primcli 3.0.0-preview.12 → 3.0.0-preview.14

package/dist/{api-command-CNCsVNk0.js → api-command-BTOIanV1.js}

@@ -1,4 +1,4 @@
-import { B as ensureSearchReportsReplyState, Gn as sdk_gen_exports, J as EMAIL_RULE_REQUEST_EVENT_TYPES, K as replyStateSurfaceForOperation, L as ReplyStateUnsupportedError, Qt as getOwnGrant, R as assertAwaitingFilterRows, Ut as getEmail, W as isAwaitingRejectedError, X as WEBHOOK_EVENT_TYPES, Y as SENT_EMAIL_EVENT_TYPES, _n as listEndpoints, at as assertAutomatedVerdict, ct as ensureSearchReportsAutomated, dt as isAutomatedRejectedError, it as AutomatedFilterUnsupportedError, lt as expectedAutomatedVerdicts, nn as getThread, ot as automatedRejectedError, q as EMAIL_RULE_OBJECTION_EVENT_TYPES, st as automatedSurfaceForOperation, v as parseRetryAfter, z as awaitingRejectedError } from "./repeats-Dj_o6c-X-wjmw2Jbx.js";
+import { $t as getOwnGrant, B as awaitingRejectedError, G as isAwaitingRejectedError, J as EMAIL_RULE_OBJECTION_EVENT_TYPES, Kn as sdk_gen_exports, R as ReplyStateUnsupportedError, V as ensureSearchReportsReplyState, Wt as getEmail, X as SENT_EMAIL_EVENT_TYPES, Y as EMAIL_RULE_REQUEST_EVENT_TYPES, Z as WEBHOOK_EVENT_TYPES, at as AutomatedFilterUnsupportedError, ct as automatedSurfaceForOperation, ft as isAutomatedRejectedError, lt as ensureSearchReportsAutomated, ot as assertAutomatedVerdict, q as replyStateSurfaceForOperation, rn as getThread, st as automatedRejectedError, ut as expectedAutomatedVerdicts, vn as listEndpoints, y as parseRetryAfter, z as assertAwaitingFilterRows } from "./repeats-Dj_o6c-X-B7sSj0oc.js";
 import { C as saveCliCredentials, F as agentProfilesDirectory, H as requireDefaultLoginProfile, N as agentProfileDirectory, R as loadConnectedAgentProfile, S as resolveCliAuth, W as PrimitiveApiClient, _ as deleteCliCredentials, b as loadCliCredentials, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, i as loadCliConfig, j as AGENT_PROFILE_ENV, m as cliAccessTokenExpiresAt, p as acquireCliCredentialsLock, w as saveSignupCredentials, x as normalizeApiBaseUrl, y as detectPrimitiveKeyEnvMisname } from "./cli-config-Ms_0vNjq.js";
 import "./oclif/global-org-flag.js";
 import { a as thrownErrorBody } from "./json-output-ch756TXV.js";
@@ -780,7 +780,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-activity-objects",
-		"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules, rule requests and objections to rules over their mail (objections only on the dashboard or the Primitive CLI). Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, and the objections to rules they wrote, under their current membership, each naming the member who asked or objected in created_through. A key, an app or an agent has none, and gets both kinds in withheld. With relation=concerning it lists instead what other members did that concerns the person's own mail: each time a rule started covering one of their mailboxes or saved a new version while covering it, named as the rule was then, naming its author in created_through, under their current membership; only on the dashboard or the Primitive CLI. A key, an app or an agent has none, and gets email_rule_coverage in withheld. A notice never reads as ended. Notices are written by a periodic job and can lag: until the notices record a rule starting to cover you, the first page lists that rule as pending (pending_complete says whether that check finished), and as_of says about when the notices last looked. For what covers you now, read GET /email-rules/covering-me.",
+		"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules, rule requests and objections to rules over their mail (objections only on the dashboard or the Primitive CLI). Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, and the objections to rules they wrote, under their current membership, each naming the member who asked or objected in created_through. A key, an app or an agent has none, and gets both kinds in withheld. With relation=concerning it lists instead what other members did that concerns the person's own mail: each time a rule started covering one of their mailboxes, saved a new version, or changed who receives its matches while covering it, named as the rule was then, naming its author in created_through, under their current membership; only on the dashboard or the Primitive CLI. A key, an app or an agent has none, and gets email_rule_coverage in withheld. A notice never reads as ended. Notices are written by a periodic job and can lag: until the notices record a rule starting to cover you, the first page lists that rule as pending (pending_complete says whether that check finished), and as_of says about when the notices last looked. For what covers you now, read GET /email-rules/covering-me.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listActivityObjects",
@@ -863,7 +863,7 @@ const operationManifest = [
 							},
 							"state": {
 								"type": "string",
-								"description": "Where it stands now: enabled, disabled, deleted or replaced (endpoints and routes), enabled or disabled (filters, wake schedules), live, suspended or deleted (Functions), active, paused or ended (repeating sends), scheduled (scheduled sends), active, suspended, expired or revoked (API keys), pending, claimed, connected or revoked (agents), draft, observe or active (email rules), pending, accepted, declined or withdrawn (rule requests and objections), and for a coverage notice what it told: started (a rule began covering your mailbox), new_version, or baseline (it already covered you when notices began). pending: a rule started covering your mailbox and the notices have not recorded that start yet (a restart within an hour of the last start notice is recorded without a new one); its id is then the rule's, and created_at when the rule last changed."
+								"description": "Where it stands now: enabled, disabled, deleted or replaced (endpoints and routes), enabled or disabled (filters, wake schedules), live, suspended or deleted (Functions), active, paused or ended (repeating sends), scheduled (scheduled sends), active, suspended, expired or revoked (API keys), pending, claimed, connected or revoked (agents), draft, observe or active (email rules), pending, accepted, declined or withdrawn (rule requests and objections), and for a coverage notice what it told: started (a rule was made or turned active over your mailboxes, or an active rule came to reach you; once per rule, not per mailbox), new_version, receivers_changed (who receives an active rule's matches changed: its keys, webhooks or share), or baseline (it already covered you when notices began). pending: a rule started covering your mailbox and the notices have not recorded that start yet (a restart within an hour of the last start notice is recorded without a new one); its id is then the rule's, and created_at when the rule last changed."
 							},
 							"created_at": {
 								"type": "string",
@@ -872,7 +872,7 @@ const operationManifest = [
 							"ended_at": {
 								"type": ["string", "null"],
 								"format": "date-time",
-								"description": "When it was deleted, replaced or revoked, when an API key expired, when a repeating send stopped, or when a rule request or objection was decided (accepted, declined or withdrawn); null otherwise."
+								"description": "When it was deleted, replaced or revoked, when an API key expired, when a repeating send stopped, or when a rule request or objection was decided (accepted, declined or withdrawn); null otherwise, as on every coverage notice."
 							},
 							"owned_now": {
 								"type": "string",
@@ -900,6 +900,74 @@ const operationManifest = [
 									"id",
 									"name"
 								]
+							},
+							"rule_id": {
+								"description": "For email_rule_coverage, always: the rule it is about, since names need not be unique (for pending, the same as id). GET /v1/email-rules/covering-me/{rule_id} shows the rule while it covers you, or as it last decided on your mail; otherwise it answers not_found.",
+								"type": "string",
+								"format": "uuid"
+							},
+							"receivers_change": {
+								"description": "For a receivers_changed notice: who received the rule's matches before and after, in totals. They can be equal when only an owner or a webhook site changed; covering-me shows them by owner. A rotated key counts once here while the old one still works; covering-me counts both.",
+								"type": "object",
+								"properties": {
+									"before": {
+										"type": "object",
+										"properties": {
+											"keys": {
+												"type": "integer",
+												"minimum": 0
+											},
+											"reads_in_full": {
+												"type": "integer",
+												"minimum": 0,
+												"description": "Of the keys, how many also read your own mail beyond the rule."
+											},
+											"webhooks": {
+												"type": "integer",
+												"minimum": 0
+											},
+											"shares": {
+												"type": "integer",
+												"minimum": 0
+											}
+										},
+										"required": [
+											"keys",
+											"reads_in_full",
+											"webhooks",
+											"shares"
+										]
+									},
+									"after": {
+										"type": "object",
+										"properties": {
+											"keys": {
+												"type": "integer",
+												"minimum": 0
+											},
+											"reads_in_full": {
+												"type": "integer",
+												"minimum": 0,
+												"description": "Of the keys, how many also read your own mail beyond the rule."
+											},
+											"webhooks": {
+												"type": "integer",
+												"minimum": 0
+											},
+											"shares": {
+												"type": "integer",
+												"minimum": 0
+											}
+										},
+										"required": [
+											"keys",
+											"reads_in_full",
+											"webhooks",
+											"shares"
+										]
+									}
+								},
+								"required": ["before", "after"]
 							}
 						},
 						"required": [
@@ -9695,6 +9763,14 @@ const operationManifest = [
 						"additionalProperties": {}
 					}
 				},
+				"mail_limits_available": {
+					"description": "Whether a key limited to some mail (addresses, domains or email rules) would be created now. While false, creating one is refused, so a client offers neither the listed-address presets nor a listed mail reach for a custom key.",
+					"type": "boolean"
+				},
+				"org_reach_available": {
+					"description": "Whether the credential policy lets a new key reach every mailbox. While false, creating one is refused, so a client offers no preset that reaches every mailbox, and a custom key lists its addresses or domains. With mail_limits_available false as well, no key can be created and every preset is unavailable.",
+					"type": "boolean"
+				},
 				"matrix": {
 					"type": "array",
 					"items": {
@@ -11227,6 +11303,27 @@ const operationManifest = [
 						"additionalProperties": {}
 					}
 				},
+				"rules_added": {
+					"description": "Each rule (or share) the edit put on a key that reads mail, with granted_emails, how many emails it has already shared, which the key can now read while it is active: counted up to 10,000, with more: true past that; null when not counted.",
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"id": { "type": "string" },
+							"granted_emails": {
+								"type": ["integer", "null"],
+								"minimum": 0,
+								"maximum": 9007199254740991
+							},
+							"more": {
+								"type": "boolean",
+								"const": true
+							}
+						},
+						"required": ["id", "granted_emails"],
+						"additionalProperties": {}
+					}
+				},
 				"grant_unguarded": {
 					"description": "Present, as true, when the grant was changed without expected_grant_ref, so the change was not checked against changes made since the key was read. Send grant.ref from GET /v1/keys/{id} as expected_grant_ref to have such a change refused instead (409 conflict, details.reason grant_changed).",
 					"type": "boolean",
@@ -12344,11 +12441,17 @@ const operationManifest = [
 			"type": "string"
 		}],
 		"queryParams": [{
-			"description": "When true, include only outbound DNS records. Verified domains default to outbound-only; pending claims default to all required records.",
+			"description": "When true, include only outbound DNS records. Cannot be combined with inbound_only=true. By default, include all records.",
 			"enum": null,
 			"name": "outbound_only",
 			"required": false,
 			"type": "boolean"
+		}, {
+			"description": "When true, include only inbound MX and ownership TXT records. Cannot be combined with outbound_only=true.",
+			"enum": null,
+			"name": "inbound_only",
+			"required": false,
+			"type": "boolean"
 		}],
 		"headerParams": [],
 		"permissions": ["domains:read"],
@@ -13044,6 +13147,388 @@ const operationManifest = [
 		"tag": "Domains",
 		"tagCommand": "domains"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-email-notification-preferences",
+		"description": "The notification emails the calling member gets, and which of them they may turn on or off. Each kind lists its label and description, its class, whether it needs an entitlement and whether the organization has it, the organization's mode (null for platform_required) and the modes it may choose, and whether the calling member gets it and may change that.\n\nPerson only: a dashboard session or the person's own OAuth token (the CLI or an app they connected). The person's role must hold notifications:manage. API keys, agent connection keys and agents are refused.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getEmailNotificationPreferences",
+		"path": "/email-notification-preferences",
+		"pathParams": [],
+		"queryParams": [],
+		"headerParams": [],
+		"permissions": ["notifications:manage"],
+		"access": "person",
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"entitled": { "type": "boolean" },
+				"kinds": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"kind": { "type": "string" },
+							"label": { "type": "string" },
+							"description": { "type": "string" },
+							"class": {
+								"type": "string",
+								"enum": [
+									"platform_required",
+									"org_requirable",
+									"optional"
+								]
+							},
+							"entitlement_required": { "type": "boolean" },
+							"entitled": { "type": "boolean" },
+							"org_mode": {
+								"type": ["string", "null"],
+								"enum": [
+									"off",
+									"optional_on",
+									"optional_off",
+									"required",
+									null
+								]
+							},
+							"org_mode_is_default": { "type": "boolean" },
+							"org_modes": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"enum": [
+										"off",
+										"optional_on",
+										"optional_off",
+										"required"
+									]
+								}
+							},
+							"member_enabled": { "type": "boolean" },
+							"member_can_change": { "type": "boolean" }
+						},
+						"required": [
+							"kind",
+							"label",
+							"description",
+							"class",
+							"entitlement_required",
+							"entitled",
+							"org_mode",
+							"org_mode_is_default",
+							"org_modes",
+							"member_enabled",
+							"member_can_change"
+						]
+					}
+				}
+			},
+			"required": ["entitled", "kinds"]
+		},
+		"sdkName": "getEmailNotificationPreferences",
+		"summary": "Get my email notification preferences",
+		"tag": "Email notifications",
+		"tagCommand": "email-notifications"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-email-notification-settings",
+		"description": "Every kind of notification email Primitive sends the organization's members, and who may turn it off. Each kind lists its label and description, its class, whether it needs an entitlement and whether the organization has it, the organization's mode (null for platform_required) and the modes it may choose, and whether the calling member gets it and may change that.\n\nPerson only: a dashboard session or the person's own OAuth token (the CLI or an app they connected). API keys, agent connection keys and agents are refused.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getEmailNotificationSettings",
+		"path": "/email-notification-settings",
+		"pathParams": [],
+		"queryParams": [],
+		"headerParams": [],
+		"permissions": ["org:read"],
+		"access": "person",
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"entitled": { "type": "boolean" },
+				"kinds": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"kind": { "type": "string" },
+							"label": { "type": "string" },
+							"description": { "type": "string" },
+							"class": {
+								"type": "string",
+								"enum": [
+									"platform_required",
+									"org_requirable",
+									"optional"
+								]
+							},
+							"entitlement_required": { "type": "boolean" },
+							"entitled": { "type": "boolean" },
+							"org_mode": {
+								"type": ["string", "null"],
+								"enum": [
+									"off",
+									"optional_on",
+									"optional_off",
+									"required",
+									null
+								]
+							},
+							"org_mode_is_default": { "type": "boolean" },
+							"org_modes": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"enum": [
+										"off",
+										"optional_on",
+										"optional_off",
+										"required"
+									]
+								}
+							},
+							"member_enabled": { "type": "boolean" },
+							"member_can_change": { "type": "boolean" }
+						},
+						"required": [
+							"kind",
+							"label",
+							"description",
+							"class",
+							"entitlement_required",
+							"entitled",
+							"org_mode",
+							"org_mode_is_default",
+							"org_modes",
+							"member_enabled",
+							"member_can_change"
+						]
+					}
+				}
+			},
+			"required": ["entitled", "kinds"]
+		},
+		"sdkName": "getEmailNotificationSettings",
+		"summary": "Get the organization's email notification settings",
+		"tag": "Email notifications",
+		"tagCommand": "email-notifications"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "update-email-notification-preferences",
+		"description": "Turn one or more kinds on or off for the calling member. Only a kind whose organization mode is optional_on or optional_off can be changed: a platform_required kind, one the organization requires, and one it turned off are refused with 409 (conflict, details.reason not_member_choice, details.org_mode saying which), and nothing is changed. An unknown kind is refused with 400. Answers the preferences as they now stand. Each kind lists its label and description, its class, whether it needs an entitlement and whether the organization has it, the organization's mode (null for platform_required) and the modes it may choose, and whether the calling member gets it and may change that.\n\nPerson only: a dashboard session or the person's own OAuth token (the CLI or an app they connected). The person's role must hold notifications:manage. API keys, agent connection keys and agents are refused.",
+		"hasJsonBody": true,
+		"method": "PUT",
+		"operationId": "updateEmailNotificationPreferences",
+		"path": "/email-notification-preferences",
+		"pathParams": [],
+		"queryParams": [],
+		"headerParams": [],
+		"permissions": ["notifications:manage"],
+		"access": "person",
+		"requestSchema": {
+			"type": "object",
+			"properties": { "preferences": {
+				"type": "object",
+				"propertyNames": {
+					"type": "string",
+					"pattern": "^[a-z][a-z0-9_]{0,63}$"
+				},
+				"additionalProperties": { "type": "boolean" }
+			} },
+			"required": ["preferences"],
+			"additionalProperties": false
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"entitled": { "type": "boolean" },
+				"kinds": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"kind": { "type": "string" },
+							"label": { "type": "string" },
+							"description": { "type": "string" },
+							"class": {
+								"type": "string",
+								"enum": [
+									"platform_required",
+									"org_requirable",
+									"optional"
+								]
+							},
+							"entitlement_required": { "type": "boolean" },
+							"entitled": { "type": "boolean" },
+							"org_mode": {
+								"type": ["string", "null"],
+								"enum": [
+									"off",
+									"optional_on",
+									"optional_off",
+									"required",
+									null
+								]
+							},
+							"org_mode_is_default": { "type": "boolean" },
+							"org_modes": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"enum": [
+										"off",
+										"optional_on",
+										"optional_off",
+										"required"
+									]
+								}
+							},
+							"member_enabled": { "type": "boolean" },
+							"member_can_change": { "type": "boolean" }
+						},
+						"required": [
+							"kind",
+							"label",
+							"description",
+							"class",
+							"entitlement_required",
+							"entitled",
+							"org_mode",
+							"org_mode_is_default",
+							"org_modes",
+							"member_enabled",
+							"member_can_change"
+						]
+					}
+				}
+			},
+			"required": ["entitled", "kinds"]
+		},
+		"sdkName": "updateEmailNotificationPreferences",
+		"summary": "Change my email notification preferences",
+		"tag": "Email notifications",
+		"tagCommand": "email-notifications"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "update-email-notification-settings",
+		"description": "Set the organization's mode for one or more kinds: off (nobody gets it), optional_on (each member gets it unless they turn it off), optional_off (only members who turn it on get it) or required (every member gets it). Kinds left out keep their mode. An unknown kind is refused with 400 (validation_error, details.reason unknown_kind). A platform_required kind is refused with 409 (conflict, details.reason platform_required), and required for an optional kind with 409 (conflict, details.reason mode_not_allowed); nothing is changed. Answers the settings as they now stand. Each kind lists its label and description, its class, whether it needs an entitlement and whether the organization has it, the organization's mode (null for platform_required) and the modes it may choose, and whether the calling member gets it and may change that.\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `org_settings.write` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold notification_policy:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+		"hasJsonBody": true,
+		"method": "PUT",
+		"operationId": "updateEmailNotificationSettings",
+		"path": "/email-notification-settings",
+		"pathParams": [],
+		"queryParams": [],
+		"headerParams": [{
+			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo, semantic search setting or email notification settings), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
+			"enum": null,
+			"name": "Primitive-Step-Up",
+			"required": false,
+			"type": "string"
+		}],
+		"permissions": ["notification_policy:manage"],
+		"access": "step_up",
+		"requestSchema": {
+			"type": "object",
+			"properties": { "modes": {
+				"type": "object",
+				"propertyNames": {
+					"type": "string",
+					"pattern": "^[a-z][a-z0-9_]{0,63}$"
+				},
+				"additionalProperties": {
+					"type": "string",
+					"enum": [
+						"off",
+						"optional_on",
+						"optional_off",
+						"required"
+					]
+				}
+			} },
+			"required": ["modes"],
+			"additionalProperties": false
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"entitled": { "type": "boolean" },
+				"kinds": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"kind": { "type": "string" },
+							"label": { "type": "string" },
+							"description": { "type": "string" },
+							"class": {
+								"type": "string",
+								"enum": [
+									"platform_required",
+									"org_requirable",
+									"optional"
+								]
+							},
+							"entitlement_required": { "type": "boolean" },
+							"entitled": { "type": "boolean" },
+							"org_mode": {
+								"type": ["string", "null"],
+								"enum": [
+									"off",
+									"optional_on",
+									"optional_off",
+									"required",
+									null
+								]
+							},
+							"org_mode_is_default": { "type": "boolean" },
+							"org_modes": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"enum": [
+										"off",
+										"optional_on",
+										"optional_off",
+										"required"
+									]
+								}
+							},
+							"member_enabled": { "type": "boolean" },
+							"member_can_change": { "type": "boolean" }
+						},
+						"required": [
+							"kind",
+							"label",
+							"description",
+							"class",
+							"entitlement_required",
+							"entitled",
+							"org_mode",
+							"org_mode_is_default",
+							"org_modes",
+							"member_enabled",
+							"member_can_change"
+						]
+					}
+				}
+			},
+			"required": ["entitled", "kinds"]
+		},
+		"sdkName": "updateEmailNotificationSettings",
+		"summary": "Change the organization's email notification settings",
+		"tag": "Email notifications",
+		"tagCommand": "email-notifications"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -13141,8 +13626,14 @@ const operationManifest = [
 						"email"
 					]
 				},
-				"is_objector": { "type": "boolean" },
-				"is_author": { "type": "boolean" },
+				"is_objector": {
+					"type": "boolean",
+					"description": "Whether you made it, in your current membership."
+				},
+				"is_author": {
+					"type": "boolean",
+					"description": "Whether it is to a rule you wrote, in your current membership."
+				},
 				"message": {
 					"description": "Why the objector objects; null when none was given, or once withdrawn.",
 					"type": ["string", "null"]
@@ -13289,8 +13780,14 @@ const operationManifest = [
 						"email"
 					]
 				},
-				"is_objector": { "type": "boolean" },
-				"is_author": { "type": "boolean" },
+				"is_objector": {
+					"type": "boolean",
+					"description": "Whether you made it, in your current membership."
+				},
+				"is_author": {
+					"type": "boolean",
+					"description": "Whether it is to a rule you wrote, in your current membership."
+				},
 				"message": {
 					"description": "Why the objector objects; null when none was given, or once withdrawn.",
 					"type": ["string", "null"]
@@ -13435,8 +13932,14 @@ const operationManifest = [
 						"email"
 					]
 				},
-				"is_objector": { "type": "boolean" },
-				"is_author": { "type": "boolean" },
+				"is_objector": {
+					"type": "boolean",
+					"description": "Whether you made it, in your current membership."
+				},
+				"is_author": {
+					"type": "boolean",
+					"description": "Whether it is to a rule you wrote, in your current membership."
+				},
 				"message": {
 					"description": "Why the objector objects; null when none was given, or once withdrawn.",
 					"type": ["string", "null"]
@@ -13576,7 +14079,7 @@ const operationManifest = [
 					"description": "Null when covers_now is false."
 				},
 				"receivers": {
-					"description": "Null when covers_now is false (who receives it now is not about your mail), or when it could not be read in time.",
+					"description": "Null when covers_now is false (who receives it now is not about your mail), when it could not be read in time, or for a rule shown in draft or observe that turned active or was deleted after it was read; try again.",
 					"anyOf": [{
 						"type": "object",
 						"properties": {
@@ -13619,6 +14122,16 @@ const operationManifest = [
 										"count": {
 											"type": "integer",
 											"exclusiveMinimum": 0
+										},
+										"reads_in_full": {
+											"description": "On a rule over your mail: how many of these keys also list one of your own mailboxes, or its domain, so they read your mail there beyond what this rule matches.",
+											"type": "integer",
+											"minimum": 0
+										},
+										"newest_at": {
+											"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+											"type": "string",
+											"format": "date-time"
 										}
 									},
 									"required": ["owner", "count"]
@@ -13666,7 +14179,7 @@ const operationManifest = [
 											"exclusiveMinimum": 0
 										},
 										"hosts": {
-											"description": "Distinct sites they deliver to (a host's registrable domain, or a tunnel, preview or function service alone), sorted, at most 10; \"unknown host\" (last) for any that cannot be named.",
+											"description": "Distinct sites they deliver to (the domain a host is registered under, an app's own name on a known app platform, or a function URL service in its region), sorted, at most 10; \"unknown host\" (last) for any that cannot be named.",
 											"type": "array",
 											"items": { "type": "string" }
 										},
@@ -13674,6 +14187,11 @@ const operationManifest = [
 											"description": "Hosts past those listed.",
 											"type": "integer",
 											"minimum": 0
+										},
+										"newest_at": {
+											"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+											"type": "string",
+											"format": "date-time"
 										}
 									},
 									"required": ["owner", "count"]
@@ -13711,6 +14229,11 @@ const operationManifest = [
 										"count": {
 											"type": "integer",
 											"exclusiveMinimum": 0
+										},
+										"newest_at": {
+											"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+											"type": "string",
+											"format": "date-time"
 										}
 									},
 									"required": ["beneficiary", "count"]
@@ -13723,7 +14246,178 @@ const operationManifest = [
 							"webhooks",
 							"shares"
 						],
-						"description": "Who receives what the rule shares now, by person and count; empty unless it is an active grant rule."
+						"description": "Who receives what the rule shares, by person and count. As receivers, empty unless it is an active grant rule."
+					}, { "type": "null" }]
+				},
+				"receivers_once_active": {
+					"description": "As on the list; also null when covers_now is false.",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"keys": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"owner": { "anyOf": [{
+											"type": "object",
+											"properties": {
+												"kind": {
+													"type": "string",
+													"const": "member"
+												},
+												"user_id": {
+													"type": "string",
+													"description": "The member's user id.",
+													"format": "uuid"
+												},
+												"name": {
+													"description": "Their name; null when they have none set.",
+													"type": ["string", "null"]
+												}
+											},
+											"required": [
+												"kind",
+												"user_id",
+												"name"
+											]
+										}, {
+											"type": "object",
+											"properties": { "kind": {
+												"type": "string",
+												"const": "organization",
+												"description": "Held by no member: an organization key, or one whose holder has left."
+											} },
+											"required": ["kind"]
+										}] },
+										"count": {
+											"type": "integer",
+											"exclusiveMinimum": 0
+										},
+										"reads_in_full": {
+											"description": "On a rule over your mail: how many of these keys also list one of your own mailboxes, or its domain, so they read your mail there beyond what this rule matches.",
+											"type": "integer",
+											"minimum": 0
+										},
+										"newest_at": {
+											"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+											"type": "string",
+											"format": "date-time"
+										}
+									},
+									"required": ["owner", "count"]
+								},
+								"description": "API keys that work now (not revoked, expired or suspended) and hold mail:read, whose access lists the rule or its live share. Owner: who holds each, or the organization."
+							},
+							"webhooks": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"owner": { "anyOf": [{
+											"type": "object",
+											"properties": {
+												"kind": {
+													"type": "string",
+													"const": "member"
+												},
+												"user_id": {
+													"type": "string",
+													"description": "The member's user id.",
+													"format": "uuid"
+												},
+												"name": {
+													"description": "Their name; null when they have none set.",
+													"type": ["string", "null"]
+												}
+											},
+											"required": [
+												"kind",
+												"user_id",
+												"name"
+											]
+										}, {
+											"type": "object",
+											"properties": { "kind": {
+												"type": "string",
+												"const": "organization",
+												"description": "Held by no member: an organization key, or one whose holder has left."
+											} },
+											"required": ["kind"]
+										}] },
+										"count": {
+											"type": "integer",
+											"exclusiveMinimum": 0
+										},
+										"hosts": {
+											"description": "Distinct sites they deliver to (the domain a host is registered under, an app's own name on a known app platform, or a function URL service in its region), sorted, at most 10; \"unknown host\" (last) for any that cannot be named.",
+											"type": "array",
+											"items": { "type": "string" }
+										},
+										"hosts_not_listed": {
+											"description": "Hosts past those listed.",
+											"type": "integer",
+											"minimum": 0
+										},
+										"newest_at": {
+											"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+											"type": "string",
+											"format": "date-time"
+										}
+									},
+									"required": ["owner", "count"]
+								},
+								"description": "Webhooks taking received mail, bounces or reports that are sent what it matches: those of the key delivery acts as, when it lists the rule or its live share (owner: its holder, or the organization), and those of the member it is shared with (owner: that member)."
+							},
+							"shares": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"beneficiary": {
+											"type": "object",
+											"properties": {
+												"kind": {
+													"type": "string",
+													"const": "member"
+												},
+												"user_id": {
+													"type": "string",
+													"description": "The member's user id.",
+													"format": "uuid"
+												},
+												"name": {
+													"description": "Their name; null when they have none set.",
+													"type": ["string", "null"]
+												}
+											},
+											"required": [
+												"kind",
+												"user_id",
+												"name"
+											]
+										},
+										"count": {
+											"type": "integer",
+											"exclusiveMinimum": 0
+										},
+										"newest_at": {
+											"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+											"type": "string",
+											"format": "date-time"
+										}
+									},
+									"required": ["beneficiary", "count"]
+								},
+								"description": "The rule's live share (at most one), by its member, if they can read it and it is among their newest 20 shares."
+							}
+						},
+						"required": [
+							"keys",
+							"webhooks",
+							"shares"
+						],
+						"description": "Who receives what the rule shares, by person and count. As receivers, empty unless it is an active grant rule."
 					}, { "type": "null" }]
 				},
 				"created_at": {
@@ -13819,6 +14513,7 @@ const operationManifest = [
 				"covers",
 				"current_version",
 				"receivers",
+				"receivers_once_active",
 				"created_at",
 				"covers_now",
 				"current"
@@ -13920,8 +14615,14 @@ const operationManifest = [
 						"email"
 					]
 				},
-				"is_objector": { "type": "boolean" },
-				"is_author": { "type": "boolean" },
+				"is_objector": {
+					"type": "boolean",
+					"description": "Whether you made it, in your current membership."
+				},
+				"is_author": {
+					"type": "boolean",
+					"description": "Whether it is to a rule you wrote, in your current membership."
+				},
 				"message": {
 					"description": "Why the objector objects; null when none was given, or once withdrawn.",
 					"type": ["string", "null"]
@@ -14087,7 +14788,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rule-objections",
-		"description": "Objections you made, objections to rules you wrote, or every objection you can see, newest first. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+		"description": "Objections you made and objections to rules you wrote (by default), only one of the two, or every objection you can see, newest first. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRuleObjections",
@@ -14095,9 +14796,10 @@ const operationManifest = [
 		"pathParams": [],
 		"queryParams": [
 			{
-				"default": "outgoing",
-				"description": "outgoing (the default): objections you made. incoming: objections to rules you wrote. all: every objection you can see.",
+				"default": "mine",
+				"description": "mine (the default): objections you made and objections to rules you wrote, each saying which (is_objector, is_author). outgoing: only those you made. incoming: only those to rules you wrote. all: every objection you can see.",
 				"enum": [
+					"mine",
 					"outgoing",
 					"incoming",
 					"all"
@@ -14212,8 +14914,14 @@ const operationManifest = [
 							"email"
 						]
 					},
-					"is_objector": { "type": "boolean" },
-					"is_author": { "type": "boolean" },
+					"is_objector": {
+						"type": "boolean",
+						"description": "Whether you made it, in your current membership."
+					},
+					"is_author": {
+						"type": "boolean",
+						"description": "Whether it is to a rule you wrote, in your current membership."
+					},
 					"message": {
 						"description": "Why the objector objects; null when none was given, or once withdrawn.",
 						"type": ["string", "null"]
@@ -14253,6 +14961,126 @@ const operationManifest = [
 		"tag": "Email Rule Oversight",
 		"tagCommand": "email-rule-oversight"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-email-rule-versions-covering-me",
+		"description": "The versions of a rule that covers one of your own mailboxes now that applied to your mail: its current version and each earlier one that decided on mail at your own mailboxes, so a decision can be read in the words of the version that made it. Each has what the covering view shows of a version: its wording, tree, explanation and assumptions. A version that did neither is not listed. Without versions, newest first, a page at a time (meta.cursor); with versions, only those named that are listed, oldest first. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listEmailRuleVersionsCoveringMe",
+		"path": "/email-rules/covering-me/{id}/versions",
+		"pathParams": [{
+			"description": "The rule id.",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [
+			{
+				"description": "Versions per page when versions is not given: 1 to 100, default 50.",
+				"enum": null,
+				"maximum": 100,
+				"minimum": 1,
+				"name": "limit",
+				"required": false,
+				"type": "integer"
+			},
+			{
+				"description": "meta.cursor from the preceding page. Omit for the first page. Not with versions.",
+				"enum": null,
+				"name": "cursor",
+				"required": false,
+				"type": "string"
+			},
+			{
+				"description": "Read only these version numbers, comma-separated, at most 100. Not with limit or cursor.",
+				"enum": null,
+				"name": "versions",
+				"required": false,
+				"type": "string"
+			}
+		],
+		"headerParams": [],
+		"permissions": ["mail:read"],
+		"access": null,
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"properties": {
+					"version": {
+						"type": "integer",
+						"exclusiveMinimum": 0
+					},
+					"english": {
+						"type": "string",
+						"description": "What its author asked for, in their words."
+					},
+					"tree": {
+						"type": "object",
+						"properties": {
+							"version": {
+								"type": "number",
+								"const": 1
+							},
+							"vocabulary": {
+								"type": "string",
+								"description": "Vocabulary version, such as v1."
+							},
+							"when": {
+								"type": "object",
+								"propertyNames": { "type": "string" },
+								"additionalProperties": {},
+								"description": "A condition {column, op, value?, min_confidence?} (see GET /email-rules/vocabulary) or {all: [...]}, {any: [...]}, {not: ...}."
+							},
+							"questions": {
+								"type": "array",
+								"items": { "type": "string" },
+								"description": "Yes/no questions asked once the conditions match, over the email's text and attachment names, never attachment contents. A grant rule needs every one yes; a do_not_share rule matches on any yes."
+							}
+						},
+						"required": [
+							"version",
+							"vocabulary",
+							"when",
+							"questions"
+						]
+					},
+					"explanation": {
+						"type": "string",
+						"description": "What the rule matches, as compiled."
+					},
+					"assumptions": {
+						"type": "array",
+						"items": { "type": "string" }
+					},
+					"compiled_by": { "type": "string" },
+					"vocabulary": { "type": "string" },
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"version",
+					"english",
+					"tree",
+					"explanation",
+					"assumptions",
+					"compiled_by",
+					"vocabulary",
+					"created_at"
+				]
+			}
+		},
+		"sdkName": "listEmailRuleVersionsCoveringMe",
+		"summary": "Read versions of a rule over your mail",
+		"tag": "Email Rule Oversight",
+		"tagCommand": "email-rule-oversight"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -14358,7 +15186,7 @@ const operationManifest = [
 						"exclusiveMinimum": 0
 					},
 					"receivers": {
-						"description": "Null when it could not be read in time; try again.",
+						"description": "Null when it could not be read in time, or for a rule shown in draft or observe that turned active or was deleted after the page was read; try again.",
 						"anyOf": [{
 							"type": "object",
 							"properties": {
@@ -14401,6 +15229,187 @@ const operationManifest = [
 											"count": {
 												"type": "integer",
 												"exclusiveMinimum": 0
+											},
+											"reads_in_full": {
+												"description": "On a rule over your mail: how many of these keys also list one of your own mailboxes, or its domain, so they read your mail there beyond what this rule matches.",
+												"type": "integer",
+												"minimum": 0
+											},
+											"newest_at": {
+												"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+												"type": "string",
+												"format": "date-time"
+											}
+										},
+										"required": ["owner", "count"]
+									},
+									"description": "API keys that work now (not revoked, expired or suspended) and hold mail:read, whose access lists the rule or its live share. Owner: who holds each, or the organization."
+								},
+								"webhooks": {
+									"type": "array",
+									"items": {
+										"type": "object",
+										"properties": {
+											"owner": { "anyOf": [{
+												"type": "object",
+												"properties": {
+													"kind": {
+														"type": "string",
+														"const": "member"
+													},
+													"user_id": {
+														"type": "string",
+														"description": "The member's user id.",
+														"format": "uuid"
+													},
+													"name": {
+														"description": "Their name; null when they have none set.",
+														"type": ["string", "null"]
+													}
+												},
+												"required": [
+													"kind",
+													"user_id",
+													"name"
+												]
+											}, {
+												"type": "object",
+												"properties": { "kind": {
+													"type": "string",
+													"const": "organization",
+													"description": "Held by no member: an organization key, or one whose holder has left."
+												} },
+												"required": ["kind"]
+											}] },
+											"count": {
+												"type": "integer",
+												"exclusiveMinimum": 0
+											},
+											"hosts": {
+												"description": "Distinct sites they deliver to (the domain a host is registered under, an app's own name on a known app platform, or a function URL service in its region), sorted, at most 10; \"unknown host\" (last) for any that cannot be named.",
+												"type": "array",
+												"items": { "type": "string" }
+											},
+											"hosts_not_listed": {
+												"description": "Hosts past those listed.",
+												"type": "integer",
+												"minimum": 0
+											},
+											"newest_at": {
+												"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+												"type": "string",
+												"format": "date-time"
+											}
+										},
+										"required": ["owner", "count"]
+									},
+									"description": "Webhooks taking received mail, bounces or reports that are sent what it matches: those of the key delivery acts as, when it lists the rule or its live share (owner: its holder, or the organization), and those of the member it is shared with (owner: that member)."
+								},
+								"shares": {
+									"type": "array",
+									"items": {
+										"type": "object",
+										"properties": {
+											"beneficiary": {
+												"type": "object",
+												"properties": {
+													"kind": {
+														"type": "string",
+														"const": "member"
+													},
+													"user_id": {
+														"type": "string",
+														"description": "The member's user id.",
+														"format": "uuid"
+													},
+													"name": {
+														"description": "Their name; null when they have none set.",
+														"type": ["string", "null"]
+													}
+												},
+												"required": [
+													"kind",
+													"user_id",
+													"name"
+												]
+											},
+											"count": {
+												"type": "integer",
+												"exclusiveMinimum": 0
+											},
+											"newest_at": {
+												"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+												"type": "string",
+												"format": "date-time"
+											}
+										},
+										"required": ["beneficiary", "count"]
+									},
+									"description": "The rule's live share (at most one), by its member, if they can read it and it is among their newest 20 shares."
+								}
+							},
+							"required": [
+								"keys",
+								"webhooks",
+								"shares"
+							],
+							"description": "Who receives what the rule shares, by person and count. As receivers, empty unless it is an active grant rule."
+						}, { "type": "null" }]
+					},
+					"receivers_once_active": {
+						"description": "For a grant rule in draft or observe: who would receive what it matches once it is turned active. None of them receives anything yet. Null for any other rule, and as receivers is null.",
+						"anyOf": [{
+							"type": "object",
+							"properties": {
+								"keys": {
+									"type": "array",
+									"items": {
+										"type": "object",
+										"properties": {
+											"owner": { "anyOf": [{
+												"type": "object",
+												"properties": {
+													"kind": {
+														"type": "string",
+														"const": "member"
+													},
+													"user_id": {
+														"type": "string",
+														"description": "The member's user id.",
+														"format": "uuid"
+													},
+													"name": {
+														"description": "Their name; null when they have none set.",
+														"type": ["string", "null"]
+													}
+												},
+												"required": [
+													"kind",
+													"user_id",
+													"name"
+												]
+											}, {
+												"type": "object",
+												"properties": { "kind": {
+													"type": "string",
+													"const": "organization",
+													"description": "Held by no member: an organization key, or one whose holder has left."
+												} },
+												"required": ["kind"]
+											}] },
+											"count": {
+												"type": "integer",
+												"exclusiveMinimum": 0
+											},
+											"reads_in_full": {
+												"description": "On a rule over your mail: how many of these keys also list one of your own mailboxes, or its domain, so they read your mail there beyond what this rule matches.",
+												"type": "integer",
+												"minimum": 0
+											},
+											"newest_at": {
+												"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+												"type": "string",
+												"format": "date-time"
 											}
 										},
 										"required": ["owner", "count"]
@@ -14448,7 +15457,7 @@ const operationManifest = [
 												"exclusiveMinimum": 0
 											},
 											"hosts": {
-												"description": "Distinct sites they deliver to (a host's registrable domain, or a tunnel, preview or function service alone), sorted, at most 10; \"unknown host\" (last) for any that cannot be named.",
+												"description": "Distinct sites they deliver to (the domain a host is registered under, an app's own name on a known app platform, or a function URL service in its region), sorted, at most 10; \"unknown host\" (last) for any that cannot be named.",
 												"type": "array",
 												"items": { "type": "string" }
 											},
@@ -14456,6 +15465,11 @@ const operationManifest = [
 												"description": "Hosts past those listed.",
 												"type": "integer",
 												"minimum": 0
+											},
+											"newest_at": {
+												"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+												"type": "string",
+												"format": "date-time"
 											}
 										},
 										"required": ["owner", "count"]
@@ -14493,6 +15507,11 @@ const operationManifest = [
 											"count": {
 												"type": "integer",
 												"exclusiveMinimum": 0
+											},
+											"newest_at": {
+												"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+												"type": "string",
+												"format": "date-time"
 											}
 										},
 										"required": ["beneficiary", "count"]
@@ -14505,7 +15524,7 @@ const operationManifest = [
 								"webhooks",
 								"shares"
 							],
-							"description": "Who receives what the rule shares now, by person and count; empty unless it is an active grant rule."
+							"description": "Who receives what the rule shares, by person and count. As receivers, empty unless it is an active grant rule."
 						}, { "type": "null" }]
 					},
 					"created_at": {
@@ -14523,6 +15542,7 @@ const operationManifest = [
 					"covers",
 					"current_version",
 					"receivers",
+					"receivers_once_active",
 					"created_at"
 				]
 			}
@@ -14629,8 +15649,14 @@ const operationManifest = [
 						"email"
 					]
 				},
-				"is_objector": { "type": "boolean" },
-				"is_author": { "type": "boolean" },
+				"is_objector": {
+					"type": "boolean",
+					"description": "Whether you made it, in your current membership."
+				},
+				"is_author": {
+					"type": "boolean",
+					"description": "Whether it is to a rule you wrote, in your current membership."
+				},
 				"message": {
 					"description": "Why the objector objects; null when none was given, or once withdrawn.",
 					"type": ["string", "null"]
@@ -14757,7 +15783,7 @@ const operationManifest = [
 					}
 				},
 				"warnings": {
-					"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
+					"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test, or on a grant rule that tests only who an email was sent to (on a rule request, every compiler note on the rule).",
 					"maxItems": 10,
 					"type": "array",
 					"items": {
@@ -14780,7 +15806,7 @@ const operationManifest = [
 							"checked": {
 								"type": "integer",
 								"minimum": 0,
-								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in the scope counted (evaluation_scope as sent; by default your own mailboxes, for a grant rule those you may share), the ones you can still read."
 							},
 							"matched": {
 								"type": "integer",
@@ -14799,7 +15825,7 @@ const operationManifest = [
 							"checked": {
 								"type": "integer",
 								"minimum": 0,
-								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in the scope counted (evaluation_scope as sent; by default your own mailboxes, for a grant rule those you may share), the ones you can still read."
 							},
 							"matched": {
 								"type": "integer",
@@ -14896,6 +15922,16 @@ const operationManifest = [
 											"pattern": "^[^\\u0000]*$"
 										}
 									},
+									"attachment_names": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+										}
+									},
 									"automated": { "type": "boolean" },
 									"from_mailing_list": { "type": "boolean" },
 									"spam_score": {
@@ -15206,6 +16242,15 @@ const operationManifest = [
 							"type": "boolean",
 							"description": "Whether you are its author, in your current membership. Only its author edits it."
 						},
+						"pending_objections": {
+							"description": "To its author, on the dashboard or the Primitive CLI: objections to it waiting for their answer (GET /email-rule-objections). A write's answer leaves it out when it could not be read in time: absent is not 0.",
+							"type": "integer",
+							"minimum": 0
+						},
+						"objection_notice": {
+							"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+							"type": "string"
+						},
 						"created_at": {
 							"type": "string",
 							"format": "date-time"
@@ -15473,7 +16518,7 @@ const operationManifest = [
 					]
 				},
 				"notice": {
-					"description": "What is now shared, in words.",
+					"description": "What is now shared, in words. When you changed the rule and it can now match mail the request left out by who it was sent to (such as mail where an address is only copied), that comes first.",
 					"type": "string"
 				}
 			},
@@ -15574,7 +16619,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "compile-email-rule",
-		"description": "Turns a plain-English description of which received emails to match into a rule tree over the column contract, with an explanation of what it matches, the assumptions made, and warnings for what the columns cannot express. Where the columns fall short it adds up to five yes/no questions, asked only after the conditions match; they read the subject, the new text and attachment file names, never attachment contents. Nothing is saved. For a rule with no questions, breadth counts, read only, how much of your recent classified mail its conditions match; for a grant rule with questions, conditions_breadth counts its conditions alone. include_sql returns the SQL it renders to. kind do_not_share compiles for recall. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
+		"description": "Turns a plain-English description of which received emails to match into a rule tree over the column contract, with an explanation of what it matches, the assumptions made, and warnings for what the columns cannot express. Where the columns fall short it adds up to five yes/no questions, asked only after the conditions match; they read the subject, the new text and attachment file names, never attachment contents. Nothing is saved. For a rule with no questions, breadth counts, read only, how much of the recent classified mail in evaluation_scope (by default your own mailboxes) its conditions match; for a grant rule with questions, conditions_breadth counts its conditions alone. include_sql returns the SQL it renders to. kind do_not_share compiles for recall. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "compileEmailRule",
@@ -15607,6 +16652,42 @@ const operationManifest = [
 				"include_sql": {
 					"description": "Also return the SQL the rule renders to. Off by default.",
 					"type": "boolean"
+				},
+				"evaluation_scope": {
+					"description": "The scope breadth is counted over, as a test of the tree runs it: send the one you will save the rule with. Nothing is saved. own_mailboxes (the default): mail to your own addresses and agents (for a rule that shares, those mail:share_own lets you share). author: all you can read, inboxes added later included. selected: what scope_selection names.",
+					"type": "string",
+					"enum": [
+						"author",
+						"own_mailboxes",
+						"selected"
+					]
+				},
+				"scope_selection": {
+					"type": "object",
+					"properties": {
+						"addresses": {
+							"maxItems": 100,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 3,
+								"maxLength": 320,
+								"pattern": "^[^\\s@]+@[^\\s@]+$"
+							}
+						},
+						"domains": {
+							"maxItems": 50,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 253,
+								"pattern": "^[^\\s@]+\\.[^\\s@]+$"
+							}
+						}
+					},
+					"additionalProperties": false,
+					"description": "For a selected rule: inboxes, and domains (each address at them the author reads); each one you can read."
 				}
 			},
 			"required": ["english"],
@@ -15669,14 +16750,14 @@ const operationManifest = [
 					"enum": ["grant", "do_not_share"]
 				},
 				"breadth": {
-					"description": "How many of your recent emails its conditions hold for, counted over your own mailboxes whatever scope you save it with, warning or not. Null when not counted in full: a rule with questions, headers-only access, no test of it possible as you, or a count that failed or ran out of time. Writes ignore it, so a compile answer (without include_sql) can be sent back unchanged.",
+					"description": "How many recent emails its conditions hold for, warning or not, counted over evaluation_scope as sent (by default your own mailboxes, whatever scope you save it with). Null when not counted in full: a rule with questions, headers-only access, no test of it possible as you, a count that failed or ran out of time, or, with no scope sent, a rule that holds only for mail to To or Cc addresses outside your own mailboxes (a warning says so). Writes ignore it, so a compile answer (without include_sql) can be sent back unchanged.",
 					"anyOf": [{
 						"type": "object",
 						"properties": {
 							"checked": {
 								"type": "integer",
 								"minimum": 0,
-								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in the scope counted (evaluation_scope as sent; by default your own mailboxes, for a grant rule those you may share), the ones you can still read."
 							},
 							"matched": {
 								"type": "integer",
@@ -15695,7 +16776,7 @@ const operationManifest = [
 							"checked": {
 								"type": "integer",
 								"minimum": 0,
-								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in the scope counted (evaluation_scope as sent; by default your own mailboxes, for a grant rule those you may share), the ones you can still read."
 							},
 							"matched": {
 								"type": "integer",
@@ -15919,6 +17000,16 @@ const operationManifest = [
 											"pattern": "^[^\\u0000]*$"
 										}
 									},
+									"attachment_names": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+										}
+									},
 									"automated": { "type": "boolean" },
 									"from_mailing_list": { "type": "boolean" },
 									"spam_score": {
@@ -15997,7 +17088,7 @@ const operationManifest = [
 					}
 				},
 				"warnings": {
-					"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
+					"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test, or on a grant rule that tests only who an email was sent to (on a rule request, every compiler note on the rule).",
 					"maxItems": 10,
 					"type": "array",
 					"items": {
@@ -16020,7 +17111,7 @@ const operationManifest = [
 							"checked": {
 								"type": "integer",
 								"minimum": 0,
-								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in the scope counted (evaluation_scope as sent; by default your own mailboxes, for a grant rule those you may share), the ones you can still read."
 							},
 							"matched": {
 								"type": "integer",
@@ -16039,7 +17130,7 @@ const operationManifest = [
 							"checked": {
 								"type": "integer",
 								"minimum": 0,
-								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in the scope counted (evaluation_scope as sent; by default your own mailboxes, for a grant rule those you may share), the ones you can still read."
 							},
 							"matched": {
 								"type": "integer",
@@ -16148,6 +17239,15 @@ const operationManifest = [
 					"type": "boolean",
 					"description": "Whether you are its author, in your current membership. Only its author edits it."
 				},
+				"pending_objections": {
+					"description": "To its author, on the dashboard or the Primitive CLI: objections to it waiting for their answer (GET /email-rule-objections). A write's answer leaves it out when it could not be read in time: absent is not 0.",
+					"type": "integer",
+					"minimum": 0
+				},
+				"objection_notice": {
+					"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+					"type": "string"
+				},
 				"created_at": {
 					"type": "string",
 					"format": "date-time"
@@ -16274,6 +17374,27 @@ const operationManifest = [
 						]
 					}
 				},
+				"expectations": {
+					"description": "Its saved expectations, each list by email id, as stored: on every create, and on an update that set or removed them.",
+					"type": "object",
+					"properties": {
+						"match": {
+							"type": "array",
+							"items": {
+								"type": "string",
+								"format": "uuid"
+							}
+						},
+						"no_match": {
+							"type": "array",
+							"items": {
+								"type": "string",
+								"format": "uuid"
+							}
+						}
+					},
+					"required": ["match", "no_match"]
+				},
 				"expectation_samples": {
 					"description": "Its saved made-up emails, when this write set or added some.",
 					"type": "array",
@@ -16351,6 +17472,16 @@ const operationManifest = [
 											"pattern": "^[^\\u0000]*$"
 										}
 									},
+									"attachment_names": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+										}
+									},
 									"automated": { "type": "boolean" },
 									"from_mailing_list": { "type": "boolean" },
 									"spam_score": {
@@ -16476,6 +17607,10 @@ const operationManifest = [
 				"notice": {
 					"description": "After a write that saved a version of an active rule keys or webhooks read without checking it first: what it changes, and how to have the next one checked.",
 					"type": "string"
+				},
+				"share_notice": {
+					"description": "After a write that ended the rule's share: that it did, given even when affects is not, with whom it was with and the version they accepted when those can be read.",
+					"type": "string"
 				}
 			},
 			"required": [
@@ -16595,7 +17730,7 @@ const operationManifest = [
 					}
 				},
 				"warnings": {
-					"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
+					"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test, or on a grant rule that tests only who an email was sent to (on a rule request, every compiler note on the rule).",
 					"maxItems": 10,
 					"type": "array",
 					"items": {
@@ -16618,7 +17753,7 @@ const operationManifest = [
 							"checked": {
 								"type": "integer",
 								"minimum": 0,
-								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in the scope counted (evaluation_scope as sent; by default your own mailboxes, for a grant rule those you may share), the ones you can still read."
 							},
 							"matched": {
 								"type": "integer",
@@ -16637,7 +17772,7 @@ const operationManifest = [
 							"checked": {
 								"type": "integer",
 								"minimum": 0,
-								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in the scope counted (evaluation_scope as sent; by default your own mailboxes, for a grant rule those you may share), the ones you can still read."
 							},
 							"matched": {
 								"type": "integer",
@@ -17097,7 +18232,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "delete-email-rule",
-		"description": "Deletes a rule with its versions, its decisions and the access it granted. A share of it ends (end_reason rule_deleted), and the member who shared can still list what it handed over. The answer lists the shares it ended (ended_shares) and the unrevoked keys that still list it, which now read nothing through it (keys, other_keys; left out when they could not be read). The author or a reader of all the organization's mail may delete it; while it is shared, only the author or someone who manages members from the dashboard. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
+		"description": "Deletes a rule with its versions, its decisions and the access it granted. A share of it ends (end_reason rule_deleted), and the member who shared can still list what it handed over. The answer lists the shares it ended (ended_shares), says whom with (share_notice), and lists the unrevoked keys that still list it, which now read nothing through it (keys, other_keys; left out when they could not be read). The author or a reader of all the organization's mail may delete it; while it is shared, only the author or someone who manages members from the dashboard. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": false,
 		"method": "DELETE",
 		"operationId": "deleteEmailRule",
@@ -17149,6 +18284,10 @@ const operationManifest = [
 				"other_keys": {
 					"description": "How many more keys, not revoked, list the rule that you may not read. They are not named.",
 					"type": "integer"
+				},
+				"share_notice": {
+					"description": "When the delete ended a share: that it did, with whom it was with and the version they accepted when those can be read.",
+					"type": "string"
 				}
 			},
 			"required": ["deleted"]
@@ -17321,7 +18460,7 @@ const operationManifest = [
 					"description": "For a selected rule: inboxes, and domains (each address at them the author reads); each one you can read."
 				},
 				"rule_id": {
-					"description": "A saved rule you can see: its current version and words.",
+					"description": "A saved rule you can see, or one that covers your mailboxes (as you, sent to one of them; dashboard or Primitive CLI only): its current version and words.",
 					"type": "string",
 					"format": "uuid"
 				},
@@ -17447,6 +18586,10 @@ const operationManifest = [
 										"type": "array",
 										"items": { "type": "string" }
 									},
+									"attachment_names": {
+										"type": "array",
+										"items": { "type": "string" }
+									},
 									"automated": { "type": "boolean" },
 									"from_mailing_list": { "type": "boolean" }
 								},
@@ -17457,6 +18600,7 @@ const operationManifest = [
 									"subject",
 									"text",
 									"attachment_types",
+									"attachment_names",
 									"automated",
 									"from_mailing_list"
 								],
@@ -17671,6 +18815,15 @@ const operationManifest = [
 					"type": "boolean",
 					"description": "Whether you are its author, in your current membership. Only its author edits it."
 				},
+				"pending_objections": {
+					"description": "To its author, on the dashboard or the Primitive CLI: objections to it waiting for their answer (GET /email-rule-objections). A write's answer leaves it out when it could not be read in time: absent is not 0.",
+					"type": "integer",
+					"minimum": 0
+				},
+				"objection_notice": {
+					"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+					"type": "string"
+				},
 				"created_at": {
 					"type": "string",
 					"format": "date-time"
@@ -17865,6 +19018,16 @@ const operationManifest = [
 											"pattern": "^[^\\u0000]*$"
 										}
 									},
+									"attachment_names": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+										}
+									},
 									"automated": { "type": "boolean" },
 									"from_mailing_list": { "type": "boolean" },
 									"spam_score": {
@@ -19329,6 +20492,16 @@ const operationManifest = [
 													"count": {
 														"type": "integer",
 														"exclusiveMinimum": 0
+													},
+													"reads_in_full": {
+														"description": "On a rule over your mail: how many of these keys also list one of your own mailboxes, or its domain, so they read your mail there beyond what this rule matches.",
+														"type": "integer",
+														"minimum": 0
+													},
+													"newest_at": {
+														"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+														"type": "string",
+														"format": "date-time"
 													}
 												},
 												"required": ["owner", "count"]
@@ -19376,7 +20549,7 @@ const operationManifest = [
 														"exclusiveMinimum": 0
 													},
 													"hosts": {
-														"description": "Distinct sites they deliver to (a host's registrable domain, or a tunnel, preview or function service alone), sorted, at most 10; \"unknown host\" (last) for any that cannot be named.",
+														"description": "Distinct sites they deliver to (the domain a host is registered under, an app's own name on a known app platform, or a function URL service in its region), sorted, at most 10; \"unknown host\" (last) for any that cannot be named.",
 														"type": "array",
 														"items": { "type": "string" }
 													},
@@ -19384,6 +20557,11 @@ const operationManifest = [
 														"description": "Hosts past those listed.",
 														"type": "integer",
 														"minimum": 0
+													},
+													"newest_at": {
+														"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+														"type": "string",
+														"format": "date-time"
 													}
 												},
 												"required": ["owner", "count"]
@@ -19421,6 +20599,11 @@ const operationManifest = [
 													"count": {
 														"type": "integer",
 														"exclusiveMinimum": 0
+													},
+													"newest_at": {
+														"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+														"type": "string",
+														"format": "date-time"
 													}
 												},
 												"required": ["beneficiary", "count"]
@@ -19433,7 +20616,7 @@ const operationManifest = [
 										"webhooks",
 										"shares"
 									],
-									"description": "Who receives what the rule shares now, by person and count; empty unless it is an active grant rule."
+									"description": "Who receives what the rule shares, by person and count. As receivers, empty unless it is an active grant rule."
 								}, { "type": "null" }]
 							}
 						},
@@ -20420,6 +21603,15 @@ const operationManifest = [
 						"type": "boolean",
 						"description": "Whether you are its author, in your current membership. Only its author edits it."
 					},
+					"pending_objections": {
+						"description": "To its author, on the dashboard or the Primitive CLI: objections to it waiting for their answer (GET /email-rule-objections). A write's answer leaves it out when it could not be read in time: absent is not 0.",
+						"type": "integer",
+						"minimum": 0
+					},
+					"objection_notice": {
+						"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+						"type": "string"
+					},
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -20867,6 +22059,16 @@ const operationManifest = [
 													"pattern": "^[^\\u0000]*$"
 												}
 											},
+											"attachment_names": {
+												"maxItems": 10,
+												"type": "array",
+												"items": {
+													"type": "string",
+													"minLength": 1,
+													"maxLength": 255,
+													"pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+												}
+											},
 											"automated": { "type": "boolean" },
 											"from_mailing_list": { "type": "boolean" },
 											"spam_score": {
@@ -21177,6 +22379,11 @@ const operationManifest = [
 							"minimum": 0,
 							"description": "Emails decided on their conditions: matched, near_miss and no_match, less any missing a fact the rule reads."
 						},
+						"conditions_held": {
+							"description": "Of decided, how many its conditions alone held for. Compile's breadth and conditions_breadth count this over recent mail in the scope sent to it, by default your own; here it is counted over the emails this test decided.",
+							"type": "integer",
+							"minimum": 0
+						},
 						"conditions": {
 							"type": "array",
 							"items": {
@@ -21244,7 +22451,7 @@ const operationManifest = [
 						"warnings": {
 							"type": "array",
 							"items": { "type": "string" },
-							"description": "What to look at first, such as what stopped every email when nothing matched."
+							"description": "What to look at first, such as what stopped every email when nothing matched. On a test of the recent window, a grant rule whose conditions held for more than 20% of at least 20 emails checked (at least 90% if it has no questions), or for every one of fewer, gets a warning saying so, before those about what it decided."
 						}
 					},
 					"required": [
@@ -21447,7 +22654,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "test-email-rule-on-sample",
-		"description": "Reports what a rule would decide for an email you describe (sender, recipients, subject, plain text, attachment types; optionally automated, from a mailing list, and a spam score), classified and decided as received mail would be. A rule reading a spam score you gave none for decides on none (unset_columns). Nothing is stored. Test an unsaved tree or a saved rule by rule_id. The answer includes what the classifier read. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
+		"description": "Reports what a rule would decide for an email you describe (sender, recipients, subject, plain text, attachment types and file names; optionally automated, from a mailing list, and a spam score), classified and decided as received mail would be. A rule reading a spam score you gave none for decides on none (unset_columns). Nothing is stored. Test an unsaved tree or a saved rule by rule_id. The answer includes what the classifier read. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "testEmailRuleOnSample",
@@ -21533,7 +22740,7 @@ const operationManifest = [
 					"description": "For a selected rule: inboxes, and domains (each address at them the author reads); each one you can read."
 				},
 				"rule_id": {
-					"description": "A saved rule you can see. Its current version is tested.",
+					"description": "A saved rule you can see, or one that covers your mailboxes (as you; dashboard or Primitive CLI only). Its current version is tested.",
 					"type": "string",
 					"format": "uuid"
 				},
@@ -21604,6 +22811,17 @@ const operationManifest = [
 								"maxLength": 255
 							}
 						},
+						"attachment_names": {
+							"description": "File names of those attachments, which the classifier and the questions read. With attachment_types, the same number, paired in order.",
+							"maxItems": 20,
+							"type": "array",
+							"items": {
+								"type": "string",
+								"minLength": 1,
+								"maxLength": 255,
+								"pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+							}
+						},
 						"automated": {
 							"description": "Whether the email was sent automatically, as its headers would show. Defaults to false.",
 							"type": "boolean"
@@ -21890,7 +23108,7 @@ const operationManifest = [
 					}
 				},
 				"warnings": {
-					"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
+					"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test, or on a grant rule that tests only who an email was sent to (on a rule request, every compiler note on the rule).",
 					"maxItems": 10,
 					"type": "array",
 					"items": {
@@ -21913,7 +23131,7 @@ const operationManifest = [
 							"checked": {
 								"type": "integer",
 								"minimum": 0,
-								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in the scope counted (evaluation_scope as sent; by default your own mailboxes, for a grant rule those you may share), the ones you can still read."
 							},
 							"matched": {
 								"type": "integer",
@@ -21932,7 +23150,7 @@ const operationManifest = [
 							"checked": {
 								"type": "integer",
 								"minimum": 0,
-								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in your own mailboxes (for a grant rule, those you may share), the ones you can still read."
+								"description": "Classified emails the conditions were decided for: of the newest 200 from the last 30 days in the scope counted (evaluation_scope as sent; by default your own mailboxes, for a grant rule those you may share), the ones you can still read."
 							},
 							"matched": {
 								"type": "integer",
@@ -22091,6 +23309,16 @@ const operationManifest = [
 											"pattern": "^[^\\u0000]*$"
 										}
 									},
+									"attachment_names": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+										}
+									},
 									"automated": { "type": "boolean" },
 									"from_mailing_list": { "type": "boolean" },
 									"spam_score": {
@@ -22198,6 +23426,16 @@ const operationManifest = [
 											"pattern": "^[^\\u0000]*$"
 										}
 									},
+									"attachment_names": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+										}
+									},
 									"automated": { "type": "boolean" },
 									"from_mailing_list": { "type": "boolean" },
 									"spam_score": {
@@ -22332,6 +23570,15 @@ const operationManifest = [
 					"type": "boolean",
 					"description": "Whether you are its author, in your current membership. Only its author edits it."
 				},
+				"pending_objections": {
+					"description": "To its author, on the dashboard or the Primitive CLI: objections to it waiting for their answer (GET /email-rule-objections). A write's answer leaves it out when it could not be read in time: absent is not 0.",
+					"type": "integer",
+					"minimum": 0
+				},
+				"objection_notice": {
+					"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+					"type": "string"
+				},
 				"created_at": {
 					"type": "string",
 					"format": "date-time"
@@ -22458,6 +23705,27 @@ const operationManifest = [
 						]
 					}
 				},
+				"expectations": {
+					"description": "Its saved expectations, each list by email id, as stored: on every create, and on an update that set or removed them.",
+					"type": "object",
+					"properties": {
+						"match": {
+							"type": "array",
+							"items": {
+								"type": "string",
+								"format": "uuid"
+							}
+						},
+						"no_match": {
+							"type": "array",
+							"items": {
+								"type": "string",
+								"format": "uuid"
+							}
+						}
+					},
+					"required": ["match", "no_match"]
+				},
 				"expectation_samples": {
 					"description": "Its saved made-up emails, when this write set or added some.",
 					"type": "array",
@@ -22535,6 +23803,16 @@ const operationManifest = [
 											"pattern": "^[^\\u0000]*$"
 										}
 									},
+									"attachment_names": {
+										"maxItems": 10,
+										"type": "array",
+										"items": {
+											"type": "string",
+											"minLength": 1,
+											"maxLength": 255,
+											"pattern": "^[^\\u0000-\\u001f\\u007f]*$"
+										}
+									},
 									"automated": { "type": "boolean" },
 									"from_mailing_list": { "type": "boolean" },
 									"spam_score": {
@@ -22660,6 +23938,10 @@ const operationManifest = [
 				"notice": {
 					"description": "After a write that saved a version of an active rule keys or webhooks read without checking it first: what it changes, and how to have the next one checked.",
 					"type": "string"
+				},
+				"share_notice": {
+					"description": "After a write that ended the rule's share: that it did, given even when affects is not, with whom it was with and the version they accepted when those can be read.",
+					"type": "string"
 				}
 			},
 			"required": [
@@ -24272,6 +25554,29 @@ const operationManifest = [
 						}
 					}
 				},
+				"attachments": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"description": "Metadata for one attachment. The bytes are not inline; download\nall attachments for a message as a gzipped tarball via\n`/emails/{id}/attachments.tar.gz`. `sha256` lets you verify a\nspecific part after extraction.\n",
+						"properties": {
+							"filename": { "type": ["string", "null"] },
+							"content_type": { "type": ["string", "null"] },
+							"size_bytes": { "type": "integer" },
+							"sha256": { "type": ["string", "null"] },
+							"part_index": {
+								"type": "integer",
+								"description": "Zero-based index of this part within the message."
+							},
+							"tar_path": {
+								"type": "string",
+								"description": "This part's file name inside the message's attachments archive. Absent on attachments stored before it was recorded."
+							}
+						},
+						"required": ["size_bytes"]
+					},
+					"description": "Attachment metadata (file name, type, size), the same items in the same order as `parsed.attachments`. Kept for a credential that reads headers only, where `parsed` is null. Empty when the email has none, its content is withheld (read `status` and `rejection_reason`), or it is not parsed yet or its parse failed (read `parse_status`). No bytes; download a part with `/emails/{id}/attachments/{part_index}`."
+				},
 				"imported": {
 					"type": ["object", "null"],
 					"description": "Historical acquisition; never sender or SMTP delivery proof. Null for live mail. Excluded from live tails and deltas.",
@@ -24330,6 +25635,7 @@ const operationManifest = [
 				"from_verified",
 				"from_header_email",
 				"from_name",
+				"attachments",
 				"imported",
 				"snippet"
 			]
@@ -24590,6 +25896,94 @@ const operationManifest = [
 		"tag": "Emails",
 		"tagCommand": "emails"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "import-google-mail-message",
+		"description": "Requires the organization email_import entitlement, granted by staff. Only the configured current owner, using a full personal session or verified first-party CLI, may import into the configured primary mailbox. Primitive verifies the transient provider token and fetches RAW content itself. No raw uploads or client provenance are accepted. Sent, draft, spam and trash messages are skipped. Historical mail appears in normal history without live delivery effects. An indeterminate response requires retrying the same provider ID. User provider credentials are never stored or queued.",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "importGoogleMailMessage",
+		"path": "/mail-imports/google/messages",
+		"pathParams": [],
+		"queryParams": [],
+		"headerParams": [{
+			"description": "Transient provider user access token. Send only in this redacted header, never in a URL or JSON body. Uses the dedicated configured desktop client and readonly/identity scopes.",
+			"enum": null,
+			"name": "X-Primitive-Google-Access-Token",
+			"required": true,
+			"type": "string"
+		}, {
+			"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+			"enum": null,
+			"name": "Idempotency-Key",
+			"required": false,
+			"type": "string"
+		}],
+		"permissions": ["mail:read"],
+		"access": null,
+		"requestSchema": {
+			"type": "object",
+			"properties": { "message_id": {
+				"type": "string",
+				"pattern": "^[A-Za-z0-9_-]{1,128}$"
+			} },
+			"required": ["message_id"],
+			"additionalProperties": false
+		},
+		"responseSchema": { "anyOf": [
+			{
+				"type": "object",
+				"properties": {
+					"status": {
+						"type": "string",
+						"enum": ["imported", "already_present"]
+					},
+					"email_id": {
+						"type": "string",
+						"format": "uuid",
+						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+					}
+				},
+				"required": ["status", "email_id"]
+			},
+			{
+				"type": "object",
+				"properties": { "status": {
+					"type": "string",
+					"enum": [
+						"suppressed",
+						"in_progress",
+						"indeterminate"
+					]
+				} },
+				"required": ["status"]
+			},
+			{
+				"type": "object",
+				"properties": {
+					"status": {
+						"type": "string",
+						"const": "skipped"
+					},
+					"reason": {
+						"type": "string",
+						"enum": [
+							"excluded_label",
+							"out_of_window",
+							"too_large",
+							"provider_missing"
+						]
+					}
+				},
+				"required": ["status", "reason"]
+			}
+		] },
+		"sdkName": "importGoogleMailMessage",
+		"summary": "Import one historical Google Workspace message",
+		"tag": "Emails",
+		"tagCommand": "emails"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -25306,6 +26700,50 @@ const operationManifest = [
 		"tag": "Emails",
 		"tagCommand": "emails"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "reconcile-google-mail-import",
+		"description": "The same configured owner may recover expired attempts after the email_import entitlement is revoked. Recovery does not require that entitlement. Selects only server-owned manifests for the configured mailbox/account/policy. No provider token, object keys, prefixes or email IDs are accepted. Unsettled uploads remain unresolved and charged; this operation does not promise automatic cleanup after a process dies.",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "reconcileGoogleMailImport",
+		"path": "/mail-imports/google/reconcile",
+		"pathParams": [],
+		"queryParams": [],
+		"headerParams": [{
+			"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+			"enum": null,
+			"name": "Idempotency-Key",
+			"required": false,
+			"type": "string"
+		}],
+		"permissions": ["mail:read"],
+		"access": null,
+		"requestSchema": {
+			"type": "object",
+			"properties": {},
+			"additionalProperties": false
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"cleaned": {
+					"type": "integer",
+					"minimum": 0
+				},
+				"unresolved": {
+					"type": "integer",
+					"minimum": 0
+				}
+			},
+			"required": ["cleaned", "unresolved"]
+		},
+		"sdkName": "reconcileGoogleMailImport",
+		"summary": "Reconcile scoped historical import attempts",
+		"tag": "Emails",
+		"tagCommand": "emails"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -35797,7 +37235,7 @@ const operationManifest = [
 		"pathParams": [],
 		"queryParams": [],
 		"headerParams": [{
-			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo or semantic search setting), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
+			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo, semantic search setting or email notification settings), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
 			"enum": null,
 			"name": "Primitive-Step-Up",
 			"required": false,
@@ -35943,7 +37381,7 @@ const operationManifest = [
 		"pathParams": [],
 		"queryParams": [],
 		"headerParams": [{
-			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo or semantic search setting), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
+			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo, semantic search setting or email notification settings), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
 			"enum": null,
 			"name": "Primitive-Step-Up",
 			"required": false,
@@ -35992,7 +37430,7 @@ const operationManifest = [
 		"pathParams": [],
 		"queryParams": [],
 		"headerParams": [{
-			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo or semantic search setting), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
+			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo, semantic search setting or email notification settings), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
 			"enum": null,
 			"name": "Primitive-Step-Up",
 			"required": false,
@@ -36052,7 +37490,7 @@ const operationManifest = [
 		"pathParams": [],
 		"queryParams": [],
 		"headerParams": [{
-			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo or semantic search setting), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
+			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo, semantic search setting or email notification settings), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
 			"enum": null,
 			"name": "Primitive-Step-Up",
 			"required": false,
@@ -45776,6 +47214,33 @@ const operationManifest = [
 					"type": "boolean",
 					"description": "Send an informational message the receiver need not answer or wake for. It is sent as an `ack` signal (status `received`) about the message in `in_reply_to`, whose note is `body_text` (at most 2000 characters, which may be omitted). Receivers see it as `fyi: true`. Plain text only: it cannot be combined with `body_html`, `attachments`, `payload_attachments` or `scheduled_at`, and on `/send-mail` it requires `in_reply_to`."
 				},
+				"unsubscribe": {
+					"type": "object",
+					"additionalProperties": false,
+					"required": ["url"],
+					"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of the message gets the same `url`, so send one message per recipient when the URL identifies who to unsubscribe. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
+					"properties": {
+						"url": {
+							"type": "string",
+							"minLength": 1,
+							"maxLength": 700,
+							"pattern": "^[Hh][Tt][Tt][Pp][Ss]://(?:[A-Za-z0-9\\-._~:/?#\\[\\]@!$&'()*+;=]|%[0-9A-Fa-f]{2})+$",
+							"description": "Absolute https URL that unsubscribes the recipient, at most 700 characters of URL characters only: printable ASCII with no spaces, double quotes, angle brackets or commas (percent-encode a comma as %2C), `%` only as a percent-encoded byte, `[` and `]` only around an IPv6 address host, a port from 1 to 65535, no `=?` (which mail readers can decode as an encoded word), and no user name or password. The host must be public: not a single-label name, `localhost` or a name under `.localhost`, `.internal`, `.local`, `.home.arpa` or `.localdomain`, or a loopback, link-local, private, shared, reserved, multicast or unspecified IP address, including an IPv6 address that embeds one. The scheme is written in lower case."
+						},
+						"one_click": {
+							"type": "boolean",
+							"default": true,
+							"description": "Whether to also write `List-Unsubscribe-Post: List-Unsubscribe=One-Click`, which tells the receiver it may unsubscribe with a single POST to `url`. Set false when `url` needs the recipient to open a page and confirm."
+						},
+						"mailto": {
+							"type": "string",
+							"minLength": 3,
+							"maxLength": 254,
+							"pattern": "^[A-Za-z0-9!$'*+=_~-]+(?:\\.[A-Za-z0-9!$'*+=_~-]+)*@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$",
+							"description": "An address to also offer as a `mailto:` unsubscribe, written after `url`. The address alone, without the `mailto:` prefix: at most 64 letters, digits and `.!$'*+=_~-` before the `@`, and a dotted domain after it. An `=` is written as `%3D` in the header."
+						}
+					}
+				},
 				"headers": {
 					"type": "object",
 					"maxProperties": 25,
@@ -46937,6 +48402,33 @@ const operationManifest = [
 						}
 					}
 				},
+				"unsubscribe": {
+					"type": "object",
+					"additionalProperties": false,
+					"required": ["url"],
+					"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of the message gets the same `url`, so send one message per recipient when the URL identifies who to unsubscribe. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
+					"properties": {
+						"url": {
+							"type": "string",
+							"minLength": 1,
+							"maxLength": 700,
+							"pattern": "^[Hh][Tt][Tt][Pp][Ss]://(?:[A-Za-z0-9\\-._~:/?#\\[\\]@!$&'()*+;=]|%[0-9A-Fa-f]{2})+$",
+							"description": "Absolute https URL that unsubscribes the recipient, at most 700 characters of URL characters only: printable ASCII with no spaces, double quotes, angle brackets or commas (percent-encode a comma as %2C), `%` only as a percent-encoded byte, `[` and `]` only around an IPv6 address host, a port from 1 to 65535, no `=?` (which mail readers can decode as an encoded word), and no user name or password. The host must be public: not a single-label name, `localhost` or a name under `.localhost`, `.internal`, `.local`, `.home.arpa` or `.localdomain`, or a loopback, link-local, private, shared, reserved, multicast or unspecified IP address, including an IPv6 address that embeds one. The scheme is written in lower case."
+						},
+						"one_click": {
+							"type": "boolean",
+							"default": true,
+							"description": "Whether to also write `List-Unsubscribe-Post: List-Unsubscribe=One-Click`, which tells the receiver it may unsubscribe with a single POST to `url`. Set false when `url` needs the recipient to open a page and confirm."
+						},
+						"mailto": {
+							"type": "string",
+							"minLength": 3,
+							"maxLength": 254,
+							"pattern": "^[A-Za-z0-9!$'*+=_~-]+(?:\\.[A-Za-z0-9!$'*+=_~-]+)*@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$",
+							"description": "An address to also offer as a `mailto:` unsubscribe, written after `url`. The address alone, without the `mailto:` prefix: at most 64 letters, digits and `.!$'*+=_~-` before the `@`, and a dotted domain after it. An `=` is written as `%3D` in the header."
+						}
+					}
+				},
 				"headers": {
 					"type": "object",
 					"maxProperties": 25,
@@ -47417,6 +48909,33 @@ const operationManifest = [
 								}
 							}
 						},
+						"unsubscribe": {
+							"type": "object",
+							"additionalProperties": false,
+							"required": ["url"],
+							"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of the message gets the same `url`, so send one message per recipient when the URL identifies who to unsubscribe. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
+							"properties": {
+								"url": {
+									"type": "string",
+									"minLength": 1,
+									"maxLength": 700,
+									"pattern": "^[Hh][Tt][Tt][Pp][Ss]://(?:[A-Za-z0-9\\-._~:/?#\\[\\]@!$&'()*+;=]|%[0-9A-Fa-f]{2})+$",
+									"description": "Absolute https URL that unsubscribes the recipient, at most 700 characters of URL characters only: printable ASCII with no spaces, double quotes, angle brackets or commas (percent-encode a comma as %2C), `%` only as a percent-encoded byte, `[` and `]` only around an IPv6 address host, a port from 1 to 65535, no `=?` (which mail readers can decode as an encoded word), and no user name or password. The host must be public: not a single-label name, `localhost` or a name under `.localhost`, `.internal`, `.local`, `.home.arpa` or `.localdomain`, or a loopback, link-local, private, shared, reserved, multicast or unspecified IP address, including an IPv6 address that embeds one. The scheme is written in lower case."
+								},
+								"one_click": {
+									"type": "boolean",
+									"default": true,
+									"description": "Whether to also write `List-Unsubscribe-Post: List-Unsubscribe=One-Click`, which tells the receiver it may unsubscribe with a single POST to `url`. Set false when `url` needs the recipient to open a page and confirm."
+								},
+								"mailto": {
+									"type": "string",
+									"minLength": 3,
+									"maxLength": 254,
+									"pattern": "^[A-Za-z0-9!$'*+=_~-]+(?:\\.[A-Za-z0-9!$'*+=_~-]+)*@[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+$",
+									"description": "An address to also offer as a `mailto:` unsubscribe, written after `url`. The address alone, without the `mailto:` prefix: at most 64 letters, digits and `.!$'*+=_~-` before the `@`, and a dotted domain after it. An `=` is written as `%3D` in the header."
+								}
+							}
+						},
 						"headers": {
 							"type": "object",
 							"maxProperties": 25,
@@ -50941,6 +52460,48 @@ function deliveryAttemptLines(data) {
 	}
 	return lines.length > 0 ? [`Attempts (${lines.length}):`, ...lines] : [];
 }
+/**
+* What an endpoint's DELIVERING column says, from `delivery` and never from
+* `enabled`: an endpoint can be on and still be sent nothing (its owner's key
+* revoked, say). A delivery the answer gives is read for any kind. Without
+* one, a webhook (or an endpoint of no stated kind) shows `unknown`, since it
+* could not be checked just now or the server does not say, and any other
+* kind (a Function or pull endpoint, which has no delivery) shows `-`.
+*/
+function deliveringCell(endpoint) {
+	const delivery = endpoint.delivery;
+	if (isRecord$3(delivery) && typeof delivery.delivering === "boolean") {
+		if (delivery.delivering) return "yes";
+		const codes = Array.isArray(delivery.reasons) ? delivery.reasons.flatMap((reason) => isRecord$3(reason) && typeof reason.code === "string" && reason.code ? [oneLine(reason.code)] : []) : [];
+		return codes.length > 0 ? `no (${codes.join(", ")})` : "no";
+	}
+	return endpoint.kind === void 0 || endpoint.kind === "http" ? "unknown" : "-";
+}
+/**
+* A table of an endpoints list (listEndpoints): each endpoint's id, kind,
+* whether it is on (ENABLED) and whether it is being sent mail at all
+* (DELIVERING, from `delivery`), and its name. Nothing for an empty list.
+*/
+function endpointDeliveryLines(data) {
+	const rows = Array.isArray(data) ? data.filter(isRecord$3) : [];
+	if (rows.length === 0) return [];
+	const text = (value) => typeof value === "string" && value ? oneLine(value) : "";
+	const table = [[
+		"ID",
+		"KIND",
+		"ENABLED",
+		"DELIVERING",
+		"NAME"
+	], ...rows.map((row) => [
+		text(row.id),
+		text(row.kind),
+		typeof row.enabled === "boolean" ? row.enabled ? "yes" : "no" : "",
+		deliveringCell(row),
+		text(row.name)
+	])];
+	const widths = table[0].map((_, column) => Math.max(...table.map((cells) => (cells[column] ?? "").length)));
+	return table.map((cells) => cells.map((cell, column) => column === cells.length - 1 ? cell : cell.padEnd(widths[column] ?? 0)).join("  ").trimEnd());
+}
 const routeReport = {
 	flags: {},
 	report: (data) => ({ lines: routeWarningLines(data) })
@@ -50951,6 +52512,10 @@ const ANSWER_REPORT_EXTENSIONS = {
 	getDelivery: {
 		flags: {},
 		report: (data) => ({ lines: deliveryAttemptLines(data) })
+	},
+	listEndpoints: {
+		flags: {},
+		report: (data) => ({ lines: endpointDeliveryLines(data) })
 	}
 };
 // src/oclif/user-grant.ts
@@ -52064,6 +53629,7 @@ const SAMPLE_EMAIL_KEYS = /* @__PURE__ */ new Set([
 	"subject",
 	"text",
 	"attachment_types",
+	"attachment_names",
 	"automated",
 	"from_mailing_list",
 	"spam_score"
@@ -52072,16 +53638,44 @@ const SAMPLE_TEXT_MAX = 4e3;
 const SAMPLE_SUBJECT_MAX = 998;
 const SAMPLE_LIST_MAX = 10;
 /**
+* The fields of each sample read from a file that this CLI does not know
+* (`email field "x"`, `sample field "y"`). They are sent as they are: the API
+* validates samples itself, so a field it added after this CLI was built is
+* not refused here. Said once per file, for the samples actually sent
+* (unknownFieldsNote).
+*/
+const UNKNOWN_FIELDS = /* @__PURE__ */ new WeakMap();
+/**
+* A field name from a file or an answer, quoted and safe to print: JSON
+* escapes control characters, and a long name is cut.
+*/
+function shownKey(key) {
+	return JSON.stringify(key.length > 60 ? `${key.slice(0, 57)}...` : key).replace(/[\u007f-\u009f]/g, "?");
+}
+/**
+* One line naming the fields this CLI does not know in the samples sent, with
+* the numbers of the samples in the file that carry each; null when none do.
+*/
+function unknownFieldsNote(source, sent, all) {
+	const carriers = /* @__PURE__ */ new Map();
+	for (const sample of sent) {
+		const number = all.indexOf(sample) + 1;
+		for (const field of UNKNOWN_FIELDS.get(sample) ?? []) carriers.set(field, [...carriers.get(field) ?? [], number]);
+	}
+	if (carriers.size === 0) return null;
+	return `${source} has fields this CLI does not know, which it does not refuse but leaves for the API to judge (if the API refuses one, take it out): ${[...carriers].map(([field, numbers]) => `${field} (sample${numbers.length === 1 ? "" : "s"} ${numbers.join(", ")})`).join(", ")}.`;
+}
+/**
 * Refuse, naming the sample and the field, a made-up email the API would
-* refuse to keep: the fields it takes and their bounds. The API checks the
-* rest (address forms, a NUL).
+* refuse to keep: the bounds of the fields it takes. Returns the fields this
+* CLI does not know, which are passed on. The API checks the rest (address
+* forms, a NUL).
 */
 function checkSampleEmail(email, at) {
 	const fail = (what) => {
 		throw usageError$2(`${at}: email ${what}.`);
 	};
-	const unknown = Object.keys(email).find((key) => !SAMPLE_EMAIL_KEYS.has(key));
-	if (unknown !== void 0) fail(`takes no "${unknown}" (it takes ${[...SAMPLE_EMAIL_KEYS].join(", ")})`);
+	const unknown = Object.keys(email).filter((key) => !SAMPLE_EMAIL_KEYS.has(key)).map((key) => `email field ${shownKey(key)}`);
 	if (!isRecord$1(email.from) || typeof email.from.address !== "string") fail("needs from.address");
 	const list = (key, min) => {
 		const value = email[key];
@@ -52091,10 +53685,15 @@ function checkSampleEmail(email, at) {
 	list("to", 1);
 	list("cc", 0);
 	list("attachment_types", 0);
+	list("attachment_names", 0);
+	const types = email.attachment_types;
+	const names = email.attachment_names;
+	if (Array.isArray(types) && Array.isArray(names) && types.length > 0 && names.length > 0 && types.length !== names.length) fail("attachment_names pairs with attachment_types by position, so give the same number of each");
 	if (email.subject !== void 0 && (typeof email.subject !== "string" || email.subject.length > SAMPLE_SUBJECT_MAX)) fail(`subject must be a string of at most ${SAMPLE_SUBJECT_MAX} characters`);
 	if (typeof email.text !== "string" || email.text.length === 0 || email.text.length > SAMPLE_TEXT_MAX) fail(`text must be 1 to ${SAMPLE_TEXT_MAX} characters`);
 	for (const key of ["automated", "from_mailing_list"]) if (email[key] !== void 0 && typeof email[key] !== "boolean") fail(`${key} must be true or false`);
 	if (email.spam_score !== void 0 && (typeof email.spam_score !== "number" || !Number.isFinite(email.spam_score))) fail("spam_score must be a number");
+	return unknown;
 }
 /** The keys a sample may carry: a saved one's id and time are taken and ignored. */
 const SAMPLE_KEYS = /* @__PURE__ */ new Set([
@@ -52117,7 +53716,8 @@ function samplesFromJson(value, source) {
 		const samples = lookAlikeSamples(data);
 		if (samples.length === 0) throw usageError$2(`${source} is a generate-look-alikes answer with no look-alikes in it.`);
 		samples.forEach((sample, index) => {
-			checkSampleEmail(sample.email, `${source}, look-alike ${index + 1}`);
+			const unknown = checkSampleEmail(sample.email, `${source}, look-alike ${index + 1}`);
+			if (unknown.length > 0) UNKNOWN_FIELDS.set(sample, unknown);
 		});
 		return samples;
 	}
@@ -52125,22 +53725,25 @@ function samplesFromJson(value, source) {
 	return data.map((item, index) => {
 		const at = `${source}, sample ${index + 1}`;
 		if (!isRecord$1(item)) throw usageError$2(`${at} is not an object.`);
-		const unknown = Object.keys(item).find((key) => !SAMPLE_KEYS.has(key));
-		if (unknown !== void 0) throw usageError$2(`${at}: "${unknown}" is not a sample field; a sample takes expected, label and email.`);
+		const unknown = Object.keys(item).filter((key) => !SAMPLE_KEYS.has(key));
 		if (item.expected !== "match" && item.expected !== "no_match") throw usageError$2(`${at}: expected must be "match" or "no_match".`);
 		if (!isRecord$1(item.email)) throw usageError$2(`${at}: email must be an object, as test-email-rule-on-sample takes it.`);
-		checkSampleEmail(item.email, at);
+		const unknownEmail = checkSampleEmail(item.email, at);
 		const label = item.label;
 		if (label !== void 0 && label !== null) {
 			if (typeof label !== "string") throw usageError$2(`${at}: label must be a string.`);
 			if (label.trim() === "") throw usageError$2(`${at}: label is blank; leave it out or say what the email stands for.`);
 			if (label.trim().length > SAMPLE_LABEL_MAX) throw usageError$2(`${at}: label is longer than ${SAMPLE_LABEL_MAX} characters.`);
 		}
-		return {
+		const sample = {
+			...Object.fromEntries(unknown.map((key) => [key, item[key]])),
 			expected: item.expected,
 			...label !== void 0 ? { label } : {},
 			email: item.email
 		};
+		const fields = [...unknown.map((key) => `sample field ${shownKey(key)}`), ...unknownEmail];
+		if (fields.length > 0) UNKNOWN_FIELDS.set(sample, fields);
+		return sample;
 	});
 }
 /**
@@ -52191,6 +53794,8 @@ function readSamplesFile(path, flag, pick) {
 	const all = samplesFromJson(readJsonFileFlag(path, `--${flag}`), source);
 	const samples = typeof pick === "string" ? pickSamples(all, pick, source) : all;
 	if (samples.length > 20) throw usageError$2(`${source} holds ${samples.length} samples, and a rule or a test takes at most 20; take some with --pick.`);
+	const note = unknownFieldsNote(source, samples, all);
+	if (note) process.stderr.write(`${note}\n`);
 	return samples;
 }
 /** The one of `names` given as a file path, or null; --pick without one is refused. */
@@ -52647,7 +54252,9 @@ function answerText(answer) {
 function conditionLines(summary) {
 	const conditions = Array.isArray(summary?.conditions) ? summary.conditions : [];
 	if (conditions.length === 0) return [];
-	return [`Conditions (${summary?.decided ?? 0} decided):`, ...conditions.map((condition) => `  ${condition.index}. ${condition.text}: held on ${condition.held}, failed on ${condition.failed} (the only failure on ${condition.only_failure})`)];
+	const held = summary?.conditions_held;
+	const together = typeof held === "number" ? `; together they held on ${held}` : "";
+	return [`Conditions (${summary?.decided ?? 0} decided${together}):`, ...conditions.map((condition) => `  ${condition.index}. ${condition.text}: held on ${condition.held}, failed on ${condition.failed} (the only failure on ${condition.only_failure})`)];
 }
 function questionLines(summary, results) {
 	const questions = Array.isArray(summary?.questions) ? summary.questions : [];
@@ -52991,6 +54598,10 @@ function authorLine(author) {
 	if (name || email) return `Author: ${name ?? email}`;
 	return `Author: user ${author.user_id} (name and email not shown to you)`;
 }
+/** A note the server wrote on a rule answer, as a line, or undefined. */
+function noteLine(note) {
+	return typeof note === "string" && note.trim() ? note.trim() : void 0;
+}
 /** The stderr report of a rule written by create-email-rule or update-email-rule. */
 function writtenEmailRuleReport(data, request) {
 	if (!isRecord(data)) return { lines: [] };
@@ -53005,11 +54616,17 @@ function writtenEmailRuleReport(data, request) {
 	if (restored) lines.push(restored);
 	const reach = affectsLine(rule.affects);
 	if (reach) lines.push(reach);
+	for (const note of [rule.share_notice, rule.notice]) {
+		const line = noteLine(note);
+		if (line) lines.push(line);
+	}
 	const sentExpectations = sentExpectationsIn(request.body);
 	const name = writtenSampleNamer(request.body, request.flags, rule.expectation_samples);
 	const checked = expectationsCheckLine(rule.expectations_check, ruleId, name);
 	if (checked) lines.push(checked);
 	else if (sentExpectations) lines.push(`Expectations were not checked on this write. Test them with \`primitive email-rules test-email-rule --rule-id ${ruleId}\`.`);
+	const objections = noteLine(rule.objection_notice);
+	if (objections) lines.push(objections);
 	if (request.flags?.["fail-on-expectations"] !== true) return { lines };
 	return {
 		lines,
@@ -53060,7 +54677,9 @@ function deleteEmailRuleReport(data, request) {
 	const answer = data;
 	const lines = [];
 	const ended = Array.isArray(answer.ended_shares) ? answer.ended_shares.length : 0;
-	if (ended > 0) lines.push(`Ended ${ended === 1 ? "1 share" : `${ended} shares`} of this rule (end_reason rule_deleted). ${ended === 1 ? "It keeps its record" : "Each keeps its record"}.`);
+	const shareNotice = noteLine(answer.share_notice);
+	if (shareNotice) lines.push(shareNotice);
+	else if (ended > 0) lines.push(`Ended ${ended === 1 ? "1 share" : `${ended} shares`} of this rule (end_reason rule_deleted). ${ended === 1 ? "It keeps its record" : "Each keeps its record"}.`);
 	const keys = Array.isArray(answer.keys) ? answer.keys : [];
 	const others = typeof answer.other_keys === "number" && answer.other_keys > 0 ? answer.other_keys : 0;
 	const ruleId = typeof request.path.id === "string" ? request.path.id : "<rule-id>";
@@ -53097,16 +54716,37 @@ function readAgain(id) {
 	return `Read it again with \`primitive email-rules get-email-rule ${id}\` and send the write again`;
 }
 /**
+* Who reads an active rule, from a refusal's details.read_by: the server
+* sends it when it checked the write against the rule's expectations because
+* API keys or webhooks read the rule, whether or not the write asked.
+* Undefined without it.
+*/
+function readByText(details) {
+	const readBy = details.read_by;
+	if (!isRecord(readBy)) return void 0;
+	const { keys, webhooks } = readBy;
+	return typeof keys === "number" && typeof webhooks === "number" ? `${plural$1(keys, "API key", "API keys")} and ${plural$1(webhooks, "webhook", "webhooks")} read what it grants` : "API keys or webhooks may read what it grants (they could not be counted in time)";
+}
+/** How to save a write the default check refused, without the check. */
+function saveUncheckedText(flags) {
+	return flags?.["fail-on-expectations"] === true ? `send it again without --${FAIL_ON_EXPECTATIONS_FLAG} and with --no-if-expectations-pass` : "send it again with --no-if-expectations-pass";
+}
+/**
 * The hint for update-email-rule's refusals: an email_rule_conflict by its
 * details.reason (version_moved, revision_moved, expectations_moved,
-* rule_changed), and the expectations guard's expectations_failed,
-* expectations_undecided, expectations_unreadable and no_expectations.
-* Nothing was saved in any of them.
+* rule_changed, readers_changed), and the expectations guard's
+* expectations_failed, expectations_undecided, expectations_unreadable and
+* no_expectations. The guard runs when the write sends if_expectations_pass,
+* and by default (details.read_by) when it changes what an active rule that
+* API keys or webhooks read grants. Nothing was saved in any of them.
 */
 function updateEmailRuleErrorHint(code, payload, ruleId, body, flags) {
 	const id = typeof ruleId === "string" && ruleId ? ruleId : "<rule-id>";
 	const details = errorDetails(payload);
 	const guarded = isRecord(body) && body.if_expectations_pass === true;
+	const readBy = readByText(details);
+	const judged = readBy ? "was judged against its expectations before saving, as a write that changes what an active rule grants is by default while API keys or webhooks read it, and nothing was saved" : "was judged against its expectations before saving (if_expectations_pass), and nothing was saved";
+	const unchecked = readBy ? ` The rule is active and ${readBy}; to save the write without the check, ${saveUncheckedText(flags)}.` : "";
 	if (code === "email_rule_conflict") switch (details.reason) {
 		case "version_moved": return versionMovedHint(payload, ruleId);
 		case "revision_moved": {
@@ -53115,6 +54755,7 @@ function updateEmailRuleErrorHint(code, payload, ruleId, body, flags) {
 		}
 		case "expectations_moved": return `Hint: the rule's saved expectations changed while this write was checked against them, so nothing was saved. ${readAgain(id)}.`;
 		case "rule_changed": return guarded ? `Hint: the rule changed after this write was judged against its expectations and before it was saved, so saving it would have gone unchecked; nothing was saved. ${readAgain(id)}.` : `Hint: the rule changed while this write was being saved, so nothing was saved. ${readAgain(id)}.`;
+		case "readers_changed": return "Hint: API keys or webhooks started reading this rule while this write was being saved, and saving it would have changed what they receive without checking it against the rule's expectations, so nothing was saved. Send the write again: it is then checked first.";
 		default: return;
 	}
 	if (code === "expectations_failed" || code === "expectations_undecided") {
@@ -53131,16 +54772,16 @@ function updateEmailRuleErrorHint(code, payload, ruleId, body, flags) {
 		const reason = String(details.reason);
 		const samplesMayStay = undecidedSamplesMayStay(undecidedSamples.length, reason);
 		const byReason = reason !== "none" && Object.hasOwn(UNDECIDED_NEXT_STEP, reason) ? UNDECIDED_NEXT_STEP[reason] : UNDECIDED_NEXT_STEP.none;
-		return `Hint: the rule, as this write would leave it, was judged against its expectations before saving (if_expectations_pass), and nothing was saved.${which}${code === "expectations_failed" ? "" : samplesMayStay ? `${undecided.length > 0 ? ` ${byReason}` : ""} ${UNDECIDED_SAMPLES_NEXT_STEP} ${refusedSampleTest(body, id)}` : ` ${byReason}`} The command exits ${updateEmailRuleErrorExitCode(payload) ?? 1}.`;
+		return `Hint: the rule, as this write would leave it, ${judged}.${which}${code === "expectations_failed" ? "" : samplesMayStay ? `${undecided.length > 0 ? ` ${byReason}` : ""} ${UNDECIDED_SAMPLES_NEXT_STEP} ${refusedSampleTest(body, id)}` : ` ${byReason}`}${unchecked} The command exits ${updateEmailRuleErrorExitCode(payload) ?? 1}.`;
 	}
 	if (code === "expectations_unreadable") {
 		const unreadable = Array.isArray(details.unreadable) ? details.unreadable.filter((entry) => entry !== null && entry !== void 0 && entry !== "").map(String) : [];
 		const one = unreadable.length === 1;
 		const named = unreadable.length > 0 ? `: ${unreadable.join(", ")}` : "";
 		const them = one ? "it" : "them";
-		return `Hint: the rule, as this write would leave it, was judged against its expectations before saving (if_expectations_pass), and nothing was saved. ${one ? "An expectation names an email" : "Expectations name emails"} this rule cannot read (deleted, or outside its scope or its author's mail)${named}. Sending the write again will not decide ${them}: send --expectations-file without ${them}, or an evaluation_scope that reads ${them}. The command exits 1.`;
+		return `Hint: the rule, as this write would leave it, ${judged}. ${one ? "An expectation names an email" : "Expectations name emails"} this rule cannot read (deleted, or outside its scope or its author's mail)${named}. Sending the write again will not decide ${them}: send --expectations-file without ${them}, or an evaluation_scope that reads ${them}.${unchecked} The command exits 1.`;
 	}
-	if (code === "no_expectations") return "Hint: nothing was saved. Give the rule expectations with --expectations-file or made-up emails with --expectation-samples-file or --add-expectation-samples-file (in this write or before it), or send the write without if_expectations_pass (--fail-on-expectations or --if-expectations-pass).";
+	if (code === "no_expectations") return readBy ? `Hint: nothing was saved: this write removes the rule's expectations, and the rule is active and ${readBy}, so a write that changes what it grants is checked against them first. Keep some with --expectations-file, --expectation-samples-file or --add-expectation-samples-file, or, to save the write without the check, ${saveUncheckedText(flags)}.` : "Hint: nothing was saved. Give the rule expectations with --expectations-file or made-up emails with --expectation-samples-file or --add-expectation-samples-file (in this write or before it), or send the write without if_expectations_pass (--fail-on-expectations or --if-expectations-pass).";
 }
 /** The reasons a guard's undecided judgment can be decided by sending the write again. */
 const RETRYABLE_REASONS = /* @__PURE__ */ new Set([
@@ -53197,12 +54838,20 @@ function updateEmailRuleErrorExitCode(payload) {
 function undecidedSamplesMayStay(count, reason) {
 	return count > 0 && !RETRYABLE_REASONS.has(reason) && reason !== "author_unresolvable";
 }
+/** Where compile counted breadth, by the evaluation_scope it was sent. */
+const BREADTH_SCOPE = {
+	own_mailboxes: "in your own mailboxes",
+	author: "in all the mail you can read",
+	selected: "in the inboxes and domains the selected scope names"
+};
 /** The stderr report of compile-email-rule: how many recent emails it holds for. */
-function compileEmailRuleReport(data) {
+function compileEmailRuleReport(data, request) {
 	if (!isRecord(data)) return { lines: [] };
 	const lines = (Array.isArray(data.warnings) ? data.warnings : []).filter((warning) => typeof warning === "string" && warning.trim() !== "").map((warning) => `Warning: ${warning.trim()}`);
 	const breadth = data.breadth;
-	if (isRecord(breadth) && typeof breadth.checked === "number" && typeof breadth.matched === "number") lines.push(`Breadth: its conditions hold for ${breadth.matched} of ${plural$1(breadth.checked, "recent email", "recent emails")} checked in your own mailboxes, whatever scope you save it with.`);
+	const sent = isRecord(request?.body) && typeof request.body.evaluation_scope === "string" ? request.body.evaluation_scope : void 0;
+	const where = sent === void 0 ? "in your own mailboxes, the default; pass --evaluation-scope to count over the scope you will save it with" : BREADTH_SCOPE[sent] ?? `in evaluation_scope ${sent}`;
+	if (isRecord(breadth) && typeof breadth.checked === "number" && typeof breadth.matched === "number") lines.push(`Breadth: its conditions hold for ${breadth.matched} of ${plural$1(breadth.checked, "recent email", "recent emails")} checked ${where}.`);
 	return { lines };
 }
 /** The stderr report of get-email-rule: who wrote it, and its revision. */
@@ -53214,6 +54863,8 @@ function getEmailRuleReport(data) {
 	const protection = protectionLine(data);
 	if (protection) lines.push(protection);
 	if (typeof data.revision === "number") lines.push(`Revision ${data.revision}: pass --if-revision ${data.revision} to update-email-rule so a change made since is never replaced unseen.`);
+	const objections = noteLine(data.objection_notice);
+	if (objections) lines.push(objections);
 	return { lines };
 }
 /** The stderr report of list-email-rules: the protective rules that protect nothing yet, or less than they seem. */
@@ -53233,9 +54884,11 @@ function listEmailRulesReport(data) {
 /** create-email-rule's --fail-on-expectations: the exit code follows the check made after saving. */
 const FAIL_ON_EXPECTATIONS_HELP = "Exit 1 when an expectation in the answer's expectations_check failed, and 3 when none failed but one is undecided or the expectations this write sent were not checked (test the rule to decide). A create does not judge made-up emails, so with some it exits 3. Without it the command exits 0 whatever the check says.";
 /** update-email-rule's --fail-on-expectations: the server refuses the write. */
-const UPDATE_FAIL_ON_EXPECTATIONS_HELP = "Refuse the write unless the rule, as this write would leave it, passes its expectations. It sends if_expectations_pass (over any in --body-file or --raw-body), so the server judges a new version, a restored one, a new scope or turning the rule active before saving, on its emails by id and its made-up emails, and saves nothing when one failed (exit 1), one names an email the rule cannot read (exit 1, since sending again never decides it), one is undecided (exit 3, or 1 when the rule cannot run as its author or a made-up email is undecided for no reason the answer gives) or the rule has none (exit 1). It can take as long as a test of the rule; the command waits for it. Judging needs a credential that reads the mail's content. A write the server does not judge (one changing only expectations, say) is saved, and the exit code then follows the answer's expectations_check, as on create. With --json, a refused write's document holds the API's error alone; a saved write's holds the rule.";
+const UPDATE_FAIL_ON_EXPECTATIONS_HELP = "Refuse the write unless the rule, as this write would leave it, passes its expectations. It sends if_expectations_pass (over any in --body-file or --raw-body), so the server judges a new version, a restored one, a new scope or turning the rule active before saving, on its emails by id and its made-up emails, and saves nothing when one failed (exit 1), one names an email the rule cannot read (exit 1, since sending again never decides it), one is undecided (exit 3, or 1 when the rule cannot run as its author or a made-up email is undecided for no reason the answer gives) or the rule has none (exit 1). It can take as long as a test of the rule; the command waits for it. Judging needs a credential that reads the mail's content. A write the server does not judge (one changing only expectations, say) is saved, and the exit code then follows the answer's expectations_check, as on create. Without it, the server still judges, and refuses the same way, a write that saves a version or changes the scope of an active rule that API keys or webhooks read and that has expectations (the refusal's details.read_by counts them), unless --no-if-expectations-pass is sent. With --json, a refused write's document holds the API's error alone; a saved write's holds the rule.";
+/** When update-email-rule judges the made-up emails a samples flag sets. */
+const UPDATE_JUDGES_SAMPLES = `The write judges them before saving with --${FAIL_ON_EXPECTATIONS_FLAG}, when it saves a version or turns the rule active, and without it when it saves a version or changes the scope of an active rule that API keys or webhooks read, unless --no-if-expectations-pass is sent.`;
 /** What a samples file flag reads. */
-const SAMPLES_FILE_SHAPE = "A JSON file of made-up emails the rule must match or not: an array such as [{\"expected\": \"no_match\", \"label\": \"a personal bill\", \"email\": {...}}], with email as test-email-rule-on-sample takes it (text up to 4,000 characters, at most 10 each of to, cc and attachment_types), like the one generate-look-alikes --samples-file writes, or a generate-look-alikes answer saved as it printed it.";
+const SAMPLES_FILE_SHAPE = "A JSON file of made-up emails the rule must match or not: an array such as [{\"expected\": \"no_match\", \"label\": \"a personal bill\", \"email\": {...}}], with email as test-email-rule-on-sample takes it (text up to 4,000 characters, at most 10 each of to, cc, attachment_types and attachment_names), like the one generate-look-alikes --samples-file writes, or a generate-look-alikes answer saved as it printed it.";
 const EXPECTATION_FLAG_NOTE = "Replaces any expect in --body-file or --raw-body. The answer reports them in expectations (passed, counts, results) and the exit code follows it; see --help-full.";
 /**
 * update-email-rule's --fail-on-expectations sends if_expectations_pass, over
@@ -53313,11 +54966,11 @@ const EMAIL_RULE_OPERATION_EXTENSIONS = {
 		flags: {
 			"expectations-file": Flags.string({ description: "A JSON file holding the emails the rule must match and must not, such as {\"match\": [\"<email-id>\"], \"no_match\": [\"<email-id>\"]}, replacing its saved expectations; a file holding null removes them. Sets expectations, over any in --body-file or --raw-body; the answer judges them in expectations_check (passed, decided, failed, undecided); the report test-email-rule answers with is named expectations instead." }),
 			[SAMPLES_FILE_FLAG]: Flags.string({
-				description: `${SAMPLES_FILE_SHAPE} They replace the rule's saved ones, and a file holding [] removes them. Sets expectation_samples, over any in --body-file or --raw-body. Not with --${ADD_SAMPLES_FILE_FLAG}. The write judges them only with --${FAIL_ON_EXPECTATIONS_FLAG}, and only when it saves a version or turns the rule active.`,
+				description: `${SAMPLES_FILE_SHAPE} They replace the rule's saved ones, and a file holding [] removes them. Sets expectation_samples, over any in --body-file or --raw-body. Not with --${ADD_SAMPLES_FILE_FLAG}. ${UPDATE_JUDGES_SAMPLES}`,
 				exclusive: [ADD_SAMPLES_FILE_FLAG]
 			}),
 			[ADD_SAMPLES_FILE_FLAG]: Flags.string({
-				description: `${SAMPLES_FILE_SHAPE} They are added to the rule's saved ones, 20 at most in all. Sets add_expectation_samples, over any in --body-file or --raw-body. Not with --${SAMPLES_FILE_FLAG}. The write judges them only with --${FAIL_ON_EXPECTATIONS_FLAG}, and only when it saves a version or turns the rule active.`,
+				description: `${SAMPLES_FILE_SHAPE} They are added to the rule's saved ones, 20 at most in all. Sets add_expectation_samples, over any in --body-file or --raw-body. Not with --${SAMPLES_FILE_FLAG}. ${UPDATE_JUDGES_SAMPLES}`,
 				exclusive: [SAMPLES_FILE_FLAG]
 			}),
 			[PICK_FLAG]: Flags.string({ description: pickFlagHelp([SAMPLES_FILE_FLAG, ADD_SAMPLES_FILE_FLAG]) }),
@@ -53363,7 +55016,9 @@ const EMAIL_RULE_OPERATION_EXTENSIONS = {
 		bodyProperties: ["expectation_samples"]
 	},
 	compileEmailRule: {
-		flags: {},
+		flags: scopeSelectionFlags(),
+		bodyFields: scopeSelectionBodyFields,
+		bodyProperties: ["scope_selection"],
 		report: compileEmailRuleReport
 	},
 	endEmailRuleShare: {
@@ -53638,7 +55293,7 @@ function unknownEventTypes(eventTypes) {
 function unknownEventTypesWarning(unknown) {
 	return `Warning: ${unknown.join(", ")} ${unknown.length === 1 ? "is" : "are"} not an event type this CLI knows. Subscriptions match exact names, so a misspelled name receives nothing. Continuing; newer event types may not be known to this CLI yet.\n`;
 }
-function isPlainObject(value) {
+function isPlainObject$1(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 /**
@@ -53651,16 +55306,16 @@ async function currentEndpointRules(endpointId, listEndpoints) {
 	if (response.error) throw new EventTypesFlagError("Could not read the endpoint's current rules to keep them. Retry, or pass the full rules with --raw-body.");
 	const row = (response.data?.data ?? []).find((endpoint) => endpoint.id === endpointId);
 	if (!row) throw new EventTypesFlagError(`No endpoint ${endpointId} is visible to this credential, so its rules cannot be updated.`);
-	return isPlainObject(row.rules) ? row.rules : {};
+	return isPlainObject$1(row.rules) ? row.rules : {};
 }
 /**
 * Put `eventTypes` in the request body's `rules.event_types`, on top of
 * `baseRules` (rules the caller passed in the body win over `baseRules`).
 */
 function withEventTypes(body, eventTypes, baseRules = {}) {
-	if (body !== void 0 && !isPlainObject(body)) throw new EventTypesFlagError("--raw-body must be a JSON object when also passing --event-types.");
+	if (body !== void 0 && !isPlainObject$1(body)) throw new EventTypesFlagError("--raw-body must be a JSON object when also passing --event-types.");
 	const current = body ?? {};
-	if (current.rules !== void 0 && !isPlainObject(current.rules)) throw new EventTypesFlagError("rules in --raw-body must be a JSON object when also passing --event-types.");
+	if (current.rules !== void 0 && !isPlainObject$1(current.rules)) throw new EventTypesFlagError("rules in --raw-body must be a JSON object when also passing --event-types.");
 	const explicitRules = current.rules ?? {};
 	return {
 		...current,
@@ -53673,7 +55328,115 @@ function withEventTypes(body, eventTypes, baseRules = {}) {
 }
 /** True when the caller already passed `rules` in the request body. */
 function bodyHasRules(body) {
-	return isPlainObject(body) && body.rules !== void 0;
+	return isPlainObject$1(body) && body.rules !== void 0;
+}
+// src/oclif/endpoint-url-shown.ts
+/** The commands whose answers carry endpoints, by operation sdkName. */
+const ENDPOINT_URL_OPERATIONS = /* @__PURE__ */ new Set([
+	"getEndpoint",
+	"listEndpoints",
+	"createEndpoint",
+	"updateEndpoint"
+]);
+/** The commands that send a URL, whose value is checked for the placeholder. */
+const ENDPOINT_URL_WRITE_OPERATIONS = /* @__PURE__ */ new Set(["createEndpoint", "updateEndpoint"]);
+/** What a hidden query string is replaced with. */
+const HIDDEN_QUERY = "?... (query hidden)";
+const SHOW_URL_FLAG_DESCRIPTION = "Print each webhook URL in full, its query string included. Without it the query string is shown as ?... (query hidden), with url_query_hidden: true on the endpoint, because it can carry a secret such as a deployment protection bypass token.";
+/**
+* Said when an answer had a URL shortened: on stderr without --json, and in
+* the document's summary with --json --envelope.
+*/
+const HIDDEN_QUERY_NOTE = "A webhook URL's query string is hidden, as it can carry a secret. Pass --show-url to print it in full.";
+/**
+* The URL with its query string, and anything after it, replaced by
+* HIDDEN_QUERY; null when it has no query string. A `?` after a `#` is part
+* of the fragment, not a query.
+*/
+function urlWithQueryHidden(url) {
+	const query = url.indexOf("?");
+	if (query < 0) return null;
+	const fragment = url.indexOf("#");
+	if (fragment >= 0 && fragment < query) return null;
+	return `${url.slice(0, query)}${HIDDEN_QUERY}`;
+}
+function hideOne(endpoint) {
+	if (endpoint === null || typeof endpoint !== "object" || Array.isArray(endpoint)) return {
+		value: endpoint,
+		hidden: false
+	};
+	const url = endpoint.url;
+	const shown = typeof url === "string" ? urlWithQueryHidden(url) : null;
+	if (shown === null) return {
+		value: endpoint,
+		hidden: false
+	};
+	return {
+		value: {
+			...endpoint,
+			url: shown,
+			url_query_hidden: true
+		},
+		hidden: true
+	};
+}
+/**
+* An answer's data (one endpoint, or a list of them) with each URL's query
+* string hidden, and whether any was.
+*/
+function endpointsWithQueryHidden(data) {
+	if (!Array.isArray(data)) {
+		const one = hideOne(data);
+		return {
+			data: one.value,
+			hidden: one.hidden
+		};
+	}
+	let hidden = false;
+	return {
+		data: data.map((row) => {
+			const one = hideOne(row);
+			hidden ||= one.hidden;
+			return one.value;
+		}),
+		hidden
+	};
+}
+function isPlainObject(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+/** How deep errorWithQueryHidden looks into an error payload. */
+const ERROR_DEPTH = 8;
+/**
+* An error answer with the query string hidden in every `url` it names, such
+* as `details.holder.url` on a 409 for a slot another endpoint holds.
+* Anything that is not a plain object or a list is left as it is.
+*/
+function errorWithQueryHidden(payload, depth = 0) {
+	if (depth > ERROR_DEPTH) return payload;
+	if (Array.isArray(payload)) return payload.map((entry) => errorWithQueryHidden(entry, depth + 1));
+	if (!isPlainObject(payload)) return payload;
+	const out = {};
+	for (const [key, value] of Object.entries(payload)) out[key] = errorWithQueryHidden(value, depth + 1);
+	return hideOne(out).value;
+}
+/**
+* A query string as a partial copy of HIDDEN_QUERY leaves it: a terminal's
+* word selection stops at its first space, after `?...`.
+*/
+const HIDDEN_QUERY_START = "?...";
+/**
+* The refusal for a request body whose url is a URL as these commands print
+* it with the query hidden, whole or cut at its first space, so a printed URL
+* is never written back in place of the real one; null for any other body.
+*/
+function hiddenQueryUrlRefusal(body) {
+	if (body === null || typeof body !== "object" || Array.isArray(body)) return null;
+	const url = body.url;
+	if (typeof url !== "string" || !url.includes(HIDDEN_QUERY_START)) return null;
+	return `The url carries ${HIDDEN_QUERY_START}, the start of ${HIDDEN_QUERY}, which is how the endpoint commands print a URL with its query string hidden, not the URL itself. Pass the full URL; \`primitive endpoints get <id> --show-url\` prints a webhook's URL in full.`;
 }
 // src/oclif/endpoints-test-redirect.ts
 async function detectFunctionEndpoint(endpointId, listEndpoints) {
@@ -55530,7 +57293,7 @@ function savedConnectedProfiles(configDir, exclude) {
 */
 async function otherProfiles(configDir, session, current) {
 	if (session) try {
-		const { connectedProfilesForSession } = await import("./machine-session-DkXYR62a.js").then((n) => n.s);
+		const { connectedProfilesForSession } = await import("./machine-session-BTkDAKda.js").then((n) => n.s);
 		return {
 			inSession: true,
 			profiles: connectedProfilesForSession(configDir, session, current)
@@ -55604,6 +57367,96 @@ async function explainPendingMailNotFound(configDir, emailId, write = (line) =>
 		if (outcome.kind === "dropped") write(`Dropped the pending notice for ${id} from profile ${current.profile} after ${outcome.reads} consecutive not_found reads; the email is no longer visible to this profile.\n`);
 	} catch {}
 }
+// src/oclif/rule-list-defaults.ts
+/** The box the objection list asks for when --box is not given: objections you made and objections to rules you wrote. */
+const OBJECTION_BOX_DEFAULT = "mine";
+/** The box asked for instead when a server refuses OBJECTION_BOX_DEFAULT: objections you made. */
+const OBJECTION_BOX_FALLBACK = "outgoing";
+/** --box on `email-rule-oversight list-email-rule-objections`, with the CLI's default. */
+const OBJECTION_BOX_FLAG = {
+	description: "mine (the default): objections you made and objections to rules you wrote, each saying which (is_objector, is_author). outgoing: only those you made. incoming: only those to rules you wrote. all: every objection you can see. On a server that does not take mine, the CLI lists only those you made by default, and says so.",
+	options: [
+		OBJECTION_BOX_DEFAULT,
+		"outgoing",
+		"incoming",
+		"all"
+	]
+};
+/**
+* The query to send: for the objection list read without --box, the CLI's
+* default box by name; any other query as it is.
+*/
+function withDefaultObjectionBox(sdkName, query) {
+	return sdkName === "listEmailRuleObjections" && query.box === void 0 ? {
+		...query,
+		box: OBJECTION_BOX_DEFAULT
+	} : query;
+}
+function errorBody(payload) {
+	if (payload === null || typeof payload !== "object") return {};
+	const inner = payload.error;
+	return inner !== null && typeof inner === "object" ? inner : payload;
+}
+/**
+* True when an API error is a server that predates box=mine refusing the
+* value: a validation error whose issue for box is an unknown option, not
+* any other refusal that happens to name box.
+*/
+function isObjectionBoxRefused(payload) {
+	const body = errorBody(payload);
+	return body.code === "validation_error" && typeof body.message === "string" && /(^|,\s*)box: Invalid (option|enum value)/.test(body.message);
+}
+/** The error line for `--box mine` given to a server that refuses it. */
+function objectionBoxErrorHint(payload, flags) {
+	if (flags?.box !== "mine" || !isObjectionBoxRefused(payload)) return void 0;
+	return "This server does not take --box mine: use --box outgoing for objections you made, and --box incoming for objections to rules you wrote.";
+}
+const widen = (flags) => `add \`${flags.join(" ")}\` to widen it`;
+/** The objection list's line: what its defaults left out, and how to see more. */
+function objectionsNote(box, status, refused) {
+	if (box && refused) return `By default this server lists only ${status ? "pending objections you made" : "objections you made"}: add \`--box incoming\` for objections to rules you wrote, or \`${["--box all", ...status ? ["--status any"] : []].join(" ")}\` for every one you can see.`;
+	const phrase = box && status ? "pending objections you made and those to rules you wrote" : box ? "objections you made and those to rules you wrote" : status ? "pending objections" : null;
+	if (phrase === null) return void 0;
+	return `By default this lists only ${phrase}: ${widen([...box ? ["--box all"] : [], ...status ? ["--status any"] : []])}.`;
+}
+/**
+* What a rule request, share or objection list read with `query` (the
+* flags as given) left out by its defaults, and the flags that show more.
+* Said on any page. Undefined for any other list, or when every default was
+* overridden.
+*/
+function ruleListDefaultsNote(sdkName, query, options = {}) {
+	const unset = (name) => query[name] === void 0;
+	const said = (phrase, flags) => phrase === null ? void 0 : `By default this lists only ${phrase}: ${widen(flags)}.`;
+	if (sdkName === "listEmailRuleRequests") {
+		const box = unset("box");
+		const status = unset("status");
+		return said(box && status ? "pending requests made to you" : box ? "requests made to you" : status ? "pending requests" : null, [...box ? ["--box all"] : [], ...status ? ["--status any"] : []]);
+	}
+	if (sdkName === "listEmailRuleShares") {
+		const box = unset("box");
+		const live = unset("live");
+		return said(box && live ? "live shares made with you" : box ? "shares made with you" : live ? "live shares" : null, [...box ? ["--box all"] : [], ...live ? ["--live any"] : []]);
+	}
+	if (sdkName === "listGivenEmailRuleShares") return said(unset("live") ? "live shares of your mail" : null, ["--live any"]);
+	if (sdkName === "listEmailRuleObjections") return objectionsNote(unset("box"), unset("status"), options.objectionBoxRefused === true);
+}
+const NOUNS = {
+	listEmailRuleRequests: "requests",
+	listEmailRuleShares: "shares",
+	listGivenEmailRuleShares: "shares",
+	listEmailRuleObjections: "objections"
+};
+/**
+* An empty first page of one of those lists: that nothing matched, then the
+* line above. Undefined for any other list, when every default was
+* overridden, or on a later page (--cursor), where the line alone is said.
+*/
+function emptyRuleListHint(sdkName, query, options = {}) {
+	if (query.cursor !== void 0) return void 0;
+	const note = ruleListDefaultsNote(sdkName, query, options);
+	return note ? `(no results) No ${NOUNS[sdkName]} match. ${note}` : void 0;
+}
 const RULE_REQUEST_WEBHOOK_CREATE_HINT = "Hint: a webhook for rule request or objection events is made by the person it is for, signed in as themself: after `primitive login`, run this without --api-key, PRIMITIVE_API_KEY or PRIMITIVE_AGENT_PROFILE set, or create it in the dashboard. An API key, another app or an agent cannot make one. If you are already signed in as yourself, try again. It is a route target whatever your access, so it never takes a domain's or the organization's default slot.";
 const RULE_REQUEST_WEBHOOK_HTTP_HINT = "Hint: rule request and objection events go only to an http webhook (kind http).";
 const RULE_REQUEST_WEBHOOK_SUBSCRIBE_HINT = "Hint: rule request and objection events go only to a webhook made for them. If this webhook does not list them yet, it cannot be given them: create a new one with `--event-types` naming them (such as 'email_rule_request.*' or 'email_rule_objection.*'), signed in as yourself. If it does, only its maker, signed in as themself, can change it.";
@@ -56013,6 +57866,7 @@ const OPERATION_PATH_FLAGS = {
 		flag: "email-id",
 		description: "The id of the email (from `primitive emails list`), not a rule id: lists what every rule you can see decided about this email, and why a rule did not run. --id is accepted too."
 	} },
+	listEmailRuleObjections: { box: OBJECTION_BOX_FLAG },
 	replyToEmail: { id: {
 		flag: "email-id",
 		description: EMAIL_ID_NOT_SENT
@@ -56205,7 +58059,7 @@ function flagForParameter(parameter, override) {
 	});
 	if (parameter.enum && parameter.enum.length > 0) return Flags.string({
 		...common,
-		options: parameter.enum
+		options: [...override?.options ?? parameter.enum]
 	});
 	return Flags.string(common);
 }
@@ -56301,8 +58155,13 @@ const NETWORK_ERROR_HINTS = {
 	ENETUNREACH: "Hint: the network is unreachable. If you're behind a proxy and set HTTP(S)_PROXY, re-run with NODE_USE_ENV_PROXY=1 (Node 22+ ignores those env vars by default). `primitive doctor` reports the local environment in one shot.",
 	ECONNREFUSED: "Hint: the server refused the connection. Check that your firewall allows egress to *.primitive.dev, that your PRIMITIVE_API_BASE_URL_* overrides (if any) point at a reachable host, and re-run with NODE_USE_ENV_PROXY=1 if you're behind a proxy. `primitive doctor` reports the local environment in one shot.",
 	ETIMEDOUT: "Hint: the connection timed out. Check egress rules and proxy configuration; if you're behind a proxy, re-run with NODE_USE_ENV_PROXY=1 and HTTPS_PROXY set. `primitive doctor` reports the local environment in one shot.",
-	EAI_AGAIN: "Hint: DNS lookup failed. Check /etc/resolv.conf inside containers, and try `curl -v https://api.primitive.dev/v1/account` to confirm the host resolves. `primitive doctor` reports the local environment in one shot."
+	EAI_AGAIN: "Hint: DNS lookup failed. Check /etc/resolv.conf inside containers, and try `curl -v https://api.primitive.dev/v1/account` to confirm the host resolves. `primitive doctor` reports the local environment in one shot.",
+	ENOTFOUND: "Hint: the API host name did not resolve. Check PRIMITIVE_API_BASE_URL and any --api-base-url for a typo, and your DNS. `primitive doctor` reports the local environment in one shot."
 };
+/** The hint for a network failure's code (`cause.code` on a failed fetch), if there is one. */
+function networkErrorHint(code) {
+	return Object.hasOwn(NETWORK_ERROR_HINTS, code) ? NETWORK_ERROR_HINTS[code] : void 0;
+}
 const RATE_LIMIT_CODES = /* @__PURE__ */ new Set(["rate_limited", "rate_limit_exceeded"]);
 /** When to retry a rate-limited request, from Retry-After when it was sent. */
 function rateLimitHint(response) {
@@ -56461,7 +58320,7 @@ function buildFlags(operation) {
 		time: Flags.boolean({ description: TIME_FLAG_DESCRIPTION })
 	};
 	if (!operation.binaryResponse) {
-		flags.json = Flags.boolean({ description: "Print exactly one JSON document on stdout, on success and on failure, and nothing on stderr. Stdout keeps its usual shape: the data payload, or with --envelope the full response envelope (data plus meta, including meta.cursor, and empty-result hints in summary). The next-cursor line is not printed; use --envelope to page. A failure prints the error with exit_code. Without --json, the cursor and notices go to stderr." });
+		flags.json = Flags.boolean({ description: "Print exactly one JSON document on stdout, on success and on failure, and nothing on stderr. Stdout keeps its usual shape: the data payload, or with --envelope the full response envelope (data plus meta, including meta.cursor, and, in summary, empty-result hints and what a list's default filters left out). The next-cursor line is not printed; use --envelope to page. A failure prints the error with exit_code. Without --json, the cursor and notices go to stderr." });
 		flags.envelope = Flags.boolean({ description: "Print the full response envelope, including pagination metadata such as meta.cursor. Defaults to printing only the data payload for backward compatibility." });
 	}
 	const positional = positionalPathParameter(operation);
@@ -56525,6 +58384,10 @@ function buildFlags(operation) {
 		multiple: true
 	});
 	if (operation.binaryResponse) flags.output = Flags.string({ description: "Write binary response bytes to a file" });
+	if (ENDPOINT_URL_OPERATIONS.has(operation.sdkName)) {
+		if (flags["show-url"] !== void 0) throw new Error(`${operation.sdkName}: --show-url is both a generated flag and the CLI's own`);
+		flags["show-url"] = Flags.boolean({ description: SHOW_URL_FLAG_DESCRIPTION });
+	}
 	if (ATTACHMENT_WAIT_OPERATIONS.has(operation.sdkName)) flags.wait = Flags.boolean({
 		allowNo: true,
 		default: true,
@@ -56620,6 +58483,9 @@ const OPERATION_HINTS = {
 	getMemory: "Tip: prefer `primitive memories get <key> [--function <function-id>]` for the common read path.",
 	deleteMemory: "Tip: prefer `primitive memories delete <key> [--function <function-id>]` for the common delete path.",
 	searchMemories: "Tip: prefer `primitive memories search [prefix] [--metadata-only] [--function <function-id>]` for the common search path.",
+	createEmailRuleObjection: "Tip: say in --message (up to 500 characters) what you want. It can ask for less than turning the rule off: ask the author to narrow the rule, or to explain where its matches go (its receivers). The author accepts, which turns the rule off, or declines, optionally giving a reason, which you see in `primitive email-rule-oversight get-email-rule-objection <objection-id>`. You can withdraw it with `primitive email-rule-oversight withdraw-email-rule-objection <objection-id>`. Objecting does not change the rule.",
+	declineEmailRuleObjection: "Tip: the member who objected sees --reason (up to 500 characters). When the objection asked you to narrow the rule or explain a receiver, the reason can answer that: say what you changed, or what the receiver is for.",
+	listEndpoints: "Tip: without --json, a table on stderr after the JSON shows each endpoint's ENABLED and DELIVERING. DELIVERING is read from delivery.delivering, whether a webhook is being sent mail at all, not from enabled: an endpoint can be enabled and still not be delivering (its owner's key revoked, say), shown as no with the reason codes in parentheses. A webhook whose delivery could not be checked shows unknown, and a Function or pull endpoint shows -.",
 	startAgentSignup: "Tip: pass --terms-accepted. Capture the signup_token from the response and feed it to `primitive agent verify-agent-signup --signup-token <token> --verification-code <6-digit-code>` (the verify flag accepts --code as an alias). The high-level `primitive signup <email>` command walks an interactive user through both steps with friendlier prompts.",
 	testEmailRule: "Tip: --expect-match and --expect-no-match (or --expect-file) set expect, the emails the rule must match and must not. When no expect is sent, by these flags or in the body, a saved rule's saved expectations are judged instead. Either way, the answer reports the expectations it judged in expectations: passed, counts and per-email results. (create-email-rule and update-email-rule instead judge the rule's saved expectations on the version they save, in expectations_check: passed, decided, failed and undecided.) The exit code follows that report: 1 when one failed; 1 when one is undecided and testing again will not decide it (its email cannot be found or read, cannot be classified, or cannot be tested: skipped); 3 when the only undecided ones can be decided later (not classified yet, or a question unanswered), so test again later. Exit 1 also means the request failed. With --json, error.code tells these apart: expectations_failed, expectations_unresolvable, expectations_undecided (exit 3), or the API's own code. Without --json a readable report follows the JSON on stderr: warnings, how each condition held, the expectations, and the values each email that did not match was compared on.",
 	verifyAgentSignup: "Tip: pass --verification-code <code> (or --code; both work). The response carries OAuth tokens but not your assigned inbox domain; run `primitive domains list` (or `primitive whoami`) after success to see the managed *.primitive.email address that routes to this account."
@@ -56640,6 +58506,7 @@ const OPERATION_ERROR_HINTS = {
 	createEndpoint: (code, body, payload) => createEndpointRuleRequestHint(code, body, payload),
 	updateEndpoint: (code, body, payload) => updateEndpointRuleRequestHint(code, body, payload),
 	updateEmailRule: (code, body, payload, path, flags) => updateEmailRuleErrorHint(code, payload, path?.id, body, flags),
+	listEmailRuleObjections: (_code, _body, payload, _path, flags) => objectionBoxErrorHint(payload, flags),
 	verifyDomain: (code, _body, payload) => code === "dns_verification_failed" ? domainVerificationFailedHint(payload) : void 0,
 	addDomain: (code, body) => {
 		if (code === "mail_relay_unavailable") return MAIL_RELAY_UNAVAILABLE_MESSAGE;
@@ -56708,6 +58575,13 @@ function createOperationCommand(operation) {
 				"verifyAgentSignup",
 				"resendAgentSignupVerification"
 			].includes(operation.operationId)) requireDefaultLoginProfile();
+			const prereadBody = ENDPOINT_URL_WRITE_OPERATIONS.has(operation.sdkName) && operation.hasJsonBody ? { value: readJsonBody(parsedFlags) } : void 0;
+			if (prereadBody) {
+				const urlFlag = [...bodyFieldFlagToProperty].find(([, property]) => property === "url")?.[0];
+				const flagUrl = urlFlag ? parsedFlags[urlFlag] : void 0;
+				const refusal = hiddenQueryUrlRefusal(typeof flagUrl === "string" ? { url: flagUrl } : prereadBody.value);
+				if (refusal) throw new Errors.CLIError(refusal, { exit: 2 });
+			}
 			await runWithTiming(parsedFlags.time === true, async () => {
 				const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
 					apiKey: typeof parsedFlags["api-key"] === "string" ? parsedFlags["api-key"] : void 0,
@@ -56716,7 +58590,7 @@ function createOperationCommand(operation) {
 				});
 				let body;
 				if (operation.hasJsonBody) {
-					const explicit = readJsonBody(parsedFlags);
+					const explicit = prereadBody ? prereadBody.value : readJsonBody(parsedFlags);
 					const overrides = collectBodyFieldFlags(parsedFlags, bodyFieldFlagToProperty);
 					const extensionFlagFor = /* @__PURE__ */ new Map();
 					for (const field of extension?.bodyFields?.(parsedFlags, explicit) ?? []) {
@@ -56736,6 +58610,10 @@ function createOperationCommand(operation) {
 						}
 					} else body = explicit;
 				}
+				if (ENDPOINT_URL_WRITE_OPERATIONS.has(operation.sdkName)) {
+					const refusal = hiddenQueryUrlRefusal(body);
+					if (refusal) throw new Errors.CLIError(refusal, { exit: 2 });
+				}
 				if (EVENT_TYPES_FLAG_OPERATIONS.has(operation.sdkName) && Array.isArray(parsedFlags["event-types"])) body = await applyEventTypesFlag({
 					body,
 					values: parsedFlags["event-types"],
@@ -56752,7 +58630,9 @@ function createOperationCommand(operation) {
 				const replyStateSurface = replyStateSurfaceForOperation(operation.sdkName, query);
 				const automatedSurface = automatedSurfaceForOperation(operation.sdkName, query);
 				const fromVerified = fromVerifiedExpectation(operation.sdkName, query);
-				const callOperation = (stepUpToken, pageQuery = query) => {
+				let sentQuery = withDefaultObjectionBox(operation.sdkName, query);
+				let objectionBoxRefused = false;
+				const callOperation = (stepUpToken, pageQuery = sentQuery) => {
 					const sent = stepUpToken ? {
 						...headers,
 						[STEP_UP_HEADER]: stepUpToken
@@ -56797,7 +58677,7 @@ function createOperationCommand(operation) {
 					const rows = [];
 					let sentCursor = query.cursor;
 					let last = await callOperation(void 0, {
-						...query,
+						...sentQuery,
 						limit: Math.min(max, wanted)
 					});
 					const budget = Math.ceil(wanted / max) + 20;
@@ -56823,7 +58703,7 @@ function createOperationCommand(operation) {
 						};
 						sentCursor = cursor;
 						last = await callOperation(void 0, {
-							...query,
+							...sentQuery,
 							cursor,
 							limit: Math.min(max, wanted - rows.length)
 						});
@@ -56834,17 +58714,26 @@ function createOperationCommand(operation) {
 					const warning = typeof role === "string" ? roleReadsAllMailWarning(role, await readRoles(apiClient.client)) : null;
 					if (warning) process.stderr.write(`${warning}\n`);
 				}
-				const result = paged ? await callPaged() : takesStepUp(operation) ? await callWithApproval() : ATTACHMENT_WAIT_OPERATIONS.has(operation.sdkName) ? await withAttachmentWait(callOperation, {
+				const send = async () => paged ? await callPaged() : takesStepUp(operation) ? await callWithApproval() : ATTACHMENT_WAIT_OPERATIONS.has(operation.sdkName) ? await withAttachmentWait(callOperation, {
 					wait: parsedFlags.wait !== false,
 					errorCode: (error) => extractErrorCode(extractErrorPayload(error)),
 					onFirstWait: () => {
 						process.stderr.write(`Attachment content is not ready yet; waiting up to ${ATTACHMENT_WAIT_MAX_MS / 1e3}s. Pass --no-wait to return immediately.\n`);
 					}
 				}) : await callOperation();
+				let result = await send();
+				if (result.error && sentQuery !== query && isObjectionBoxRefused(extractErrorPayload(result.error))) {
+					sentQuery = {
+						...query,
+						box: OBJECTION_BOX_FALLBACK
+					};
+					objectionBoxRefused = true;
+					result = await send();
+				}
 				if (result.error) {
 					const errorPayload = extractErrorPayload(result.error);
 					const operationErrorHint = OPERATION_ERROR_HINTS[operation.sdkName]?.(extractErrorCode(errorPayload), body, errorPayload, collectValues(operation.pathParams, parsedFlags, operation.sdkName), parsedFlags);
-					writeErrorWithHints(errorPayload, result.response, { codeHint: !(operationErrorHint && OPERATION_ERROR_HINTS_REPLACING_CODE_HINT.has(operation.sdkName)) });
+					writeErrorWithHints(ENDPOINT_URL_OPERATIONS.has(operation.sdkName) && parsedFlags["show-url"] !== true ? errorWithQueryHidden(errorPayload) : errorPayload, result.response, { codeHint: !(operationErrorHint && OPERATION_ERROR_HINTS_REPLACING_CODE_HINT.has(operation.sdkName)) });
 					if (operationErrorHint) process.stderr.write(`${operationErrorHint}\n`);
 					if (stepUpUrl) process.stderr.write(approveThenRerunHint(stepUpUrl));
 					if (replyStateSurface && isAwaitingRejectedError(errorPayload)) process.stderr.write(`${awaitingRejectedError(replyStateSurface).message}\n`);
@@ -56920,18 +58809,26 @@ function createOperationCommand(operation) {
 				if (cursor && !jsonOutput) process.stderr.write(`next cursor: ${cursor}\n`);
 				if (pagingNote && !jsonOutput) process.stderr.write(`${pagingNote}\n`);
 				const summary = [];
+				let ruleListHintSaid = false;
 				if (Array.isArray(envelope?.data) && envelope.data.length === 0 && (!jsonOutput || withEnvelope) && (jsonOutput || !metaExplainsEmptyList(envelope?.meta))) {
 					const tail = query.since !== void 0;
 					const more = envelope?.meta?.cursor ?? null;
+					const ruleListHint = emptyRuleListHint(operation.sdkName, query, { objectionBoxRefused });
+					ruleListHintSaid = ruleListHint !== void 0;
 					const hint = operation.sdkName === "listEmails" ? emptyEmailListHint({
 						filterFlags: listFilters(query).map((name) => `--${parameterFlagName(operation.sdkName, name)}`),
 						...tail ? { pastFlag: "--since" } : query.cursor !== void 0 ? { pastFlag: "--cursor" } : {},
 						nextCursor: tail ? null : more,
 						caller: tail || more ? null : await readCallerMailFor(auth, apiClient.client)
-					}) : emptyRuleListHint(operation.sdkName, query) ?? emptyDeliveriesHint(operation.sdkName, query) ?? EMPTY_RESULT_HINTS[operation.sdkName];
+					}) : ruleListHint ?? emptyDeliveriesHint(operation.sdkName, query) ?? EMPTY_RESULT_HINTS[operation.sdkName];
 					if (hint && jsonOutput) summary.push(hint);
 					else if (hint) process.stderr.write(`${hint}\n`);
 				}
+				if (Array.isArray(envelope?.data) && (!jsonOutput || withEnvelope)) {
+					const note = ruleListHintSaid ? void 0 : ruleListDefaultsNote(operation.sdkName, query, { objectionBoxRefused });
+					if (note && jsonOutput) summary.push(note);
+					else if (note) process.stderr.write(`${note}\n`);
+				}
 				if (!jsonOutput) for (const line of metaNoteLines(envelope?.meta)) process.stderr.write(`${line}\n`);
 				if (operation.sdkName === "listSentEmails") {
 					const note = sentListOtherSendersNote(envelope?.data, auth.connectedAgent?.agentAddress);
@@ -56984,12 +58881,26 @@ function createOperationCommand(operation) {
 						}
 					};
 				}
-				let printed = jsonOutput && withEnvelope ? operationJsonDocument(envelope, summary) : operationOutputPayload(envelope, withEnvelope);
+				let shownEnvelope = envelope;
+				let queryHidden = false;
+				if (ENDPOINT_URL_OPERATIONS.has(operation.sdkName) && parsedFlags["show-url"] !== true && envelope) {
+					const shown = endpointsWithQueryHidden(envelope.data);
+					if (shown.hidden) {
+						shownEnvelope = {
+							...envelope,
+							data: shown.data
+						};
+						queryHidden = true;
+						if (jsonOutput && withEnvelope) summary.push(HIDDEN_QUERY_NOTE);
+					}
+				}
+				let printed = jsonOutput && withEnvelope ? operationJsonDocument(shownEnvelope, summary) : operationOutputPayload(shownEnvelope, withEnvelope);
 				if (jsonOutput && report?.exitCode && report.error && printed !== null && typeof printed === "object" && !Array.isArray(printed)) printed = {
 					...printed,
 					error: report.error
 				};
 				this.log(JSON.stringify(printed, null, 2));
+				if (queryHidden && !jsonOutput) process.stderr.write(`${HIDDEN_QUERY_NOTE}\n`);
 				if (reportError !== void 0) process.stderr.write(`Warning: ${operation.sdkName} succeeded but its report could not be built (${reportError}). The JSON above is the full answer; read it rather than the exit code.\n`);
 				if (report && !jsonOutput) for (const line of report.lines) process.stderr.write(`${line}\n`);
 				if (reportError !== void 0 && report?.exitCode && !jsonOutput) process.stderr.write(`The answer's expectations were not all shown to pass, so the command exits ${report.exitCode}.\n`);
@@ -57007,35 +58918,6 @@ const EMPTY_RESULT_HINTS = {
 	listFunctions: "(no results) No Functions configured yet. Start with `primitive functions templates`, then `primitive functions init --template <template>` and `primitive functions deploy --name <name> --file <bundle>`."
 };
 /**
-* An empty rule request, share or objection list, read by the filters the
-* call left at their defaults: each list shows only part of what you can see
-* by default (pending requests made to you; live shares made with you;
-* pending objections you made), so an empty answer says which flags widen
-* it. Undefined for any other list, when every filter was given, or on a
-* later page (--cursor), which is empty only past the end.
-*/
-function emptyRuleListHint(sdkName, query) {
-	if (query.cursor !== void 0) return void 0;
-	const unset = (name) => query[name] === void 0;
-	const said = (noun, phrase, flags) => phrase === null ? void 0 : `(no results) No ${noun} match. By default this lists only ${phrase}: add \`${flags.join(" ")}\` to widen it.`;
-	if (sdkName === "listEmailRuleRequests") {
-		const box = unset("box");
-		const status = unset("status");
-		return said("requests", box && status ? "pending requests made to you" : box ? "requests made to you" : status ? "pending requests" : null, [...box ? ["--box all"] : [], ...status ? ["--status any"] : []]);
-	}
-	if (sdkName === "listEmailRuleShares") {
-		const box = unset("box");
-		const live = unset("live");
-		return said("shares", box && live ? "live shares made with you" : box ? "shares made with you" : live ? "live shares" : null, [...box ? ["--box all"] : [], ...live ? ["--live any"] : []]);
-	}
-	if (sdkName === "listGivenEmailRuleShares") return said("shares", unset("live") ? "live shares of your mail" : null, ["--live any"]);
-	if (sdkName === "listEmailRuleObjections") {
-		const box = unset("box");
-		const status = unset("status");
-		return said("objections", box && status ? "pending objections you made" : box ? "objections you made" : status ? "pending objections" : null, [...box ? ["--box all"] : [], ...status ? ["--status any"] : []]);
-	}
-}
-/**
 * An empty delivery list narrowed by a filter (--endpoint-id, --status,
 * --event-type and the rest) names the filters given, in place of the general
 * hint, which reads as if nothing was ever delivered, and keeps its point that
@@ -57052,4 +58934,4 @@ function emptyDeliveriesHint(sdkName, query) {
 function canonicalizeCliReferences(description) {
 	return description.replaceAll("`primitive emails:latest`", "`primitive emails latest`").replaceAll("`primitive describe emails:get-email | jq '.responseSchema.properties'`", "`primitive describe emails:get | jq '.responseSchema.properties'`");
 }
-export { readEmailInteraction as $, SAVED_CLI_OAUTH_SESSION_EXPIRED_MESSAGE as $t, explainPendingMailNotFound as A, cliInvocation as At, skillFirstLine as B, formatAlreadySentNotice as Bt, promptLine as C, sendOutcomeExitCode as Ct, formatBrowserLoginInstructions as D, successfulSendOutcome as Dt, canOfferCopyHotkey as E, serializeErrorPayload as Et, latestOwnOutbound as F, loadSkillLine as Ft, clearConsumedPendingMail as G, classificationFactLines as Gt, wakeRecipientField as H, emptyEmailListHint as Ht, readThreadContext as I, currentMailSessionKey as It, readPendingMail as J, noFactsMessage as Jt, clearReadPendingMail as K, classificationOf as Kt, sentInThread as L, detectAgentRuntime as Lt, describeWake as M, defaultConnectionName as Mt, displayAddress as N, generatedAgentName as Nt, listenForCopyHotkey as O, thrownErrorExitCode as Ot, formatMailWakeLine as P, identitySuggestions as Pt, interactionNextActions as Q, ConnectedAgentKeyRequiredError as Qt, serverMuted as R, detectRuntimeSession as Rt, approveThenRerunHint as S, sendIdentityFields as St, withApproval as T, sentHistoryWindowStart as Tt, wakeRelationship as U, mailReach as Ut, wakeReadCommand as V, withFlagSuggestion as Vt, claimPendingMail as W, readCallerMailFor as Wt, removePendingMail as X, ATTACHMENT_WAIT_MAX_MS as Xt, recordPendingMail as Y, ATTACHMENT_WAIT_FLAG_DESCRIPTION as Yt, interactionHumanLine as Z, withAttachmentWait as Zt, takesStepUp as _, setKnownCommands as _n, formatPriorRepliesWarning as _t, createOperationCommand as a, selectedOrgFromEnv as an, SEND_OUTCOME_HELP as at, STEP_UP_HEADER as b, priorRepliesThatWentOut as bt, formatErrorPayload as c, credentialsFromUserLogin as cn, buildFollowUpCommand as ct, isGrantRefusal as d, revokeUserLogin as dn, classifySendError as dt, createAuthenticatedCliApiClient as en, replyExpectation as et, parameterFlagName as f, roleKeyLabel as fn, deriveSendIdempotencyKey as ft, surfaceUnauthorizedHint as g, sanitizeForTerminal as gn, formatPriorRepliesCheckSkipped as gt, runWithTiming as h, routeWarningLines as hn, formatDeletedEarlierSendNotice as ht, TIME_FLAG_DESCRIPTION as i, resolveCliApiRequestConfig as in, MAX_SEND_WAIT_TIMEOUT_MS as it, bareAddress$1 as j, connectNextSteps as jt, openBrowser as k, DEFAULT_ENROLL_NAME as kt, hasControlCharacter as l, fetchCliOrgs as ln, buildThrownSendFailureEnvelope as lt, refusalDetails as m, switchCurrentOrg as mn, followUpCommandPrefix as mt, API_ERROR_CODES as n, refreshStoredCliCredentials as nn, wakeInteractionSentence as nt, extractErrorCode as o, CliOrgRefusedError as on, apiResultHttpStatus as ot, readTextFileFlag as p, roleKeyText as pn, excludeSignalReplies as pt, pendingMailPath as q, isEmailId as qt, OPERATION_PATH_FLAGS as r, refuseOrgSelectionForProfile as rn, IDEMPOTENCY_KEY_FLAG_DESCRIPTION as rt, extractErrorPayload as s, RESTRICTED_ROLE_NOTE as sn, assertValidIdempotencyKey as st, API_BASE_URL_FLAG_DESCRIPTION as t, createCliApiClient as tn, replyInteractionWarning as tt, headerFlagName as u, isBuiltInRoleKey as un, checkPriorReplies as ut, writeErrorWithHints as v, operationManifest as vn, formatSendFailureSummary as vt, terminalApprovalIo as w, sendWaitClampNotice as wt, STEP_UP_TOKEN_FLAG_DESCRIPTION as x, reportSendCommandResult as xt, BROWSER_FLAG_DESCRIPTION as y, formatSendRecordFailureSummary as yt, serverRelationship as z, runtimeSessionVariableList as zt };
+export { interactionNextActions as $, ConnectedAgentKeyRequiredError as $t, openBrowser as A, DEFAULT_ENROLL_NAME as At, serverRelationship as B, runtimeSessionVariableList as Bt, approveThenRerunHint as C, sendIdentityFields as Ct, canOfferCopyHotkey as D, serializeErrorPayload as Dt, withApproval as E, sentHistoryWindowStart as Et, formatMailWakeLine as F, identitySuggestions as Ft, claimPendingMail as G, readCallerMailFor as Gt, wakeReadCommand as H, withFlagSuggestion as Ht, latestOwnOutbound as I, loadSkillLine as It, pendingMailPath as J, isEmailId as Jt, clearConsumedPendingMail as K, classificationFactLines as Kt, readThreadContext as L, currentMailSessionKey as Lt, bareAddress$1 as M, connectNextSteps as Mt, describeWake as N, defaultConnectionName as Nt, formatBrowserLoginInstructions as O, successfulSendOutcome as Ot, displayAddress as P, generatedAgentName as Pt, interactionHumanLine as Q, withAttachmentWait as Qt, sentInThread as R, detectAgentRuntime as Rt, STEP_UP_TOKEN_FLAG_DESCRIPTION as S, reportSendCommandResult as St, terminalApprovalIo as T, sendWaitClampNotice as Tt, wakeRecipientField as U, emptyEmailListHint as Ut, skillFirstLine as V, formatAlreadySentNotice as Vt, wakeRelationship as W, mailReach as Wt, recordPendingMail as X, ATTACHMENT_WAIT_FLAG_DESCRIPTION as Xt, readPendingMail as Y, noFactsMessage as Yt, removePendingMail as Z, ATTACHMENT_WAIT_MAX_MS as Zt, surfaceUnauthorizedHint as _, sanitizeForTerminal as _n, formatPriorRepliesCheckSkipped as _t, createOperationCommand as a, resolveCliApiRequestConfig as an, MAX_SEND_WAIT_TIMEOUT_MS as at, BROWSER_FLAG_DESCRIPTION as b, formatSendRecordFailureSummary as bt, formatErrorPayload as c, RESTRICTED_ROLE_NOTE as cn, assertValidIdempotencyKey as ct, isGrantRefusal as d, isBuiltInRoleKey as dn, checkPriorReplies as dt, SAVED_CLI_OAUTH_SESSION_EXPIRED_MESSAGE as en, readEmailInteraction as et, networkErrorHint as f, revokeUserLogin as fn, classifySendError as ft, runWithTiming as g, routeWarningLines as gn, formatDeletedEarlierSendNotice as gt, refusalDetails as h, switchCurrentOrg as hn, followUpCommandPrefix as ht, TIME_FLAG_DESCRIPTION as i, refuseOrgSelectionForProfile as in, IDEMPOTENCY_KEY_FLAG_DESCRIPTION as it, explainPendingMailNotFound as j, cliInvocation as jt, listenForCopyHotkey as k, thrownErrorExitCode as kt, hasControlCharacter as l, credentialsFromUserLogin as ln, buildFollowUpCommand as lt, readTextFileFlag as m, roleKeyText as mn, excludeSignalReplies as mt, API_ERROR_CODES as n, createCliApiClient as nn, replyInteractionWarning as nt, extractErrorCode as o, selectedOrgFromEnv as on, SEND_OUTCOME_HELP as ot, parameterFlagName as p, roleKeyLabel as pn, deriveSendIdempotencyKey as pt, clearReadPendingMail as q, classificationOf as qt, OPERATION_PATH_FLAGS as r, refreshStoredCliCredentials as rn, wakeInteractionSentence as rt, extractErrorPayload as s, CliOrgRefusedError as sn, apiResultHttpStatus as st, API_BASE_URL_FLAG_DESCRIPTION as t, createAuthenticatedCliApiClient as tn, replyExpectation as tt, headerFlagName as u, fetchCliOrgs as un, buildThrownSendFailureEnvelope as ut, takesStepUp as v, setKnownCommands as vn, formatPriorRepliesWarning as vt, promptLine as w, sendOutcomeExitCode as wt, STEP_UP_HEADER as x, priorRepliesThatWentOut as xt, writeErrorWithHints as y, operationManifest as yn, formatSendFailureSummary as yt, serverMuted as z, detectRuntimeSession as zt };