primcli 3.0.0-preview.13 → 3.0.0-preview.15

package/dist/{api-command-D5Tj9C-K.js → api-command-D5Nbd6Pq.js}

@@ -1,4 +1,4 @@
-import { B as ensureSearchReportsReplyState, Gn as sdk_gen_exports, J as EMAIL_RULE_REQUEST_EVENT_TYPES, K as replyStateSurfaceForOperation, L as ReplyStateUnsupportedError, Qt as getOwnGrant, R as assertAwaitingFilterRows, Ut as getEmail, W as isAwaitingRejectedError, X as WEBHOOK_EVENT_TYPES, Y as SENT_EMAIL_EVENT_TYPES, _n as listEndpoints, at as assertAutomatedVerdict, ct as ensureSearchReportsAutomated, dt as isAutomatedRejectedError, it as AutomatedFilterUnsupportedError, lt as expectedAutomatedVerdicts, nn as getThread, ot as automatedRejectedError, q as EMAIL_RULE_OBJECTION_EVENT_TYPES, st as automatedSurfaceForOperation, v as parseRetryAfter, z as awaitingRejectedError } from "./repeats-Dj_o6c-X-ykfsraq6.js";
+import { $t as getOwnGrant, B as awaitingRejectedError, G as isAwaitingRejectedError, J as EMAIL_RULE_OBJECTION_EVENT_TYPES, Kn as sdk_gen_exports, R as ReplyStateUnsupportedError, V as ensureSearchReportsReplyState, Wt as getEmail, X as SENT_EMAIL_EVENT_TYPES, Y as EMAIL_RULE_REQUEST_EVENT_TYPES, Z as WEBHOOK_EVENT_TYPES, at as AutomatedFilterUnsupportedError, ct as automatedSurfaceForOperation, ft as isAutomatedRejectedError, lt as ensureSearchReportsAutomated, ot as assertAutomatedVerdict, q as replyStateSurfaceForOperation, rn as getThread, st as automatedRejectedError, ut as expectedAutomatedVerdicts, vn as listEndpoints, y as parseRetryAfter, z as assertAwaitingFilterRows } from "./repeats-Dj_o6c-X-C1y88ZwJ.js";
 import { C as saveCliCredentials, F as agentProfilesDirectory, H as requireDefaultLoginProfile, N as agentProfileDirectory, R as loadConnectedAgentProfile, S as resolveCliAuth, W as PrimitiveApiClient, _ as deleteCliCredentials, b as loadCliCredentials, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, i as loadCliConfig, j as AGENT_PROFILE_ENV, m as cliAccessTokenExpiresAt, p as acquireCliCredentialsLock, w as saveSignupCredentials, x as normalizeApiBaseUrl, y as detectPrimitiveKeyEnvMisname } from "./cli-config-Ms_0vNjq.js";
 import "./oclif/global-org-flag.js";
 import { a as thrownErrorBody } from "./json-output-ch756TXV.js";
@@ -780,7 +780,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-activity-objects",
-		"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules, rule requests and objections to rules over their mail (objections only on the dashboard or the Primitive CLI). Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, and the objections to rules they wrote, under their current membership, each naming the member who asked or objected in created_through. A key, an app or an agent has none, and gets both kinds in withheld. With relation=concerning it lists instead what other members did that concerns the person's own mail: each time a rule started covering one of their mailboxes or saved a new version while covering it, named as the rule was then, naming its author in created_through, under their current membership; only on the dashboard or the Primitive CLI. A key, an app or an agent has none, and gets email_rule_coverage in withheld. A notice never reads as ended. Notices are written by a periodic job and can lag: until the notices record a rule starting to cover you, the first page lists that rule as pending (pending_complete says whether that check finished), and as_of says about when the notices last looked. For what covers you now, read GET /email-rules/covering-me.",
+		"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules, rule requests and objections to rules over their mail (objections only on the dashboard or the Primitive CLI). Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, and the objections to rules they wrote, under their current membership, each naming the member who asked or objected in created_through. A key, an app or an agent has none, and gets both kinds in withheld. With relation=concerning it lists instead what other members did that concerns the person's own mail: each time a rule started covering one of their mailboxes, saved a new version, or changed who receives its matches while covering it, named as the rule was then, naming its author in created_through, under their current membership; only on the dashboard or the Primitive CLI. A key, an app or an agent has none, and gets email_rule_coverage in withheld. A notice never reads as ended. Notices are written by a periodic job and can lag: until the notices record a rule starting to cover you, the first page lists that rule as pending (pending_complete says whether that check finished), and as_of says about when the notices last looked. For what covers you now, read GET /email-rules/covering-me.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listActivityObjects",
@@ -863,7 +863,7 @@ const operationManifest = [
 							},
 							"state": {
 								"type": "string",
-								"description": "Where it stands now: enabled, disabled, deleted or replaced (endpoints and routes), enabled or disabled (filters, wake schedules), live, suspended or deleted (Functions), active, paused or ended (repeating sends), scheduled (scheduled sends), active, suspended, expired or revoked (API keys), pending, claimed, connected or revoked (agents), draft, observe or active (email rules), pending, accepted, declined or withdrawn (rule requests and objections), and for a coverage notice what it told: started (a rule was made or turned active over your mailboxes, or an active rule came to reach you; once per rule, not per mailbox), new_version, or baseline (it already covered you when notices began). pending: a rule started covering your mailbox and the notices have not recorded that start yet (a restart within an hour of the last start notice is recorded without a new one); its id is then the rule's, and created_at when the rule last changed."
+								"description": "Where it stands now: enabled, disabled, deleted or replaced (endpoints and routes), enabled or disabled (filters, wake schedules), live, suspended or deleted (Functions), active, paused or ended (repeating sends), scheduled (scheduled sends), active, suspended, expired or revoked (API keys), pending, claimed, connected or revoked (agents), draft, observe or active (email rules), pending, accepted, declined or withdrawn (rule requests and objections), and for a coverage notice what it told: started (a rule was made or turned active over your mailboxes, or an active rule came to reach you; once per rule, not per mailbox), new_version, receivers_changed (who receives an active rule's matches changed: its keys, webhooks or share), or baseline (it already covered you when notices began). pending: a rule started covering your mailbox and the notices have not recorded that start yet (a restart within an hour of the last start notice is recorded without a new one); its id is then the rule's, and created_at when the rule last changed."
 							},
 							"created_at": {
 								"type": "string",
@@ -872,7 +872,7 @@ const operationManifest = [
 							"ended_at": {
 								"type": ["string", "null"],
 								"format": "date-time",
-								"description": "When it was deleted, replaced or revoked, when an API key expired, when a repeating send stopped, or when a rule request or objection was decided (accepted, declined or withdrawn); null otherwise, as on every coverage notice."
+								"description": "When it was deleted, replaced or revoked, when an API key expired, when a repeating send stopped, or when a rule request or objection was decided (accepted, declined or withdrawn); null otherwise, as on every coverage notice (rule_now marks one whose rule was deleted)."
 							},
 							"owned_now": {
 								"type": "string",
@@ -902,9 +902,77 @@ const operationManifest = [
 								]
 							},
 							"rule_id": {
-								"description": "For email_rule_coverage, always: the rule it is about, since names need not be unique (for pending, the same as id). GET /v1/email-rules/covering-me/{rule_id} shows the rule while it covers you, or as it last decided on your mail; otherwise it answers not_found.",
+								"description": "For email_rule_coverage, always: the rule it is about, since names need not be unique (for pending, the same as id). GET /v1/email-rules/covering-me/{rule_id} shows the rule while it covers you, or as it last decided on your mail; otherwise it answers not_found, with details.reason rule_deleted once a rule you were told of is deleted.",
 								"type": "string",
 								"format": "uuid"
+							},
+							"rule_now": {
+								"description": "For email_rule_coverage: deleted once the rule it is about has been deleted. Left out while it exists, or when that could not be checked.",
+								"type": "string",
+								"enum": ["deleted"]
+							},
+							"receivers_change": {
+								"description": "For a receivers_changed notice: who received the rule's matches before and after, in totals. They can be equal when only an owner or a webhook site changed; covering-me shows them by owner. A rotated key counts once here while the old one still works; covering-me counts both.",
+								"type": "object",
+								"properties": {
+									"before": {
+										"type": "object",
+										"properties": {
+											"keys": {
+												"type": "integer",
+												"minimum": 0
+											},
+											"reads_in_full": {
+												"type": "integer",
+												"minimum": 0,
+												"description": "Of the keys, how many also read your own mail beyond the rule."
+											},
+											"webhooks": {
+												"type": "integer",
+												"minimum": 0
+											},
+											"shares": {
+												"type": "integer",
+												"minimum": 0
+											}
+										},
+										"required": [
+											"keys",
+											"reads_in_full",
+											"webhooks",
+											"shares"
+										]
+									},
+									"after": {
+										"type": "object",
+										"properties": {
+											"keys": {
+												"type": "integer",
+												"minimum": 0
+											},
+											"reads_in_full": {
+												"type": "integer",
+												"minimum": 0,
+												"description": "Of the keys, how many also read your own mail beyond the rule."
+											},
+											"webhooks": {
+												"type": "integer",
+												"minimum": 0
+											},
+											"shares": {
+												"type": "integer",
+												"minimum": 0
+											}
+										},
+										"required": [
+											"keys",
+											"reads_in_full",
+											"webhooks",
+											"shares"
+										]
+									}
+								},
+								"required": ["before", "after"]
 							}
 						},
 						"required": [
@@ -951,7 +1019,7 @@ const operationManifest = [
 				"as_of": {
 					"type": ["string", "null"],
 					"format": "date-time",
-					"description": "With relation=concerning only: about when the notices last looked at your organization; null if never or unread. Coverage since may have no notice yet."
+					"description": "With relation=concerning only: about when the notices last looked at your organization; null if never or unread. Coverage since may have no notice yet. They look only while one of its rules could cover someone, so this stops moving while none could."
 				},
 				"pending_complete": {
 					"description": "With relation=concerning, on the first page only: whether the check for rules that started covering you without their start notice (state pending, listed ahead of the notices and beyond limit) was finished. false: some may be missing. Absent where there is nothing to check.",
@@ -6390,7 +6458,10 @@ const operationManifest = [
 														null
 													]
 												},
-												"webhook_attempt_count": { "type": "integer" },
+												"webhook_attempt_count": {
+													"type": "integer",
+													"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its attempts."
+												},
 												"thread_id": {
 													"type": ["string", "null"],
 													"format": "uuid",
@@ -9700,6 +9771,14 @@ const operationManifest = [
 						"additionalProperties": {}
 					}
 				},
+				"mail_limits_available": {
+					"description": "Whether a key limited to some mail (addresses, domains or email rules) would be created now. While false, creating one is refused, so a client offers neither the listed-address presets nor a listed mail reach for a custom key.",
+					"type": "boolean"
+				},
+				"org_reach_available": {
+					"description": "Whether the credential policy lets a new key reach every mailbox. While false, creating one is refused, so a client offers no preset that reaches every mailbox, and a custom key lists its addresses or domains. With mail_limits_available false as well, no key can be created and every preset is unavailable.",
+					"type": "boolean"
+				},
 				"matrix": {
 					"type": "array",
 					"items": {
@@ -10867,7 +10946,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "rotate-key",
-		"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Revoking the successor during the overlap also revokes the old key when you may revoke that one too; the revoke's predecessors_left counts any left working. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+		"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once, with its name and grant so you can see they carried over. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Revoking the successor during the overlap also revokes the old key when you may revoke that one too; the revoke's predecessors_left counts any left working. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "rotateKey",
@@ -10925,6 +11004,36 @@ const operationManifest = [
 					"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
 				},
 				"previous_key_id": { "type": "string" },
+				"name": {
+					"description": "The successor's name: the rotated key's, which it keeps.",
+					"type": ["string", "null"]
+				},
+				"grant": {
+					"description": "The grant the successor holds, as a create answers it: the rotated key's own, carried over unchanged (rules, addresses and domains included).",
+					"type": "object",
+					"properties": {
+						"template": { "type": ["string", "null"] },
+						"credential_grant_id": { "type": ["string", "null"] },
+						"permissions": {
+							"type": ["array", "null"],
+							"items": { "type": "string" }
+						},
+						"mail_scope": {},
+						"resources": {}
+					},
+					"required": [
+						"template",
+						"credential_grant_id",
+						"permissions",
+						"mail_scope",
+						"resources"
+					],
+					"additionalProperties": {}
+				},
+				"rotated_from": {
+					"description": "The rotated key: previous_key_id, under the name GET /v1/keys/{id} gives it.",
+					"type": "string"
+				},
 				"previous_key_expires_at": {
 					"type": "string",
 					"format": "date-time",
@@ -13076,6 +13185,388 @@ const operationManifest = [
 		"tag": "Domains",
 		"tagCommand": "domains"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-email-notification-preferences",
+		"description": "The notification emails the calling member gets, and which of them they may turn on or off. Each kind lists its label and description, its class, whether it needs an entitlement and whether the organization has it, the organization's mode (null for platform_required) and the modes it may choose, and whether the calling member gets it and may change that.\n\nPerson only: a dashboard session or the person's own OAuth token (the CLI or an app they connected). The person's role must hold notifications:manage. API keys, agent connection keys and agents are refused.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getEmailNotificationPreferences",
+		"path": "/email-notification-preferences",
+		"pathParams": [],
+		"queryParams": [],
+		"headerParams": [],
+		"permissions": ["notifications:manage"],
+		"access": "person",
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"entitled": { "type": "boolean" },
+				"kinds": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"kind": { "type": "string" },
+							"label": { "type": "string" },
+							"description": { "type": "string" },
+							"class": {
+								"type": "string",
+								"enum": [
+									"platform_required",
+									"org_requirable",
+									"optional"
+								]
+							},
+							"entitlement_required": { "type": "boolean" },
+							"entitled": { "type": "boolean" },
+							"org_mode": {
+								"type": ["string", "null"],
+								"enum": [
+									"off",
+									"optional_on",
+									"optional_off",
+									"required",
+									null
+								]
+							},
+							"org_mode_is_default": { "type": "boolean" },
+							"org_modes": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"enum": [
+										"off",
+										"optional_on",
+										"optional_off",
+										"required"
+									]
+								}
+							},
+							"member_enabled": { "type": "boolean" },
+							"member_can_change": { "type": "boolean" }
+						},
+						"required": [
+							"kind",
+							"label",
+							"description",
+							"class",
+							"entitlement_required",
+							"entitled",
+							"org_mode",
+							"org_mode_is_default",
+							"org_modes",
+							"member_enabled",
+							"member_can_change"
+						]
+					}
+				}
+			},
+			"required": ["entitled", "kinds"]
+		},
+		"sdkName": "getEmailNotificationPreferences",
+		"summary": "Get my email notification preferences",
+		"tag": "Email notifications",
+		"tagCommand": "email-notifications"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-email-notification-settings",
+		"description": "Every kind of notification email Primitive sends the organization's members, and who may turn it off. Each kind lists its label and description, its class, whether it needs an entitlement and whether the organization has it, the organization's mode (null for platform_required) and the modes it may choose, and whether the calling member gets it and may change that.\n\nPerson only: a dashboard session or the person's own OAuth token (the CLI or an app they connected). API keys, agent connection keys and agents are refused.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getEmailNotificationSettings",
+		"path": "/email-notification-settings",
+		"pathParams": [],
+		"queryParams": [],
+		"headerParams": [],
+		"permissions": ["org:read"],
+		"access": "person",
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"entitled": { "type": "boolean" },
+				"kinds": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"kind": { "type": "string" },
+							"label": { "type": "string" },
+							"description": { "type": "string" },
+							"class": {
+								"type": "string",
+								"enum": [
+									"platform_required",
+									"org_requirable",
+									"optional"
+								]
+							},
+							"entitlement_required": { "type": "boolean" },
+							"entitled": { "type": "boolean" },
+							"org_mode": {
+								"type": ["string", "null"],
+								"enum": [
+									"off",
+									"optional_on",
+									"optional_off",
+									"required",
+									null
+								]
+							},
+							"org_mode_is_default": { "type": "boolean" },
+							"org_modes": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"enum": [
+										"off",
+										"optional_on",
+										"optional_off",
+										"required"
+									]
+								}
+							},
+							"member_enabled": { "type": "boolean" },
+							"member_can_change": { "type": "boolean" }
+						},
+						"required": [
+							"kind",
+							"label",
+							"description",
+							"class",
+							"entitlement_required",
+							"entitled",
+							"org_mode",
+							"org_mode_is_default",
+							"org_modes",
+							"member_enabled",
+							"member_can_change"
+						]
+					}
+				}
+			},
+			"required": ["entitled", "kinds"]
+		},
+		"sdkName": "getEmailNotificationSettings",
+		"summary": "Get the organization's email notification settings",
+		"tag": "Email notifications",
+		"tagCommand": "email-notifications"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "update-email-notification-preferences",
+		"description": "Turn one or more kinds on or off for the calling member. Only a kind whose organization mode is optional_on or optional_off can be changed: a platform_required kind, one the organization requires, and one it turned off are refused with 409 (conflict, details.reason not_member_choice, details.org_mode saying which), and nothing is changed. An unknown kind is refused with 400. Answers the preferences as they now stand. Each kind lists its label and description, its class, whether it needs an entitlement and whether the organization has it, the organization's mode (null for platform_required) and the modes it may choose, and whether the calling member gets it and may change that.\n\nPerson only: a dashboard session or the person's own OAuth token (the CLI or an app they connected). The person's role must hold notifications:manage. API keys, agent connection keys and agents are refused.",
+		"hasJsonBody": true,
+		"method": "PUT",
+		"operationId": "updateEmailNotificationPreferences",
+		"path": "/email-notification-preferences",
+		"pathParams": [],
+		"queryParams": [],
+		"headerParams": [],
+		"permissions": ["notifications:manage"],
+		"access": "person",
+		"requestSchema": {
+			"type": "object",
+			"properties": { "preferences": {
+				"type": "object",
+				"propertyNames": {
+					"type": "string",
+					"pattern": "^[a-z][a-z0-9_]{0,63}$"
+				},
+				"additionalProperties": { "type": "boolean" }
+			} },
+			"required": ["preferences"],
+			"additionalProperties": false
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"entitled": { "type": "boolean" },
+				"kinds": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"kind": { "type": "string" },
+							"label": { "type": "string" },
+							"description": { "type": "string" },
+							"class": {
+								"type": "string",
+								"enum": [
+									"platform_required",
+									"org_requirable",
+									"optional"
+								]
+							},
+							"entitlement_required": { "type": "boolean" },
+							"entitled": { "type": "boolean" },
+							"org_mode": {
+								"type": ["string", "null"],
+								"enum": [
+									"off",
+									"optional_on",
+									"optional_off",
+									"required",
+									null
+								]
+							},
+							"org_mode_is_default": { "type": "boolean" },
+							"org_modes": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"enum": [
+										"off",
+										"optional_on",
+										"optional_off",
+										"required"
+									]
+								}
+							},
+							"member_enabled": { "type": "boolean" },
+							"member_can_change": { "type": "boolean" }
+						},
+						"required": [
+							"kind",
+							"label",
+							"description",
+							"class",
+							"entitlement_required",
+							"entitled",
+							"org_mode",
+							"org_mode_is_default",
+							"org_modes",
+							"member_enabled",
+							"member_can_change"
+						]
+					}
+				}
+			},
+			"required": ["entitled", "kinds"]
+		},
+		"sdkName": "updateEmailNotificationPreferences",
+		"summary": "Change my email notification preferences",
+		"tag": "Email notifications",
+		"tagCommand": "email-notifications"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "update-email-notification-settings",
+		"description": "Set the organization's mode for one or more kinds: off (nobody gets it), optional_on (each member gets it unless they turn it off), optional_off (only members who turn it on get it) or required (every member gets it). Kinds left out keep their mode. An unknown kind is refused with 400 (validation_error, details.reason unknown_kind). A platform_required kind is refused with 409 (conflict, details.reason platform_required), and required for an optional kind with 409 (conflict, details.reason mode_not_allowed); nothing is changed. Answers the settings as they now stand. Each kind lists its label and description, its class, whether it needs an entitlement and whether the organization has it, the organization's mode (null for platform_required) and the modes it may choose, and whether the calling member gets it and may change that.\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `org_settings.write` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold notification_policy:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+		"hasJsonBody": true,
+		"method": "PUT",
+		"operationId": "updateEmailNotificationSettings",
+		"path": "/email-notification-settings",
+		"pathParams": [],
+		"queryParams": [],
+		"headerParams": [{
+			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo, semantic search setting or email notification settings), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
+			"enum": null,
+			"name": "Primitive-Step-Up",
+			"required": false,
+			"type": "string"
+		}],
+		"permissions": ["notification_policy:manage"],
+		"access": "step_up",
+		"requestSchema": {
+			"type": "object",
+			"properties": { "modes": {
+				"type": "object",
+				"propertyNames": {
+					"type": "string",
+					"pattern": "^[a-z][a-z0-9_]{0,63}$"
+				},
+				"additionalProperties": {
+					"type": "string",
+					"enum": [
+						"off",
+						"optional_on",
+						"optional_off",
+						"required"
+					]
+				}
+			} },
+			"required": ["modes"],
+			"additionalProperties": false
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"entitled": { "type": "boolean" },
+				"kinds": {
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"kind": { "type": "string" },
+							"label": { "type": "string" },
+							"description": { "type": "string" },
+							"class": {
+								"type": "string",
+								"enum": [
+									"platform_required",
+									"org_requirable",
+									"optional"
+								]
+							},
+							"entitlement_required": { "type": "boolean" },
+							"entitled": { "type": "boolean" },
+							"org_mode": {
+								"type": ["string", "null"],
+								"enum": [
+									"off",
+									"optional_on",
+									"optional_off",
+									"required",
+									null
+								]
+							},
+							"org_mode_is_default": { "type": "boolean" },
+							"org_modes": {
+								"type": "array",
+								"items": {
+									"type": "string",
+									"enum": [
+										"off",
+										"optional_on",
+										"optional_off",
+										"required"
+									]
+								}
+							},
+							"member_enabled": { "type": "boolean" },
+							"member_can_change": { "type": "boolean" }
+						},
+						"required": [
+							"kind",
+							"label",
+							"description",
+							"class",
+							"entitlement_required",
+							"entitled",
+							"org_mode",
+							"org_mode_is_default",
+							"org_modes",
+							"member_enabled",
+							"member_can_change"
+						]
+					}
+				}
+			},
+			"required": ["entitled", "kinds"]
+		},
+		"sdkName": "updateEmailNotificationSettings",
+		"summary": "Change the organization's email notification settings",
+		"tag": "Email notifications",
+		"tagCommand": "email-notifications"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -13182,10 +13673,13 @@ const operationManifest = [
 					"description": "Whether it is to a rule you wrote, in your current membership."
 				},
 				"message": {
-					"description": "Why the objector objects; null when none was given, or once withdrawn.",
+					"description": "Why they object and what they ask (to turn the rule off, narrow it, or explain who receives it); null when none was given, or once withdrawn.",
+					"type": ["string", "null"]
+				},
+				"decline_reason": {
+					"description": "The author's answer when declining, which the objector sees; null when none was given.",
 					"type": ["string", "null"]
 				},
-				"decline_reason": { "type": ["string", "null"] },
 				"created_at": {
 					"type": "string",
 					"format": "date-time"
@@ -13223,7 +13717,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "create-email-rule-objection",
-		"description": "Asks the author of a rule that covers one of your own mailboxes now to turn it off. Only a rule that covers you now: one you see only because it once decided on your mail cannot be objected to. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. You may have one pending objection per rule and 50 in all, and object to the same rule again only 10 minutes after you last did, whatever became of it. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+		"description": "Objects to a rule that covers one of your own mailboxes now: say in the message what you ask its author, to turn it off, narrow it, or explain who receives what it matches. The author answers by accepting, which turns it off, or by declining, optionally with a reason you see; the rule keeps running unless they accept. Only a rule that covers you now: one you see only because it once decided on your mail cannot be objected to. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it (optionally with a reason the objector sees), or the member who made it withdraws it, which clears its message. It never changes after that. You may have one pending objection per rule and 50 in all, and object to the same rule again only 10 minutes after you last did, whatever became of it. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "createEmailRuleObjection",
@@ -13251,7 +13745,7 @@ const operationManifest = [
 					"type": ["string", "null"],
 					"minLength": 1,
 					"maxLength": 500,
-					"description": "Why you object, up to 500 characters; null or absent for none. The rule's author and the organization's owners and admins see it while it stands; withdrawing clears it."
+					"description": "Why you object and what you ask, up to 500 characters: to turn the rule off, to narrow it, or to explain who receives what it matches. Null or absent for none. The rule's author and the organization's owners and admins see it while it stands; withdrawing clears it."
 				}
 			},
 			"required": ["rule_id"],
@@ -13336,10 +13830,13 @@ const operationManifest = [
 					"description": "Whether it is to a rule you wrote, in your current membership."
 				},
 				"message": {
-					"description": "Why the objector objects; null when none was given, or once withdrawn.",
+					"description": "Why they object and what they ask (to turn the rule off, narrow it, or explain who receives it); null when none was given, or once withdrawn.",
+					"type": ["string", "null"]
+				},
+				"decline_reason": {
+					"description": "The author's answer when declining, which the objector sees; null when none was given.",
 					"type": ["string", "null"]
 				},
-				"decline_reason": { "type": ["string", "null"] },
 				"created_at": {
 					"type": "string",
 					"format": "date-time"
@@ -13377,7 +13874,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "decline-email-rule-objection",
-		"description": "Declines a pending objection to a rule you wrote, optionally saying why; the rule stays as it is. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+		"description": "Declines a pending objection to a rule you wrote, optionally saying why (reason), which the member who objected sees; the rule stays as it is. When its message asks you to narrow the rule or explain who receives it, the reason is your answer; narrow it with a new version as well if you agree. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "declineEmailRuleObjection",
@@ -13405,7 +13902,7 @@ const operationManifest = [
 				"type": ["string", "null"],
 				"minLength": 1,
 				"maxLength": 500,
-				"description": "Why you are declining, up to 500 characters; null or absent for none. The member who objected sees it."
+				"description": "Why you are declining, up to 500 characters; null or absent for none. The member who objected sees it: it is how to answer one that asks you to narrow the rule or explain who receives it."
 			} },
 			"additionalProperties": false
 		},
@@ -13488,10 +13985,13 @@ const operationManifest = [
 					"description": "Whether it is to a rule you wrote, in your current membership."
 				},
 				"message": {
-					"description": "Why the objector objects; null when none was given, or once withdrawn.",
+					"description": "Why they object and what they ask (to turn the rule off, narrow it, or explain who receives it); null when none was given, or once withdrawn.",
+					"type": ["string", "null"]
+				},
+				"decline_reason": {
+					"description": "The author's answer when declining, which the objector sees; null when none was given.",
 					"type": ["string", "null"]
 				},
-				"decline_reason": { "type": ["string", "null"] },
 				"created_at": {
 					"type": "string",
 					"format": "date-time"
@@ -13529,7 +14029,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-email-rule-covering-me",
-		"description": "One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+		"description": "One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. For what happened to one email of yours, every rule's decision on it and, for another member's rule covering you, who receives what it shares: GET /v1/emails/{id}/rule-results (primitive email-rules list-email-rule-results --email-id <email-id>). Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getEmailRuleCoveringMe",
@@ -13571,6 +14071,10 @@ const operationManifest = [
 					"enum": ["grant", "do_not_share"],
 					"description": "grant: what it matches can be shared. do_not_share: it blocks sharing what it matches."
 				},
+				"do_not_share_note": {
+					"description": "On a grant rule: that the active do-not-share rules over an email run first, keeping from it what they match and holding back what they cannot decide, which is decided again for up to a day and shared only if none of them then matches it.",
+					"type": "string"
+				},
 				"author": {
 					"type": "object",
 					"properties": {
@@ -13674,6 +14178,11 @@ const operationManifest = [
 											"description": "On a rule over your mail: how many of these keys also list one of your own mailboxes, or its domain, so they read your mail there beyond what this rule matches.",
 											"type": "integer",
 											"minimum": 0
+										},
+										"newest_at": {
+											"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+											"type": "string",
+											"format": "date-time"
 										}
 									},
 									"required": ["owner", "count"]
@@ -13729,6 +14238,11 @@ const operationManifest = [
 											"description": "Hosts past those listed.",
 											"type": "integer",
 											"minimum": 0
+										},
+										"newest_at": {
+											"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+											"type": "string",
+											"format": "date-time"
 										}
 									},
 									"required": ["owner", "count"]
@@ -13766,6 +14280,11 @@ const operationManifest = [
 										"count": {
 											"type": "integer",
 											"exclusiveMinimum": 0
+										},
+										"newest_at": {
+											"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+											"type": "string",
+											"format": "date-time"
 										}
 									},
 									"required": ["beneficiary", "count"]
@@ -13830,6 +14349,11 @@ const operationManifest = [
 											"description": "On a rule over your mail: how many of these keys also list one of your own mailboxes, or its domain, so they read your mail there beyond what this rule matches.",
 											"type": "integer",
 											"minimum": 0
+										},
+										"newest_at": {
+											"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+											"type": "string",
+											"format": "date-time"
 										}
 									},
 									"required": ["owner", "count"]
@@ -13885,6 +14409,11 @@ const operationManifest = [
 											"description": "Hosts past those listed.",
 											"type": "integer",
 											"minimum": 0
+										},
+										"newest_at": {
+											"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+											"type": "string",
+											"format": "date-time"
 										}
 									},
 									"required": ["owner", "count"]
@@ -13922,6 +14451,11 @@ const operationManifest = [
 										"count": {
 											"type": "integer",
 											"exclusiveMinimum": 0
+										},
+										"newest_at": {
+											"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+											"type": "string",
+											"format": "date-time"
 										}
 									},
 									"required": ["beneficiary", "count"]
@@ -14045,7 +14579,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-email-rule-objection",
-		"description": "One objection you can see. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+		"description": "One objection you can see. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it (optionally with a reason the objector sees), or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getEmailRuleObjection",
@@ -14141,10 +14675,13 @@ const operationManifest = [
 					"description": "Whether it is to a rule you wrote, in your current membership."
 				},
 				"message": {
-					"description": "Why the objector objects; null when none was given, or once withdrawn.",
+					"description": "Why they object and what they ask (to turn the rule off, narrow it, or explain who receives it); null when none was given, or once withdrawn.",
+					"type": ["string", "null"]
+				},
+				"decline_reason": {
+					"description": "The author's answer when declining, which the objector sees; null when none was given.",
 					"type": ["string", "null"]
 				},
-				"decline_reason": { "type": ["string", "null"] },
 				"created_at": {
 					"type": "string",
 					"format": "date-time"
@@ -14305,7 +14842,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rule-objections",
-		"description": "Objections you made and objections to rules you wrote (by default), only one of the two, or every objection you can see, newest first. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+		"description": "Objections you made and objections to rules you wrote (by default), only one of the two, or every objection you can see, newest first. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it (optionally with a reason the objector sees), or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRuleObjections",
@@ -14440,10 +14977,13 @@ const operationManifest = [
 						"description": "Whether it is to a rule you wrote, in your current membership."
 					},
 					"message": {
-						"description": "Why the objector objects; null when none was given, or once withdrawn.",
+						"description": "Why they object and what they ask (to turn the rule off, narrow it, or explain who receives it); null when none was given, or once withdrawn.",
+						"type": ["string", "null"]
+					},
+					"decline_reason": {
+						"description": "The author's answer when declining, which the objector sees; null when none was given.",
 						"type": ["string", "null"]
 					},
-					"decline_reason": { "type": ["string", "null"] },
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -14602,7 +15142,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rules-covering-me",
-		"description": "Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+		"description": "Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. For what happened to one email of yours, every rule's decision on it and, for another member's rule covering you, who receives what it shares: GET /v1/emails/{id}/rule-results (primitive email-rules list-email-rule-results --email-id <email-id>). Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRulesCoveringMe",
@@ -14652,6 +15192,10 @@ const operationManifest = [
 						"enum": ["grant", "do_not_share"],
 						"description": "grant: what it matches can be shared. do_not_share: it blocks sharing what it matches."
 					},
+					"do_not_share_note": {
+						"description": "On a grant rule: that the active do-not-share rules over an email run first, keeping from it what they match and holding back what they cannot decide, which is decided again for up to a day and shared only if none of them then matches it.",
+						"type": "string"
+					},
 					"author": {
 						"type": "object",
 						"properties": {
@@ -14751,6 +15295,11 @@ const operationManifest = [
 												"description": "On a rule over your mail: how many of these keys also list one of your own mailboxes, or its domain, so they read your mail there beyond what this rule matches.",
 												"type": "integer",
 												"minimum": 0
+											},
+											"newest_at": {
+												"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+												"type": "string",
+												"format": "date-time"
 											}
 										},
 										"required": ["owner", "count"]
@@ -14806,6 +15355,11 @@ const operationManifest = [
 												"description": "Hosts past those listed.",
 												"type": "integer",
 												"minimum": 0
+											},
+											"newest_at": {
+												"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+												"type": "string",
+												"format": "date-time"
 											}
 										},
 										"required": ["owner", "count"]
@@ -14843,6 +15397,11 @@ const operationManifest = [
 											"count": {
 												"type": "integer",
 												"exclusiveMinimum": 0
+											},
+											"newest_at": {
+												"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+												"type": "string",
+												"format": "date-time"
 											}
 										},
 										"required": ["beneficiary", "count"]
@@ -14907,6 +15466,11 @@ const operationManifest = [
 												"description": "On a rule over your mail: how many of these keys also list one of your own mailboxes, or its domain, so they read your mail there beyond what this rule matches.",
 												"type": "integer",
 												"minimum": 0
+											},
+											"newest_at": {
+												"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+												"type": "string",
+												"format": "date-time"
 											}
 										},
 										"required": ["owner", "count"]
@@ -14962,6 +15526,11 @@ const operationManifest = [
 												"description": "Hosts past those listed.",
 												"type": "integer",
 												"minimum": 0
+											},
+											"newest_at": {
+												"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+												"type": "string",
+												"format": "date-time"
 											}
 										},
 										"required": ["owner", "count"]
@@ -14999,6 +15568,11 @@ const operationManifest = [
 											"count": {
 												"type": "integer",
 												"exclusiveMinimum": 0
+											},
+											"newest_at": {
+												"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+												"type": "string",
+												"format": "date-time"
 											}
 										},
 										"required": ["beneficiary", "count"]
@@ -15145,10 +15719,13 @@ const operationManifest = [
 					"description": "Whether it is to a rule you wrote, in your current membership."
 				},
 				"message": {
-					"description": "Why the objector objects; null when none was given, or once withdrawn.",
+					"description": "Why they object and what they ask (to turn the rule off, narrow it, or explain who receives it); null when none was given, or once withdrawn.",
+					"type": ["string", "null"]
+				},
+				"decline_reason": {
+					"description": "The author's answer when declining, which the objector sees; null when none was given.",
 					"type": ["string", "null"]
 				},
-				"decline_reason": { "type": ["string", "null"] },
 				"created_at": {
 					"type": "string",
 					"format": "date-time"
@@ -15323,6 +15900,44 @@ const operationManifest = [
 						"required": ["checked", "matched"]
 					}, { "type": "null" }]
 				},
+				"breadth_scope": {
+					"type": "object",
+					"properties": {
+						"evaluation_scope": {
+							"type": "string",
+							"enum": [
+								"author",
+								"own_mailboxes",
+								"selected"
+							],
+							"description": "author, own_mailboxes or selected, as a rule's evaluation_scope."
+						},
+						"scope_selection": {
+							"type": ["object", "null"],
+							"properties": {
+								"addresses": {
+									"maxItems": 100,
+									"type": "array",
+									"items": {
+										"type": "string",
+										"maxLength": 320
+									}
+								},
+								"domains": {
+									"maxItems": 50,
+									"type": "array",
+									"items": {
+										"type": "string",
+										"maxLength": 253
+									}
+								}
+							},
+							"required": ["addresses", "domains"],
+							"description": "What a selected scope names; null for any other."
+						}
+					},
+					"required": ["evaluation_scope", "scope_selection"]
+				},
 				"kind": {
 					"description": "Only grant.",
 					"type": "string",
@@ -15612,7 +16227,7 @@ const operationManifest = [
 							"type": ["boolean", "null"]
 						},
 						"notice": {
-							"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+							"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, what accepting would share, then where to see what becomes of one email (rule-results). For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 							"type": ["string", "null"]
 						}
 					},
@@ -15735,7 +16350,7 @@ const operationManifest = [
 							"minimum": 0
 						},
 						"objection_notice": {
-							"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+							"description": "With pending_objections above 0: that members objected (each message says what they ask: to turn it off, narrow it or explain it), and how to answer.",
 							"type": "string"
 						},
 						"created_at": {
@@ -16005,7 +16620,7 @@ const operationManifest = [
 					]
 				},
 				"notice": {
-					"description": "What is now shared, in words. When you changed the rule and it can now match mail the request left out by who it was sent to (such as mail where an address is only copied), that comes first.",
+					"description": "What is now shared, in words. When you changed the rule and it can now match mail the request left out by who it was sent to (such as mail where an address is only copied), that comes first; when you changed its english, tree or explanation (edited_on_accept; a new name alone is no change), that rule.current is what you agreed to and request what was asked.",
 					"type": "string"
 				}
 			},
@@ -16274,6 +16889,44 @@ const operationManifest = [
 						"required": ["checked", "matched"]
 					}, { "type": "null" }]
 				},
+				"breadth_scope": {
+					"type": "object",
+					"properties": {
+						"evaluation_scope": {
+							"type": "string",
+							"enum": [
+								"author",
+								"own_mailboxes",
+								"selected"
+							],
+							"description": "author, own_mailboxes or selected, as a rule's evaluation_scope."
+						},
+						"scope_selection": {
+							"type": ["object", "null"],
+							"properties": {
+								"addresses": {
+									"maxItems": 100,
+									"type": "array",
+									"items": {
+										"type": "string",
+										"maxLength": 320
+									}
+								},
+								"domains": {
+									"maxItems": 50,
+									"type": "array",
+									"items": {
+										"type": "string",
+										"maxLength": 253
+									}
+								}
+							},
+							"required": ["addresses", "domains"],
+							"description": "What a selected scope names; null for any other."
+						}
+					},
+					"required": ["evaluation_scope", "scope_selection"]
+				},
 				"sql": {
 					"description": "Present only when include_sql was true.",
 					"type": "object",
@@ -16627,6 +17280,44 @@ const operationManifest = [
 						},
 						"required": ["checked", "matched"]
 					}, { "type": "null" }]
+				},
+				"breadth_scope": {
+					"type": "object",
+					"properties": {
+						"evaluation_scope": {
+							"type": "string",
+							"enum": [
+								"author",
+								"own_mailboxes",
+								"selected"
+							],
+							"description": "author, own_mailboxes or selected, as a rule's evaluation_scope."
+						},
+						"scope_selection": {
+							"type": ["object", "null"],
+							"properties": {
+								"addresses": {
+									"maxItems": 100,
+									"type": "array",
+									"items": {
+										"type": "string",
+										"maxLength": 320
+									}
+								},
+								"domains": {
+									"maxItems": 50,
+									"type": "array",
+									"items": {
+										"type": "string",
+										"maxLength": 253
+									}
+								}
+							},
+							"required": ["addresses", "domains"],
+							"description": "What a selected scope names; null for any other."
+						}
+					},
+					"required": ["evaluation_scope", "scope_selection"]
 				}
 			},
 			"required": [
@@ -16732,7 +17423,7 @@ const operationManifest = [
 					"minimum": 0
 				},
 				"objection_notice": {
-					"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+					"description": "With pending_objections above 0: that members objected (each message says what they ask: to turn it off, narrow it or explain it), and how to answer.",
 					"type": "string"
 				},
 				"created_at": {
@@ -16861,6 +17552,10 @@ const operationManifest = [
 						]
 					}
 				},
+				"do_not_share_note": {
+					"description": "On a grant rule's create answer: that active do-not-share rules reaching an email run first: one that matches it keeps it from being shared through this rule, and one that cannot decide it holds it back while it is decided again for up to a day; it is shared through this rule only if none of them then matches it.",
+					"type": "string"
+				},
 				"expectations": {
 					"description": "Its saved expectations, each list by email id, as stored: on every create, and on an update that set or removed them.",
 					"type": "object",
@@ -17121,7 +17816,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "create-email-rule-request",
-		"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated or shared until they accept, and they may change the rule first. A message (up to 500 characters, fixed once sent) tells them why you ask. At most 5 pending requests to one member and 50 in all. With members:read the answer says whether they can accept it under their role (target_can_accept, target_warning); POST /v1/email-rule-requests/target-check checks first. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
+		"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated or shared until they accept, and they may change the rule first. A message (up to 500 characters, fixed once sent) tells them why you ask. With an Idempotency-Key, asking again for exactly what a pending request of yours to the same member asks (name, english, tree, explanation and message, naming them the same way) returns that request with existing: true (200), so a retry never asks them twice. At most 5 pending requests to one member and 50 in all. With members:read the answer says whether they can accept it under their role (target_can_accept, target_warning); POST /v1/email-rule-requests/target-check checks first. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "createEmailRuleRequest",
@@ -17129,7 +17824,7 @@ const operationManifest = [
 		"pathParams": [],
 		"queryParams": [],
 		"headerParams": [{
-			"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+			"description": "Optional. With a key, a create identical to a pending request of yours to the same member (name, english, tree, explanation and message, naming the member the same way) returns that request with existing: true (200) instead of making a second one. The key itself is not stored, so any key does this, and a create without one is never matched to an existing request. A key that is empty, longer than 255 characters or not printable ASCII is refused with 400 `validation_error`; a valid one is echoed in the Idempotency-Key response header.",
 			"enum": null,
 			"name": "Idempotency-Key",
 			"required": false,
@@ -17270,6 +17965,44 @@ const operationManifest = [
 						"required": ["checked", "matched"]
 					}, { "type": "null" }]
 				},
+				"breadth_scope": {
+					"type": "object",
+					"properties": {
+						"evaluation_scope": {
+							"type": "string",
+							"enum": [
+								"author",
+								"own_mailboxes",
+								"selected"
+							],
+							"description": "author, own_mailboxes or selected, as a rule's evaluation_scope."
+						},
+						"scope_selection": {
+							"type": ["object", "null"],
+							"properties": {
+								"addresses": {
+									"maxItems": 100,
+									"type": "array",
+									"items": {
+										"type": "string",
+										"maxLength": 320
+									}
+								},
+								"domains": {
+									"maxItems": 50,
+									"type": "array",
+									"items": {
+										"type": "string",
+										"maxLength": 253
+									}
+								}
+							},
+							"required": ["addresses", "domains"],
+							"description": "What a selected scope names; null for any other."
+						}
+					},
+					"required": ["evaluation_scope", "scope_selection"]
+				},
 				"kind": {
 					"description": "Only grant.",
 					"type": "string",
@@ -17445,7 +18178,7 @@ const operationManifest = [
 					"type": ["boolean", "null"]
 				},
 				"notice": {
-					"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, what accepting would share, then where to see what becomes of one email (rule-results). For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 					"type": ["string", "null"]
 				},
 				"target_can_accept": {
@@ -17455,6 +18188,11 @@ const operationManifest = [
 				"target_warning": {
 					"description": "Why the member asked cannot accept it yet, naming the permission their role lacks. The request is still sent. Null when they can, or when target_can_accept is null.",
 					"type": ["string", "null"]
+				},
+				"existing": {
+					"description": "Present, as true, when the create carried an Idempotency-Key and you already had a pending request to this member asking exactly this (name, english, tree, explanation and message, naming the member the same way): that request is returned (200), and no second one is made or sent.",
+					"type": "boolean",
+					"const": true
 				}
 			},
 			"required": [
@@ -17683,7 +18421,7 @@ const operationManifest = [
 					"type": ["boolean", "null"]
 				},
 				"notice": {
-					"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, what accepting would share, then where to see what becomes of one email (rule-results). For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 					"type": ["string", "null"]
 				}
 			},
@@ -17957,7 +18695,7 @@ const operationManifest = [
 					"format": "uuid"
 				},
 				"kind": {
-					"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+					"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule or a request uses its own.",
 					"type": "string",
 					"enum": ["grant", "do_not_share"]
 				},
@@ -18308,7 +19046,7 @@ const operationManifest = [
 					"minimum": 0
 				},
 				"objection_notice": {
-					"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+					"description": "With pending_objections above 0: that members objected (each message says what they ask: to turn it off, narrow it or explain it), and how to answer.",
 					"type": "string"
 				},
 				"created_at": {
@@ -18745,7 +19483,7 @@ const operationManifest = [
 					"type": ["boolean", "null"]
 				},
 				"notice": {
-					"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, what accepting would share, then where to see what becomes of one email (rule-results). For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 					"type": ["string", "null"]
 				}
 			},
@@ -19644,7 +20382,7 @@ const operationManifest = [
 						"type": ["boolean", "null"]
 					},
 					"notice": {
-						"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+						"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, what accepting would share, then where to see what becomes of one email (rule-results). For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 						"type": ["string", "null"]
 					}
 				},
@@ -19899,9 +20637,10 @@ const operationManifest = [
 								"enum": [
 									"draft",
 									"created_after_email",
+									"outside_scope",
 									null
 								],
-								"description": "What is known about a rule with no result on this email. draft: the rule is a draft now. created_after_email: the rule was created after the email arrived. Null when it has a result, or when nothing is known."
+								"description": "What is known about a rule with no result on this email. draft: the rule is a draft now. created_after_email: the rule was created after the email arrived. outside_scope: the mailbox this email is in is outside what its scope names (its author's own mailboxes, its selection, or all its author reads now), so it does not decide on it. Null when it has a result, or when nothing is known (it may not have decided yet)."
 							},
 							"author_left": {
 								"description": "On a do-not-share rule whose author is no longer a member of the organization: it blocks nothing now, whatever it decided. Absent otherwise.",
@@ -19984,6 +20723,11 @@ const operationManifest = [
 														"description": "On a rule over your mail: how many of these keys also list one of your own mailboxes, or its domain, so they read your mail there beyond what this rule matches.",
 														"type": "integer",
 														"minimum": 0
+													},
+													"newest_at": {
+														"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+														"type": "string",
+														"format": "date-time"
 													}
 												},
 												"required": ["owner", "count"]
@@ -20039,6 +20783,11 @@ const operationManifest = [
 														"description": "Hosts past those listed.",
 														"type": "integer",
 														"minimum": 0
+													},
+													"newest_at": {
+														"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+														"type": "string",
+														"format": "date-time"
 													}
 												},
 												"required": ["owner", "count"]
@@ -20076,6 +20825,11 @@ const operationManifest = [
 													"count": {
 														"type": "integer",
 														"exclusiveMinimum": 0
+													},
+													"newest_at": {
+														"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+														"type": "string",
+														"format": "date-time"
 													}
 												},
 												"required": ["beneficiary", "count"]
@@ -21081,7 +21835,7 @@ const operationManifest = [
 						"minimum": 0
 					},
 					"objection_notice": {
-						"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+						"description": "With pending_objections above 0: that members objected (each message says what they ask: to turn it off, narrow it or explain it), and how to answer.",
 						"type": "string"
 					},
 					"created_at": {
@@ -21324,7 +22078,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "test-email-rule",
-		"description": "Runs a rule over received mail and reports what it would decide for each email (matched, near_miss, no_match, unclassified, skipped or not_found), with a summary of how each top-level condition and question decided. Test an unsaved tree, or a saved rule by rule_id (its current version, as its author). It reads only mail its author can read and its scope covers. A rule you see only because it covers your own mailboxes runs as you, over only those, from the dashboard or the Primitive CLI. Without email_ids it tests the newest emails, at most 200 and none older than 30 days, plus any expected ones. Unclassified emails over 2 hours old are classified first unless classify_missing is false. It records no decision and grants nothing, and stops at about 90 seconds. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
+		"description": "Runs a rule over received mail and reports what it would decide for each email (matched, near_miss, no_match, unclassified, skipped or not_found), with a summary of how each top-level condition and question decided. Test an unsaved tree, a saved rule by rule_id (its current version, as its author), or a pending rule request by request_id (its rule as asked, as you, over your own mailboxes). It reads only mail its author can read and its scope covers. A rule you see only because it covers your own mailboxes runs as you, over only those, from the dashboard or the Primitive CLI. Without email_ids it tests the newest emails, at most 200 and none older than 30 days, plus any expected ones. Unclassified emails over 2 hours old are classified first unless classify_missing is false. It records no decision and grants nothing, and stops at about 90 seconds. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "testEmailRule",
@@ -21414,8 +22168,13 @@ const operationManifest = [
 					"type": "string",
 					"format": "uuid"
 				},
+				"request_id": {
+					"description": "A pending rule request you can see: its rule as asked, tested as you over your own mailboxes (what accepting would share, for the member asked). Give one of tree, rule_id and request_id.",
+					"type": "string",
+					"format": "uuid"
+				},
 				"kind": {
-					"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+					"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule or a request uses its own.",
 					"type": "string",
 					"enum": ["grant", "do_not_share"]
 				},
@@ -21620,6 +22379,54 @@ const operationManifest = [
 							"type": "integer",
 							"minimum": 0,
 							"description": "The most emails the recent window holds: 200, less one place per expected email."
+						},
+						"scope": {
+							"type": "object",
+							"properties": {
+								"evaluation_scope": {
+									"type": "string",
+									"enum": [
+										"author",
+										"own_mailboxes",
+										"selected"
+									],
+									"description": "author, own_mailboxes or selected, as a rule's evaluation_scope."
+								},
+								"scope_selection": {
+									"type": ["object", "null"],
+									"properties": {
+										"addresses": {
+											"maxItems": 100,
+											"type": "array",
+											"items": {
+												"type": "string",
+												"maxLength": 320
+											}
+										},
+										"domains": {
+											"maxItems": 50,
+											"type": "array",
+											"items": {
+												"type": "string",
+												"maxLength": 253
+											}
+										}
+									},
+									"required": ["addresses", "domains"],
+									"description": "What a selected scope names; null for any other."
+								}
+							},
+							"required": ["evaluation_scope", "scope_selection"]
+						},
+						"oldest_at": {
+							"type": ["string", "null"],
+							"format": "date-time",
+							"description": "When the oldest email tested arrived, expected ones included; null when none was. The window is the newest 200 the scope reaches, so a narrower scope reaches further back: compare counts only over the same scope and span."
+						},
+						"newest_at": {
+							"type": ["string", "null"],
+							"format": "date-time",
+							"description": "When the newest email tested arrived; null when none was."
 						}
 					},
 					"required": [
@@ -22126,7 +22933,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "test-email-rule-on-sample",
-		"description": "Reports what a rule would decide for an email you describe (sender, recipients, subject, plain text, attachment types and file names; optionally automated, from a mailing list, and a spam score), classified and decided as received mail would be. A rule reading a spam score you gave none for decides on none (unset_columns). Nothing is stored. Test an unsaved tree or a saved rule by rule_id. The answer includes what the classifier read. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
+		"description": "Reports what a rule would decide for an email you describe (sender, recipients, subject, plain text, attachment types and file names; optionally automated, from a mailing list, and a spam score), classified and decided as received mail would be. A rule reading a spam score you gave none for decides on none (unset_columns). Nothing is stored. Test an unsaved tree, a saved rule by rule_id, or a pending rule request by request_id (its rule as asked, as you). The answer includes what the classifier read. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "testEmailRuleOnSample",
@@ -22216,8 +23023,13 @@ const operationManifest = [
 					"type": "string",
 					"format": "uuid"
 				},
+				"request_id": {
+					"description": "A pending rule request you can see: its rule as asked, tested as you over your own mailboxes (what accepting would share, for the member asked). Give one of tree, rule_id and request_id.",
+					"type": "string",
+					"format": "uuid"
+				},
 				"kind": {
-					"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+					"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule or a request uses its own.",
 					"type": "string",
 					"enum": ["grant", "do_not_share"]
 				},
@@ -22316,6 +23128,10 @@ const operationManifest = [
 					],
 					"additionalProperties": false,
 					"description": "A made-up received email. Nothing about it is stored."
+				},
+				"with_protection": {
+					"description": "With true, a grant rule that matches is also judged against the active do-not-share rules over the first recipient's mailbox, which you must read in full and the rule must run over; see protection. Limited to 20 an hour per member.",
+					"type": "boolean"
 				}
 			},
 			"required": ["email"],
@@ -22472,6 +23288,59 @@ const operationManifest = [
 						"required": ["value", "confidence"]
 					},
 					"description": "What the classifier read from the email, by fact: its value and confidence."
+				},
+				"protection": {
+					"description": "With with_protection: whether a match would be shared. Nothing is stored.",
+					"type": "object",
+					"properties": {
+						"mailbox": {
+							"type": "string",
+							"description": "The mailbox judged: the first recipient."
+						},
+						"outcome": {
+							"type": "string",
+							"enum": [
+								"shared",
+								"withheld",
+								"not_matched"
+							],
+							"description": "not_matched: the rule did not match, so nothing would be shared and no do-not-share rule was judged."
+						},
+						"withheld_by": {
+							"type": "array",
+							"items": {
+								"type": "object",
+								"properties": {
+									"id": {
+										"type": "string",
+										"format": "uuid"
+									},
+									"name": { "type": "string" },
+									"reason": {
+										"type": "string",
+										"enum": ["matched", "undecided"]
+									}
+								},
+								"required": [
+									"id",
+									"name",
+									"reason"
+								]
+							},
+							"description": "Do-not-share rules you can see that would keep it from being shared. undecided: left undecided as real mail would leave it, or not reached by this test (past 50 rules, 10 rules' questions, or the time limit); it is held back either way."
+						},
+						"withheld_by_hidden": {
+							"type": "integer",
+							"minimum": 0,
+							"description": "Rules you cannot see that would."
+						}
+					},
+					"required": [
+						"mailbox",
+						"outcome",
+						"withheld_by",
+						"withheld_by_hidden"
+					]
 				}
 			},
 			"required": [
@@ -22633,6 +23502,44 @@ const operationManifest = [
 						"required": ["checked", "matched"]
 					}, { "type": "null" }]
 				},
+				"breadth_scope": {
+					"type": "object",
+					"properties": {
+						"evaluation_scope": {
+							"type": "string",
+							"enum": [
+								"author",
+								"own_mailboxes",
+								"selected"
+							],
+							"description": "author, own_mailboxes or selected, as a rule's evaluation_scope."
+						},
+						"scope_selection": {
+							"type": ["object", "null"],
+							"properties": {
+								"addresses": {
+									"maxItems": 100,
+									"type": "array",
+									"items": {
+										"type": "string",
+										"maxLength": 320
+									}
+								},
+								"domains": {
+									"maxItems": 50,
+									"type": "array",
+									"items": {
+										"type": "string",
+										"maxLength": 253
+									}
+								}
+							},
+							"required": ["addresses", "domains"],
+							"description": "What a selected scope names; null for any other."
+						}
+					},
+					"required": ["evaluation_scope", "scope_selection"]
+				},
 				"kind": {
 					"description": "Must be the rule's own (400 kind_mismatch).",
 					"type": "string",
@@ -23048,7 +23955,7 @@ const operationManifest = [
 					"minimum": 0
 				},
 				"objection_notice": {
-					"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+					"description": "With pending_objections above 0: that members objected (each message says what they ask: to turn it off, narrow it or explain it), and how to answer.",
 					"type": "string"
 				},
 				"created_at": {
@@ -23177,6 +24084,10 @@ const operationManifest = [
 						]
 					}
 				},
+				"do_not_share_note": {
+					"description": "On a grant rule's create answer: that active do-not-share rules reaching an email run first: one that matches it keeps it from being shared through this rule, and one that cannot decide it holds it back while it is decided again for up to a day; it is shared through this rule only if none of them then matches it.",
+					"type": "string"
+				},
 				"expectations": {
 					"description": "Its saved expectations, each list by email id, as stored: on every create, and on an update that set or removed them.",
 					"type": "object",
@@ -23622,7 +24533,7 @@ const operationManifest = [
 					"type": ["boolean", "null"]
 				},
 				"notice": {
-					"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, what accepting would share, then where to see what becomes of one email (rule-results). For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 					"type": ["string", "null"]
 				}
 			},
@@ -24340,16 +25251,27 @@ const operationManifest = [
 						null
 					]
 				},
-				"webhook_attempt_count": { "type": "integer" },
+				"webhook_attempt_count": {
+					"type": "integer",
+					"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its attempts."
+				},
 				"webhook_last_attempt_at": {
 					"type": ["string", "null"],
-					"format": "date-time"
+					"format": "date-time",
+					"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its last attempt."
+				},
+				"webhook_last_status_code": {
+					"type": ["integer", "null"],
+					"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. What it last answered."
+				},
+				"webhook_last_error": {
+					"type": ["string", "null"],
+					"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its last error."
 				},
-				"webhook_last_status_code": { "type": ["integer", "null"] },
-				"webhook_last_error": { "type": ["string", "null"] },
 				"webhook_fired_at": {
 					"type": ["string", "null"],
-					"format": "date-time"
+					"format": "date-time",
+					"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. When it was delivered."
 				},
 				"smtp_helo": { "type": ["string", "null"] },
 				"smtp_mail_from": {
@@ -24903,6 +25825,81 @@ const operationManifest = [
 						}
 					}
 				},
+				"rule_deliveries": {
+					"type": ["object", "null"],
+					"description": "Where Email Rules delivered this email by webhook, for the owner of the mailbox it is at, on their own dashboard session or the Primitive CLI. Null for everyone else, and when it could not be read in time. A key reading it through a rule is not a delivery.",
+					"required": [
+						"rules",
+						"hidden",
+						"complete"
+					],
+					"properties": {
+						"rules": {
+							"type": "array",
+							"description": "Each rule over your mail that queued a webhook delivery of this email, newest rule first.",
+							"items": {
+								"type": "object",
+								"required": [
+									"rule_id",
+									"name",
+									"delivered",
+									"pending",
+									"failed",
+									"not_sent",
+									"hosts",
+									"hosts_not_listed"
+								],
+								"properties": {
+									"rule_id": {
+										"type": "string",
+										"format": "uuid",
+										"description": "The rule. A webhook sent it through several rules counts under one."
+									},
+									"name": { "type": "string" },
+									"delivered": {
+										"type": "integer",
+										"minimum": 0,
+										"description": "Webhooks it was delivered to."
+									},
+									"pending": {
+										"type": "integer",
+										"minimum": 0,
+										"description": "Webhooks still owed it."
+									},
+									"failed": {
+										"type": "integer",
+										"minimum": 0,
+										"description": "Webhooks whose attempts gave up."
+									},
+									"not_sent": {
+										"type": "integer",
+										"minimum": 0,
+										"description": "Webhooks it was not sent to after all."
+									},
+									"hosts": {
+										"type": "array",
+										"items": { "type": "string" },
+										"description": "The sites it was delivered to at the time, named as the covering view names sites; they may differ from the rule's current receivers there."
+									},
+									"hosts_not_listed": {
+										"type": "integer",
+										"minimum": 0,
+										"description": "Sites past the listed ones."
+									}
+								}
+							}
+						},
+						"hidden": {
+							"type": "integer",
+							"minimum": 0,
+							"description": "Rules that queued a delivery of it that are not listed: they do not cover your mailboxes now, or are past the 50 one answer judges."
+						},
+						"complete": {
+							"type": "boolean",
+							"description": "False when a delivery may be missing: the email is older than 14 days, or it has more deliveries or rules than one answer reads."
+						}
+					}
+				},
 				"from_name": {
 					"type": ["string", "null"],
 					"description": "Display name from the `From:` header, decoded for display: RFC 2047 encoded words are decoded in their declared charset and folded lines are joined (e.g. `Dana Rúiz` for `=?UTF-8?Q?Dana_R=C3=BAiz?= <dana@example.com>`). Null when the header carries no display name. For display only: identify the sender by `from_email`, never by this name, which the sender chooses freely."
@@ -25798,7 +26795,10 @@ const operationManifest = [
 							null
 						]
 					},
-					"webhook_attempt_count": { "type": "integer" },
+					"webhook_attempt_count": {
+						"type": "integer",
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its attempts."
+					},
 					"thread_id": {
 						"type": ["string", "null"],
 						"format": "uuid",
@@ -26533,7 +27533,10 @@ const operationManifest = [
 							null
 						]
 					},
-					"webhook_attempt_count": { "type": "integer" },
+					"webhook_attempt_count": {
+						"type": "integer",
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its attempts."
+					},
 					"thread_id": {
 						"type": ["string", "null"],
 						"format": "uuid",
@@ -36707,7 +37710,7 @@ const operationManifest = [
 		"pathParams": [],
 		"queryParams": [],
 		"headerParams": [{
-			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo or semantic search setting), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
+			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo, semantic search setting or email notification settings), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
 			"enum": null,
 			"name": "Primitive-Step-Up",
 			"required": false,
@@ -36853,7 +37856,7 @@ const operationManifest = [
 		"pathParams": [],
 		"queryParams": [],
 		"headerParams": [{
-			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo or semantic search setting), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
+			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo, semantic search setting or email notification settings), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
 			"enum": null,
 			"name": "Primitive-Step-Up",
 			"required": false,
@@ -36902,7 +37905,7 @@ const operationManifest = [
 		"pathParams": [],
 		"queryParams": [],
 		"headerParams": [{
-			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo or semantic search setting), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
+			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo, semantic search setting or email notification settings), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
 			"enum": null,
 			"name": "Primitive-Step-Up",
 			"required": false,
@@ -36962,7 +37965,7 @@ const operationManifest = [
 		"pathParams": [],
 		"queryParams": [],
 		"headerParams": [{
-			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo or semantic search setting), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
+			"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo, semantic search setting or email notification settings), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
 			"enum": null,
 			"name": "Primitive-Step-Up",
 			"required": false,
@@ -46690,7 +47693,7 @@ const operationManifest = [
 					"type": "object",
 					"additionalProperties": false,
 					"required": ["url"],
-					"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of the message gets the same `url`, so send one message per recipient when the URL identifies who to unsubscribe. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
+					"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of a message would get the same `url`, so another recipient could unsubscribe whoever it identifies: a reply with `unsubscribe` must go to the one address it answers, and one with `reply_all` that adds a cc is refused with a `validation_error`. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
 					"properties": {
 						"url": {
 							"type": "string",
@@ -47878,7 +48881,7 @@ const operationManifest = [
 					"type": "object",
 					"additionalProperties": false,
 					"required": ["url"],
-					"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of the message gets the same `url`, so send one message per recipient when the URL identifies who to unsubscribe. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
+					"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of a message would get the same `url`, so another recipient could unsubscribe whoever it identifies: a send with `unsubscribe` must have exactly one recipient, one entry across `to`, `cc` and `bcc` (an address given twice counts twice), and a send to more is refused with a `validation_error`. Send one message per recipient, for example with `POST /v1/send-mail/batch`. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
 					"properties": {
 						"url": {
 							"type": "string",
@@ -48385,7 +49388,7 @@ const operationManifest = [
 							"type": "object",
 							"additionalProperties": false,
 							"required": ["url"],
-							"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of the message gets the same `url`, so send one message per recipient when the URL identifies who to unsubscribe. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
+							"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of a message would get the same `url`, so another recipient could unsubscribe whoever it identifies: a send with `unsubscribe` must have exactly one recipient, one entry across `to`, `cc` and `bcc` (an address given twice counts twice), and a send to more is refused with a `validation_error`. Send one message per recipient, for example with `POST /v1/send-mail/batch`. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
 							"properties": {
 								"url": {
 									"type": "string",
@@ -51932,6 +52935,48 @@ function deliveryAttemptLines(data) {
 	}
 	return lines.length > 0 ? [`Attempts (${lines.length}):`, ...lines] : [];
 }
+/**
+* What an endpoint's DELIVERING column says, from `delivery` and never from
+* `enabled`: an endpoint can be on and still be sent nothing (its owner's key
+* revoked, say). A delivery the answer gives is read for any kind. Without
+* one, a webhook (or an endpoint of no stated kind) shows `unknown`, since it
+* could not be checked just now or the server does not say, and any other
+* kind (a Function or pull endpoint, which has no delivery) shows `-`.
+*/
+function deliveringCell(endpoint) {
+	const delivery = endpoint.delivery;
+	if (isRecord$3(delivery) && typeof delivery.delivering === "boolean") {
+		if (delivery.delivering) return "yes";
+		const codes = Array.isArray(delivery.reasons) ? delivery.reasons.flatMap((reason) => isRecord$3(reason) && typeof reason.code === "string" && reason.code ? [oneLine(reason.code)] : []) : [];
+		return codes.length > 0 ? `no (${codes.join(", ")})` : "no";
+	}
+	return endpoint.kind === void 0 || endpoint.kind === "http" ? "unknown" : "-";
+}
+/**
+* A table of an endpoints list (listEndpoints): each endpoint's id, kind,
+* whether it is on (ENABLED) and whether it is being sent mail at all
+* (DELIVERING, from `delivery`), and its name. Nothing for an empty list.
+*/
+function endpointDeliveryLines(data) {
+	const rows = Array.isArray(data) ? data.filter(isRecord$3) : [];
+	if (rows.length === 0) return [];
+	const text = (value) => typeof value === "string" && value ? oneLine(value) : "";
+	const table = [[
+		"ID",
+		"KIND",
+		"ENABLED",
+		"DELIVERING",
+		"NAME"
+	], ...rows.map((row) => [
+		text(row.id),
+		text(row.kind),
+		typeof row.enabled === "boolean" ? row.enabled ? "yes" : "no" : "",
+		deliveringCell(row),
+		text(row.name)
+	])];
+	const widths = table[0].map((_, column) => Math.max(...table.map((cells) => (cells[column] ?? "").length)));
+	return table.map((cells) => cells.map((cell, column) => column === cells.length - 1 ? cell : cell.padEnd(widths[column] ?? 0)).join("  ").trimEnd());
+}
 const routeReport = {
 	flags: {},
 	report: (data) => ({ lines: routeWarningLines(data) })
@@ -51942,6 +52987,10 @@ const ANSWER_REPORT_EXTENSIONS = {
 	getDelivery: {
 		flags: {},
 		report: (data) => ({ lines: deliveryAttemptLines(data) })
+	},
+	listEndpoints: {
+		flags: {},
+		report: (data) => ({ lines: endpointDeliveryLines(data) })
 	}
 };
 // src/oclif/user-grant.ts
@@ -53064,16 +54113,44 @@ const SAMPLE_TEXT_MAX = 4e3;
 const SAMPLE_SUBJECT_MAX = 998;
 const SAMPLE_LIST_MAX = 10;
 /**
+* The fields of each sample read from a file that this CLI does not know
+* (`email field "x"`, `sample field "y"`). They are sent as they are: the API
+* validates samples itself, so a field it added after this CLI was built is
+* not refused here. Said once per file, for the samples actually sent
+* (unknownFieldsNote).
+*/
+const UNKNOWN_FIELDS = /* @__PURE__ */ new WeakMap();
+/**
+* A field name from a file or an answer, quoted and safe to print: JSON
+* escapes control characters, and a long name is cut.
+*/
+function shownKey(key) {
+	return JSON.stringify(key.length > 60 ? `${key.slice(0, 57)}...` : key).replace(/[\u007f-\u009f]/g, "?");
+}
+/**
+* One line naming the fields this CLI does not know in the samples sent, with
+* the numbers of the samples in the file that carry each; null when none do.
+*/
+function unknownFieldsNote(source, sent, all) {
+	const carriers = /* @__PURE__ */ new Map();
+	for (const sample of sent) {
+		const number = all.indexOf(sample) + 1;
+		for (const field of UNKNOWN_FIELDS.get(sample) ?? []) carriers.set(field, [...carriers.get(field) ?? [], number]);
+	}
+	if (carriers.size === 0) return null;
+	return `${source} has fields this CLI does not know, which it does not refuse but leaves for the API to judge (if the API refuses one, take it out): ${[...carriers].map(([field, numbers]) => `${field} (sample${numbers.length === 1 ? "" : "s"} ${numbers.join(", ")})`).join(", ")}.`;
+}
+/**
 * Refuse, naming the sample and the field, a made-up email the API would
-* refuse to keep: the fields it takes and their bounds. The API checks the
-* rest (address forms, a NUL).
+* refuse to keep: the bounds of the fields it takes. Returns the fields this
+* CLI does not know, which are passed on. The API checks the rest (address
+* forms, a NUL).
 */
 function checkSampleEmail(email, at) {
 	const fail = (what) => {
 		throw usageError$2(`${at}: email ${what}.`);
 	};
-	const unknown = Object.keys(email).find((key) => !SAMPLE_EMAIL_KEYS.has(key));
-	if (unknown !== void 0) fail(`takes no "${unknown}" (it takes ${[...SAMPLE_EMAIL_KEYS].join(", ")})`);
+	const unknown = Object.keys(email).filter((key) => !SAMPLE_EMAIL_KEYS.has(key)).map((key) => `email field ${shownKey(key)}`);
 	if (!isRecord$1(email.from) || typeof email.from.address !== "string") fail("needs from.address");
 	const list = (key, min) => {
 		const value = email[key];
@@ -53091,6 +54168,7 @@ function checkSampleEmail(email, at) {
 	if (typeof email.text !== "string" || email.text.length === 0 || email.text.length > SAMPLE_TEXT_MAX) fail(`text must be 1 to ${SAMPLE_TEXT_MAX} characters`);
 	for (const key of ["automated", "from_mailing_list"]) if (email[key] !== void 0 && typeof email[key] !== "boolean") fail(`${key} must be true or false`);
 	if (email.spam_score !== void 0 && (typeof email.spam_score !== "number" || !Number.isFinite(email.spam_score))) fail("spam_score must be a number");
+	return unknown;
 }
 /** The keys a sample may carry: a saved one's id and time are taken and ignored. */
 const SAMPLE_KEYS = /* @__PURE__ */ new Set([
@@ -53113,7 +54191,8 @@ function samplesFromJson(value, source) {
 		const samples = lookAlikeSamples(data);
 		if (samples.length === 0) throw usageError$2(`${source} is a generate-look-alikes answer with no look-alikes in it.`);
 		samples.forEach((sample, index) => {
-			checkSampleEmail(sample.email, `${source}, look-alike ${index + 1}`);
+			const unknown = checkSampleEmail(sample.email, `${source}, look-alike ${index + 1}`);
+			if (unknown.length > 0) UNKNOWN_FIELDS.set(sample, unknown);
 		});
 		return samples;
 	}
@@ -53121,22 +54200,25 @@ function samplesFromJson(value, source) {
 	return data.map((item, index) => {
 		const at = `${source}, sample ${index + 1}`;
 		if (!isRecord$1(item)) throw usageError$2(`${at} is not an object.`);
-		const unknown = Object.keys(item).find((key) => !SAMPLE_KEYS.has(key));
-		if (unknown !== void 0) throw usageError$2(`${at}: "${unknown}" is not a sample field; a sample takes expected, label and email.`);
+		const unknown = Object.keys(item).filter((key) => !SAMPLE_KEYS.has(key));
 		if (item.expected !== "match" && item.expected !== "no_match") throw usageError$2(`${at}: expected must be "match" or "no_match".`);
 		if (!isRecord$1(item.email)) throw usageError$2(`${at}: email must be an object, as test-email-rule-on-sample takes it.`);
-		checkSampleEmail(item.email, at);
+		const unknownEmail = checkSampleEmail(item.email, at);
 		const label = item.label;
 		if (label !== void 0 && label !== null) {
 			if (typeof label !== "string") throw usageError$2(`${at}: label must be a string.`);
 			if (label.trim() === "") throw usageError$2(`${at}: label is blank; leave it out or say what the email stands for.`);
 			if (label.trim().length > SAMPLE_LABEL_MAX) throw usageError$2(`${at}: label is longer than ${SAMPLE_LABEL_MAX} characters.`);
 		}
-		return {
+		const sample = {
+			...Object.fromEntries(unknown.map((key) => [key, item[key]])),
 			expected: item.expected,
 			...label !== void 0 ? { label } : {},
 			email: item.email
 		};
+		const fields = [...unknown.map((key) => `sample field ${shownKey(key)}`), ...unknownEmail];
+		if (fields.length > 0) UNKNOWN_FIELDS.set(sample, fields);
+		return sample;
 	});
 }
 /**
@@ -53187,6 +54269,8 @@ function readSamplesFile(path, flag, pick) {
 	const all = samplesFromJson(readJsonFileFlag(path, `--${flag}`), source);
 	const samples = typeof pick === "string" ? pickSamples(all, pick, source) : all;
 	if (samples.length > 20) throw usageError$2(`${source} holds ${samples.length} samples, and a rule or a test takes at most 20; take some with --pick.`);
+	const note = unknownFieldsNote(source, samples, all);
+	if (note) process.stderr.write(`${note}\n`);
 	return samples;
 }
 /** The one of `names` given as a file path, or null; --pick without one is refused. */
@@ -54007,7 +55091,11 @@ function writtenEmailRuleReport(data, request) {
 	if (restored) lines.push(restored);
 	const reach = affectsLine(rule.affects);
 	if (reach) lines.push(reach);
-	for (const note of [rule.share_notice, rule.notice]) {
+	for (const note of [
+		rule.share_notice,
+		rule.notice,
+		rule.do_not_share_note
+	]) {
 		const line = noteLine(note);
 		if (line) lines.push(line);
 	}
@@ -54229,6 +55317,25 @@ function updateEmailRuleErrorExitCode(payload) {
 function undecidedSamplesMayStay(count, reason) {
 	return count > 0 && !RETRYABLE_REASONS.has(reason) && reason !== "author_unresolvable";
 }
+/**
+* The stderr report of test-email-rule-on-sample with --with-protection:
+* whether a match would be shared, and the do-not-share rules that would
+* keep it from being shared. Nothing without protection in the answer.
+*/
+function testSampleProtectionReport(data) {
+	if (!isRecord(data) || !isRecord(data.protection)) return { lines: [] };
+	const protection = data.protection;
+	const mailbox = typeof protection.mailbox === "string" && protection.mailbox ? ` over ${protection.mailbox}` : "";
+	if (protection.outcome === "not_matched") return { lines: [`Protection${mailbox}: the rule did not match, so nothing would be shared and no do-not-share rule was judged.`] };
+	if (protection.outcome === "shared") return { lines: [`Protection${mailbox}: a match would be shared; no do-not-share rule keeps it back.`] };
+	if (protection.outcome !== "withheld") return { lines: [] };
+	const withheld = (Array.isArray(protection.withheld_by) ? protection.withheld_by : []).filter(isRecord);
+	const named = withheld.map((rule) => `${typeof rule.name === "string" ? rule.name : "a rule"} (${rule.id}, ${rule.reason === "undecided" ? "undecided" : "matched"})`);
+	const hidden = typeof protection.withheld_by_hidden === "number" && protection.withheld_by_hidden > 0 ? protection.withheld_by_hidden : 0;
+	const by = [...named, ...hidden > 0 ? [plural$1(hidden, "rule you cannot see", "rules you cannot see")] : []];
+	const undecided = withheld.some((rule) => rule.reason === "undecided") ? " An undecided one holds it back until it is decided." : "";
+	return { lines: [`Protection${mailbox}: a match would be withheld${by.length > 0 ? ` by ${by.join(", ")}` : ""}.${undecided}`] };
+}
 /** Where compile counted breadth, by the evaluation_scope it was sent. */
 const BREADTH_SCOPE = {
 	own_mailboxes: "in your own mailboxes",
@@ -54241,7 +55348,8 @@ function compileEmailRuleReport(data, request) {
 	const lines = (Array.isArray(data.warnings) ? data.warnings : []).filter((warning) => typeof warning === "string" && warning.trim() !== "").map((warning) => `Warning: ${warning.trim()}`);
 	const breadth = data.breadth;
 	const sent = isRecord(request?.body) && typeof request.body.evaluation_scope === "string" ? request.body.evaluation_scope : void 0;
-	const where = sent === void 0 ? "in your own mailboxes, the default; pass --evaluation-scope to count over the scope you will save it with" : BREADTH_SCOPE[sent] ?? `in evaluation_scope ${sent}`;
+	const counted = isRecord(data.breadth_scope) && typeof data.breadth_scope.evaluation_scope === "string" ? data.breadth_scope.evaluation_scope : sent;
+	const where = sent === void 0 && (counted === void 0 || counted === "own_mailboxes") ? "in your own mailboxes, the default; pass --evaluation-scope to count over the scope you will save it with" : BREADTH_SCOPE[counted ?? "own_mailboxes"] ?? `in evaluation_scope ${counted}`;
 	if (isRecord(breadth) && typeof breadth.checked === "number" && typeof breadth.matched === "number") lines.push(`Breadth: its conditions hold for ${breadth.matched} of ${plural$1(breadth.checked, "recent email", "recent emails")} checked ${where}.`);
 	return { lines };
 }
@@ -54396,7 +55504,8 @@ const EMAIL_RULE_OPERATION_EXTENSIONS = {
 	testEmailRuleOnSample: {
 		flags: scopeSelectionFlags(),
 		bodyFields: scopeSelectionBodyFields,
-		bodyProperties: ["scope_selection"]
+		bodyProperties: ["scope_selection"],
+		report: testSampleProtectionReport
 	},
 	acceptEmailRuleRequest: {
 		flags: {
@@ -54684,7 +55793,7 @@ function unknownEventTypes(eventTypes) {
 function unknownEventTypesWarning(unknown) {
 	return `Warning: ${unknown.join(", ")} ${unknown.length === 1 ? "is" : "are"} not an event type this CLI knows. Subscriptions match exact names, so a misspelled name receives nothing. Continuing; newer event types may not be known to this CLI yet.\n`;
 }
-function isPlainObject(value) {
+function isPlainObject$1(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 /**
@@ -54697,16 +55806,16 @@ async function currentEndpointRules(endpointId, listEndpoints) {
 	if (response.error) throw new EventTypesFlagError("Could not read the endpoint's current rules to keep them. Retry, or pass the full rules with --raw-body.");
 	const row = (response.data?.data ?? []).find((endpoint) => endpoint.id === endpointId);
 	if (!row) throw new EventTypesFlagError(`No endpoint ${endpointId} is visible to this credential, so its rules cannot be updated.`);
-	return isPlainObject(row.rules) ? row.rules : {};
+	return isPlainObject$1(row.rules) ? row.rules : {};
 }
 /**
 * Put `eventTypes` in the request body's `rules.event_types`, on top of
 * `baseRules` (rules the caller passed in the body win over `baseRules`).
 */
 function withEventTypes(body, eventTypes, baseRules = {}) {
-	if (body !== void 0 && !isPlainObject(body)) throw new EventTypesFlagError("--raw-body must be a JSON object when also passing --event-types.");
+	if (body !== void 0 && !isPlainObject$1(body)) throw new EventTypesFlagError("--raw-body must be a JSON object when also passing --event-types.");
 	const current = body ?? {};
-	if (current.rules !== void 0 && !isPlainObject(current.rules)) throw new EventTypesFlagError("rules in --raw-body must be a JSON object when also passing --event-types.");
+	if (current.rules !== void 0 && !isPlainObject$1(current.rules)) throw new EventTypesFlagError("rules in --raw-body must be a JSON object when also passing --event-types.");
 	const explicitRules = current.rules ?? {};
 	return {
 		...current,
@@ -54719,7 +55828,115 @@ function withEventTypes(body, eventTypes, baseRules = {}) {
 }
 /** True when the caller already passed `rules` in the request body. */
 function bodyHasRules(body) {
-	return isPlainObject(body) && body.rules !== void 0;
+	return isPlainObject$1(body) && body.rules !== void 0;
+}
+// src/oclif/endpoint-url-shown.ts
+/** The commands whose answers carry endpoints, by operation sdkName. */
+const ENDPOINT_URL_OPERATIONS = /* @__PURE__ */ new Set([
+	"getEndpoint",
+	"listEndpoints",
+	"createEndpoint",
+	"updateEndpoint"
+]);
+/** The commands that send a URL, whose value is checked for the placeholder. */
+const ENDPOINT_URL_WRITE_OPERATIONS = /* @__PURE__ */ new Set(["createEndpoint", "updateEndpoint"]);
+/** What a hidden query string is replaced with. */
+const HIDDEN_QUERY = "?... (query hidden)";
+const SHOW_URL_FLAG_DESCRIPTION = "Print each webhook URL in full, its query string included. Without it the query string is shown as ?... (query hidden), with url_query_hidden: true on the endpoint, because it can carry a secret such as a deployment protection bypass token.";
+/**
+* Said when an answer had a URL shortened: on stderr without --json, and in
+* the document's summary with --json --envelope.
+*/
+const HIDDEN_QUERY_NOTE = "A webhook URL's query string is hidden, as it can carry a secret. Pass --show-url to print it in full.";
+/**
+* The URL with its query string, and anything after it, replaced by
+* HIDDEN_QUERY; null when it has no query string. A `?` after a `#` is part
+* of the fragment, not a query.
+*/
+function urlWithQueryHidden(url) {
+	const query = url.indexOf("?");
+	if (query < 0) return null;
+	const fragment = url.indexOf("#");
+	if (fragment >= 0 && fragment < query) return null;
+	return `${url.slice(0, query)}${HIDDEN_QUERY}`;
+}
+function hideOne(endpoint) {
+	if (endpoint === null || typeof endpoint !== "object" || Array.isArray(endpoint)) return {
+		value: endpoint,
+		hidden: false
+	};
+	const url = endpoint.url;
+	const shown = typeof url === "string" ? urlWithQueryHidden(url) : null;
+	if (shown === null) return {
+		value: endpoint,
+		hidden: false
+	};
+	return {
+		value: {
+			...endpoint,
+			url: shown,
+			url_query_hidden: true
+		},
+		hidden: true
+	};
+}
+/**
+* An answer's data (one endpoint, or a list of them) with each URL's query
+* string hidden, and whether any was.
+*/
+function endpointsWithQueryHidden(data) {
+	if (!Array.isArray(data)) {
+		const one = hideOne(data);
+		return {
+			data: one.value,
+			hidden: one.hidden
+		};
+	}
+	let hidden = false;
+	return {
+		data: data.map((row) => {
+			const one = hideOne(row);
+			hidden ||= one.hidden;
+			return one.value;
+		}),
+		hidden
+	};
+}
+function isPlainObject(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+/** How deep errorWithQueryHidden looks into an error payload. */
+const ERROR_DEPTH = 8;
+/**
+* An error answer with the query string hidden in every `url` it names, such
+* as `details.holder.url` on a 409 for a slot another endpoint holds.
+* Anything that is not a plain object or a list is left as it is.
+*/
+function errorWithQueryHidden(payload, depth = 0) {
+	if (depth > ERROR_DEPTH) return payload;
+	if (Array.isArray(payload)) return payload.map((entry) => errorWithQueryHidden(entry, depth + 1));
+	if (!isPlainObject(payload)) return payload;
+	const out = {};
+	for (const [key, value] of Object.entries(payload)) out[key] = errorWithQueryHidden(value, depth + 1);
+	return hideOne(out).value;
+}
+/**
+* A query string as a partial copy of HIDDEN_QUERY leaves it: a terminal's
+* word selection stops at its first space, after `?...`.
+*/
+const HIDDEN_QUERY_START = "?...";
+/**
+* The refusal for a request body whose url is a URL as these commands print
+* it with the query hidden, whole or cut at its first space, so a printed URL
+* is never written back in place of the real one; null for any other body.
+*/
+function hiddenQueryUrlRefusal(body) {
+	if (body === null || typeof body !== "object" || Array.isArray(body)) return null;
+	const url = body.url;
+	if (typeof url !== "string" || !url.includes(HIDDEN_QUERY_START)) return null;
+	return `The url carries ${HIDDEN_QUERY_START}, the start of ${HIDDEN_QUERY}, which is how the endpoint commands print a URL with its query string hidden, not the URL itself. Pass the full URL; \`primitive endpoints get <id> --show-url\` prints a webhook's URL in full.`;
 }
 // src/oclif/endpoints-test-redirect.ts
 async function detectFunctionEndpoint(endpointId, listEndpoints) {
@@ -56576,7 +57793,7 @@ function savedConnectedProfiles(configDir, exclude) {
 */
 async function otherProfiles(configDir, session, current) {
 	if (session) try {
-		const { connectedProfilesForSession } = await import("./machine-session-BMr-zPLx.js").then((n) => n.s);
+		const { connectedProfilesForSession } = await import("./machine-session-DyGP7wDs.js").then((n) => n.s);
 		return {
 			inSession: true,
 			profiles: connectedProfilesForSession(configDir, session, current)
@@ -57438,8 +58655,13 @@ const NETWORK_ERROR_HINTS = {
 	ENETUNREACH: "Hint: the network is unreachable. If you're behind a proxy and set HTTP(S)_PROXY, re-run with NODE_USE_ENV_PROXY=1 (Node 22+ ignores those env vars by default). `primitive doctor` reports the local environment in one shot.",
 	ECONNREFUSED: "Hint: the server refused the connection. Check that your firewall allows egress to *.primitive.dev, that your PRIMITIVE_API_BASE_URL_* overrides (if any) point at a reachable host, and re-run with NODE_USE_ENV_PROXY=1 if you're behind a proxy. `primitive doctor` reports the local environment in one shot.",
 	ETIMEDOUT: "Hint: the connection timed out. Check egress rules and proxy configuration; if you're behind a proxy, re-run with NODE_USE_ENV_PROXY=1 and HTTPS_PROXY set. `primitive doctor` reports the local environment in one shot.",
-	EAI_AGAIN: "Hint: DNS lookup failed. Check /etc/resolv.conf inside containers, and try `curl -v https://api.primitive.dev/v1/account` to confirm the host resolves. `primitive doctor` reports the local environment in one shot."
+	EAI_AGAIN: "Hint: DNS lookup failed. Check /etc/resolv.conf inside containers, and try `curl -v https://api.primitive.dev/v1/account` to confirm the host resolves. `primitive doctor` reports the local environment in one shot.",
+	ENOTFOUND: "Hint: the API host name did not resolve. Check PRIMITIVE_API_BASE_URL and any --api-base-url for a typo, and your DNS. `primitive doctor` reports the local environment in one shot."
 };
+/** The hint for a network failure's code (`cause.code` on a failed fetch), if there is one. */
+function networkErrorHint(code) {
+	return Object.hasOwn(NETWORK_ERROR_HINTS, code) ? NETWORK_ERROR_HINTS[code] : void 0;
+}
 const RATE_LIMIT_CODES = /* @__PURE__ */ new Set(["rate_limited", "rate_limit_exceeded"]);
 /** When to retry a rate-limited request, from Retry-After when it was sent. */
 function rateLimitHint(response) {
@@ -57662,6 +58884,10 @@ function buildFlags(operation) {
 		multiple: true
 	});
 	if (operation.binaryResponse) flags.output = Flags.string({ description: "Write binary response bytes to a file" });
+	if (ENDPOINT_URL_OPERATIONS.has(operation.sdkName)) {
+		if (flags["show-url"] !== void 0) throw new Error(`${operation.sdkName}: --show-url is both a generated flag and the CLI's own`);
+		flags["show-url"] = Flags.boolean({ description: SHOW_URL_FLAG_DESCRIPTION });
+	}
 	if (ATTACHMENT_WAIT_OPERATIONS.has(operation.sdkName)) flags.wait = Flags.boolean({
 		allowNo: true,
 		default: true,
@@ -57757,6 +58983,9 @@ const OPERATION_HINTS = {
 	getMemory: "Tip: prefer `primitive memories get <key> [--function <function-id>]` for the common read path.",
 	deleteMemory: "Tip: prefer `primitive memories delete <key> [--function <function-id>]` for the common delete path.",
 	searchMemories: "Tip: prefer `primitive memories search [prefix] [--metadata-only] [--function <function-id>]` for the common search path.",
+	createEmailRuleObjection: "Tip: say in --message (up to 500 characters) what you want. It can ask for less than turning the rule off: ask the author to narrow the rule, or to explain where its matches go (its receivers). The author accepts, which turns the rule off, or declines, optionally giving a reason, which you see in `primitive email-rule-oversight get-email-rule-objection <objection-id>`. You can withdraw it with `primitive email-rule-oversight withdraw-email-rule-objection <objection-id>`. Objecting does not change the rule.",
+	declineEmailRuleObjection: "Tip: the member who objected sees --reason (up to 500 characters). When the objection asked you to narrow the rule or explain a receiver, the reason can answer that: say what you changed, or what the receiver is for.",
+	listEndpoints: "Tip: without --json, a table on stderr after the JSON shows each endpoint's ENABLED and DELIVERING. DELIVERING is read from delivery.delivering, whether a webhook is being sent mail at all, not from enabled: an endpoint can be enabled and still not be delivering (its owner's key revoked, say), shown as no with the reason codes in parentheses. A webhook whose delivery could not be checked shows unknown, and a Function or pull endpoint shows -.",
 	startAgentSignup: "Tip: pass --terms-accepted. Capture the signup_token from the response and feed it to `primitive agent verify-agent-signup --signup-token <token> --verification-code <6-digit-code>` (the verify flag accepts --code as an alias). The high-level `primitive signup <email>` command walks an interactive user through both steps with friendlier prompts.",
 	testEmailRule: "Tip: --expect-match and --expect-no-match (or --expect-file) set expect, the emails the rule must match and must not. When no expect is sent, by these flags or in the body, a saved rule's saved expectations are judged instead. Either way, the answer reports the expectations it judged in expectations: passed, counts and per-email results. (create-email-rule and update-email-rule instead judge the rule's saved expectations on the version they save, in expectations_check: passed, decided, failed and undecided.) The exit code follows that report: 1 when one failed; 1 when one is undecided and testing again will not decide it (its email cannot be found or read, cannot be classified, or cannot be tested: skipped); 3 when the only undecided ones can be decided later (not classified yet, or a question unanswered), so test again later. Exit 1 also means the request failed. With --json, error.code tells these apart: expectations_failed, expectations_unresolvable, expectations_undecided (exit 3), or the API's own code. Without --json a readable report follows the JSON on stderr: warnings, how each condition held, the expectations, and the values each email that did not match was compared on.",
 	verifyAgentSignup: "Tip: pass --verification-code <code> (or --code; both work). The response carries OAuth tokens but not your assigned inbox domain; run `primitive domains list` (or `primitive whoami`) after success to see the managed *.primitive.email address that routes to this account."
@@ -57846,6 +59075,13 @@ function createOperationCommand(operation) {
 				"verifyAgentSignup",
 				"resendAgentSignupVerification"
 			].includes(operation.operationId)) requireDefaultLoginProfile();
+			const prereadBody = ENDPOINT_URL_WRITE_OPERATIONS.has(operation.sdkName) && operation.hasJsonBody ? { value: readJsonBody(parsedFlags) } : void 0;
+			if (prereadBody) {
+				const urlFlag = [...bodyFieldFlagToProperty].find(([, property]) => property === "url")?.[0];
+				const flagUrl = urlFlag ? parsedFlags[urlFlag] : void 0;
+				const refusal = hiddenQueryUrlRefusal(typeof flagUrl === "string" ? { url: flagUrl } : prereadBody.value);
+				if (refusal) throw new Errors.CLIError(refusal, { exit: 2 });
+			}
 			await runWithTiming(parsedFlags.time === true, async () => {
 				const { apiClient, auth, baseUrlOverridden } = await createAuthenticatedCliApiClient({
 					apiKey: typeof parsedFlags["api-key"] === "string" ? parsedFlags["api-key"] : void 0,
@@ -57854,7 +59090,7 @@ function createOperationCommand(operation) {
 				});
 				let body;
 				if (operation.hasJsonBody) {
-					const explicit = readJsonBody(parsedFlags);
+					const explicit = prereadBody ? prereadBody.value : readJsonBody(parsedFlags);
 					const overrides = collectBodyFieldFlags(parsedFlags, bodyFieldFlagToProperty);
 					const extensionFlagFor = /* @__PURE__ */ new Map();
 					for (const field of extension?.bodyFields?.(parsedFlags, explicit) ?? []) {
@@ -57874,6 +59110,10 @@ function createOperationCommand(operation) {
 						}
 					} else body = explicit;
 				}
+				if (ENDPOINT_URL_WRITE_OPERATIONS.has(operation.sdkName)) {
+					const refusal = hiddenQueryUrlRefusal(body);
+					if (refusal) throw new Errors.CLIError(refusal, { exit: 2 });
+				}
 				if (EVENT_TYPES_FLAG_OPERATIONS.has(operation.sdkName) && Array.isArray(parsedFlags["event-types"])) body = await applyEventTypesFlag({
 					body,
 					values: parsedFlags["event-types"],
@@ -57993,7 +59233,7 @@ function createOperationCommand(operation) {
 				if (result.error) {
 					const errorPayload = extractErrorPayload(result.error);
 					const operationErrorHint = OPERATION_ERROR_HINTS[operation.sdkName]?.(extractErrorCode(errorPayload), body, errorPayload, collectValues(operation.pathParams, parsedFlags, operation.sdkName), parsedFlags);
-					writeErrorWithHints(errorPayload, result.response, { codeHint: !(operationErrorHint && OPERATION_ERROR_HINTS_REPLACING_CODE_HINT.has(operation.sdkName)) });
+					writeErrorWithHints(ENDPOINT_URL_OPERATIONS.has(operation.sdkName) && parsedFlags["show-url"] !== true ? errorWithQueryHidden(errorPayload) : errorPayload, result.response, { codeHint: !(operationErrorHint && OPERATION_ERROR_HINTS_REPLACING_CODE_HINT.has(operation.sdkName)) });
 					if (operationErrorHint) process.stderr.write(`${operationErrorHint}\n`);
 					if (stepUpUrl) process.stderr.write(approveThenRerunHint(stepUpUrl));
 					if (replyStateSurface && isAwaitingRejectedError(errorPayload)) process.stderr.write(`${awaitingRejectedError(replyStateSurface).message}\n`);
@@ -58141,12 +59381,26 @@ function createOperationCommand(operation) {
 						}
 					};
 				}
-				let printed = jsonOutput && withEnvelope ? operationJsonDocument(envelope, summary) : operationOutputPayload(envelope, withEnvelope);
+				let shownEnvelope = envelope;
+				let queryHidden = false;
+				if (ENDPOINT_URL_OPERATIONS.has(operation.sdkName) && parsedFlags["show-url"] !== true && envelope) {
+					const shown = endpointsWithQueryHidden(envelope.data);
+					if (shown.hidden) {
+						shownEnvelope = {
+							...envelope,
+							data: shown.data
+						};
+						queryHidden = true;
+						if (jsonOutput && withEnvelope) summary.push(HIDDEN_QUERY_NOTE);
+					}
+				}
+				let printed = jsonOutput && withEnvelope ? operationJsonDocument(shownEnvelope, summary) : operationOutputPayload(shownEnvelope, withEnvelope);
 				if (jsonOutput && report?.exitCode && report.error && printed !== null && typeof printed === "object" && !Array.isArray(printed)) printed = {
 					...printed,
 					error: report.error
 				};
 				this.log(JSON.stringify(printed, null, 2));
+				if (queryHidden && !jsonOutput) process.stderr.write(`${HIDDEN_QUERY_NOTE}\n`);
 				if (reportError !== void 0) process.stderr.write(`Warning: ${operation.sdkName} succeeded but its report could not be built (${reportError}). The JSON above is the full answer; read it rather than the exit code.\n`);
 				if (report && !jsonOutput) for (const line of report.lines) process.stderr.write(`${line}\n`);
 				if (reportError !== void 0 && report?.exitCode && !jsonOutput) process.stderr.write(`The answer's expectations were not all shown to pass, so the command exits ${report.exitCode}.\n`);
@@ -58180,4 +59434,4 @@ function emptyDeliveriesHint(sdkName, query) {
 function canonicalizeCliReferences(description) {
 	return description.replaceAll("`primitive emails:latest`", "`primitive emails latest`").replaceAll("`primitive describe emails:get-email | jq '.responseSchema.properties'`", "`primitive describe emails:get | jq '.responseSchema.properties'`");
 }
-export { readEmailInteraction as $, SAVED_CLI_OAUTH_SESSION_EXPIRED_MESSAGE as $t, explainPendingMailNotFound as A, cliInvocation as At, skillFirstLine as B, formatAlreadySentNotice as Bt, promptLine as C, sendOutcomeExitCode as Ct, formatBrowserLoginInstructions as D, successfulSendOutcome as Dt, canOfferCopyHotkey as E, serializeErrorPayload as Et, latestOwnOutbound as F, loadSkillLine as Ft, clearConsumedPendingMail as G, classificationFactLines as Gt, wakeRecipientField as H, emptyEmailListHint as Ht, readThreadContext as I, currentMailSessionKey as It, readPendingMail as J, noFactsMessage as Jt, clearReadPendingMail as K, classificationOf as Kt, sentInThread as L, detectAgentRuntime as Lt, describeWake as M, defaultConnectionName as Mt, displayAddress as N, generatedAgentName as Nt, listenForCopyHotkey as O, thrownErrorExitCode as Ot, formatMailWakeLine as P, identitySuggestions as Pt, interactionNextActions as Q, ConnectedAgentKeyRequiredError as Qt, serverMuted as R, detectRuntimeSession as Rt, approveThenRerunHint as S, sendIdentityFields as St, withApproval as T, sentHistoryWindowStart as Tt, wakeRelationship as U, mailReach as Ut, wakeReadCommand as V, withFlagSuggestion as Vt, claimPendingMail as W, readCallerMailFor as Wt, removePendingMail as X, ATTACHMENT_WAIT_MAX_MS as Xt, recordPendingMail as Y, ATTACHMENT_WAIT_FLAG_DESCRIPTION as Yt, interactionHumanLine as Z, withAttachmentWait as Zt, takesStepUp as _, setKnownCommands as _n, formatPriorRepliesWarning as _t, createOperationCommand as a, selectedOrgFromEnv as an, SEND_OUTCOME_HELP as at, STEP_UP_HEADER as b, priorRepliesThatWentOut as bt, formatErrorPayload as c, credentialsFromUserLogin as cn, buildFollowUpCommand as ct, isGrantRefusal as d, revokeUserLogin as dn, classifySendError as dt, createAuthenticatedCliApiClient as en, replyExpectation as et, parameterFlagName as f, roleKeyLabel as fn, deriveSendIdempotencyKey as ft, surfaceUnauthorizedHint as g, sanitizeForTerminal as gn, formatPriorRepliesCheckSkipped as gt, runWithTiming as h, routeWarningLines as hn, formatDeletedEarlierSendNotice as ht, TIME_FLAG_DESCRIPTION as i, resolveCliApiRequestConfig as in, MAX_SEND_WAIT_TIMEOUT_MS as it, bareAddress$1 as j, connectNextSteps as jt, openBrowser as k, DEFAULT_ENROLL_NAME as kt, hasControlCharacter as l, fetchCliOrgs as ln, buildThrownSendFailureEnvelope as lt, refusalDetails as m, switchCurrentOrg as mn, followUpCommandPrefix as mt, API_ERROR_CODES as n, refreshStoredCliCredentials as nn, wakeInteractionSentence as nt, extractErrorCode as o, CliOrgRefusedError as on, apiResultHttpStatus as ot, readTextFileFlag as p, roleKeyText as pn, excludeSignalReplies as pt, pendingMailPath as q, isEmailId as qt, OPERATION_PATH_FLAGS as r, refuseOrgSelectionForProfile as rn, IDEMPOTENCY_KEY_FLAG_DESCRIPTION as rt, extractErrorPayload as s, RESTRICTED_ROLE_NOTE as sn, assertValidIdempotencyKey as st, API_BASE_URL_FLAG_DESCRIPTION as t, createCliApiClient as tn, replyInteractionWarning as tt, headerFlagName as u, isBuiltInRoleKey as un, checkPriorReplies as ut, writeErrorWithHints as v, operationManifest as vn, formatSendFailureSummary as vt, terminalApprovalIo as w, sendWaitClampNotice as wt, STEP_UP_TOKEN_FLAG_DESCRIPTION as x, reportSendCommandResult as xt, BROWSER_FLAG_DESCRIPTION as y, formatSendRecordFailureSummary as yt, serverRelationship as z, runtimeSessionVariableList as zt };
+export { interactionNextActions as $, ConnectedAgentKeyRequiredError as $t, openBrowser as A, DEFAULT_ENROLL_NAME as At, serverRelationship as B, runtimeSessionVariableList as Bt, approveThenRerunHint as C, sendIdentityFields as Ct, canOfferCopyHotkey as D, serializeErrorPayload as Dt, withApproval as E, sentHistoryWindowStart as Et, formatMailWakeLine as F, identitySuggestions as Ft, claimPendingMail as G, readCallerMailFor as Gt, wakeReadCommand as H, withFlagSuggestion as Ht, latestOwnOutbound as I, loadSkillLine as It, pendingMailPath as J, isEmailId as Jt, clearConsumedPendingMail as K, classificationFactLines as Kt, readThreadContext as L, currentMailSessionKey as Lt, bareAddress$1 as M, connectNextSteps as Mt, describeWake as N, defaultConnectionName as Nt, formatBrowserLoginInstructions as O, successfulSendOutcome as Ot, displayAddress as P, generatedAgentName as Pt, interactionHumanLine as Q, withAttachmentWait as Qt, sentInThread as R, detectAgentRuntime as Rt, STEP_UP_TOKEN_FLAG_DESCRIPTION as S, reportSendCommandResult as St, terminalApprovalIo as T, sendWaitClampNotice as Tt, wakeRecipientField as U, emptyEmailListHint as Ut, skillFirstLine as V, formatAlreadySentNotice as Vt, wakeRelationship as W, mailReach as Wt, recordPendingMail as X, ATTACHMENT_WAIT_FLAG_DESCRIPTION as Xt, readPendingMail as Y, noFactsMessage as Yt, removePendingMail as Z, ATTACHMENT_WAIT_MAX_MS as Zt, surfaceUnauthorizedHint as _, sanitizeForTerminal as _n, formatPriorRepliesCheckSkipped as _t, createOperationCommand as a, resolveCliApiRequestConfig as an, MAX_SEND_WAIT_TIMEOUT_MS as at, BROWSER_FLAG_DESCRIPTION as b, formatSendRecordFailureSummary as bt, formatErrorPayload as c, RESTRICTED_ROLE_NOTE as cn, assertValidIdempotencyKey as ct, isGrantRefusal as d, isBuiltInRoleKey as dn, checkPriorReplies as dt, SAVED_CLI_OAUTH_SESSION_EXPIRED_MESSAGE as en, readEmailInteraction as et, networkErrorHint as f, revokeUserLogin as fn, classifySendError as ft, runWithTiming as g, routeWarningLines as gn, formatDeletedEarlierSendNotice as gt, refusalDetails as h, switchCurrentOrg as hn, followUpCommandPrefix as ht, TIME_FLAG_DESCRIPTION as i, refuseOrgSelectionForProfile as in, IDEMPOTENCY_KEY_FLAG_DESCRIPTION as it, explainPendingMailNotFound as j, cliInvocation as jt, listenForCopyHotkey as k, thrownErrorExitCode as kt, hasControlCharacter as l, credentialsFromUserLogin as ln, buildFollowUpCommand as lt, readTextFileFlag as m, roleKeyText as mn, excludeSignalReplies as mt, API_ERROR_CODES as n, createCliApiClient as nn, replyInteractionWarning as nt, extractErrorCode as o, selectedOrgFromEnv as on, SEND_OUTCOME_HELP as ot, parameterFlagName as p, roleKeyLabel as pn, deriveSendIdempotencyKey as pt, clearReadPendingMail as q, classificationOf as qt, OPERATION_PATH_FLAGS as r, refreshStoredCliCredentials as rn, wakeInteractionSentence as rt, extractErrorPayload as s, CliOrgRefusedError as sn, apiResultHttpStatus as st, API_BASE_URL_FLAG_DESCRIPTION as t, createAuthenticatedCliApiClient as tn, replyExpectation as tt, headerFlagName as u, fetchCliOrgs as un, buildThrownSendFailureEnvelope as ut, takesStepUp as v, setKnownCommands as vn, formatPriorRepliesWarning as vt, promptLine as w, sendOutcomeExitCode as wt, STEP_UP_HEADER as x, priorRepliesThatWentOut as xt, writeErrorWithHints as y, operationManifest as yn, formatSendFailureSummary as yt, serverMuted as z, detectRuntimeSession as zt };