["string", "null"]
 								},
 								"state": {
 									"type": "string",
-									"description": "Where it stands now: enabled, disabled, deleted or replaced (endpoints and routes), enabled or disabled (filters, wake schedules), live, suspended or deleted (Functions), active, paused or ended (repeating sends), scheduled (scheduled sends), active, suspended, expired or revoked (API keys), pending, claimed, connected or revoked (agents), draft, observe or active (email rules), pending, accepted, declined or withdrawn (rule requests and objections)."
+									"description": "Where it stands now: enabled, disabled, deleted or replaced (endpoints and routes), enabled or disabled (filters, wake schedules), live, suspended or deleted (Functions), active, paused or ended (repeating sends), scheduled (scheduled sends), active, suspended, expired or revoked (API keys), pending, claimed, connected or revoked (agents), draft, observe or active (email rules), pending, accepted, declined or withdrawn (rule requests and objections), and for a coverage notice what it told: started (a rule began covering your mailbox), new_version, or baseline (it already covered you when notices began)."
 								},
 								"created_at": {
 									"type": "string",
@@ -50246,21 +50250,21 @@ const openapiDocument = {
 								"owned_now": {
 									"type": "string",
 									"enum": ["you", "someone_else"],
-									"description": "you: it is still yours: never transferred, or transferred back to you. someone_else: it was transferred and another person holds it now, or, with relation=asked, another member made it."
+									"description": "you: it is still yours: never transferred, or transferred back to you. someone_else: it was transferred and another person holds it now, or, with relation=asked or concerning, another member made it."
 								},
 								"created_through": {
 									"type": "object",
 									"properties": {
 										"kind": {
 											"type": "string",
-											"description": "The kind of credential it was created through: org_key, function_key, connected_key, oauth, agent_delegate or member (the person themselves). With relation=asked, member: the member who asked or objected."
+											"description": "The kind of credential it was created through: org_key, function_key, connected_key, oauth, agent_delegate or member (the person themselves). With relation=asked, member: the member who asked or objected; with relation=concerning, member: the rule's author."
 										},
 										"id": {
-											"description": "In a person's view, the person's own user id for member, and an API key's id where they may read their keys (for a person limited to their own keys, only a key they still hold). Null otherwise, and always null in one credential's view, where it is the calling credential itself. With relation=asked, the user id of the member who asked or objected.",
+											"description": "In a person's view, the person's own user id for member, and an API key's id where they may read their keys (for a person limited to their own keys, only a key they still hold). Null otherwise, and always null in one credential's view, where it is the calling credential itself. With relation=asked, the user id of the member who asked or objected; with relation=concerning, of the rule's author.",
 											"type": ["string", "null"]
 										},
 										"name": {
-											"description": "In a person's view, what that credential of theirs is called: an app login by its app, an API key by its name, an agent's key by its address. Null otherwise, and for the person themselves. With relation=asked, the name of the member who asked or objected.",
+											"description": "In a person's view, what that credential of theirs is called: an app login by its app, an API key by its name, an agent's key by its address. Null otherwise, and for the person themselves. With relation=asked, the name of the member who asked or objected; with relation=concerning, of the rule's author.",
 											"type": ["string", "null"]
 										}
 									},
@@ -52264,7 +52268,7 @@ const openapiDocument = {
 						}
 					},
 					"warnings": {
-						"description": "The compile response's warnings. Stored as sent.",
+						"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
 						"maxItems": 10,
 						"type": "array",
 						"items": {
@@ -52546,7 +52550,7 @@ const openapiDocument = {
 						}
 					},
 					"warnings": {
-						"description": "The compile response's warnings. Stored as sent.",
+						"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
 						"maxItems": 10,
 						"type": "array",
 						"items": {
@@ -52803,6 +52807,144 @@ const openapiDocument = {
 					"email"
 				]
 			},
+			"EmailRuleReceivers": {
+				"type": "object",
+				"properties": {
+					"keys": {
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"owner": { "anyOf": [{
+									"type": "object",
+									"properties": {
+										"kind": {
+											"type": "string",
+											"const": "member"
+										},
+										"user_id": {
+											"type": "string",
+											"description": "The member's user id.",
+											"format": "uuid"
+										},
+										"name": {
+											"description": "Their name; null when they have none set.",
+											"type": ["string", "null"]
+										}
+									},
+									"required": [
+										"kind",
+										"user_id",
+										"name"
+									]
+								}, {
+									"type": "object",
+									"properties": { "kind": {
+										"type": "string",
+										"const": "organization",
+										"description": "Held by no member: an organization key, or one whose holder has left."
+									} },
+									"required": ["kind"]
+								}] },
+								"count": {
+									"type": "integer",
+									"exclusiveMinimum": 0
+								}
+							},
+							"required": ["owner", "count"]
+						},
+						"description": "API keys that work now (not revoked, expired or suspended) whose access lists the rule, or its live share: they read what it matches. Owner: the member who holds each, or the organization."
+					},
+					"webhooks": {
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"owner": { "anyOf": [{
+									"type": "object",
+									"properties": {
+										"kind": {
+											"type": "string",
+											"const": "member"
+										},
+										"user_id": {
+											"type": "string",
+											"description": "The member's user id.",
+											"format": "uuid"
+										},
+										"name": {
+											"description": "Their name; null when they have none set.",
+											"type": ["string", "null"]
+										}
+									},
+									"required": [
+										"kind",
+										"user_id",
+										"name"
+									]
+								}, {
+									"type": "object",
+									"properties": { "kind": {
+										"type": "string",
+										"const": "organization",
+										"description": "Held by no member: an organization key, or one whose holder has left."
+									} },
+									"required": ["kind"]
+								}] },
+								"count": {
+									"type": "integer",
+									"exclusiveMinimum": 0
+								}
+							},
+							"required": ["owner", "count"]
+						},
+						"description": "Webhooks that are sent what it matches: those whose key, as delivery acts as it, lists the rule or its live share (owner: the member who holds that key, or the organization), and the webhooks of the member the rule is shared with (owner: that member)."
+					},
+					"shares": {
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"beneficiary": {
+									"type": "object",
+									"properties": {
+										"kind": {
+											"type": "string",
+											"const": "member"
+										},
+										"user_id": {
+											"type": "string",
+											"description": "The member's user id.",
+											"format": "uuid"
+										},
+										"name": {
+											"description": "Their name; null when they have none set.",
+											"type": ["string", "null"]
+										}
+									},
+									"required": [
+										"kind",
+										"user_id",
+										"name"
+									]
+								},
+								"count": {
+									"type": "integer",
+									"exclusiveMinimum": 0
+								}
+							},
+							"required": ["beneficiary", "count"]
+						},
+						"description": "The rule's live share, if it has one (a rule is shared at most once): the member it gives what it matches to."
+					}
+				},
+				"required": [
+					"keys",
+					"webhooks",
+					"shares"
+				],
+				"description": "Who receives what the rule shares now, by person and count; empty unless it is an active grant rule."
+			},
 			"ListEmailRuleResultsResult": {
 				"type": "object",
 				"properties": {
@@ -52969,6 +53111,10 @@ const openapiDocument = {
 								"author": {
 									"description": "With read_only: who wrote it.",
 									"$ref": "#/components/schemas/EmailRuleCoveringAuthor"
+								},
+								"receivers": {
+									"description": "With read_only: who receives what it shares; null unless it covers you now.",
+									"anyOf": [{ "$ref": "#/components/schemas/EmailRuleReceivers" }, { "type": "null" }]
 								}
 							},
 							"required": [
@@ -53259,7 +53405,7 @@ const openapiDocument = {
 						}
 					},
 					"warnings": {
-						"description": "The compile response's warnings. Stored as sent.",
+						"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
 						"maxItems": 10,
 						"type": "array",
 						"items": {
@@ -53313,7 +53459,16 @@ const openapiDocument = {
 					"warnings": {
 						"type": "array",
 						"items": { "type": "string" },
-						"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+						"description": "As the member who asked sent them, normally from their compile, then every compiler note on the rule's tree and words they lack. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+					},
+					"server_explanation": {
+						"description": "What the rule as asked actually does: Primitive's own reading of the request's tree, never the words of the member who asked or of a model. Null when the tree no longer reads as one.",
+						"type": ["string", "null"]
+					},
+					"server_notes": {
+						"description": "Primitive's own notes on the rule as asked, worked out from its tree and description each time the request is read, and to the member asked while pending, how to test it on look-alikes. Unlike warnings, never written by the member who asked, though a note can quote their words or tree values.",
+						"type": "array",
+						"items": { "type": "string" }
 					},
 					"compiled_by": { "type": "string" },
 					"vocabulary": { "type": "string" },
@@ -53360,7 +53515,7 @@ const openapiDocument = {
 						"type": ["boolean", "null"]
 					},
 					"notice": {
-						"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+						"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 						"type": ["string", "null"]
 					},
 					"target_can_accept": {
@@ -53479,7 +53634,16 @@ const openapiDocument = {
 					"warnings": {
 						"type": "array",
 						"items": { "type": "string" },
-						"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+						"description": "As the member who asked sent them, normally from their compile, then every compiler note on the rule's tree and words they lack. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+					},
+					"server_explanation": {
+						"description": "What the rule as asked actually does: Primitive's own reading of the request's tree, never the words of the member who asked or of a model. Null when the tree no longer reads as one.",
+						"type": ["string", "null"]
+					},
+					"server_notes": {
+						"description": "Primitive's own notes on the rule as asked, worked out from its tree and description each time the request is read, and to the member asked while pending, how to test it on look-alikes. Unlike warnings, never written by the member who asked, though a note can quote their words or tree values.",
+						"type": "array",
+						"items": { "type": "string" }
 					},
 					"compiled_by": { "type": "string" },
 					"vocabulary": { "type": "string" },
@@ -53526,7 +53690,7 @@ const openapiDocument = {
 						"type": ["boolean", "null"]
 					},
 					"notice": {
-						"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+						"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 						"type": ["string", "null"]
 					}
 				},
@@ -53854,7 +54018,7 @@ const openapiDocument = {
 						}
 					},
 					"warnings": {
-						"description": "The compile response's warnings. Stored as sent.",
+						"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
 						"maxItems": 10,
 						"type": "array",
 						"items": {
@@ -54225,6 +54389,10 @@ const openapiDocument = {
 						"type": ["integer", "null"],
 						"exclusiveMinimum": 0
 					},
+					"receivers": {
+						"description": "Null when it could not be read in time; try again.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleReceivers" }, { "type": "null" }]
+					},
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -54239,6 +54407,7 @@ const openapiDocument = {
 					"is_author",
 					"covers",
 					"current_version",
+					"receivers",
 					"created_at"
 				]
 			},
@@ -54308,6 +54477,10 @@ const openapiDocument = {
 						"exclusiveMinimum": 0,
 						"description": "Null when covers_now is false."
 					},
+					"receivers": {
+						"description": "Null when covers_now is false (who receives it now is not about your mail), or when it could not be read in time.",
+						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleReceivers" }, { "type": "null" }]
+					},
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -54334,6 +54507,7 @@ const openapiDocument = {
 					"is_author",
 					"covers",
 					"current_version",
+					"receivers",
 					"created_at",
 					"covers_now",
 					"current"
@@ -63070,6 +63244,32 @@ function formatAskedRows(items, complete = false) {
 	const line = (cells) => cells.map((cell, i) => i === cells.length - 1 ? cell : cell.padEnd(widths[i] ?? 0)).join("  ");
 	return [line(header), ...rows.map(line)].join("\n");
 }
+/**
+* One line per coverage notice: what it told (started, new_version, or
+* baseline for a rule that already covered you when notices began), when, the
+* rule's name then, and its author. No id: a notice's id is not a rule's, and
+* no command takes it. `complete` says the listing is the whole of it (from
+* the first page to the last, nothing withheld), the only time an empty one
+* means no notice has been written for you.
+*/
+function formatConcerningRows(items, complete = false) {
+	if (items.length === 0) return complete ? "No other member's rule has covered your mail since these notices began." : "Nothing to show.";
+	const rows = items.map((item) => [
+		item.state,
+		minute(item.created_at),
+		item.name ?? "(unnamed)",
+		item.created_through.name ?? item.created_through.id ?? ""
+	]);
+	const header = [
+		"NOTICE",
+		"WHEN (UTC)",
+		"RULE",
+		"AUTHOR"
+	];
+	const widths = header.map((h, i) => Math.max(h.length, ...rows.map((row) => (row[i] ?? "").length)));
+	const line = (cells) => cells.map((cell, i) => i === cells.length - 1 ? cell : cell.padEnd(widths[i] ?? 0)).join("  ");
+	return [line(header), ...rows.map(line)].join("\n");
+}
 /** What was left out, and why: no counts, only the kinds and what would show them. */
 function formatWithheld(withheld) {
 	if (withheld.length === 0) return null;
@@ -63090,7 +63290,7 @@ function resumeCommand(bin, flags, cursor, subcommand = "created") {
 		`--cursor ${shellWord(cursor)}`
 	].join(" ");
 }
-/** List one page, or every page with --all, of what the caller created or was asked. */
+/** List one page, or every page with --all, of what the caller created, was asked, or what concerns their mail. */
 async function runActivityList(command, flags, relation) {
 	const auth = await createAuthenticatedCliApiClient({
 		apiKey: flags["api-key"],
@@ -63105,7 +63305,7 @@ async function runActivityList(command, flags, relation) {
 		const result = await call$1(listActivityObjects({
 			client: auth.apiClient.client,
 			query: {
-				...relation === "asked" ? { relation } : {},
+				...relation !== "created" ? { relation } : {},
 				state: flags.state,
 				limit: flags.limit,
 				...flags.kind ? { kind: flags.kind } : {},
@@ -63139,7 +63339,8 @@ async function runActivityList(command, flags, relation) {
 		}, null, 2));
 		return;
 	}
-	command.log(relation === "asked" ? formatAskedRows(items, flags.state === "all" && !flags.cursor && !cursor && withheld.length === 0) : formatActivityRows(covers, items));
+	const complete = flags.state === "all" && !flags.cursor && !cursor && withheld.length === 0;
+	command.log(relation === "asked" ? formatAskedRows(items, complete) : relation === "concerning" ? formatConcerningRows(items, complete) : formatActivityRows(covers, items));
 	const notShown = formatWithheld(withheld);
 	if (notShown) command.log(`\n${notShown}`);
 	if (cursor) command.log(`\nMore: ${resumeCommand(command.config.bin, flags, cursor, relation)}`);
@@ -63221,6 +63422,33 @@ var ActivityAskedCommand = class ActivityAskedCommand extends Command {
 		await runActivityList(this, flags, "asked");
 	}
 };
+var ActivityConcerningCommand = class ActivityConcerningCommand extends Command {
+	static description = `List what other members did that concerns your own mail, newest first: each time another member's rule started covering one of your mailboxes (started), or saved a new version while covering it (new_version), named as the rule was then, with its author. A rule that already covered you when these notices began is listed once as baseline.
+
+  Signed in with \`primitive login\`, you see the notices about your own mail under your current membership. A key, an app or an agent has none. The rules that cover you now, with their ids, are listed by \`primitive email-rule-oversight list-email-rules-covering-me\`; ask a rule's author to turn it off with \`primitive email-rule-oversight create-email-rule-objection --rule-id <rule-id>\`. With --json each item's id is the notice's, not the rule's.`;
+	static summary = "List rules that started covering your mail or changed";
+	static examples = ["<%= config.bin %> activity concerning", "<%= config.bin %> activity concerning --all --json"];
+	static flags = {
+		"api-key": API_KEY_FLAG$3,
+		"api-base-url": API_BASE_URL_FLAG$4,
+		limit: Flags.integer({
+			description: "Notices per page, 1 to 200.",
+			min: 1,
+			max: 200,
+			default: DEFAULT_LIMIT$3
+		}),
+		cursor: Flags.string({ description: "Resume from a next_cursor an earlier page printed." }),
+		all: Flags.boolean({ description: `Follow every page (at most 50).` }),
+		json: Flags.boolean({ description: "Print the answer as JSON." })
+	};
+	async run() {
+		const { flags } = await this.parse(ActivityConcerningCommand);
+		await runActivityList(this, {
+			...flags,
+			state: "all"
+		}, "concerning");
+	}
+};
 // src/oclif/agent-mail-check.ts
 /**
 * One check for mail that arrived since this profile's previous check. It is
@@ -73379,8 +73607,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^3.0.0-preview.10";
-const CLI_VERSION_RANGE = "^3.0.0-preview.10";
+const SDK_VERSION_RANGE = "^3.0.0-preview.11";
+const CLI_VERSION_RANGE = "^3.0.0-preview.11";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -89053,6 +89281,7 @@ const COMMANDS = {
 	"org:use": OrgUseCommand,
 	"cli:list-cli-orgs": OrgsCommand,
 	"activity:asked": ActivityAskedCommand,
+	"activity:concerning": ActivityConcerningCommand,
 	"activity:created": ActivityCreatedCommand,
 	"keys:list": KeysListCommand,
 	"keys:get": KeysGetCommand,

package/dist/oclif/receiver-heal.js

@@ -1,7 +1,7 @@
 import { N as agentProfileDirectory, P as agentProfileName, R as loadConnectedAgentProfile, j as AGENT_PROFILE_ENV } from "../cli-config-Ms_0vNjq.js";
 import { a as backgroundListenStatus, i as backgroundListenRestartable, s as claimBackgroundListenRestart, t as BACKGROUND_LISTEN_RELAUNCH_ENV } from "../listen-background-DyBYca28.js";
-import { d as SESSION_UUID, t as notificationScope } from "../notify-session-DN8tSfAi.js";
-import { Lt as detectAgentRuntime } from "../api-command-D0KHkqhA.js";
+import { d as SESSION_UUID, t as notificationScope } from "../notify-session-DcFHxUL9.js";
+import { Lt as detectAgentRuntime } from "../api-command-CkMEFiBL.js";
 import { d as readMailJson } from "../shared-mail-files-BAQSGxxz.js";
 import { join } from "node:path";
 import { spawn } from "node:child_process";