primcli 3.0.0-preview.10 → 3.0.0-preview.12

package/dist/{api-command-D0KHkqhA.js → api-command-CNCsVNk0.js}

@@ -1,4 +1,4 @@
-import { B as ensureSearchReportsReplyState, Ht as getEmail, J as SENT_EMAIL_EVENT_TYPES, K as replyStateSurfaceForOperation, L as ReplyStateUnsupportedError, R as assertAwaitingFilterRows, W as isAwaitingRejectedError, Wn as sdk_gen_exports, Y as WEBHOOK_EVENT_TYPES, Zt as getOwnGrant, at as automatedRejectedError, ct as expectedAutomatedVerdicts, gn as listEndpoints, it as assertAutomatedVerdict, ot as automatedSurfaceForOperation, q as EMAIL_RULE_REQUEST_EVENT_TYPES, rt as AutomatedFilterUnsupportedError, st as ensureSearchReportsAutomated, tn as getThread, ut as isAutomatedRejectedError, v as parseRetryAfter, z as awaitingRejectedError } from "./repeats-Dj_o6c-X-CDaE-kdZ.js";
+import { B as ensureSearchReportsReplyState, Gn as sdk_gen_exports, J as EMAIL_RULE_REQUEST_EVENT_TYPES, K as replyStateSurfaceForOperation, L as ReplyStateUnsupportedError, Qt as getOwnGrant, R as assertAwaitingFilterRows, Ut as getEmail, W as isAwaitingRejectedError, X as WEBHOOK_EVENT_TYPES, Y as SENT_EMAIL_EVENT_TYPES, _n as listEndpoints, at as assertAutomatedVerdict, ct as ensureSearchReportsAutomated, dt as isAutomatedRejectedError, it as AutomatedFilterUnsupportedError, lt as expectedAutomatedVerdicts, nn as getThread, ot as automatedRejectedError, q as EMAIL_RULE_OBJECTION_EVENT_TYPES, st as automatedSurfaceForOperation, v as parseRetryAfter, z as awaitingRejectedError } from "./repeats-Dj_o6c-X-wjmw2Jbx.js";
 import { C as saveCliCredentials, F as agentProfilesDirectory, H as requireDefaultLoginProfile, N as agentProfileDirectory, R as loadConnectedAgentProfile, S as resolveCliAuth, W as PrimitiveApiClient, _ as deleteCliCredentials, b as loadCliCredentials, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, i as loadCliConfig, j as AGENT_PROFILE_ENV, m as cliAccessTokenExpiresAt, p as acquireCliCredentialsLock, w as saveSignupCredentials, x as normalizeApiBaseUrl, y as detectPrimitiveKeyEnvMisname } from "./cli-config-Ms_0vNjq.js";
 import "./oclif/global-org-flag.js";
 import { a as thrownErrorBody } from "./json-output-ch756TXV.js";
@@ -780,7 +780,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-activity-objects",
-		"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules, rule requests and objections to rules over their mail (objections only on the dashboard or the Primitive CLI). Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, and the objections to rules they wrote, under their current membership, each naming the member who asked or objected in created_through. A key, an app or an agent has none, and gets both kinds in withheld.",
+		"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules, rule requests and objections to rules over their mail (objections only on the dashboard or the Primitive CLI). Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, and the objections to rules they wrote, under their current membership, each naming the member who asked or objected in created_through. A key, an app or an agent has none, and gets both kinds in withheld. With relation=concerning it lists instead what other members did that concerns the person's own mail: each time a rule started covering one of their mailboxes or saved a new version while covering it, named as the rule was then, naming its author in created_through, under their current membership; only on the dashboard or the Primitive CLI. A key, an app or an agent has none, and gets email_rule_coverage in withheld. A notice never reads as ended. Notices are written by a periodic job and can lag: until the notices record a rule starting to cover you, the first page lists that rule as pending (pending_complete says whether that check finished), and as_of says about when the notices last looked. For what covers you now, read GET /email-rules/covering-me.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listActivityObjects",
@@ -789,14 +789,18 @@ const operationManifest = [
 		"queryParams": [
 			{
 				"default": "created",
-				"description": "created (the default) or asked.",
-				"enum": ["created", "asked"],
+				"description": "created (the default), asked or concerning.",
+				"enum": [
+					"created",
+					"asked",
+					"concerning"
+				],
 				"name": "relation",
 				"required": false,
 				"type": "string"
 			},
 			{
-				"description": "Only these kinds, comma-separated: function, endpoint, function_trigger, pull_subscription, recipient_route, filter_rule, wake_schedule, repeating_send, scheduled_send, api_key, agent_connection, email_rule, email_rule_request, email_rule_objection. Defaults to every kind the caller can have created (a person's own kinds only for a person). With relation=asked, only email_rule_request and email_rule_objection, which are also the default.",
+				"description": "Only these kinds, comma-separated: function, endpoint, function_trigger, pull_subscription, recipient_route, filter_rule, wake_schedule, repeating_send, scheduled_send, api_key, agent_connection, email_rule, email_rule_request, email_rule_objection, email_rule_coverage. Defaults to every kind the caller can have created (a person's own kinds only for a person). With relation=asked, only email_rule_request and email_rule_objection, which are also the default; with relation=concerning, only email_rule_coverage, the default. email_rule_coverage is listed only with relation=concerning.",
 				"enum": null,
 				"name": "kind",
 				"required": false,
@@ -816,7 +820,7 @@ const operationManifest = [
 			},
 			{
 				"default": 50,
-				"description": "Objects per page, from 1 to 200; defaults to 50.",
+				"description": "Objects per page, from 1 to 200; defaults to 50. With relation=concerning the first page may also hold pending items beyond it.",
 				"enum": null,
 				"maximum": 200,
 				"minimum": 1,
@@ -850,16 +854,16 @@ const operationManifest = [
 						"properties": {
 							"kind": {
 								"type": "string",
-								"description": "One of: function, endpoint, function_trigger, pull_subscription, recipient_route, filter_rule, wake_schedule, repeating_send, scheduled_send, api_key, agent_connection, email_rule, email_rule_request, email_rule_objection."
+								"description": "One of: function, endpoint, function_trigger, pull_subscription, recipient_route, filter_rule, wake_schedule, repeating_send, scheduled_send, api_key, agent_connection, email_rule, email_rule_request, email_rule_objection, email_rule_coverage."
 							},
 							"id": { "type": "string" },
 							"name": {
-								"description": "The name the object is known by: an endpoint's display name, a route's or filter's pattern, a Function's name, a send's From address, a wake schedule's command and the address it wakes, an API key's name, an agent's address, a rule's or rule request's name, and for an objection the name its rule had when the objection was made. Never a webhook URL and never mail content.",
+								"description": "The name the object is known by: an endpoint's display name, a route's or filter's pattern, a Function's name, a send's From address, a wake schedule's command and the address it wakes, an API key's name, an agent's address, a rule's or rule request's name, and for an objection or a coverage notice the name its rule had then. Never a webhook URL and never mail content.",
 								"type": ["string", "null"]
 							},
 							"state": {
 								"type": "string",
-								"description": "Where it stands now: enabled, disabled, deleted or replaced (endpoints and routes), enabled or disabled (filters, wake schedules), live, suspended or deleted (Functions), active, paused or ended (repeating sends), scheduled (scheduled sends), active, suspended, expired or revoked (API keys), pending, claimed, connected or revoked (agents), draft, observe or active (email rules), pending, accepted, declined or withdrawn (rule requests and objections)."
+								"description": "Where it stands now: enabled, disabled, deleted or replaced (endpoints and routes), enabled or disabled (filters, wake schedules), live, suspended or deleted (Functions), active, paused or ended (repeating sends), scheduled (scheduled sends), active, suspended, expired or revoked (API keys), pending, claimed, connected or revoked (agents), draft, observe or active (email rules), pending, accepted, declined or withdrawn (rule requests and objections), and for a coverage notice what it told: started (a rule began covering your mailbox), new_version, or baseline (it already covered you when notices began). pending: a rule started covering your mailbox and the notices have not recorded that start yet (a restart within an hour of the last start notice is recorded without a new one); its id is then the rule's, and created_at when the rule last changed."
 							},
 							"created_at": {
 								"type": "string",
@@ -873,21 +877,21 @@ const operationManifest = [
 							"owned_now": {
 								"type": "string",
 								"enum": ["you", "someone_else"],
-								"description": "you: it is still yours: never transferred, or transferred back to you. someone_else: it was transferred and another person holds it now, or, with relation=asked, another member made it."
+								"description": "you: it is still yours: never transferred, or transferred back to you. someone_else: it was transferred and another person holds it now, or, with relation=asked or concerning, another member made it."
 							},
 							"created_through": {
 								"type": "object",
 								"properties": {
 									"kind": {
 										"type": "string",
-										"description": "The kind of credential it was created through: org_key, function_key, connected_key, oauth, agent_delegate or member (the person themselves). With relation=asked, member: the member who asked or objected."
+										"description": "The kind of credential it was created through: org_key, function_key, connected_key, oauth, agent_delegate or member (the person themselves). With relation=asked, member: the member who asked or objected; with relation=concerning, member: the rule's author."
 									},
 									"id": {
-										"description": "In a person's view, the person's own user id for member, and an API key's id where they may read their keys (for a person limited to their own keys, only a key they still hold). Null otherwise, and always null in one credential's view, where it is the calling credential itself. With relation=asked, the user id of the member who asked or objected.",
+										"description": "In a person's view, the person's own user id for member, and an API key's id where they may read their keys (for a person limited to their own keys, only a key they still hold). Null otherwise, and always null in one credential's view, where it is the calling credential itself. With relation=asked, the user id of the member who asked or objected; with relation=concerning, of the rule's author.",
 										"type": ["string", "null"]
 									},
 									"name": {
-										"description": "In a person's view, what that credential of theirs is called: an app login by its app, an API key by its name, an agent's key by its address. Null otherwise, and for the person themselves. With relation=asked, the name of the member who asked or objected.",
+										"description": "In a person's view, what that credential of theirs is called: an app login by its app, an API key by its name, an agent's key by its address. Null otherwise, and for the person themselves. With relation=asked, the name of the member who asked or objected; with relation=concerning, of the rule's author.",
 										"type": ["string", "null"]
 									}
 								},
@@ -938,6 +942,15 @@ const operationManifest = [
 				"next_cursor": {
 					"description": "Pass as cursor to read the next page; null on the last page. A page can hold fewer items than limit, or none, while next_cursor is set.",
 					"type": ["string", "null"]
+				},
+				"as_of": {
+					"type": ["string", "null"],
+					"format": "date-time",
+					"description": "With relation=concerning only: about when the notices last looked at your organization; null if never or unread. Coverage since may have no notice yet."
+				},
+				"pending_complete": {
+					"description": "With relation=concerning, on the first page only: whether the check for rules that started covering you without their start notice (state pending, listed ahead of the notices and beyond limit) was finished. false: some may be missing. Absent where there is nothing to check.",
+					"type": "boolean"
 				}
 			},
 			"required": [
@@ -6685,6 +6698,35 @@ const operationManifest = [
 													"format": "uuid",
 													"description": "With `group=message`: the send of this message, when you can read it (under a connected agent key, only its own sends)."
 												},
+												"imported": {
+													"type": ["object", "null"],
+													"description": "Historical acquisition; never sender or SMTP delivery proof. Null for live mail. Excluded from live tails and deltas.",
+													"required": [
+														"from",
+														"method",
+														"verification",
+														"at"
+													],
+													"properties": {
+														"from": {
+															"type": "string",
+															"enum": ["google_workspace"]
+														},
+														"method": {
+															"type": "string",
+															"enum": ["primitive_direct"]
+														},
+														"verification": {
+															"type": "string",
+															"enum": ["provider_fetched"]
+														},
+														"at": {
+															"type": "string",
+															"format": "date-time",
+															"description": "When Primitive acquired this historical message."
+														}
+													}
+												},
 												"snippet": {
 													"type": ["string", "null"],
 													"maxLength": 200,
@@ -6707,6 +6749,7 @@ const operationManifest = [
 												"automated_reasons",
 												"from_verified",
 												"from_header_email",
+												"imported",
 												"snippet"
 											]
 										}, {
@@ -9469,7 +9512,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-key",
-		"description": "One key's metadata, never its secret, with whether it works now (status). A revoked key whose record is kept is answered too, with status revoked, revoked_at and revoked_by, under the same access rules as a key that works: one the caller may not read is 404, revoked or not. Its grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. A rule the key lists that reads nothing any more (a deleted rule, or a share that ended) is listed under grant.mail_scope.ended_rules, each with its id and reason (rule_deleted or share_ended), and not under rules. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
+		"description": "One key's metadata, never its secret, with whether it works now (status). A revoked key whose record is kept is answered too, with status revoked, revoked_at and revoked_by, under the same access rules as a key that works: one the caller may not read is 404, revoked or not. Its grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. A rule the key lists that reads nothing any more (a deleted rule, or a share that ended) is listed under grant.mail_scope.ended_rules, each with its id and reason (rule_deleted or share_ended), and not under rules. grant.mail_scope.rule_versions gives each rule it lists directly its current_version, state and version_saved_at. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getKey",
@@ -9562,6 +9605,24 @@ const operationManifest = [
 				"rotated_to": {
 					"description": "The id of the newest key rotated from this key that the caller may read; null until it is rotated, or when the caller may read no key rotated from it. A revoked one is still named: GET /v1/keys/{id} answers it.",
 					"type": ["string", "null"]
+				},
+				"address_warnings": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"address": { "type": "string" },
+							"reason": { "type": "string" },
+							"description": { "type": "string" }
+						},
+						"required": [
+							"address",
+							"reason",
+							"description"
+						],
+						"additionalProperties": {}
+					},
+					"description": "Notes on the key's grant, worked out from it on every read: whole_mailbox, an address or domain listed beside email rules, which the key reads in full; no_send_address, with address empty, a key that can send but lists only email rules. The notes that need the organization's mailboxes and domains (member_address, unowned_domain) are given only when the grant is written. Only rules not deleted and shares not ended count. Empty, or absent, for a key on a template, and empty for a revoked key."
 				}
 			},
 			"required": [
@@ -10296,6 +10357,24 @@ const operationManifest = [
 									"agent_address",
 									"person"
 								]
+							},
+							"address_warnings": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"address": { "type": "string" },
+										"reason": { "type": "string" },
+										"description": { "type": "string" }
+									},
+									"required": [
+										"address",
+										"reason",
+										"description"
+									],
+									"additionalProperties": {}
+								},
+								"description": "Notes on the key's grant, worked out from it on every read: whole_mailbox, an address or domain listed beside email rules, which the key reads in full; no_send_address, with address empty, a key that can send but lists only email rules. The notes that need the organization's mailboxes and domains (member_address, unowned_domain) are given only when the grant is written. Only rules not deleted and shares not ended count. Empty, or absent, for a key on a template, and empty for a revoked key."
 							}
 						},
 						"required": [
@@ -10335,7 +10414,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-keys",
-		"description": "Key metadata, never a secret: name, prefix, grant, creator, last use, expiry, suspension and whether each key works now (status). Revoked keys are left out unless include_revoked is true, which lists them too with status revoked, revoked_at and revoked_by, under the same access rules as keys that work. A grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. A rule the key lists that reads nothing any more (a deleted rule, or a share that ended) is listed under grant.mail_scope.ended_rules, each with its id and reason (rule_deleted or share_ended), and not under rules. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
+		"description": "Key metadata, never a secret: name, prefix, grant, creator, last use, expiry, suspension and whether each key works now (status). Revoked keys are left out unless include_revoked is true, which lists them too with status revoked, revoked_at and revoked_by, under the same access rules as keys that work. A grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. A rule the key lists that reads nothing any more (a deleted rule, or a share that ended) is listed under grant.mail_scope.ended_rules, each with its id and reason (rule_deleted or share_ended), and not under rules. grant.mail_scope.rule_versions gives each rule it lists directly its current_version, state and version_saved_at. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listKeys",
@@ -10439,6 +10518,24 @@ const operationManifest = [
 							"rotated_to": {
 								"description": "The id of the newest key rotated from this key that the caller may read; null until it is rotated, or when the caller may read no key rotated from it. A revoked one is still named: GET /v1/keys/{id} answers it.",
 								"type": ["string", "null"]
+							},
+							"address_warnings": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"address": { "type": "string" },
+										"reason": { "type": "string" },
+										"description": { "type": "string" }
+									},
+									"required": [
+										"address",
+										"reason",
+										"description"
+									],
+									"additionalProperties": {}
+								},
+								"description": "Notes on the key's grant, worked out from it on every read: whole_mailbox, an address or domain listed beside email rules, which the key reads in full; no_send_address, with address empty, a key that can send but lists only email rules. The notes that need the organization's mailboxes and domains (member_address, unowned_domain) are given only when the grant is written. Only rules not deleted and shares not ended count. Empty, or absent, for a key on a template, and empty for a revoked key."
 							}
 						},
 						"required": [
@@ -12951,7 +13048,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "accept-email-rule-objection",
-		"description": "Accepts a pending objection to a rule you wrote: turns the rule off (state draft), as updating it would, and records the objection accepted, together. You can turn the rule on again later. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+		"description": "Accepts a pending objection to a rule you wrote: turns the rule off (state draft), as updating it would, and records the objection accepted, together. You can turn the rule on again later. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": false,
 		"method": "POST",
 		"operationId": "acceptEmailRuleObjection",
@@ -13088,7 +13185,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "create-email-rule-objection",
-		"description": "Asks the author of a rule that covers one of your own mailboxes now to turn it off. Only a rule that covers you now: one you see only because it once decided on your mail cannot be objected to. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. You may have one pending objection per rule and 50 in all, and object to the same rule again only 10 minutes after you last did, whatever became of it. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+		"description": "Asks the author of a rule that covers one of your own mailboxes now to turn it off. Only a rule that covers you now: one you see only because it once decided on your mail cannot be objected to. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. You may have one pending objection per rule and 50 in all, and object to the same rule again only 10 minutes after you last did, whatever became of it. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "createEmailRuleObjection",
@@ -13236,7 +13333,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "decline-email-rule-objection",
-		"description": "Declines a pending objection to a rule you wrote, optionally saying why; the rule stays as it is. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+		"description": "Declines a pending objection to a rule you wrote, optionally saying why; the rule stays as it is. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "declineEmailRuleObjection",
@@ -13382,7 +13479,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-email-rule-covering-me",
-		"description": "One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). You do not see the other inboxes and domains its scope names, its saved expectations, or the keys, shares and webhooks that use it. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+		"description": "One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getEmailRuleCoveringMe",
@@ -13478,6 +13575,157 @@ const operationManifest = [
 					"exclusiveMinimum": 0,
 					"description": "Null when covers_now is false."
 				},
+				"receivers": {
+					"description": "Null when covers_now is false (who receives it now is not about your mail), or when it could not be read in time.",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"keys": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"owner": { "anyOf": [{
+											"type": "object",
+											"properties": {
+												"kind": {
+													"type": "string",
+													"const": "member"
+												},
+												"user_id": {
+													"type": "string",
+													"description": "The member's user id.",
+													"format": "uuid"
+												},
+												"name": {
+													"description": "Their name; null when they have none set.",
+													"type": ["string", "null"]
+												}
+											},
+											"required": [
+												"kind",
+												"user_id",
+												"name"
+											]
+										}, {
+											"type": "object",
+											"properties": { "kind": {
+												"type": "string",
+												"const": "organization",
+												"description": "Held by no member: an organization key, or one whose holder has left."
+											} },
+											"required": ["kind"]
+										}] },
+										"count": {
+											"type": "integer",
+											"exclusiveMinimum": 0
+										}
+									},
+									"required": ["owner", "count"]
+								},
+								"description": "API keys that work now (not revoked, expired or suspended) and hold mail:read, whose access lists the rule or its live share. Owner: who holds each, or the organization."
+							},
+							"webhooks": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"owner": { "anyOf": [{
+											"type": "object",
+											"properties": {
+												"kind": {
+													"type": "string",
+													"const": "member"
+												},
+												"user_id": {
+													"type": "string",
+													"description": "The member's user id.",
+													"format": "uuid"
+												},
+												"name": {
+													"description": "Their name; null when they have none set.",
+													"type": ["string", "null"]
+												}
+											},
+											"required": [
+												"kind",
+												"user_id",
+												"name"
+											]
+										}, {
+											"type": "object",
+											"properties": { "kind": {
+												"type": "string",
+												"const": "organization",
+												"description": "Held by no member: an organization key, or one whose holder has left."
+											} },
+											"required": ["kind"]
+										}] },
+										"count": {
+											"type": "integer",
+											"exclusiveMinimum": 0
+										},
+										"hosts": {
+											"description": "Distinct sites they deliver to (a host's registrable domain, or a tunnel, preview or function service alone), sorted, at most 10; \"unknown host\" (last) for any that cannot be named.",
+											"type": "array",
+											"items": { "type": "string" }
+										},
+										"hosts_not_listed": {
+											"description": "Hosts past those listed.",
+											"type": "integer",
+											"minimum": 0
+										}
+									},
+									"required": ["owner", "count"]
+								},
+								"description": "Webhooks taking received mail, bounces or reports that are sent what it matches: those of the key delivery acts as, when it lists the rule or its live share (owner: its holder, or the organization), and those of the member it is shared with (owner: that member)."
+							},
+							"shares": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"beneficiary": {
+											"type": "object",
+											"properties": {
+												"kind": {
+													"type": "string",
+													"const": "member"
+												},
+												"user_id": {
+													"type": "string",
+													"description": "The member's user id.",
+													"format": "uuid"
+												},
+												"name": {
+													"description": "Their name; null when they have none set.",
+													"type": ["string", "null"]
+												}
+											},
+											"required": [
+												"kind",
+												"user_id",
+												"name"
+											]
+										},
+										"count": {
+											"type": "integer",
+											"exclusiveMinimum": 0
+										}
+									},
+									"required": ["beneficiary", "count"]
+								},
+								"description": "The rule's live share (at most one), by its member, if they can read it and it is among their newest 20 shares."
+							}
+						},
+						"required": [
+							"keys",
+							"webhooks",
+							"shares"
+						],
+						"description": "Who receives what the rule shares now, by person and count; empty unless it is an active grant rule."
+					}, { "type": "null" }]
+				},
 				"created_at": {
 					"type": "string",
 					"format": "date-time"
@@ -13570,6 +13818,7 @@ const operationManifest = [
 				"is_author",
 				"covers",
 				"current_version",
+				"receivers",
 				"created_at",
 				"covers_now",
 				"current"
@@ -13584,7 +13833,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-email-rule-objection",
-		"description": "One objection you can see. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+		"description": "One objection you can see. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getEmailRuleObjection",
@@ -13715,7 +13964,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rule-decisions-on-my-mail",
-		"description": "What a rule that covers your mailboxes, or decided on your mail, decided about mail at your own mailboxes, newest first: never about anyone else's mail. Each decision is in the words of the version that made it, which can be earlier than the current one: the questions it asked about that email (question_answers) and the columns its conditions read (parts). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+		"description": "What a rule that covers your mailboxes, or decided on your mail, decided about mail at your own mailboxes, newest first: never about anyone else's mail. Each decision is in the words of the version that made it, which can be earlier than the current one: the questions it asked about that email (question_answers) and the columns its conditions read (parts). Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRuleDecisionsOnMyMail",
@@ -13838,7 +14087,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rule-objections",
-		"description": "Objections you made, objections to rules you wrote, or every objection you can see, newest first. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+		"description": "Objections you made, objections to rules you wrote, or every objection you can see, newest first. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRuleObjections",
@@ -14008,7 +14257,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rules-covering-me",
-		"description": "Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). You do not see the other inboxes and domains its scope names, its saved expectations, or the keys, shares and webhooks that use it. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+		"description": "Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRulesCoveringMe",
@@ -14108,6 +14357,157 @@ const operationManifest = [
 						"type": ["integer", "null"],
 						"exclusiveMinimum": 0
 					},
+					"receivers": {
+						"description": "Null when it could not be read in time; try again.",
+						"anyOf": [{
+							"type": "object",
+							"properties": {
+								"keys": {
+									"type": "array",
+									"items": {
+										"type": "object",
+										"properties": {
+											"owner": { "anyOf": [{
+												"type": "object",
+												"properties": {
+													"kind": {
+														"type": "string",
+														"const": "member"
+													},
+													"user_id": {
+														"type": "string",
+														"description": "The member's user id.",
+														"format": "uuid"
+													},
+													"name": {
+														"description": "Their name; null when they have none set.",
+														"type": ["string", "null"]
+													}
+												},
+												"required": [
+													"kind",
+													"user_id",
+													"name"
+												]
+											}, {
+												"type": "object",
+												"properties": { "kind": {
+													"type": "string",
+													"const": "organization",
+													"description": "Held by no member: an organization key, or one whose holder has left."
+												} },
+												"required": ["kind"]
+											}] },
+											"count": {
+												"type": "integer",
+												"exclusiveMinimum": 0
+											}
+										},
+										"required": ["owner", "count"]
+									},
+									"description": "API keys that work now (not revoked, expired or suspended) and hold mail:read, whose access lists the rule or its live share. Owner: who holds each, or the organization."
+								},
+								"webhooks": {
+									"type": "array",
+									"items": {
+										"type": "object",
+										"properties": {
+											"owner": { "anyOf": [{
+												"type": "object",
+												"properties": {
+													"kind": {
+														"type": "string",
+														"const": "member"
+													},
+													"user_id": {
+														"type": "string",
+														"description": "The member's user id.",
+														"format": "uuid"
+													},
+													"name": {
+														"description": "Their name; null when they have none set.",
+														"type": ["string", "null"]
+													}
+												},
+												"required": [
+													"kind",
+													"user_id",
+													"name"
+												]
+											}, {
+												"type": "object",
+												"properties": { "kind": {
+													"type": "string",
+													"const": "organization",
+													"description": "Held by no member: an organization key, or one whose holder has left."
+												} },
+												"required": ["kind"]
+											}] },
+											"count": {
+												"type": "integer",
+												"exclusiveMinimum": 0
+											},
+											"hosts": {
+												"description": "Distinct sites they deliver to (a host's registrable domain, or a tunnel, preview or function service alone), sorted, at most 10; \"unknown host\" (last) for any that cannot be named.",
+												"type": "array",
+												"items": { "type": "string" }
+											},
+											"hosts_not_listed": {
+												"description": "Hosts past those listed.",
+												"type": "integer",
+												"minimum": 0
+											}
+										},
+										"required": ["owner", "count"]
+									},
+									"description": "Webhooks taking received mail, bounces or reports that are sent what it matches: those of the key delivery acts as, when it lists the rule or its live share (owner: its holder, or the organization), and those of the member it is shared with (owner: that member)."
+								},
+								"shares": {
+									"type": "array",
+									"items": {
+										"type": "object",
+										"properties": {
+											"beneficiary": {
+												"type": "object",
+												"properties": {
+													"kind": {
+														"type": "string",
+														"const": "member"
+													},
+													"user_id": {
+														"type": "string",
+														"description": "The member's user id.",
+														"format": "uuid"
+													},
+													"name": {
+														"description": "Their name; null when they have none set.",
+														"type": ["string", "null"]
+													}
+												},
+												"required": [
+													"kind",
+													"user_id",
+													"name"
+												]
+											},
+											"count": {
+												"type": "integer",
+												"exclusiveMinimum": 0
+											}
+										},
+										"required": ["beneficiary", "count"]
+									},
+									"description": "The rule's live share (at most one), by its member, if they can read it and it is among their newest 20 shares."
+								}
+							},
+							"required": [
+								"keys",
+								"webhooks",
+								"shares"
+							],
+							"description": "Who receives what the rule shares now, by person and count; empty unless it is an active grant rule."
+						}, { "type": "null" }]
+					},
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -14122,6 +14522,7 @@ const operationManifest = [
 					"is_author",
 					"covers",
 					"current_version",
+					"receivers",
 					"created_at"
 				]
 			}
@@ -14135,7 +14536,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "withdraw-email-rule-objection",
-		"description": "Withdraws a pending objection you made, and clears its message. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+		"description": "Withdraws a pending objection you made, and clears its message. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": false,
 		"method": "POST",
 		"operationId": "withdrawEmailRuleObjection",
@@ -14272,7 +14673,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "accept-email-rule-request",
-		"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked: each email in full with its attachments, but never raw. It does not go back through mail already received. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Before accepting, test it on your mail: pass the request's tree to POST /v1/email-rules/test. To try it on an email that has not arrived, pass the request's tree to POST /v1/email-rules/test-sample with one you make up, or have look-alikes written (POST /v1/email-rules/look-alikes with request_id); neither stores anything. expectation_samples are kept on the rule it writes. Accepting also needs mail:share_own. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked: each email in full with its attachments, but never raw. It does not go back through mail already received. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Before accepting, test it on your mail: pass the request's tree to POST /v1/email-rules/test. To try it on an email that has not arrived, pass the request's tree to POST /v1/email-rules/test-sample with one you make up, or have look-alikes written (POST /v1/email-rules/look-alikes with request_id); neither stores anything. expectation_samples are kept on the rule it writes. Accepting also needs mail:share_own. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "acceptEmailRuleRequest",
@@ -14356,7 +14757,7 @@ const operationManifest = [
 					}
 				},
 				"warnings": {
-					"description": "The compile response's warnings. Stored as sent.",
+					"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
 					"maxItems": 10,
 					"type": "array",
 					"items": {
@@ -14390,6 +14791,30 @@ const operationManifest = [
 						"required": ["checked", "matched"]
 					}, { "type": "null" }]
 				},
+				"conditions_breadth": {
+					"description": "Ignored.",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"checked": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+							},
+							"matched": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Of those, how many they hold for (for a do-not-share rule, one they cannot decide counts)."
+							}
+						},
+						"required": ["checked", "matched"]
+					}, { "type": "null" }]
+				},
+				"kind": {
+					"description": "Only grant.",
+					"type": "string",
+					"const": "grant"
+				},
 				"expectation_samples": {
 					"description": "Made-up emails the rule must match or not, such as look-alikes it must never match, kept on the rule this accept writes.",
 					"minItems": 1,
@@ -14558,7 +14983,16 @@ const operationManifest = [
 						"warnings": {
 							"type": "array",
 							"items": { "type": "string" },
-							"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+							"description": "As the member who asked sent them, normally from their compile, then every compiler note on the rule's tree and words they lack. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+						},
+						"server_explanation": {
+							"description": "What the rule as asked actually does: Primitive's own reading of the request's tree, never the words of the member who asked or of a model. Null when the tree no longer reads as one.",
+							"type": ["string", "null"]
+						},
+						"server_notes": {
+							"description": "Primitive's own notes on the rule as asked, worked out from its tree and description each time the request is read, and to the member asked while pending, how to test it on look-alikes. Unlike warnings, never written by the member who asked, though a note can quote their words or tree values.",
+							"type": "array",
+							"items": { "type": "string" }
 						},
 						"compiled_by": { "type": "string" },
 						"vocabulary": { "type": "string" },
@@ -14655,7 +15089,7 @@ const operationManifest = [
 							"type": ["boolean", "null"]
 						},
 						"notice": {
-							"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+							"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 							"type": ["string", "null"]
 						}
 					},
@@ -15058,7 +15492,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "check-email-rule-request-target",
-		"description": "Says, before you ask, whether a member could accept a rule request now under their role, and if not, which permission their role lacks. Nothing is sent and nothing is recorded. Needs members:read, as listing members and their roles does. At most 60 checks an hour. Name them by user id, or by their member mailbox address or verified work email (counted with asking: at most 30 lookups by address an hour). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Says, before you ask, whether a member could accept a rule request now under their role, and if not, which permission their role lacks. Nothing is sent and nothing is recorded. Needs members:read, as listing members and their roles does. At most 60 checks an hour. Name them by user id, or by their member mailbox address or verified work email (counted with asking: at most 30 lookups by address an hour). Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "checkEmailRuleRequestTarget",
@@ -15140,7 +15574,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "compile-email-rule",
-		"description": "Turns a plain-English description of which received emails to match into a rule tree over the column contract, with an explanation of what it matches, the assumptions made, and warnings for what the columns cannot express. Where the columns fall short it adds up to five yes/no questions, asked only after the conditions match; they read the subject, the new text and attachment file names, never attachment contents. Nothing is saved. For a rule with no questions, breadth counts, read only, how much of your recent classified mail its conditions match. include_sql returns the SQL it renders to. kind do_not_share compiles for recall. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Turns a plain-English description of which received emails to match into a rule tree over the column contract, with an explanation of what it matches, the assumptions made, and warnings for what the columns cannot express. Where the columns fall short it adds up to five yes/no questions, asked only after the conditions match; they read the subject, the new text and attachment file names, never attachment contents. Nothing is saved. For a rule with no questions, breadth counts, read only, how much of your recent classified mail its conditions match; for a grant rule with questions, conditions_breadth counts its conditions alone. include_sql returns the SQL it renders to. kind do_not_share compiles for recall. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "compileEmailRule",
@@ -15223,12 +15657,17 @@ const operationManifest = [
 				"warnings": {
 					"type": "array",
 					"items": { "type": "string" },
-					"description": "Parts of the description the column contract cannot express, and how the rule handles them. It also has notes on reading automated, from_mailing_list or sender_relationship, a sender address the description does not give, and a grant worded as a prohibition. When the rule has no questions and its conditions hold for all of the caller's recent classified mail (what a test of it covers by default), or for at least 90% of at least 20 emails, the first warning says so. That count is not made for a caller whose access shows headers only, or who could not run a test of the rule, and may also be skipped when the compile ran long or the count fails."
+					"description": "Parts of the description the column contract cannot express, how the rule handles them, and the compiler's own notes on the rule (the Email Rules docs list them). When the rule has no questions and its conditions hold for nearly all of your recent mail (see breadth), or it is a grant rule whose conditions alone hold for over 20% of at least 20 emails (see conditions_breadth), the first warning says so."
 				},
 				"compiled_by": {
 					"type": "string",
 					"description": "An opaque name for the version of the rule compiler that produced the rule, such as rule-compiler-v1. Send it back as compiled_by when you save the rule."
 				},
+				"kind": {
+					"description": "The kind it was compiled for. Send it with the tree to a test.",
+					"type": "string",
+					"enum": ["grant", "do_not_share"]
+				},
 				"breadth": {
 					"description": "How many of your recent emails its conditions hold for, counted over your own mailboxes whatever scope you save it with, warning or not. Null when not counted in full: a rule with questions, headers-only access, no test of it possible as you, or a count that failed or ran out of time. Writes ignore it, so a compile answer (without include_sql) can be sent back unchanged.",
 					"anyOf": [{
@@ -15248,6 +15687,25 @@ const operationManifest = [
 						"required": ["checked", "matched"]
 					}, { "type": "null" }]
 				},
+				"conditions_breadth": {
+					"description": "For a grant rule with questions, breadth counted on its conditions alone: the emails its questions are asked about. Null for any other rule, or when not counted in full (as breadth).",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"checked": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+							},
+							"matched": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Of those, how many they hold for (for a do-not-share rule, one they cannot decide counts)."
+							}
+						},
+						"required": ["checked", "matched"]
+					}, { "type": "null" }]
+				},
 				"sql": {
 					"description": "Present only when include_sql was true.",
 					"type": "object",
@@ -15282,7 +15740,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "create-email-rule",
-		"description": "Saves a rule as version 1 from a compile response or a tree you wrote, checked against the column contract. It starts in observe (recorded, nothing granted or blocked) unless state is draft, or active for a do_not_share rule. You are its author, and it never reaches mail you cannot read. evaluation_scope is own_mailboxes unless you name author or selected (scope_selection names only what you can read). expectations are judged in expectations_check. kind do_not_share blocks sharing what it matches; a key cannot list it (details.reason rule_blocks_sharing). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Saves a rule as version 1 from a compile response or a tree you wrote, checked against the column contract. It starts in observe (recorded, nothing granted or blocked) unless state is draft, or active for a do_not_share rule. You are its author, and it never reaches mail you cannot read. evaluation_scope is own_mailboxes unless you name author or selected (scope_selection names only what you can read). expectations are judged in expectations_check. kind do_not_share blocks sharing what it matches; a key cannot list it (details.reason rule_blocks_sharing). Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "createEmailRule",
@@ -15539,7 +15997,7 @@ const operationManifest = [
 					}
 				},
 				"warnings": {
-					"description": "The compile response's warnings. Stored as sent.",
+					"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
 					"maxItems": 10,
 					"type": "array",
 					"items": {
@@ -15572,6 +16030,25 @@ const operationManifest = [
 						},
 						"required": ["checked", "matched"]
 					}, { "type": "null" }]
+				},
+				"conditions_breadth": {
+					"description": "Ignored.",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"checked": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+							},
+							"matched": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Of those, how many they hold for (for a do-not-share rule, one they cannot decide counts)."
+							}
+						},
+						"required": ["checked", "matched"]
+					}, { "type": "null" }]
 				}
 			},
 			"required": [
@@ -15995,6 +16472,10 @@ const operationManifest = [
 						"endpoints",
 						"shares_ended"
 					]
+				},
+				"notice": {
+					"description": "After a write that saved a version of an active rule keys or webhooks read without checking it first: what it changes, and how to have the next one checked.",
+					"type": "string"
 				}
 			},
 			"required": [
@@ -16018,7 +16499,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "create-email-rule-request",
-		"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated or shared until they accept, and they may change the rule first. A message (up to 500 characters, fixed once sent) tells them why you ask. At most 5 pending requests to one member and 50 in all. With members:read the answer says whether they can accept it under their role (target_can_accept, target_warning); POST /v1/email-rule-requests/target-check checks first. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated or shared until they accept, and they may change the rule first. A message (up to 500 characters, fixed once sent) tells them why you ask. At most 5 pending requests to one member and 50 in all. With members:read the answer says whether they can accept it under their role (target_can_accept, target_warning); POST /v1/email-rule-requests/target-check checks first. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "createEmailRuleRequest",
@@ -16114,7 +16595,7 @@ const operationManifest = [
 					}
 				},
 				"warnings": {
-					"description": "The compile response's warnings. Stored as sent.",
+					"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
 					"maxItems": 10,
 					"type": "array",
 					"items": {
@@ -16147,6 +16628,30 @@ const operationManifest = [
 						},
 						"required": ["checked", "matched"]
 					}, { "type": "null" }]
+				},
+				"conditions_breadth": {
+					"description": "Ignored.",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"checked": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+							},
+							"matched": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Of those, how many they hold for (for a do-not-share rule, one they cannot decide counts)."
+							}
+						},
+						"required": ["checked", "matched"]
+					}, { "type": "null" }]
+				},
+				"kind": {
+					"description": "Only grant.",
+					"type": "string",
+					"const": "grant"
 				}
 			},
 			"required": [
@@ -16212,7 +16717,16 @@ const operationManifest = [
 				"warnings": {
 					"type": "array",
 					"items": { "type": "string" },
-					"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+					"description": "As the member who asked sent them, normally from their compile, then every compiler note on the rule's tree and words they lack. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+				},
+				"server_explanation": {
+					"description": "What the rule as asked actually does: Primitive's own reading of the request's tree, never the words of the member who asked or of a model. Null when the tree no longer reads as one.",
+					"type": ["string", "null"]
+				},
+				"server_notes": {
+					"description": "Primitive's own notes on the rule as asked, worked out from its tree and description each time the request is read, and to the member asked while pending, how to test it on look-alikes. Unlike warnings, never written by the member who asked, though a note can quote their words or tree values.",
+					"type": "array",
+					"items": { "type": "string" }
 				},
 				"compiled_by": { "type": "string" },
 				"vocabulary": { "type": "string" },
@@ -16309,7 +16823,7 @@ const operationManifest = [
 					"type": ["boolean", "null"]
 				},
 				"notice": {
-					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 					"type": ["string", "null"]
 				},
 				"target_can_accept": {
@@ -16353,7 +16867,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "decline-email-rule-request",
-		"description": "Declines a pending request made to you. Nothing is written but the decision and, if you give one, its reason (reason, up to 500 characters), which the member who asked sees with the request. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Declines a pending request made to you. Nothing is written but the decision and, if you give one, its reason (reason, up to 500 characters), which the member who asked sees with the request. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "declineEmailRuleRequest",
@@ -16441,7 +16955,16 @@ const operationManifest = [
 				"warnings": {
 					"type": "array",
 					"items": { "type": "string" },
-					"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+					"description": "As the member who asked sent them, normally from their compile, then every compiler note on the rule's tree and words they lack. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+				},
+				"server_explanation": {
+					"description": "What the rule as asked actually does: Primitive's own reading of the request's tree, never the words of the member who asked or of a model. Null when the tree no longer reads as one.",
+					"type": ["string", "null"]
+				},
+				"server_notes": {
+					"description": "Primitive's own notes on the rule as asked, worked out from its tree and description each time the request is read, and to the member asked while pending, how to test it on look-alikes. Unlike warnings, never written by the member who asked, though a note can quote their words or tree values.",
+					"type": "array",
+					"items": { "type": "string" }
 				},
 				"compiled_by": { "type": "string" },
 				"vocabulary": { "type": "string" },
@@ -16538,7 +17061,7 @@ const operationManifest = [
 					"type": ["boolean", "null"]
 				},
 				"notice": {
-					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 					"type": ["string", "null"]
 				}
 			},
@@ -16574,7 +17097,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "delete-email-rule",
-		"description": "Deletes a rule with its versions, its decisions and the access it granted. A share of it ends (end_reason rule_deleted), and the member who shared can still list what it handed over. The answer lists the shares it ended (ended_shares) and the unrevoked keys that still list it, which now read nothing through it (keys, other_keys; left out when they could not be read). The author or a reader of all the organization's mail may delete it; while it is shared, only the author or someone who manages members from the dashboard. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Deletes a rule with its versions, its decisions and the access it granted. A share of it ends (end_reason rule_deleted), and the member who shared can still list what it handed over. The answer lists the shares it ended (ended_shares) and the unrevoked keys that still list it, which now read nothing through it (keys, other_keys; left out when they could not be read). The author or a reader of all the organization's mail may delete it; while it is shared, only the author or someone who manages members from the dashboard. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": false,
 		"method": "DELETE",
 		"operationId": "deleteEmailRule",
@@ -16639,7 +17162,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "delete-email-rule-request",
-		"description": "Deletes a request you withdrew, for everyone who could see it. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Deletes a request you withdrew, for everyone who could see it. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": false,
 		"method": "DELETE",
 		"operationId": "deleteEmailRuleRequest",
@@ -16706,7 +17229,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "generate-look-alikes",
-		"description": "Writes made-up emails that come close to what a grant rule describes, and reports what the rule decides for each, as test-sample would. Most should not match (expected no_match): business near misses from its senders and topic (kind other: an all-clear, a reply with nothing new, a related document, another subject) and private mail (a personal medical bill, pay for named people, a personal purchase, personal banking or tax). By default a third, rounded down, are near cases it should match (expected match, kind other). failed means the rule decided one against expected. Nothing is stored and no mail is read. Keep them, with their expected, with add_expectation_samples, or for a request with the accept's expectation_samples. Limited to 20 an hour per member. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Writes made-up emails that come close to what a grant rule describes, and reports what the rule decides for each, as test-sample would. Most should not match (expected no_match): business near misses from its senders and topic (kind other: an all-clear, a reply with nothing new, a related document, another subject) and private mail (a personal medical bill, pay for named people, a personal purchase, personal banking or tax). By default a third, rounded down, are near cases it should match (expected match, kind other). failed means the rule decided one against expected. Nothing is stored and no mail is read. Keep them, with their expected, with add_expectation_samples, or for a request with the accept's expectation_samples. Limited to 20 an hour per member. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "generateLookAlikes",
@@ -16858,7 +17381,16 @@ const operationManifest = [
 							"type": ["integer", "null"],
 							"exclusiveMinimum": 0
 						},
-						"vocabulary": { "type": "string" }
+						"vocabulary": { "type": "string" },
+						"kind": {
+							"description": "The kind it was tested as.",
+							"type": "string",
+							"enum": ["grant", "do_not_share"]
+						},
+						"note": {
+							"description": "Present when a tree was sent without kind, so it was tested as grant.",
+							"type": "string"
+						}
 					},
 					"required": [
 						"id",
@@ -17026,7 +17558,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-email-rule",
-		"description": "A rule, its scope (evaluation_scope, and scope_selection for a selected rule), its current version and its saved expectations. The current version's text (english, tree, explanation, assumptions, warnings) is under current, and current_version is its number. What the scope comes to for its author now is GET /email-rules/{id}/scope. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "A rule, its scope (evaluation_scope, and scope_selection for a selected rule), its current version and its saved expectations. The current version's text (english, tree, explanation, assumptions, warnings) is under current, and current_version is its number. What the scope comes to for its author now is GET /email-rules/{id}/scope. The SQL the version renders to is included only when include_sql is true. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getEmailRule",
@@ -17384,7 +17916,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-email-rule-request",
-		"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. If you are the member asked, you can try the rule as proposed before answering: pass the request's tree to POST /v1/email-rules/test to test it on mail you have received. To try it on an email that has not arrived, pass the request's tree to POST /v1/email-rules/test-sample with one you make up, or have look-alikes written (POST /v1/email-rules/look-alikes with request_id); neither stores anything. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. If you are the member asked, you can try the rule as proposed before answering: pass the request's tree to POST /v1/email-rules/test to test it on mail you have received. To try it on an email that has not arrived, pass the request's tree to POST /v1/email-rules/test-sample with one you make up, or have look-alikes written (POST /v1/email-rules/look-alikes with request_id); neither stores anything. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getEmailRuleRequest",
@@ -17457,7 +17989,16 @@ const operationManifest = [
 				"warnings": {
 					"type": "array",
 					"items": { "type": "string" },
-					"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+					"description": "As the member who asked sent them, normally from their compile, then every compiler note on the rule's tree and words they lack. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+				},
+				"server_explanation": {
+					"description": "What the rule as asked actually does: Primitive's own reading of the request's tree, never the words of the member who asked or of a model. Null when the tree no longer reads as one.",
+					"type": ["string", "null"]
+				},
+				"server_notes": {
+					"description": "Primitive's own notes on the rule as asked, worked out from its tree and description each time the request is read, and to the member asked while pending, how to test it on look-alikes. Unlike warnings, never written by the member who asked, though a note can quote their words or tree values.",
+					"type": "array",
+					"items": { "type": "string" }
 				},
 				"compiled_by": { "type": "string" },
 				"vocabulary": { "type": "string" },
@@ -17554,7 +18095,7 @@ const operationManifest = [
 					"type": ["boolean", "null"]
 				},
 				"notice": {
-					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 					"type": ["string", "null"]
 				}
 			},
@@ -17590,7 +18131,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-email-rule-scope",
-		"description": "Whose mail the rule runs over, and what that comes to now: a rule never reaches further than what its author can read when it runs, so what a selected rule names and its author can no longer read stops matching. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Whose mail the rule runs over, and what that comes to now: a rule never reaches further than what its author can read when it runs, so what a selected rule names and its author can no longer read stops matching. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getEmailRuleScope",
@@ -17723,7 +18264,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-email-rule-share",
-		"description": "One share. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "One share. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getEmailRuleShare",
@@ -17906,7 +18447,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-email-rule-vocabulary",
-		"description": "What a rule tree you write yourself can say: each column of the current vocabulary with its type, source, meaning, operators and the value each takes, options, and whether it takes min_confidence; and the tree's limits, its stored size included. Built from the checks a saved or tested tree must pass. A tree is {version: tree_version, vocabulary: version, when, questions}. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "What a rule tree you write yourself can say: each column of the current vocabulary with its type, source, meaning, operators and the value each takes, options, and whether it takes min_confidence; and the tree's limits, its stored size included. Built from the checks a saved or tested tree must pass. A tree is {version: tree_version, vocabulary: version, when, questions}. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getEmailRuleVocabulary",
@@ -18080,7 +18621,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rule-decisions",
-		"description": "What the rule decided for each email it was evaluated against, newest first: whether it matched, whether it nearly did, how each part decided and the answers to its questions, with which email it was (from_address, subject, received_at). Only decisions on emails the caller can read are listed. With matched, only matches (true) or only the rest (false). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "What the rule decided for each email it was evaluated against, newest first: whether it matched, whether it nearly did, how each part decided and the answers to its questions, with which email it was (from_address, subject, received_at). Only decisions on emails the caller can read are listed. With matched, only matches (true) or only the rest (false). Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRuleDecisions",
@@ -18236,7 +18777,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rule-requests",
-		"description": "Rule requests, newest first: those made to you (box incoming, the default), those you made (outgoing), or every one you can see (all). Pending ones by default; status decided lists accepted, declined and withdrawn ones, and any lists both. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Rule requests, newest first: those made to you (box incoming, the default), those you made (outgoing), or every one you can see (all). Pending ones by default; status decided lists accepted, declined and withdrawn ones, and any lists both. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRuleRequests",
@@ -18347,7 +18888,16 @@ const operationManifest = [
 					"warnings": {
 						"type": "array",
 						"items": { "type": "string" },
-						"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+						"description": "As the member who asked sent them, normally from their compile, then every compiler note on the rule's tree and words they lack. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+					},
+					"server_explanation": {
+						"description": "What the rule as asked actually does: Primitive's own reading of the request's tree, never the words of the member who asked or of a model. Null when the tree no longer reads as one.",
+						"type": ["string", "null"]
+					},
+					"server_notes": {
+						"description": "Primitive's own notes on the rule as asked, worked out from its tree and description each time the request is read, and to the member asked while pending, how to test it on look-alikes. Unlike warnings, never written by the member who asked, though a note can quote their words or tree values.",
+						"type": "array",
+						"items": { "type": "string" }
 					},
 					"compiled_by": { "type": "string" },
 					"vocabulary": { "type": "string" },
@@ -18444,7 +18994,7 @@ const operationManifest = [
 						"type": ["boolean", "null"]
 					},
 					"notice": {
-						"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+						"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 						"type": ["string", "null"]
 					}
 				},
@@ -18481,7 +19031,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rule-results",
-		"description": "What each rule you can see decided about this email (matched, not matched, or not run), in the words of the deciding version. A do_not_share rule that matched it blocks sharing while active; earlier shares stay. Only a caller who can read the email gets an answer. classification is every fact the classifier read, as rule conditions read it. At most 50 rules are listed, results first; not_listed counts the rest. Another member's rule that decided on your own mail is listed read_only (dashboard and CLI only); hidden counts deciding rules you cannot see. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "What each rule you can see decided about this email (matched, not matched, or not run), in the words of the deciding version. A do_not_share rule that matched it blocks sharing while active; earlier shares stay. Only a caller who can read the email gets an answer. classification is every fact the classifier read, as rule conditions read it. At most 50 rules are listed, results first; not_listed counts the rest. Another member's rule that decided on your own mail is listed read_only (dashboard and CLI only), with who receives what it shares (receivers) while it covers you; hidden counts deciding rules you cannot see. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRuleResults",
@@ -18734,6 +19284,157 @@ const operationManifest = [
 									"name",
 									"email"
 								]
+							},
+							"receivers": {
+								"description": "With read_only: who receives what it shares; null unless it covers you now.",
+								"anyOf": [{
+									"type": "object",
+									"properties": {
+										"keys": {
+											"type": "array",
+											"items": {
+												"type": "object",
+												"properties": {
+													"owner": { "anyOf": [{
+														"type": "object",
+														"properties": {
+															"kind": {
+																"type": "string",
+																"const": "member"
+															},
+															"user_id": {
+																"type": "string",
+																"description": "The member's user id.",
+																"format": "uuid"
+															},
+															"name": {
+																"description": "Their name; null when they have none set.",
+																"type": ["string", "null"]
+															}
+														},
+														"required": [
+															"kind",
+															"user_id",
+															"name"
+														]
+													}, {
+														"type": "object",
+														"properties": { "kind": {
+															"type": "string",
+															"const": "organization",
+															"description": "Held by no member: an organization key, or one whose holder has left."
+														} },
+														"required": ["kind"]
+													}] },
+													"count": {
+														"type": "integer",
+														"exclusiveMinimum": 0
+													}
+												},
+												"required": ["owner", "count"]
+											},
+											"description": "API keys that work now (not revoked, expired or suspended) and hold mail:read, whose access lists the rule or its live share. Owner: who holds each, or the organization."
+										},
+										"webhooks": {
+											"type": "array",
+											"items": {
+												"type": "object",
+												"properties": {
+													"owner": { "anyOf": [{
+														"type": "object",
+														"properties": {
+															"kind": {
+																"type": "string",
+																"const": "member"
+															},
+															"user_id": {
+																"type": "string",
+																"description": "The member's user id.",
+																"format": "uuid"
+															},
+															"name": {
+																"description": "Their name; null when they have none set.",
+																"type": ["string", "null"]
+															}
+														},
+														"required": [
+															"kind",
+															"user_id",
+															"name"
+														]
+													}, {
+														"type": "object",
+														"properties": { "kind": {
+															"type": "string",
+															"const": "organization",
+															"description": "Held by no member: an organization key, or one whose holder has left."
+														} },
+														"required": ["kind"]
+													}] },
+													"count": {
+														"type": "integer",
+														"exclusiveMinimum": 0
+													},
+													"hosts": {
+														"description": "Distinct sites they deliver to (a host's registrable domain, or a tunnel, preview or function service alone), sorted, at most 10; \"unknown host\" (last) for any that cannot be named.",
+														"type": "array",
+														"items": { "type": "string" }
+													},
+													"hosts_not_listed": {
+														"description": "Hosts past those listed.",
+														"type": "integer",
+														"minimum": 0
+													}
+												},
+												"required": ["owner", "count"]
+											},
+											"description": "Webhooks taking received mail, bounces or reports that are sent what it matches: those of the key delivery acts as, when it lists the rule or its live share (owner: its holder, or the organization), and those of the member it is shared with (owner: that member)."
+										},
+										"shares": {
+											"type": "array",
+											"items": {
+												"type": "object",
+												"properties": {
+													"beneficiary": {
+														"type": "object",
+														"properties": {
+															"kind": {
+																"type": "string",
+																"const": "member"
+															},
+															"user_id": {
+																"type": "string",
+																"description": "The member's user id.",
+																"format": "uuid"
+															},
+															"name": {
+																"description": "Their name; null when they have none set.",
+																"type": ["string", "null"]
+															}
+														},
+														"required": [
+															"kind",
+															"user_id",
+															"name"
+														]
+													},
+													"count": {
+														"type": "integer",
+														"exclusiveMinimum": 0
+													}
+												},
+												"required": ["beneficiary", "count"]
+											},
+											"description": "The rule's live share (at most one), by its member, if they can read it and it is among their newest 20 shares."
+										}
+									},
+									"required": [
+										"keys",
+										"webhooks",
+										"shares"
+									],
+									"description": "Who receives what the rule shares now, by person and count; empty unless it is an active grant rule."
+								}, { "type": "null" }]
 							}
 						},
 						"required": [
@@ -18817,7 +19518,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rule-scope-options",
-		"description": "How much the caller can read, and the inboxes and domains the caller can read, which is what they may name when a rule runs over selected inboxes and domains. For a caller who reads the whole organization, addresses lists the inboxes known as someone's (member addresses, members' verified work emails at the organization's domains, agents' addresses and inboxes with shared access), not every address that receives mail: may_name_unlisted says when an address that is not listed, such as an inbox nobody has claimed, may be named too. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "How much the caller can read, and the inboxes and domains the caller can read, which is what they may name when a rule runs over selected inboxes and domains. For a caller who reads the whole organization, addresses lists the inboxes known as someone's (member addresses, members' verified work emails at the organization's domains, agents' addresses and inboxes with shared access), not every address that receives mail: may_name_unlisted says when an address that is not listed, such as an inbox nobody has claimed, may be named too. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRuleScopeOptions",
@@ -18927,6 +19628,34 @@ const operationManifest = [
 			"items": {
 				"type": "object",
 				"properties": {
+					"imported": {
+						"type": ["object", "null"],
+						"properties": {
+							"from": {
+								"type": "string",
+								"const": "google_workspace"
+							},
+							"method": {
+								"type": "string",
+								"const": "primitive_direct"
+							},
+							"verification": {
+								"type": "string",
+								"const": "provider_fetched"
+							},
+							"at": {
+								"type": "string",
+								"format": "date-time"
+							}
+						},
+						"required": [
+							"from",
+							"method",
+							"verification",
+							"at"
+						],
+						"default": null
+					},
 					"delivery_report": {
 						"type": ["object", "null"],
 						"properties": {
@@ -19164,6 +19893,7 @@ const operationManifest = [
 					}
 				},
 				"required": [
+					"imported",
 					"id",
 					"message_id",
 					"domain_id",
@@ -19202,7 +19932,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rule-shares",
-		"description": "Lists rules shared with you, rules you share, or every share you can see. A share is visible to its two people and the organization's owners and admins. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Lists rules shared with you, rules you share, or every share you can see. A share is visible to its two people and the organization's owners and admins. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRuleShares",
@@ -19424,7 +20154,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rule-versions",
-		"description": "A rule's versions as they were written: what each one's conditions and questions were, so a decision can be read against the version that made it. Without versions, every version newest first, a page at a time (meta.cursor). With versions, only those named, oldest first; numbers that are not versions of the rule are left out. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "A rule's versions as they were written: what each one's conditions and questions were, so a decision can be read against the version that made it. Without versions, every version newest first, a page at a time (meta.cursor). With versions, only those named, oldest first; numbers that are not versions of the rule are left out. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRuleVersions",
@@ -19562,7 +20292,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rules",
-		"description": "The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. Each carries its scope (evaluation_scope, and scope_selection for a selected rule) and current_version, but not the version's text: read that under current from GET /email-rules/{id}. With matched_email_id, only the rules that matched that email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. Each carries its scope (evaluation_scope, and scope_selection for a selected rule) and current_version, but not the version's text: read that under current from GET /email-rules/{id}. With matched_email_id, only the rules that matched that email. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRules",
@@ -19930,7 +20660,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "test-email-rule",
-		"description": "Runs a rule over received mail and reports what it would decide for each email (matched, near_miss, no_match, unclassified, skipped or not_found), with a summary of how each top-level condition and question decided. Test an unsaved tree, or a saved rule by rule_id (its current version, as its author). It reads only mail its author can read and its scope covers. Without email_ids it tests the newest emails, at most 200 and none older than 30 days, plus any expected ones. Unclassified emails over 2 hours old are classified first unless classify_missing is false. It records no decision and grants nothing, and stops at about 90 seconds. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Runs a rule over received mail and reports what it would decide for each email (matched, near_miss, no_match, unclassified, skipped or not_found), with a summary of how each top-level condition and question decided. Test an unsaved tree, or a saved rule by rule_id (its current version, as its author). It reads only mail its author can read and its scope covers. A rule you see only because it covers your own mailboxes runs as you, over only those, from the dashboard or the Primitive CLI. Without email_ids it tests the newest emails, at most 200 and none older than 30 days, plus any expected ones. Unclassified emails over 2 hours old are classified first unless classify_missing is false. It records no decision and grants nothing, and stops at about 90 seconds. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "testEmailRule",
@@ -20016,7 +20746,7 @@ const operationManifest = [
 					"description": "For a selected rule: inboxes, and domains (each address at them the author reads); each one you can read."
 				},
 				"rule_id": {
-					"description": "A saved rule you can see. Its current version is tested, with its author's access.",
+					"description": "A saved rule you can see. Its current version is tested, with its author's access; one you see only because it covers your mailboxes, with yours, over only those (dashboard or Primitive CLI only).",
 					"type": "string",
 					"format": "uuid"
 				},
@@ -20183,7 +20913,16 @@ const operationManifest = [
 							"type": ["integer", "null"],
 							"exclusiveMinimum": 0
 						},
-						"vocabulary": { "type": "string" }
+						"vocabulary": { "type": "string" },
+						"kind": {
+							"description": "The kind it was tested as.",
+							"type": "string",
+							"enum": ["grant", "do_not_share"]
+						},
+						"note": {
+							"description": "Present when a tree was sent without kind, so it was tested as grant.",
+							"type": "string"
+						}
 					},
 					"required": [
 						"id",
@@ -20708,7 +21447,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "test-email-rule-on-sample",
-		"description": "Reports what a rule would decide for an email you describe (sender, recipients, subject, plain text, attachment types; optionally automated, from a mailing list, and a spam score), classified and decided as received mail would be. A rule reading a spam score you gave none for decides on none (unset_columns). Nothing is stored. Test an unsaved tree or a saved rule by rule_id. The answer includes what the classifier read. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Reports what a rule would decide for an email you describe (sender, recipients, subject, plain text, attachment types; optionally automated, from a mailing list, and a spam score), classified and decided as received mail would be. A rule reading a spam score you gave none for decides on none (unset_columns). Nothing is stored. Test an unsaved tree or a saved rule by rule_id. The answer includes what the classifier read. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "testEmailRuleOnSample",
@@ -20906,7 +21645,16 @@ const operationManifest = [
 							"type": ["integer", "null"],
 							"exclusiveMinimum": 0
 						},
-						"vocabulary": { "type": "string" }
+						"vocabulary": { "type": "string" },
+						"kind": {
+							"description": "The kind it was tested as.",
+							"type": "string",
+							"enum": ["grant", "do_not_share"]
+						},
+						"note": {
+							"description": "Present when a tree was sent without kind, so it was tested as grant.",
+							"type": "string"
+						}
 					},
 					"required": [
 						"id",
@@ -21055,7 +21803,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "update-email-rule",
-		"description": "Renames the rule, saves a new version (english and tree together; earlier versions stay) or restores one (restore_version), changes its state (draft is off; observe; active), its scope (evaluation_scope, with scope_selection when selected) or its saved expectations (judged in expectations_check). Anyone but its author who sees it may only set state draft, and while it is shared only if they manage members from the dashboard. A scope change saves a new version; a shared rule keeps its scope, and a kind never changes. A saved version takes effect at once. if_version refuses a write once a version was saved since you read it; if_revision, once anything changed. Without if_expectations_pass a version is saved even when its expectations fail. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Renames the rule, saves a new version (english and tree together; earlier versions stay) or restores one (restore_version), changes its state (draft is off; observe; active), its scope (evaluation_scope, with scope_selection when selected) or its saved expectations (judged in expectations_check). Anyone but its author who sees it may only set state draft, and while it is shared only if they manage members from the dashboard. A scope change saves a new version; a shared rule keeps its scope, and a kind never changes. A saved version takes effect at once. if_version refuses a write once a version was saved since you read it; if_revision, once anything changed. Without if_expectations_pass a version is saved even when its expectations fail, except on an active rule keys or webhooks read: that write is checked first unless if_expectations_pass is false. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": true,
 		"method": "PATCH",
 		"operationId": "updateEmailRule",
@@ -21142,7 +21890,7 @@ const operationManifest = [
 					}
 				},
 				"warnings": {
-					"description": "The compile response's warnings. Stored as sent.",
+					"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
 					"maxItems": 10,
 					"type": "array",
 					"items": {
@@ -21176,6 +21924,30 @@ const operationManifest = [
 						"required": ["checked", "matched"]
 					}, { "type": "null" }]
 				},
+				"conditions_breadth": {
+					"description": "Ignored.",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"checked": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+							},
+							"matched": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Of those, how many they hold for (for a do-not-share rule, one they cannot decide counts)."
+							}
+						},
+						"required": ["checked", "matched"]
+					}, { "type": "null" }]
+				},
+				"kind": {
+					"description": "Must be the rule's own (400 kind_mismatch).",
+					"type": "string",
+					"enum": ["grant", "do_not_share"]
+				},
 				"evaluation_scope": {
 					"type": "string",
 					"enum": [
@@ -21458,7 +22230,7 @@ const operationManifest = [
 					"maximum": 2147483647
 				},
 				"if_expectations_pass": {
-					"description": "true: judge the rule as this write leaves it (new tree, restored version, new scope, or the version it activates) against the expectations it leaves, as POST /email-rules/test would, before saving; it can take as long as a test. Failed: 409 expectations_failed; on emails the rule cannot read: 409 expectations_unreadable; undecided: 409 expectations_undecided (each with details.expectations_check); none to judge: 400 no_expectations. Refused writes save nothing; a pass saves unless the rule moved meanwhile (409 email_rule_conflict). Only writes that save a version or activate the rule are judged.",
+					"description": "true: judge the rule as this write leaves it (new tree, restored version, new scope, or the version it activates) against the expectations it leaves, as POST /email-rules/test would, before saving; it can take as long as a test. Failed: 409 expectations_failed; on emails the rule cannot read: 409 expectations_unreadable; undecided: 409 expectations_undecided (each with details.expectations_check); none to judge: 400 no_expectations. Refused writes save nothing; a pass saves unless the rule moved meanwhile (409 email_rule_conflict). Only writes that save a version or activate the rule are judged. Omitted: judged as with true when the write saves a version or changes the scope of an active rule that API keys or webhooks read and that has expectations. false: never judged first.",
 					"type": "boolean"
 				},
 				"restore_version": {
@@ -21884,6 +22656,10 @@ const operationManifest = [
 						"endpoints",
 						"shares_ended"
 					]
+				},
+				"notice": {
+					"description": "After a write that saved a version of an active rule keys or webhooks read without checking it first: what it changes, and how to have the next one checked.",
+					"type": "string"
 				}
 			},
 			"required": [
@@ -21907,7 +22683,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "withdraw-email-rule-request",
-		"description": "Withdraws a pending request you made. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Withdraws a pending request you made. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": false,
 		"method": "POST",
 		"operationId": "withdrawEmailRuleRequest",
@@ -21986,7 +22762,16 @@ const operationManifest = [
 				"warnings": {
 					"type": "array",
 					"items": { "type": "string" },
-					"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+					"description": "As the member who asked sent them, normally from their compile, then every compiler note on the rule's tree and words they lack. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+				},
+				"server_explanation": {
+					"description": "What the rule as asked actually does: Primitive's own reading of the request's tree, never the words of the member who asked or of a model. Null when the tree no longer reads as one.",
+					"type": ["string", "null"]
+				},
+				"server_notes": {
+					"description": "Primitive's own notes on the rule as asked, worked out from its tree and description each time the request is read, and to the member asked while pending, how to test it on look-alikes. Unlike warnings, never written by the member who asked, though a note can quote their words or tree values.",
+					"type": "array",
+					"items": { "type": "string" }
 				},
 				"compiled_by": { "type": "string" },
 				"vocabulary": { "type": "string" },
@@ -22083,7 +22868,7 @@ const operationManifest = [
 					"type": ["boolean", "null"]
 				},
 				"notice": {
-					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 					"type": ["string", "null"]
 				}
 			},
@@ -22595,6 +23380,35 @@ const operationManifest = [
 								},
 								"description": "Attachment metadata for this message, each item as its own detail read reports it: `parsed.attachments` on `/emails/{id}` for inbound, `attachments` on `/sent-emails/{id}` for outbound, in the same order. Empty when there are none or an inbound message has no parsed content. No bytes or download URLs; download a part with `/emails/{id}/attachments/{part_index}` or `/sent-emails/{id}/attachments/{part_index}`."
 							},
+							"imported": {
+								"type": ["object", "null"],
+								"description": "Historical acquisition; never sender or SMTP delivery proof. Null for live mail. Excluded from live tails and deltas.",
+								"required": [
+									"from",
+									"method",
+									"verification",
+									"at"
+								],
+								"properties": {
+									"from": {
+										"type": "string",
+										"enum": ["google_workspace"]
+									},
+									"method": {
+										"type": "string",
+										"enum": ["primitive_direct"]
+									},
+									"verification": {
+										"type": "string",
+										"enum": ["provider_fetched"]
+									},
+									"at": {
+										"type": "string",
+										"format": "date-time",
+										"description": "When Primitive acquired this historical message."
+									}
+								}
+							},
 							"copies": {
 								"type": "array",
 								"items": {
@@ -23458,6 +24272,35 @@ const operationManifest = [
 						}
 					}
 				},
+				"imported": {
+					"type": ["object", "null"],
+					"description": "Historical acquisition; never sender or SMTP delivery proof. Null for live mail. Excluded from live tails and deltas.",
+					"required": [
+						"from",
+						"method",
+						"verification",
+						"at"
+					],
+					"properties": {
+						"from": {
+							"type": "string",
+							"enum": ["google_workspace"]
+						},
+						"method": {
+							"type": "string",
+							"enum": ["primitive_direct"]
+						},
+						"verification": {
+							"type": "string",
+							"enum": ["provider_fetched"]
+						},
+						"at": {
+							"type": "string",
+							"format": "date-time",
+							"description": "When Primitive acquired this historical message."
+						}
+					}
+				},
 				"snippet": {
 					"type": ["string", "null"],
 					"maxLength": 200,
@@ -23487,6 +24330,7 @@ const operationManifest = [
 				"from_verified",
 				"from_header_email",
 				"from_name",
+				"imported",
 				"snippet"
 			]
 		},
@@ -23547,6 +24391,7 @@ const operationManifest = [
 			"type": "object",
 			"description": "What an inbound email says, as plain text, with the fields that identify it.",
 			"required": [
+				"imported",
 				"id",
 				"thread_id",
 				"received_at",
@@ -23567,6 +24412,35 @@ const operationManifest = [
 				"attachments"
 			],
 			"properties": {
+				"imported": {
+					"type": ["object", "null"],
+					"description": "Historical acquisition; never sender or SMTP delivery proof. Null for live mail. Excluded from live tails and deltas.",
+					"required": [
+						"from",
+						"method",
+						"verification",
+						"at"
+					],
+					"properties": {
+						"from": {
+							"type": "string",
+							"enum": ["google_workspace"]
+						},
+						"method": {
+							"type": "string",
+							"enum": ["primitive_direct"]
+						},
+						"verification": {
+							"type": "string",
+							"enum": ["provider_fetched"]
+						},
+						"at": {
+							"type": "string",
+							"format": "date-time",
+							"description": "When Primitive acquired this historical message."
+						}
+					}
+				},
 				"id": {
 					"type": "string",
 					"format": "uuid",
@@ -24371,6 +25245,35 @@ const operationManifest = [
 						"format": "uuid",
 						"description": "With `group=message`: the send of this message, when you can read it (under a connected agent key, only its own sends)."
 					},
+					"imported": {
+						"type": ["object", "null"],
+						"description": "Historical acquisition; never sender or SMTP delivery proof. Null for live mail. Excluded from live tails and deltas.",
+						"required": [
+							"from",
+							"method",
+							"verification",
+							"at"
+						],
+						"properties": {
+							"from": {
+								"type": "string",
+								"enum": ["google_workspace"]
+							},
+							"method": {
+								"type": "string",
+								"enum": ["primitive_direct"]
+							},
+							"verification": {
+								"type": "string",
+								"enum": ["provider_fetched"]
+							},
+							"at": {
+								"type": "string",
+								"format": "date-time",
+								"description": "When Primitive acquired this historical message."
+							}
+						}
+					},
 					"snippet": {
 						"type": ["string", "null"],
 						"maxLength": 200,
@@ -24393,6 +25296,7 @@ const operationManifest = [
 					"automated_reasons",
 					"from_verified",
 					"from_header_email",
+					"imported",
 					"snippet"
 				]
 			}
@@ -25032,6 +25936,35 @@ const operationManifest = [
 						"format": "uuid",
 						"description": "With `group=message`: the send of this message, when you can read it (under a connected agent key, only its own sends)."
 					},
+					"imported": {
+						"type": ["object", "null"],
+						"description": "Historical acquisition; never sender or SMTP delivery proof. Null for live mail. Excluded from live tails and deltas.",
+						"required": [
+							"from",
+							"method",
+							"verification",
+							"at"
+						],
+						"properties": {
+							"from": {
+								"type": "string",
+								"enum": ["google_workspace"]
+							},
+							"method": {
+								"type": "string",
+								"enum": ["primitive_direct"]
+							},
+							"verification": {
+								"type": "string",
+								"enum": ["provider_fetched"]
+							},
+							"at": {
+								"type": "string",
+								"format": "date-time",
+								"description": "When Primitive acquired this historical message."
+							}
+						}
+					},
 					"snippet": {
 						"type": ["string", "null"],
 						"maxLength": 200,
@@ -25054,6 +25987,7 @@ const operationManifest = [
 					"automated_reasons",
 					"from_verified",
 					"from_header_email",
+					"imported",
 					"snippet"
 				]
 			}, {
@@ -25512,7 +26446,7 @@ const operationManifest = [
 				}
 			}
 		},
-		"responseSchema": {
+		"responseSchema": { "allOf": [{
 			"type": "object",
 			"properties": {
 				"recipient": {
@@ -25778,7 +26712,28 @@ const operationManifest = [
 				"failure_count",
 				"consecutive_fails"
 			]
-		},
+		}, {
+			"type": "object",
+			"properties": { "warnings": {
+				"description": "For a webhook (kind http). same_path_as_another_endpoint: another webhook you can see, on and not deleted, sends to the same scheme, host and path with any query string, so each email both receive is delivered twice; endpoint_id names it (at most 5, newest first). The URL is never echoed. Empty when none; absent when it could not be checked (a caller who may not read endpoints, or a failed read). Other codes may be added.",
+				"type": "array",
+				"items": {
+					"type": "object",
+					"properties": {
+						"code": { "type": "string" },
+						"message": { "type": "string" },
+						"endpoint_id": {
+							"description": "The other webhook a same_path_as_another_endpoint warning names.",
+							"type": "string",
+							"format": "uuid",
+							"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+						}
+					},
+					"required": ["code", "message"],
+					"additionalProperties": {}
+				}
+			} }
+		}] },
 		"sdkName": "createEndpoint",
 		"summary": "Create a webhook endpoint",
 		"tag": "Endpoints",
@@ -26627,8 +27582,8 @@ const operationManifest = [
 					"description": "HTTP status code returned by the endpoint"
 				},
 				"body": {
-					"type": "string",
-					"description": "Response body (truncated to 1000 characters)"
+					"description": "The receiver response text, only with organization-wide mail.raw:read. Null without that access because a receiver can echo a raw download link.",
+					"type": ["string", "null"]
 				},
 				"signature": {
 					"type": "string",
@@ -38441,7 +39396,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-relay-auto-join",
-		"description": "Whether someone who proves an address on the organization's mail relay domain with Google Workspace joins automatically, and with what access. `option` is null when auto-join is off and an invitation is required; `options` lists the choices. Answers 404 `feature_disabled` unless the organization has mail relay.",
+		"description": "Whether someone who proves an address on the organization's mail relay domain with Google Workspace joins automatically. Auto-joined people have no mail access until an owner or admin assigns a role. `option` is null when auto-join is off and an invitation is required; legacy mail-grant settings read as `no_access`. `options` lists the choices. Answers 404 `feature_disabled` unless the organization has mail relay.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getRelayAutoJoin",
@@ -39250,7 +40205,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "set-relay-auto-join",
-		"description": "`option` is a choice's id from the GET, or null to require an invitation (turning it off needs only members:manage). Choosing an option answers 404 `feature_disabled` unless the organization has mail relay, 400 `validation_error` for an id that is not one of the choices, 403 `grant_forbidden` unless the caller is an owner or admin who can assign roles and send invitations and covers the role the option gives, 409 `role_key_taken` when a custom role already holds that role's key, and 409 `role_assignment_unavailable` when the organization cannot be given that role yet. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `relay_auto_join.write` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage, and roles:assign to turn it on. API keys are refused.",
+		"description": "`option` is a choice's id from the GET, or null to require an invitation (turning it off needs only members:manage). Auto-joined people have no mail access until an owner or admin assigns a role; legacy mail-grant choices cannot be selected. Choosing an option answers 404 `feature_disabled` unless the organization has mail relay, 400 `validation_error` for an id outside the current catalog, 403 `grant_forbidden` without owner or admin assignment authority, and 409 `role_assignment_unavailable` when the restricted role cannot be assigned yet. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `relay_auto_join.write` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage, and roles:assign to turn it on. API keys are refused.",
 		"hasJsonBody": true,
 		"method": "PUT",
 		"operationId": "setRelayAutoJoin",
@@ -52645,18 +53600,19 @@ function emptyEmailListHint(input) {
 }
 // src/oclif/endpoint-event-types.ts
 const EVENT_TYPES_FLAG_OPERATIONS = /* @__PURE__ */ new Set(["createEndpoint", "updateEndpoint"]);
-const EVENT_TYPES_FLAG_DESCRIPTION = "Event types this endpoint subscribes to, comma separated or repeated (sets rules.event_types). Omitting the subscription means every event type except the opt-in sent_email.* and email_rule_request.* events, which an endpoint receives only when it lists them; sent_email.* and email_rule_request.* each expand to all four. Rule request events can be listed only when the webhook is created, signed in as yourself; such a webhook is yours and always a route target. Keep email.received in the list if the endpoint also handles inbound mail. On update, the endpoint's other rules are kept.";
+const EVENT_TYPES_FLAG_DESCRIPTION = "Event types this endpoint subscribes to, comma separated or repeated (sets rules.event_types). Omitting the subscription means every event type except the opt-in sent_email.*, email_rule_request.* and email_rule_objection.* events, which an endpoint receives only when it lists them; each of those shorthands expands to all four. Rule request and objection events can be listed only when the webhook is created, signed in as yourself; such a webhook is yours and always a route target. Keep email.received in the list if the endpoint also handles inbound mail. On update, the endpoint's other rules are kept.";
 /** Shorthands the CLI expands, since the server would store them as literals that match nothing. */
 const WILDCARDS = {
 	"sent_email.*": SENT_EMAIL_EVENT_TYPES,
-	"email_rule_request.*": EMAIL_RULE_REQUEST_EVENT_TYPES
+	"email_rule_request.*": EMAIL_RULE_REQUEST_EVENT_TYPES,
+	"email_rule_objection.*": EMAIL_RULE_OBJECTION_EVENT_TYPES
 };
 const KNOWN_EVENT_TYPES = new Set(WEBHOOK_EVENT_TYPES);
 var EventTypesFlagError = class extends Error {};
 /**
 * Turn the raw `--event-types` values into the list to store: split on
-* commas, trim, expand `sent_email.*` and `email_rule_request.*`, and drop duplicates while keeping the
-* order the caller gave.
+* commas, trim, expand the shorthands in WILDCARDS, and drop duplicates while
+* keeping the order the caller gave.
 */
 function parseEventTypesFlag(values) {
 	const out = [];
@@ -52671,7 +53627,7 @@ function parseEventTypesFlag(values) {
 			out.push(entry);
 		}
 	}
-	if (out.length === 0) throw new EventTypesFlagError("--event-types needs at least one event type. To receive every event type except the opt-in sent_email.* and email_rule_request.* events, omit the subscription instead.");
+	if (out.length === 0) throw new EventTypesFlagError("--event-types needs at least one event type. To receive every event type except the opt-in sent_email.*, email_rule_request.* and email_rule_objection.* events, omit the subscription instead.");
 	if (out.length > 50) throw new EventTypesFlagError(`--event-types accepts at most 50 event types (got ${out.length}).`);
 	return out;
 }
@@ -54574,7 +55530,7 @@ function savedConnectedProfiles(configDir, exclude) {
 */
 async function otherProfiles(configDir, session, current) {
 	if (session) try {
-		const { connectedProfilesForSession } = await import("./machine-session-CI8tnGzz.js").then((n) => n.s);
+		const { connectedProfilesForSession } = await import("./machine-session-DkXYR62a.js").then((n) => n.s);
 		return {
 			inSession: true,
 			profiles: connectedProfilesForSession(configDir, session, current)
@@ -54648,24 +55604,25 @@ async function explainPendingMailNotFound(configDir, emailId, write = (line) =>
 		if (outcome.kind === "dropped") write(`Dropped the pending notice for ${id} from profile ${current.profile} after ${outcome.reads} consecutive not_found reads; the email is no longer visible to this profile.\n`);
 	} catch {}
 }
-const RULE_REQUEST_WEBHOOK_CREATE_HINT = "Hint: a webhook for rule request events is made by the person it is for, signed in as themself: after `primitive login`, run this without --api-key, PRIMITIVE_API_KEY or PRIMITIVE_AGENT_PROFILE set, or create it in the dashboard. An API key, another app or an agent cannot make one. If you are already signed in as yourself, try again. It is a route target whatever your access, so it never takes a domain's or the organization's default slot.";
-const RULE_REQUEST_WEBHOOK_HTTP_HINT = "Hint: rule request events go only to an http webhook (kind http).";
-const RULE_REQUEST_WEBHOOK_SUBSCRIBE_HINT = "Hint: rule request events go only to a webhook made for them. If this webhook does not list them yet, it cannot be given them: create a new one with `--event-types 'email_rule_request.*'`, signed in as yourself. If it does, only its maker, signed in as themself, can change it.";
-const RULE_REQUEST_WEBHOOK_KEY_HINT = "Hint: a webhook for rule request events is made by the person it is for, signed in as themself, and stays theirs: it cannot be given to an API key.";
-const RULE_REQUEST_WEBHOOK_CHANGE_HINT = "Hint: only the person who made a webhook for rule request events, signed in as themself (not with an API key, another app or an agent), can change it. It can be deleted as any other webhook can.";
-const RULE_REQUEST_WEBHOOK_DEFAULT_HINT = "Hint: a webhook for rule request events is always a route target. Leave out --no-is-route-target, --takeover and --no-takeover (is_route_target: false and takeover in a raw body).";
-const RULE_REQUEST_EVENT_PREFIX = "email_rule_request.";
+const RULE_REQUEST_WEBHOOK_CREATE_HINT = "Hint: a webhook for rule request or objection events is made by the person it is for, signed in as themself: after `primitive login`, run this without --api-key, PRIMITIVE_API_KEY or PRIMITIVE_AGENT_PROFILE set, or create it in the dashboard. An API key, another app or an agent cannot make one. If you are already signed in as yourself, try again. It is a route target whatever your access, so it never takes a domain's or the organization's default slot.";
+const RULE_REQUEST_WEBHOOK_HTTP_HINT = "Hint: rule request and objection events go only to an http webhook (kind http).";
+const RULE_REQUEST_WEBHOOK_SUBSCRIBE_HINT = "Hint: rule request and objection events go only to a webhook made for them. If this webhook does not list them yet, it cannot be given them: create a new one with `--event-types` naming them (such as 'email_rule_request.*' or 'email_rule_objection.*'), signed in as yourself. If it does, only its maker, signed in as themself, can change it.";
+const RULE_REQUEST_WEBHOOK_KEY_HINT = "Hint: a webhook for rule request or objection events is made by the person it is for, signed in as themself, and stays theirs: it cannot be given to an API key.";
+const RULE_REQUEST_WEBHOOK_CHANGE_HINT = "Hint: only the person who made a webhook for rule request or objection events, signed in as themself (not with an API key, another app or an agent), can change it. It can be deleted as any other webhook can.";
+const RULE_REQUEST_WEBHOOK_DEFAULT_HINT = "Hint: a webhook for rule request or objection events is always a route target. Leave out --no-is-route-target, --takeover and --no-takeover (is_route_target: false and takeover in a raw body).";
+/** The event families, of those this CLI lists, that the API keeps to a webhook its person made for them, matched by prefix as the API matches them. */
+const MEMBER_EVENT_PREFIXES = ["email_rule_request.", "email_rule_objection."];
 function record(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 /**
-* Whether a create or update body lists any rule request event. Matched by
-* prefix, as the API matches it, so a raw body's literal
-* `email_rule_request.*` counts too.
+* Whether a create or update body lists any rule request or objection
+* event. Matched by prefix, as the API matches it, so a raw body's
+* literal `email_rule_request.*` counts too.
 */
 function listsRuleRequestEvents(body) {
 	const types = record(record(body)?.rules)?.event_types;
-	return Array.isArray(types) && types.some((t) => typeof t === "string" && t.startsWith(RULE_REQUEST_EVENT_PREFIX));
+	return Array.isArray(types) && types.some((t) => typeof t === "string" && MEMBER_EVENT_PREFIXES.some((prefix) => t.startsWith(prefix)));
 }
 function refusalReason(payload) {
 	const top = record(payload);
@@ -55971,7 +56928,7 @@ function createOperationCommand(operation) {
 						...tail ? { pastFlag: "--since" } : query.cursor !== void 0 ? { pastFlag: "--cursor" } : {},
 						nextCursor: tail ? null : more,
 						caller: tail || more ? null : await readCallerMailFor(auth, apiClient.client)
-					}) : emptyRuleListHint(operation.sdkName, query) ?? EMPTY_RESULT_HINTS[operation.sdkName];
+					}) : emptyRuleListHint(operation.sdkName, query) ?? emptyDeliveriesHint(operation.sdkName, query) ?? EMPTY_RESULT_HINTS[operation.sdkName];
 					if (hint && jsonOutput) summary.push(hint);
 					else if (hint) process.stderr.write(`${hint}\n`);
 				}
@@ -56078,6 +57035,20 @@ function emptyRuleListHint(sdkName, query) {
 		return said("objections", box && status ? "pending objections you made" : box ? "objections you made" : status ? "pending objections" : null, [...box ? ["--box all"] : [], ...status ? ["--status any"] : []]);
 	}
 }
+/**
+* An empty delivery list narrowed by a filter (--endpoint-id, --status,
+* --event-type and the rest) names the filters given, in place of the general
+* hint, which reads as if nothing was ever delivered, and keeps its point that
+* test fires are not logged. Undefined for any other list, or when no filter
+* was given.
+*/
+function emptyDeliveriesHint(sdkName, query) {
+	if (sdkName !== "listDeliveries") return void 0;
+	const flags = listFilters(query).map((name) => `--${parameterFlagName(sdkName, name)}`);
+	if (flags.length === 0) return void 0;
+	if (query.cursor !== void 0) return "(no results) No more deliveries match these filters.";
+	return `(no results) No deliveries match ${flags.length === 1 ? flags[0] : `${flags.slice(0, -1).join(", ")} and ${flags[flags.length - 1]}`}. Test fires from \`primitive endpoints test\` are not logged here; real deliveries are, when an event fans out to the endpoint. Leave out ${flags.length === 1 ? flags[0] : "a filter"} to list more.`;
+}
 function canonicalizeCliReferences(description) {
 	return description.replaceAll("`primitive emails:latest`", "`primitive emails latest`").replaceAll("`primitive describe emails:get-email | jq '.responseSchema.properties'`", "`primitive describe emails:get | jq '.responseSchema.properties'`");
 }