primcli 3.0.0-preview.13 → 3.0.0-preview.15

package/dist/oclif/index.js

@@ -1,12 +1,12 @@
-import { $ as readEmailInteraction, A as explainPendingMailNotFound, At as cliInvocation, Bt as formatAlreadySentNotice, C as promptLine$2, Ct as sendOutcomeExitCode, D as formatBrowserLoginInstructions, Dt as successfulSendOutcome, E as canOfferCopyHotkey, Et as serializeErrorPayload, F as latestOwnOutbound, Ft as loadSkillLine, G as clearConsumedPendingMail, Gt as classificationFactLines, H as wakeRecipientField, Ht as emptyEmailListHint, I as readThreadContext, It as currentMailSessionKey, J as readPendingMail, Jt as noFactsMessage, K as clearReadPendingMail, Kt as classificationOf, L as sentInThread, Lt as detectAgentRuntime, M as describeWake, N as displayAddress, Nt as generatedAgentName, O as listenForCopyHotkey, Ot as thrownErrorExitCode, P as formatMailWakeLine, Pt as identitySuggestions, Q as interactionNextActions, Qt as ConnectedAgentKeyRequiredError, R as serverMuted, Rt as detectRuntimeSession, S as approveThenRerunHint, St as sendIdentityFields, T as withApproval, Tt as sentHistoryWindowStart, U as wakeRelationship, Ut as mailReach, V as wakeReadCommand, Vt as withFlagSuggestion, W as claimPendingMail, Wt as readCallerMailFor, X as removePendingMail, Xt as ATTACHMENT_WAIT_MAX_MS, Y as recordPendingMail, Yt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, Z as interactionHumanLine, Zt as withAttachmentWait, _ as takesStepUp, _n as setKnownCommands, _t as formatPriorRepliesWarning, a as createOperationCommand, an as selectedOrgFromEnv, at as SEND_OUTCOME_HELP, b as STEP_UP_HEADER$1, bt as priorRepliesThatWentOut, c as formatErrorPayload, cn as credentialsFromUserLogin, ct as buildFollowUpCommand, d as isGrantRefusal, dn as revokeUserLogin, dt as classifySendError, en as createAuthenticatedCliApiClient, et as replyExpectation, f as parameterFlagName, fn as roleKeyLabel, ft as deriveSendIdempotencyKey, g as surfaceUnauthorizedHint, gn as sanitizeForTerminal, gt as formatPriorRepliesCheckSkipped, h as runWithTiming, hn as routeWarningLines, ht as formatDeletedEarlierSendNotice, i as TIME_FLAG_DESCRIPTION, in as resolveCliApiRequestConfig, it as MAX_SEND_WAIT_TIMEOUT_MS, j as bareAddress, jt as connectNextSteps, k as openBrowser, l as hasControlCharacter$1, ln as fetchCliOrgs, lt as buildThrownSendFailureEnvelope, m as refusalDetails, mn as switchCurrentOrg, mt as followUpCommandPrefix, n as API_ERROR_CODES, nn as refreshStoredCliCredentials, o as extractErrorCode, on as CliOrgRefusedError, ot as apiResultHttpStatus, p as readTextFileFlag, pn as roleKeyText, pt as excludeSignalReplies, q as pendingMailPath, qt as isEmailId, r as OPERATION_PATH_FLAGS, rn as refuseOrgSelectionForProfile, rt as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, s as extractErrorPayload, sn as RESTRICTED_ROLE_NOTE, st as assertValidIdempotencyKey, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createCliApiClient, tt as replyInteractionWarning, u as headerFlagName, un as isBuiltInRoleKey, ut as checkPriorReplies, v as writeErrorWithHints, vn as operationManifest, vt as formatSendFailureSummary, w as terminalApprovalIo, wt as sendWaitClampNotice, x as STEP_UP_TOKEN_FLAG_DESCRIPTION, xt as reportSendCommandResult, y as BROWSER_FLAG_DESCRIPTION, yt as formatSendRecordFailureSummary, z as serverRelationship, zt as runtimeSessionVariableList } from "../api-command-D5Tj9C-K.js";
-import { $ as parseWebhookEvent, $n as simulateRoute, $t as getRepeatingSend, A as lateMailReread, An as listWakeDispatches, At as deleteWakeSchedule, B as ensureSearchReportsReplyState, Bn as replyToEmail, Bt as getConversation, C as waitOutRetryAfter, Cn as listOrganizationPeople, Ct as createWakeAuthorization, D as encodeReceivedAtSearchCursor, Dn as listSentAttachmentArchiveMembers, Dt as deleteMemory, E as cursorFromAcceptedRows, En as listRoutes, F as AWAITING_VALUES, Ft as downloadSentAttachmentByFilename, G as queryUsesAwaiting, Gt as getFunctionRouting, H as formatRepliesCell, Hn as revokeCredential, Ht as getDefaultNetworkAgent, I as REPLY_STATE_UNSUPPORTED_CODE, It as getAccessMode, Jn as semanticSearch, Jt as getKey, Kn as searchEmails, Kt as getFunctionTestRunTrace, L as ReplyStateUnsupportedError, Ln as redeemCreditCode, Lt as getAccount, M as sinceFromFlags, Mn as pollCliLogin, Mt as downloadEmailAttachmentByFilename, N as sleep$3, Nn as pullWebhookEvent, O as fetchEmailSearchPage, On as listSentEmails, Ot as deleteRoute, P as AWAITING_FLAG_DESCRIPTION, Pt as downloadSentAttachmentArchiveMember, Qn as setMemory, Qt as getOwnGrant, R as assertAwaitingFilterRows, Rn as removeDefaultNetworkMember, Rt as getAgentContactPolicy, S as transientFailure, Sn as listMailboxAccess, St as createRoute, T as collectNewAcceptedEmails, Tn as listRoles, U as hasReplyState, Un as rotateKey, Ut as getEmail, V as formatAwaitingCell, Vn as resendAgentSignupVerification, Vt as getCreditBalance, W as isAwaitingRejectedError, Wn as runWakeSchedule, Wt as getFunction, Xn as setFunctionRoute, Xt as getOrgRoutingTopology, Yn as sendEmail, Yt as getMemory, Z as isEmailReceivedEvent, Zn as setFunctionSecret, Zt as getOutboundStatus, _ as describeApiFailure, _n as listEndpoints, _t as cliLogout, a as REPEAT_IDLE_MAX_MINUTES, an as leaveOrganization, ar as unsetFunctionRoute, at as assertAutomatedVerdict, b as retryTransient, bn as listGroups, bt as createFunction, cn as listAgentContacts, cr as updateKey, d as parseRepeatTick, dn as listDefaultNetworkAgents, dr as updateWakeAuthorization, dt as isAutomatedRejectedError, en as getSendFrom, er as startAgentClaim, et as parseFromHeader, f as preparePresenceAliveEmail, fn as listDefaultNetworkMembers, fr as updateWakeSchedule, ft as addDefaultNetworkMember, g as WaitDeadlineReached, gn as listEmails, gt as checkSendability, hn as listEmailRuleResults, hr as whoami, ht as checkDefaultNetworkContactAdmission, i as REPEAT_EVERY_MAX_MINUTES, ir as testFunction, it as AutomatedFilterUnsupportedError, j as quoteDslValue, jn as listWakeSchedules, jt as downloadEmailAttachmentArchiveMember, k as filtersFromFlags, kn as listWakeAuthorizations, kt as deleteWakeAuthorization, l as parseInteractionEnvelope, ln as listAgentNetworks, lr as updateRepeatingSend, m as repeatStopCommand, mn as listEmailAttachmentArchiveMembers, mr as verifyAgentSignup, mt as cancelSentEmailByIdempotencyKey, nn as getThread, nr as startCliLogin, nt as AUTOMATED_FLAG_DESCRIPTION, o as REPEAT_MAX_SENDS_MAX, on as listActivityObjects, or as updateDefaultNetworkMember, ot as automatedRejectedError, p as prepareSignalEmail, pn as listDomains, pr as verifyAgentClaim, pt as cancelSentEmail, qn as searchMemories, qt as getInboxStatus, rn as getWakeSchedule, rr as stopRepeatFromEmail, rt as AUTOMATED_VALUES, s as buildRepeatStopBody, sr as updateFunction, tn as getSentEmail, tr as startAgentSignup, tt as AUTOMATED_FILTER_UNSUPPORTED_CODE, u as parsePresenceEnvelope, ur as updateRoute, ut as hasAutomatedVerdict, vn as listFunctionLogs, vt as completeWebhookEvent, w as SINCE_VALUE_HELP, wn as listRepeatingSends, wt as createWakeSchedule, x as retryingOperation, xn as listKeys, xt as createKey, y as pauseForTransientFailure, yn as listFunctions, yt as createEndpoint, z as awaitingRejectedError, zn as reorderRoutes } from "../repeats-Dj_o6c-X-ykfsraq6.js";
-import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-cIUz_kxR.js";
+import { $ as interactionNextActions, $t as ConnectedAgentKeyRequiredError, A as openBrowser, B as serverRelationship, Bt as runtimeSessionVariableList, C as approveThenRerunHint, Ct as sendIdentityFields, D as canOfferCopyHotkey, Dt as serializeErrorPayload, E as withApproval, Et as sentHistoryWindowStart, F as formatMailWakeLine, Ft as identitySuggestions, G as claimPendingMail, Gt as readCallerMailFor, H as wakeReadCommand, Ht as withFlagSuggestion, I as latestOwnOutbound, It as loadSkillLine, J as pendingMailPath, Jt as isEmailId, K as clearConsumedPendingMail, Kt as classificationFactLines, L as readThreadContext, Lt as currentMailSessionKey, M as bareAddress, Mt as connectNextSteps, N as describeWake, O as formatBrowserLoginInstructions, Ot as successfulSendOutcome, P as displayAddress, Pt as generatedAgentName, Q as interactionHumanLine, Qt as withAttachmentWait, R as sentInThread, Rt as detectAgentRuntime, S as STEP_UP_TOKEN_FLAG_DESCRIPTION, St as reportSendCommandResult, T as terminalApprovalIo, Tt as sendWaitClampNotice, U as wakeRecipientField, Ut as emptyEmailListHint, Vt as formatAlreadySentNotice, W as wakeRelationship, Wt as mailReach, X as recordPendingMail, Xt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, Y as readPendingMail, Yt as noFactsMessage, Z as removePendingMail, Zt as ATTACHMENT_WAIT_MAX_MS, _ as surfaceUnauthorizedHint, _n as sanitizeForTerminal, _t as formatPriorRepliesCheckSkipped, a as createOperationCommand, an as resolveCliApiRequestConfig, at as MAX_SEND_WAIT_TIMEOUT_MS, b as BROWSER_FLAG_DESCRIPTION, bt as formatSendRecordFailureSummary, c as formatErrorPayload, cn as RESTRICTED_ROLE_NOTE, ct as assertValidIdempotencyKey, d as isGrantRefusal, dn as isBuiltInRoleKey, dt as checkPriorReplies, et as readEmailInteraction, f as networkErrorHint, fn as revokeUserLogin, ft as classifySendError, g as runWithTiming, gn as routeWarningLines, gt as formatDeletedEarlierSendNotice, h as refusalDetails, hn as switchCurrentOrg, ht as followUpCommandPrefix, i as TIME_FLAG_DESCRIPTION, in as refuseOrgSelectionForProfile, it as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, j as explainPendingMailNotFound, jt as cliInvocation, k as listenForCopyHotkey, kt as thrownErrorExitCode, l as hasControlCharacter$1, ln as credentialsFromUserLogin, lt as buildFollowUpCommand, m as readTextFileFlag, mn as roleKeyText, mt as excludeSignalReplies, n as API_ERROR_CODES, nn as createCliApiClient, nt as replyInteractionWarning, o as extractErrorCode, on as selectedOrgFromEnv, ot as SEND_OUTCOME_HELP, p as parameterFlagName, pn as roleKeyLabel, pt as deriveSendIdempotencyKey, q as clearReadPendingMail, qt as classificationOf, r as OPERATION_PATH_FLAGS, rn as refreshStoredCliCredentials, s as extractErrorPayload, sn as CliOrgRefusedError, st as apiResultHttpStatus, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createAuthenticatedCliApiClient, tt as replyExpectation, u as headerFlagName, un as fetchCliOrgs, ut as buildThrownSendFailureEnvelope, v as takesStepUp, vn as setKnownCommands, vt as formatPriorRepliesWarning, w as promptLine$2, wt as sendOutcomeExitCode, x as STEP_UP_HEADER$1, xt as priorRepliesThatWentOut, y as writeErrorWithHints, yn as operationManifest, yt as formatSendFailureSummary, z as serverMuted, zt as detectRuntimeSession } from "../api-command-D5Nbd6Pq.js";
+import { $n as setMemory, $t as getOwnGrant, A as filtersFromFlags, An as listWakeAuthorizations, At as deleteWakeAuthorization, B as awaitingRejectedError, Bn as reorderRoutes, C as transientFailure, Cn as listMailboxAccess, Ct as createRoute, D as cursorFromAcceptedRows, Dn as listRoutes, E as collectNewAcceptedEmails, En as listRoles, F as AWAITING_FLAG_DESCRIPTION, Ft as downloadSentAttachmentArchiveMember, G as isAwaitingRejectedError, Gn as runWakeSchedule, Gt as getFunction, H as formatAwaitingCell, Hn as resendAgentSignupVerification, Ht as getCreditBalance, I as AWAITING_VALUES, It as downloadSentAttachmentByFilename, Jn as searchMemories, Jt as getInboxStatus, K as queryUsesAwaiting, Kt as getFunctionRouting, L as REPLY_STATE_UNSUPPORTED_CODE, Lt as getAccessMode, M as quoteDslValue, Mn as listWakeSchedules, Mt as downloadEmailAttachmentArchiveMember, N as sinceFromFlags, Nn as pollCliLogin, Nt as downloadEmailAttachmentByFilename, O as encodeReceivedAtSearchCursor, On as listSentAttachmentArchiveMembers, Ot as deleteMemory, P as sleep$3, Pn as pullWebhookEvent, Q as isEmailReceivedEvent, Qn as setFunctionSecret, Qt as getOutboundStatus, R as ReplyStateUnsupportedError, Rn as redeemCreditCode, Rt as getAccount, S as retryingOperation, Sn as listKeys, St as createKey, T as SINCE_VALUE_HELP, Tn as listRepeatingSends, Tt as createWakeSchedule, U as formatRepliesCell, Un as revokeCredential, Ut as getDefaultNetworkAgent, V as ensureSearchReportsReplyState, Vn as replyToEmail, Vt as getConversation, W as hasReplyState, Wn as rotateKey, Wt as getEmail, Xn as sendEmail, Xt as getMemory, Yn as semanticSearch, Yt as getKey, Zn as setFunctionRoute, Zt as getOrgRoutingTopology, _ as backoffDelay, _n as listEmails, _t as checkSendability, a as REPEAT_IDLE_MAX_MINUTES, ar as testFunction, at as AutomatedFilterUnsupportedError, b as pauseForTransientFailure, bn as listFunctions, bt as createEndpoint, cr as updateFunction, d as parseRepeatTick, dr as updateRoute, dt as hasAutomatedVerdict, en as getRepeatingSend, er as simulateRoute, et as parseWebhookEvent, f as preparePresenceAliveEmail, fn as listDefaultNetworkAgents, fr as updateWakeAuthorization, ft as isAutomatedRejectedError, g as WaitDeadlineReached, gn as listEmailRuleResults, gr as whoami, gt as checkDefaultNetworkContactAdmission, hn as listEmailAttachmentArchiveMembers, hr as verifyAgentSignup, ht as cancelSentEmailByIdempotencyKey, i as REPEAT_EVERY_MAX_MINUTES, in as getWakeSchedule, ir as stopRepeatFromEmail, it as AUTOMATED_VALUES, j as lateMailReread, jn as listWakeDispatches, jt as deleteWakeSchedule, k as fetchEmailSearchPage, kn as listSentEmails, kt as deleteRoute, l as parseInteractionEnvelope, ln as listAgentContacts, lr as updateKey, m as repeatStopCommand, mn as listDomains, mr as verifyAgentClaim, mt as cancelSentEmail, nn as getSentEmail, nr as startAgentSignup, nt as AUTOMATED_FILTER_UNSUPPORTED_CODE, o as REPEAT_MAX_SENDS_MAX, on as leaveOrganization, or as unsetFunctionRoute, ot as assertAutomatedVerdict, p as prepareSignalEmail, pn as listDefaultNetworkMembers, pr as updateWakeSchedule, pt as addDefaultNetworkMember, qn as searchEmails, qt as getFunctionTestRunTrace, rn as getThread, rr as startCliLogin, rt as AUTOMATED_FLAG_DESCRIPTION, s as buildRepeatStopBody, sn as listActivityObjects, sr as updateDefaultNetworkMember, st as automatedRejectedError, tn as getSendFrom, tr as startAgentClaim, tt as parseFromHeader, u as parsePresenceEnvelope, un as listAgentNetworks, ur as updateRepeatingSend, v as describeApiFailure, vn as listEndpoints, vt as cliLogout, w as waitOutRetryAfter, wn as listOrganizationPeople, wt as createWakeAuthorization, x as retryTransient, xn as listGroups, xt as createFunction, yn as listFunctionLogs, yt as completeWebhookEvent, z as assertAwaitingFilterRows, zn as removeDefaultNetworkMember, zt as getAgentContactPolicy } from "../repeats-Dj_o6c-X-C1y88ZwJ.js";
+import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-B64Lgv6Z.js";
 import { A as AGENT_ADDRESS_ENV, C as saveCliCredentials, D as loadActiveChatState, E as deleteChatState, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadChatConversationByLocalId, P as agentProfileName, R as loadConnectedAgentProfile, S as resolveCliAuth, T as chatStatePath, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as loadCliCredentials, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as saveActiveChatState, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveSignupCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-Ms_0vNjq.js";
 import { C as resolveListenSubscription, S as normalizeListenOrigin, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, y as listenIdentity } from "../shared-mail-files-BAQSGxxz.js";
-import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-BMr-zPLx.js";
-import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-DVSsLSRw.js";
+import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-DyGP7wDs.js";
+import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-CocomDwR.js";
 import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, readWorkingLease, restoreAutoWorking } from "./auto-signals.js";
-import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-gpH2AhIi.js";
+import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-lJM0763f.js";
 import { a as thrownErrorBody, i as runStreamingJson, n as guardJsonOutputCommands, r as jsonOutputRequested, t as JSON_OUTPUT_FLAG } from "../json-output-ch756TXV.js";
 import { a as backgroundListenStatus, c as runBackgroundListen, d as stopBackgroundListen, f as verifyBackgroundListenTarget, o as backgroundListenToken, r as backgroundListenConfiguration, u as startBackgroundListen } from "../listen-background-DyBYca28.js";
 import { ORG_SELECTION_ENV } from "./global-org-flag.js";
@@ -184,6 +184,11 @@ const openapiDocument = {
 			"description": "Organization administration for people: your own connected apps and CLI logins, the organization's connected apps, its name and logo, and semantic search consent. API keys, agent connection keys and agents are refused. Billing and deleting the organization are done in the dashboard only.",
 			"x-openapi-spec": "https://api.primitive.dev/v1/openapi/tags/organization-settings"
 		},
+		{
+			"name": "Email notifications",
+			"description": "The notification emails Primitive sends an organization's members: the organization chooses, per kind, whether it is off, left to each member or required, and each member chooses where it is left to them. Some kinds are always sent. API keys, agent connection keys and agents are refused.",
+			"x-openapi-spec": "https://api.primitive.dev/v1/openapi/tags/email-notifications"
+		},
 		{
 			"name": "Roles and members",
 			"description": "Roles, member roles and removal, the mailbox access mode, break-glass, transfers and suspensions. Reads are open to people; every write is person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up. API keys never reach these. Answers 404 feature_disabled while the feature is not enabled for the organization, with details.feature naming the feature; contact Primitive to turn it on.",
@@ -221,7 +226,7 @@ const openapiDocument = {
 		},
 		{
 			"name": "Email Rule Oversight",
-			"description": "The email rules that reach your own mailboxes, whoever wrote them, read-only, and your objections to them: asking a rule's author to turn it off. The organization needs the email rules feature, and the caller must be a member with mail:read on their own dashboard session or the Primitive CLI, not narrowed.",
+			"description": "The email rules that reach your own mailboxes, whoever wrote them, read-only, and your objections to them: asking a rule's author to turn it off, narrow it or explain it. The organization needs the email rules feature, and the caller must be a member with mail:read on their own dashboard session or the Primitive CLI, not narrowed.",
 			"x-openapi-spec": "https://api.primitive.dev/v1/openapi/tags/email-rule-oversight"
 		},
 		{
@@ -21774,7 +21779,7 @@ const openapiDocument = {
 		"/activity/objects": { "get": {
 			"operationId": "listActivityObjects",
 			"summary": "List what you created, or what you were asked",
-			"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules, rule requests and objections to rules over their mail (objections only on the dashboard or the Primitive CLI). Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, and the objections to rules they wrote, under their current membership, each naming the member who asked or objected in created_through. A key, an app or an agent has none, and gets both kinds in withheld. With relation=concerning it lists instead what other members did that concerns the person's own mail: each time a rule started covering one of their mailboxes or saved a new version while covering it, named as the rule was then, naming its author in created_through, under their current membership; only on the dashboard or the Primitive CLI. A key, an app or an agent has none, and gets email_rule_coverage in withheld. A notice never reads as ended. Notices are written by a periodic job and can lag: until the notices record a rule starting to cover you, the first page lists that rule as pending (pending_complete says whether that check finished), and as_of says about when the notices last looked. For what covers you now, read GET /email-rules/covering-me.",
+			"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules, rule requests and objections to rules over their mail (objections only on the dashboard or the Primitive CLI). Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, and the objections to rules they wrote, under their current membership, each naming the member who asked or objected in created_through. A key, an app or an agent has none, and gets both kinds in withheld. With relation=concerning it lists instead what other members did that concerns the person's own mail: each time a rule started covering one of their mailboxes, saved a new version, or changed who receives its matches while covering it, named as the rule was then, naming its author in created_through, under their current membership; only on the dashboard or the Primitive CLI. A key, an app or an agent has none, and gets email_rule_coverage in withheld. A notice never reads as ended. Notices are written by a periodic job and can lag: until the notices record a rule starting to cover you, the first page lists that rule as pending (pending_complete says whether that check finished), and as_of says about when the notices last looked. For what covers you now, read GET /email-rules/covering-me.",
 			"tags": ["Activity"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [
@@ -21785,7 +21790,7 @@ const openapiDocument = {
 					"description": "created (the default), asked or concerning.",
 					"schema": {
 						"default": "created",
-						"description": "created (the default): what you created. asked: what other members asked of you, open or answered: rule requests made to you, and objections to rules you wrote; kind may then name only email_rule_request and email_rule_objection. concerning: what other members did that concerns your own mail: an active rule that started covering one of your mailboxes, or saved a new version while covering it (email_rule_coverage, the only kind it takes). A rule in draft or observe is not told of; GET /v1/email-rules/covering-me lists it. asked and concerning are for a person's own view only.",
+						"description": "created (the default): what you created. asked: what other members asked of you, open or answered: rule requests made to you, and objections to rules you wrote; kind may then name only email_rule_request and email_rule_objection. concerning: what other members did that concerns your own mail: an active rule that started covering one of your mailboxes, saved a new version, or changed who receives its matches while covering it (email_rule_coverage, the only kind it takes). A rule in draft or observe is not told of; GET /v1/email-rules/covering-me lists it. asked and concerning are for a person's own view only.",
 						"type": "string",
 						"enum": [
 							"created",
@@ -22112,7 +22117,7 @@ const openapiDocument = {
 		"/email-rules/test": { "post": {
 			"operationId": "testEmailRule",
 			"summary": "Test a rule against received mail",
-			"description": "Runs a rule over received mail and reports what it would decide for each email (matched, near_miss, no_match, unclassified, skipped or not_found), with a summary of how each top-level condition and question decided. Test an unsaved tree, or a saved rule by rule_id (its current version, as its author). It reads only mail its author can read and its scope covers. A rule you see only because it covers your own mailboxes runs as you, over only those, from the dashboard or the Primitive CLI. Without email_ids it tests the newest emails, at most 200 and none older than 30 days, plus any expected ones. Unclassified emails over 2 hours old are classified first unless classify_missing is false. It records no decision and grants nothing, and stops at about 90 seconds. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
+			"description": "Runs a rule over received mail and reports what it would decide for each email (matched, near_miss, no_match, unclassified, skipped or not_found), with a summary of how each top-level condition and question decided. Test an unsaved tree, a saved rule by rule_id (its current version, as its author), or a pending rule request by request_id (its rule as asked, as you, over your own mailboxes). It reads only mail its author can read and its scope covers. A rule you see only because it covers your own mailboxes runs as you, over only those, from the dashboard or the Primitive CLI. Without email_ids it tests the newest emails, at most 200 and none older than 30 days, plus any expected ones. Unclassified emails over 2 hours old are classified first unless classify_missing is false. It records no decision and grants nothing, and stops at about 90 seconds. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"requestBody": {
@@ -22135,7 +22140,7 @@ const openapiDocument = {
 					}
 				},
 				"400": {
-					"description": "validation_error: give exactly one of tree and rule_id, at most 200 email_ids (with the expected emails), 1 to 100 expected emails none in both lists (or only expect.samples, up to 20), and a tree that is valid for the column contract. evaluation_scope, scope_selection and kind go only with tree. A saved rule whose current version no longer renders answers details.reason version_not_renderable; email_ids that with its saved expectations name over 200 emails, too_many_emails.",
+					"description": "validation_error: give exactly one of tree, rule_id and request_id, at most 200 email_ids (with the expected emails), 1 to 100 expected emails none in both lists (or only expect.samples, up to 20), and a tree that is valid for the column contract. evaluation_scope, scope_selection and kind go only with tree. A saved rule's current version or a request's rule that no longer renders answers details.reason version_not_renderable; email_ids that with its saved expectations name over 200 emails, too_many_emails.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"401": {
@@ -22162,11 +22167,11 @@ const openapiDocument = {
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
-					"description": "not_found: rule_id names no rule you can see or that covers your mailboxes (details.reason rule_not_found).",
+					"description": "not_found: rule_id names no rule you can see or that covers your mailboxes (details.reason rule_not_found), or request_id no rule request you can see (request_not_found).",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"409": {
-					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree or a rule covering you, the caller). details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox, no_shareable_mailbox or no_selected_mailbox.",
+					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree, a request or a rule covering you, the caller). details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox, no_shareable_mailbox or no_selected_mailbox. email_rule_request_not_pending: request_id names a request already decided.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -22314,7 +22319,7 @@ const openapiDocument = {
 		"/email-rules/test-sample": { "post": {
 			"operationId": "testEmailRuleOnSample",
 			"summary": "Test a rule against a made-up email",
-			"description": "Reports what a rule would decide for an email you describe (sender, recipients, subject, plain text, attachment types and file names; optionally automated, from a mailing list, and a spam score), classified and decided as received mail would be. A rule reading a spam score you gave none for decides on none (unset_columns). Nothing is stored. Test an unsaved tree or a saved rule by rule_id. The answer includes what the classifier read. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
+			"description": "Reports what a rule would decide for an email you describe (sender, recipients, subject, plain text, attachment types and file names; optionally automated, from a mailing list, and a spam score), classified and decided as received mail would be. A rule reading a spam score you gave none for decides on none (unset_columns). Nothing is stored. Test an unsaved tree, a saved rule by rule_id, or a pending rule request by request_id (its rule as asked, as you). The answer includes what the classifier read. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"requestBody": {
@@ -22337,7 +22342,7 @@ const openapiDocument = {
 					}
 				},
 				"400": {
-					"description": "validation_error: give exactly one of tree and rule_id (evaluation_scope, scope_selection and kind only with tree), an email with a sender, 1 to 50 To addresses (and up to 50 Cc), and a text body, and a tree that is valid for the column contract and within the size limits for a saved rule. A saved rule whose current version no longer renders answers details.reason version_not_renderable.",
+					"description": "validation_error: give exactly one of tree, rule_id and request_id (evaluation_scope, scope_selection and kind only with tree), an email with a sender, 1 to 50 To addresses (and up to 50 Cc), and a text body, and a tree that is valid for the column contract and within the size limits for a saved rule. A saved rule's current version or a request's rule that no longer renders answers details.reason version_not_renderable. With with_protection: not_a_grant_rule, or protection_mailbox_outside_rule when the rule does not run over the first recipient.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"401": {
@@ -22360,15 +22365,15 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. email_rule_scope_not_readable: scope_selection names something you cannot read. forbidden with details.reason covering_view_only: you read this rule only in the covering view, since it decided on your mail before and covers none of your mailboxes now (details.covering_view).",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. email_rule_scope_not_readable: scope_selection names something you cannot read. forbidden with details.reason covering_view_only: you read this rule only in the covering view, since it decided on your mail before and covers none of your mailboxes now (details.covering_view). grant_forbidden protection_mailbox_not_read: with_protection at a mailbox you do not read in full.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
-					"description": "not_found: rule_id names no rule you can see or that covers your mailboxes (details.reason rule_not_found).",
+					"description": "not_found: rule_id names no rule you can see or that covers your mailboxes (details.reason rule_not_found), or request_id no rule request you can see (request_not_found).",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"409": {
-					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree or a rule covering you, you), so it would decide nothing for real. details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox, no_shareable_mailbox or no_selected_mailbox.",
+					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree, a request or a rule covering you, you), so it would decide nothing for real. details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox, no_shareable_mailbox or no_selected_mailbox. email_rule_request_not_pending: request_id names a request already decided.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -22393,6 +22398,10 @@ const openapiDocument = {
 							}
 						}
 					} }
+				},
+				"503": {
+					"description": "service_unavailable: with_protection could not read the do-not-share rules in time (protection_unavailable), or its limit could not be checked (protection_limit_unavailable).",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				}
 			},
 			"x-primitive-permission": ["mail:read"],
@@ -23497,7 +23506,7 @@ const openapiDocument = {
 			"post": {
 				"operationId": "createEmailRuleRequest",
 				"summary": "Ask a member for a rule",
-				"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated or shared until they accept, and they may change the rule first. A message (up to 500 characters, fixed once sent) tells them why you ask. At most 5 pending requests to one member and 50 in all. With members:read the answer says whether they can accept it under their role (target_can_accept, target_warning); POST /v1/email-rule-requests/target-check checks first. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
+				"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated or shared until they accept, and they may change the rule first. A message (up to 500 characters, fixed once sent) tells them why you ask. With an Idempotency-Key, asking again for exactly what a pending request of yours to the same member asks (name, english, tree, explanation and message, naming them the same way) returns that request with existing: true (200), so a retry never asks them twice. At most 5 pending requests to one member and 50 in all. With members:read the answer says whether they can accept it under their role (target_can_accept, target_warning); POST /v1/email-rule-requests/target-check checks first. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"requestBody": {
@@ -23505,6 +23514,20 @@ const openapiDocument = {
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateEmailRuleRequestRequest" } } }
 				},
 				"responses": {
+					"200": {
+						"description": "The pending request this create matched (existing: true): no second one was made.",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"required": ["data"],
+							"properties": { "data": { "$ref": "#/components/schemas/CreateEmailRuleRequestResult" } }
+						}] } } },
+						"headers": {
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+						}
+					},
 					"201": {
 						"description": "Ask a member for a rule",
 						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
@@ -23576,18 +23599,18 @@ const openapiDocument = {
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					}
 				},
-				"x-primitive-permission": ["mail:read"],
 				"parameters": [{
 					"name": "Idempotency-Key",
 					"in": "header",
 					"required": false,
-					"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+					"description": "Optional. With a key, a create identical to a pending request of yours to the same member (name, english, tree, explanation and message, naming the member the same way) returns that request with existing: true (200) instead of making a second one. The key itself is not stored, so any key does this, and a create without one is never matched to an existing request. A key that is empty, longer than 255 characters or not printable ASCII is refused with 400 `validation_error`; a valid one is echoed in the Idempotency-Key response header.",
 					"schema": {
 						"type": "string",
 						"minLength": 1,
 						"maxLength": 255
 					}
-				}]
+				}],
+				"x-primitive-permission": ["mail:read"]
 			},
 			"get": {
 				"operationId": "listEmailRuleRequests",
@@ -24858,7 +24881,7 @@ const openapiDocument = {
 		"/email-rules/covering-me": { "get": {
 			"operationId": "listEmailRulesCoveringMe",
 			"summary": "List the rules over your mail",
-			"description": "Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+			"description": "Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. For what happened to one email of yours, every rule's decision on it and, for another member's rule covering you, who receives what it shares: GET /v1/emails/{id}/rule-results (primitive email-rules list-email-rule-results --email-id <email-id>). Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -24956,7 +24979,7 @@ const openapiDocument = {
 		"/email-rules/covering-me/{id}": { "get": {
 			"operationId": "getEmailRuleCoveringMe",
 			"summary": "Get a rule over your mail",
-			"description": "One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+			"description": "One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. For what happened to one email of yours, every rule's decision on it and, for another member's rule covering you, who receives what it shares: GET /v1/emails/{id}/rule-results (primitive email-rules list-email-rule-results --email-id <email-id>). Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -25008,7 +25031,7 @@ const openapiDocument = {
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
-					"description": "not_found: no rule with this id covers your mailboxes or decided on your mail.",
+					"description": "not_found: no rule with this id covers your mailboxes or decided on your mail; details.reason rule_deleted (with details.rule_name) for one deleted after you were told it covered you.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -25134,7 +25157,7 @@ const openapiDocument = {
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
-					"description": "not_found: no rule with this id covers your mailboxes or decided on your mail.",
+					"description": "not_found: no rule with this id covers your mailboxes or decided on your mail; details.reason rule_deleted (with details.rule_name) for one deleted after you were told it covered you.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -25262,7 +25285,7 @@ const openapiDocument = {
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
-					"description": "not_found: no rule with this id covers your mailboxes or decided on your mail.",
+					"description": "not_found: no rule with this id covers your mailboxes or decided on your mail; details.reason rule_deleted (with details.rule_name) for one deleted after you were told it covered you.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -25295,7 +25318,7 @@ const openapiDocument = {
 			"post": {
 				"operationId": "createEmailRuleObjection",
 				"summary": "Object to a rule over your mail",
-				"description": "Asks the author of a rule that covers one of your own mailboxes now to turn it off. Only a rule that covers you now: one you see only because it once decided on your mail cannot be objected to. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. You may have one pending objection per rule and 50 in all, and object to the same rule again only 10 minutes after you last did, whatever became of it. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+				"description": "Objects to a rule that covers one of your own mailboxes now: say in the message what you ask its author, to turn it off, narrow it, or explain who receives what it matches. The author answers by accepting, which turns it off, or by declining, optionally with a reason you see; the rule keeps running unless they accept. Only a rule that covers you now: one you see only because it once decided on your mail cannot be objected to. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it (optionally with a reason the objector sees), or the member who made it withdraws it, which clears its message. It never changes after that. You may have one pending objection per rule and 50 in all, and object to the same rule again only 10 minutes after you last did, whatever became of it. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 				"tags": ["Email Rule Oversight"],
 				"security": [{ "BearerAuth": [] }],
 				"requestBody": {
@@ -25396,7 +25419,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "listEmailRuleObjections",
 				"summary": "List objections",
-				"description": "Objections you made and objections to rules you wrote (by default), only one of the two, or every objection you can see, newest first. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+				"description": "Objections you made and objections to rules you wrote (by default), only one of the two, or every objection you can see, newest first. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it (optionally with a reason the objector sees), or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 				"tags": ["Email Rule Oversight"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [
@@ -25530,7 +25553,7 @@ const openapiDocument = {
 		"/email-rule-objections/{id}": { "get": {
 			"operationId": "getEmailRuleObjection",
 			"summary": "Get an objection",
-			"description": "One objection you can see. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+			"description": "One objection you can see. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it (optionally with a reason the objector sees), or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -25712,7 +25735,7 @@ const openapiDocument = {
 		"/email-rule-objections/{id}/decline": { "post": {
 			"operationId": "declineEmailRuleObjection",
 			"summary": "Decline an objection to your rule",
-			"description": "Declines a pending objection to a rule you wrote, optionally saying why; the rule stays as it is. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+			"description": "Declines a pending objection to a rule you wrote, optionally saying why (reason), which the member who objected sees; the rule stays as it is. When its message asks you to narrow the rule or explain who receives it, the reason is your answer; narrow it with a new version as well if you agree. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -34798,7 +34821,7 @@ const openapiDocument = {
 			"summary": "Rotate an API key",
 			"tags": ["Credentials"],
 			"security": [{ "BearerAuth": [] }],
-			"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Revoking the successor during the overlap also revokes the old key when you may revoke that one too; the revoke's predecessors_left counts any left working. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+			"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once, with its name and grant so you can see they carried over. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Revoking the successor during the overlap also revokes the old key when you may revoke that one too; the revoke's predecessors_left counts any left working. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 			"x-primitive-person-only": {
 				"access": "step_up",
 				"step_up_purpose": "keys.create",
@@ -36033,7 +36056,7 @@ const openapiDocument = {
 					"name": "Primitive-Step-Up",
 					"in": "header",
 					"required": false,
-					"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo or semantic search setting), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
+					"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo, semantic search setting or email notification settings), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
 					"schema": {
 						"type": "string",
 						"pattern": "^pstep_[0-9a-f]{64}$"
@@ -36184,7 +36207,7 @@ const openapiDocument = {
 					"name": "Primitive-Step-Up",
 					"in": "header",
 					"required": false,
-					"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo or semantic search setting), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
+					"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo, semantic search setting or email notification settings), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
 					"schema": {
 						"type": "string",
 						"pattern": "^pstep_[0-9a-f]{64}$"
@@ -36333,7 +36356,7 @@ const openapiDocument = {
 					"name": "Primitive-Step-Up",
 					"in": "header",
 					"required": false,
-					"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo or semantic search setting), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
+					"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo, semantic search setting or email notification settings), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
 					"schema": {
 						"type": "string",
 						"pattern": "^pstep_[0-9a-f]{64}$"
@@ -36444,34 +36467,548 @@ const openapiDocument = {
 								}
 							}
 						} }
-					},
-					"502": {
-						"description": "upstream_unavailable: the organization profile could not be reached, or (after a write) the change was saved but could not be read back. Retryable for a read; read the profile again before repeating a write.",
-						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
-					},
-					"503": {
-						"description": "upstream_unavailable: the organization profile is temporarily unavailable. Retry-After says when to retry.",
-						"headers": { "Retry-After": {
-							"description": "Seconds to wait before retrying.",
-							"schema": {
-								"type": "integer",
-								"minimum": 1
-							}
-						} },
-						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"502": {
+						"description": "upstream_unavailable: the organization profile could not be reached, or (after a write) the change was saved but could not be read back. Retryable for a read; read the profile again before repeating a write.",
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					},
+					"503": {
+						"description": "upstream_unavailable: the organization profile is temporarily unavailable. Retry-After says when to retry.",
+						"headers": { "Retry-After": {
+							"description": "Seconds to wait before retrying.",
+							"schema": {
+								"type": "integer",
+								"minimum": 1
+							}
+						} },
+						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+					}
+				},
+				"x-primitive-permission": ["org:manage"],
+				"x-primitive-permission-alternatives": [["members:manage"]]
+			}
+		},
+		"/search-settings": {
+			"get": {
+				"operationId": "getSearchSettings",
+				"summary": "Get the semantic search setting",
+				"tags": ["Organization settings"],
+				"security": [{ "BearerAuth": [] }],
+				"description": "Whether the organization consents to semantic search, and whether it is active: it also needs a paid plan, the feature to be available to the organization, and HIPAA mode off.\n\nPerson only: a dashboard session or the person's own OAuth token (the CLI or an app they connected). API keys, agent connection keys and agents are refused.",
+				"x-primitive-person-only": { "access": "person" },
+				"parameters": [],
+				"responses": {
+					"200": {
+						"description": "Success",
+						"content": { "application/json": { "schema": {
+							"type": "object",
+							"required": ["success", "data"],
+							"properties": {
+								"success": {
+									"type": "boolean",
+									"const": true
+								},
+								"data": { "$ref": "#/components/schemas/OrgSettings_getSearchSettings_Result" }
+							}
+						} } },
+						"headers": {
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+						}
+					},
+					"400": {
+						"description": "Invalid request parameters",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "validation_error",
+									"message": "Invalid domain format"
+								}
+							}
+						} }
+					},
+					"401": {
+						"description": "Invalid or missing API key",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "unauthorized",
+									"message": "Invalid or missing API key"
+								}
+							}
+						} },
+						"headers": {
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+						}
+					},
+					"403": {
+						"description": "Authenticated caller lacks permission for the operation",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "forbidden",
+									"message": "Insufficient permissions"
+								}
+							}
+						} }
+					},
+					"404": {
+						"description": "Resource not found",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "not_found",
+									"message": "Resource not found"
+								}
+							}
+						} }
+					},
+					"429": {
+						"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+						"headers": {
+							"Retry-After": {
+								"schema": { "type": "integer" },
+								"description": "Seconds to wait before retrying"
+							},
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+						},
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "rate_limit_exceeded",
+									"message": "Rate limit exceeded"
+								}
+							}
+						} }
+					}
+				},
+				"x-primitive-permission": ["org:read"]
+			},
+			"put": {
+				"operationId": "updateSearchSettings",
+				"summary": "Change the semantic search setting",
+				"tags": ["Organization settings"],
+				"security": [{ "BearerAuth": [] }],
+				"description": "Consent to, or withdraw consent from, semantic search. Consenting sends the organization's mail content to an embedding provider, so it is a person's decision. Turning it on is refused with 409 under HIPAA mode (hipaa_mode), without a paid plan (plan_required) or while it is not available to the organization (not_available). Turning it off is always allowed.\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `org_settings.write` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold search_settings:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+				"x-primitive-person-only": {
+					"access": "step_up",
+					"step_up_purpose": "org_settings.write"
+				},
+				"parameters": [{
+					"name": "Primitive-Step-Up",
+					"in": "header",
+					"required": false,
+					"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo, semantic search setting or email notification settings), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
+					"schema": {
+						"type": "string",
+						"pattern": "^pstep_[0-9a-f]{64}$"
+					}
+				}],
+				"responses": {
+					"200": {
+						"description": "Success",
+						"content": { "application/json": { "schema": {
+							"type": "object",
+							"required": ["success", "data"],
+							"properties": {
+								"success": {
+									"type": "boolean",
+									"const": true
+								},
+								"data": { "$ref": "#/components/schemas/OrgSettings_updateSearchSettings_Result" }
+							}
+						} } },
+						"headers": {
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+						}
+					},
+					"400": {
+						"description": "Invalid request parameters",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "validation_error",
+									"message": "Invalid domain format"
+								}
+							}
+						} }
+					},
+					"401": {
+						"description": "Invalid or missing API key",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "unauthorized",
+									"message": "Invalid or missing API key"
+								}
+							}
+						} },
+						"headers": {
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+						}
+					},
+					"403": {
+						"description": "Authenticated caller lacks permission for the operation",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "forbidden",
+									"message": "Insufficient permissions"
+								}
+							}
+						} }
+					},
+					"404": {
+						"description": "Resource not found",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "not_found",
+									"message": "Resource not found"
+								}
+							}
+						} }
+					},
+					"409": {
+						"description": "The request conflicts with the current state of the resource",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "conflict",
+									"message": "The request conflicts with the current state of the resource"
+								}
+							}
+						} }
+					},
+					"429": {
+						"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+						"headers": {
+							"Retry-After": {
+								"schema": { "type": "integer" },
+								"description": "Seconds to wait before retrying"
+							},
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+						},
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "rate_limit_exceeded",
+									"message": "Rate limit exceeded"
+								}
+							}
+						} }
+					}
+				},
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/OrgSettings_updateSearchSettings_Input" } } }
+				},
+				"x-primitive-permission": ["search_settings:manage"]
+			}
+		},
+		"/email-notification-settings": {
+			"get": {
+				"operationId": "getEmailNotificationSettings",
+				"summary": "Get the organization's email notification settings",
+				"tags": ["Email notifications"],
+				"security": [{ "BearerAuth": [] }],
+				"description": "Every kind of notification email Primitive sends the organization's members, and who may turn it off. Each kind lists its label and description, its class, whether it needs an entitlement and whether the organization has it, the organization's mode (null for platform_required) and the modes it may choose, and whether the calling member gets it and may change that.\n\nPerson only: a dashboard session or the person's own OAuth token (the CLI or an app they connected). API keys, agent connection keys and agents are refused.",
+				"x-primitive-person-only": { "access": "person" },
+				"parameters": [],
+				"responses": {
+					"200": {
+						"description": "Success",
+						"content": { "application/json": { "schema": {
+							"type": "object",
+							"required": ["success", "data"],
+							"properties": {
+								"success": {
+									"type": "boolean",
+									"const": true
+								},
+								"data": { "$ref": "#/components/schemas/EmailNotifications_getEmailNotificationSettings_Result" }
+							}
+						} } },
+						"headers": {
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+						}
+					},
+					"400": {
+						"description": "Invalid request parameters",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "validation_error",
+									"message": "Invalid domain format"
+								}
+							}
+						} }
+					},
+					"401": {
+						"description": "Invalid or missing API key",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "unauthorized",
+									"message": "Invalid or missing API key"
+								}
+							}
+						} },
+						"headers": {
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+						}
+					},
+					"403": {
+						"description": "Authenticated caller lacks permission for the operation",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "forbidden",
+									"message": "Insufficient permissions"
+								}
+							}
+						} }
+					},
+					"404": {
+						"description": "Resource not found",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "not_found",
+									"message": "Resource not found"
+								}
+							}
+						} }
+					},
+					"429": {
+						"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+						"headers": {
+							"Retry-After": {
+								"schema": { "type": "integer" },
+								"description": "Seconds to wait before retrying"
+							},
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+						},
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "rate_limit_exceeded",
+									"message": "Rate limit exceeded"
+								}
+							}
+						} }
+					}
+				},
+				"x-primitive-permission": ["org:read"]
+			},
+			"put": {
+				"operationId": "updateEmailNotificationSettings",
+				"summary": "Change the organization's email notification settings",
+				"tags": ["Email notifications"],
+				"security": [{ "BearerAuth": [] }],
+				"description": "Set the organization's mode for one or more kinds: off (nobody gets it), optional_on (each member gets it unless they turn it off), optional_off (only members who turn it on get it) or required (every member gets it). Kinds left out keep their mode. An unknown kind is refused with 400 (validation_error, details.reason unknown_kind). A platform_required kind is refused with 409 (conflict, details.reason platform_required), and required for an optional kind with 409 (conflict, details.reason mode_not_allowed); nothing is changed. Answers the settings as they now stand. Each kind lists its label and description, its class, whether it needs an entitlement and whether the organization has it, the organization's mode (null for platform_required) and the modes it may choose, and whether the calling member gets it and may change that.\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `org_settings.write` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold notification_policy:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+				"x-primitive-person-only": {
+					"access": "step_up",
+					"step_up_purpose": "org_settings.write"
+				},
+				"parameters": [{
+					"name": "Primitive-Step-Up",
+					"in": "header",
+					"required": false,
+					"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo, semantic search setting or email notification settings), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
+					"schema": {
+						"type": "string",
+						"pattern": "^pstep_[0-9a-f]{64}$"
+					}
+				}],
+				"responses": {
+					"200": {
+						"description": "Success",
+						"content": { "application/json": { "schema": {
+							"type": "object",
+							"required": ["success", "data"],
+							"properties": {
+								"success": {
+									"type": "boolean",
+									"const": true
+								},
+								"data": { "$ref": "#/components/schemas/EmailNotifications_updateEmailNotificationSettings_Result" }
+							}
+						} } },
+						"headers": {
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+						}
+					},
+					"400": {
+						"description": "Invalid request parameters",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "validation_error",
+									"message": "Invalid domain format"
+								}
+							}
+						} }
+					},
+					"401": {
+						"description": "Invalid or missing API key",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "unauthorized",
+									"message": "Invalid or missing API key"
+								}
+							}
+						} },
+						"headers": {
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-unauthenticated" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-unauthenticated" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset-unauthenticated" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-unauthenticated" }
+						}
+					},
+					"403": {
+						"description": "Authenticated caller lacks permission for the operation",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "forbidden",
+									"message": "Insufficient permissions"
+								}
+							}
+						} }
+					},
+					"404": {
+						"description": "Resource not found",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "not_found",
+									"message": "Resource not found"
+								}
+							}
+						} }
+					},
+					"409": {
+						"description": "The request conflicts with the current state of the resource",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "conflict",
+									"message": "The request conflicts with the current state of the resource"
+								}
+							}
+						} }
+					},
+					"429": {
+						"description": "Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.",
+						"headers": {
+							"Retry-After": {
+								"schema": { "type": "integer" },
+								"description": "Seconds to wait before retrying"
+							},
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit-429" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining-429" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy-429" }
+						},
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "rate_limit_exceeded",
+									"message": "Rate limit exceeded"
+								}
+							}
+						} }
 					}
 				},
-				"x-primitive-permission": ["org:manage"],
-				"x-primitive-permission-alternatives": [["members:manage"]]
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailNotifications_updateEmailNotificationSettings_Input" } } }
+				},
+				"x-primitive-permission": ["notification_policy:manage"]
 			}
 		},
-		"/search-settings": {
+		"/email-notification-preferences": {
 			"get": {
-				"operationId": "getSearchSettings",
-				"summary": "Get the semantic search setting",
-				"tags": ["Organization settings"],
+				"operationId": "getEmailNotificationPreferences",
+				"summary": "Get my email notification preferences",
+				"tags": ["Email notifications"],
 				"security": [{ "BearerAuth": [] }],
-				"description": "Whether the organization consents to semantic search, and whether it is active: it also needs a paid plan, the feature to be available to the organization, and HIPAA mode off.\n\nPerson only: a dashboard session or the person's own OAuth token (the CLI or an app they connected). API keys, agent connection keys and agents are refused.",
+				"description": "The notification emails the calling member gets, and which of them they may turn on or off. Each kind lists its label and description, its class, whether it needs an entitlement and whether the organization has it, the organization's mode (null for platform_required) and the modes it may choose, and whether the calling member gets it and may change that.\n\nPerson only: a dashboard session or the person's own OAuth token (the CLI or an app they connected). The person's role must hold notifications:manage. API keys, agent connection keys and agents are refused.",
 				"x-primitive-person-only": { "access": "person" },
 				"parameters": [],
 				"responses": {
@@ -36485,7 +37022,7 @@ const openapiDocument = {
 									"type": "boolean",
 									"const": true
 								},
-								"data": { "$ref": "#/components/schemas/OrgSettings_getSearchSettings_Result" }
+								"data": { "$ref": "#/components/schemas/EmailNotifications_getEmailNotificationPreferences_Result" }
 							}
 						} } },
 						"headers": {
@@ -36577,28 +37114,16 @@ const openapiDocument = {
 						} }
 					}
 				},
-				"x-primitive-permission": ["org:read"]
+				"x-primitive-permission": ["notifications:manage"]
 			},
 			"put": {
-				"operationId": "updateSearchSettings",
-				"summary": "Change the semantic search setting",
-				"tags": ["Organization settings"],
+				"operationId": "updateEmailNotificationPreferences",
+				"summary": "Change my email notification preferences",
+				"tags": ["Email notifications"],
 				"security": [{ "BearerAuth": [] }],
-				"description": "Consent to, or withdraw consent from, semantic search. Consenting sends the organization's mail content to an embedding provider, so it is a person's decision. Turning it on is refused with 409 under HIPAA mode (hipaa_mode), without a paid plan (plan_required) or while it is not available to the organization (not_available). Turning it off is always allowed.\n\nPerson only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `org_settings.write` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold search_settings:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
-				"x-primitive-person-only": {
-					"access": "step_up",
-					"step_up_purpose": "org_settings.write"
-				},
-				"parameters": [{
-					"name": "Primitive-Step-Up",
-					"in": "header",
-					"required": false,
-					"description": "A single-use step-up token of purpose `org_settings.write` (Change the organization name, logo or semantic search setting), valid 5 minutes. When this operation answers 403 `step_up_required`, the person confirms at the link in `details.step_up_url` and the request is retried with the token that page shows, in this header. Accepted only with the person's own OAuth token of the client it was confirmed for; refused with a token issued for MCP, with any API key or agent connection key, and with a dashboard session.",
-					"schema": {
-						"type": "string",
-						"pattern": "^pstep_[0-9a-f]{64}$"
-					}
-				}],
+				"description": "Turn one or more kinds on or off for the calling member. Only a kind whose organization mode is optional_on or optional_off can be changed: a platform_required kind, one the organization requires, and one it turned off are refused with 409 (conflict, details.reason not_member_choice, details.org_mode saying which), and nothing is changed. An unknown kind is refused with 400. Answers the preferences as they now stand. Each kind lists its label and description, its class, whether it needs an entitlement and whether the organization has it, the organization's mode (null for platform_required) and the modes it may choose, and whether the calling member gets it and may change that.\n\nPerson only: a dashboard session or the person's own OAuth token (the CLI or an app they connected). The person's role must hold notifications:manage. API keys, agent connection keys and agents are refused.",
+				"x-primitive-person-only": { "access": "person" },
+				"parameters": [],
 				"responses": {
 					"200": {
 						"description": "Success",
@@ -36610,7 +37135,7 @@ const openapiDocument = {
 									"type": "boolean",
 									"const": true
 								},
-								"data": { "$ref": "#/components/schemas/OrgSettings_updateSearchSettings_Result" }
+								"data": { "$ref": "#/components/schemas/EmailNotifications_updateEmailNotificationPreferences_Result" }
 							}
 						} } },
 						"headers": {
@@ -36717,9 +37242,9 @@ const openapiDocument = {
 				},
 				"requestBody": {
 					"required": true,
-					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/OrgSettings_updateSearchSettings_Input" } } }
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmailNotifications_updateEmailNotificationPreferences_Input" } } }
 				},
-				"x-primitive-permission": ["search_settings:manage"]
+				"x-primitive-permission": ["notifications:manage"]
 			}
 		},
 		"/roles": {
@@ -40654,6 +41179,7 @@ const openapiDocument = {
 									"agent_work_version_conflict",
 									"already_claimed",
 									"already_member",
+									"always_sent",
 									"archive_busy",
 									"archive_invalid",
 									"archive_limit_exceeded",
@@ -40846,6 +41372,7 @@ const openapiDocument = {
 									"removal_failed",
 									"removal_timeout",
 									"request_expired",
+									"required_by_organization",
 									"resend_limit_exceeded",
 									"resend_too_soon",
 									"role_assigned",
@@ -42728,8 +43255,14 @@ const openapiDocument = {
 						"format": "date-time"
 					},
 					"raw_size_bytes": { "type": ["integer", "null"] },
-					"webhook_status": { "$ref": "#/components/schemas/EmailWebhookStatus" },
-					"webhook_attempt_count": { "type": "integer" },
+					"webhook_status": {
+						"$ref": "#/components/schemas/EmailWebhookStatus",
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its delivery state. `pending` with 0 attempts can also mean no route webhook took it."
+					},
+					"webhook_attempt_count": {
+						"type": "integer",
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its attempts."
+					},
 					"thread_id": {
 						"type": ["string", "null"],
 						"format": "uuid",
@@ -43227,17 +43760,31 @@ const openapiDocument = {
 						"format": "date-time"
 					},
 					"rejection_reason": { "type": ["string", "null"] },
-					"webhook_status": { "$ref": "#/components/schemas/EmailWebhookStatus" },
-					"webhook_attempt_count": { "type": "integer" },
+					"webhook_status": {
+						"$ref": "#/components/schemas/EmailWebhookStatus",
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its delivery state. `pending` with 0 attempts can also mean no route webhook took it."
+					},
+					"webhook_attempt_count": {
+						"type": "integer",
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its attempts."
+					},
 					"webhook_last_attempt_at": {
 						"type": ["string", "null"],
-						"format": "date-time"
+						"format": "date-time",
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its last attempt."
+					},
+					"webhook_last_status_code": {
+						"type": ["integer", "null"],
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. What it last answered."
+					},
+					"webhook_last_error": {
+						"type": ["string", "null"],
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its last error."
 					},
-					"webhook_last_status_code": { "type": ["integer", "null"] },
-					"webhook_last_error": { "type": ["string", "null"] },
 					"webhook_fired_at": {
 						"type": ["string", "null"],
-						"format": "date-time"
+						"format": "date-time",
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. When it was delivered."
 					},
 					"smtp_helo": { "type": ["string", "null"] },
 					"smtp_mail_from": {
@@ -43531,6 +44078,81 @@ const openapiDocument = {
 							}
 						}
 					},
+					"rule_deliveries": {
+						"type": ["object", "null"],
+						"description": "Where Email Rules delivered this email by webhook, for the owner of the mailbox it is at, on their own dashboard session or the Primitive CLI. Null for everyone else, and when it could not be read in time. A key reading it through a rule is not a delivery.",
+						"required": [
+							"rules",
+							"hidden",
+							"complete"
+						],
+						"properties": {
+							"rules": {
+								"type": "array",
+								"description": "Each rule over your mail that queued a webhook delivery of this email, newest rule first.",
+								"items": {
+									"type": "object",
+									"required": [
+										"rule_id",
+										"name",
+										"delivered",
+										"pending",
+										"failed",
+										"not_sent",
+										"hosts",
+										"hosts_not_listed"
+									],
+									"properties": {
+										"rule_id": {
+											"type": "string",
+											"format": "uuid",
+											"description": "The rule. A webhook sent it through several rules counts under one."
+										},
+										"name": { "type": "string" },
+										"delivered": {
+											"type": "integer",
+											"minimum": 0,
+											"description": "Webhooks it was delivered to."
+										},
+										"pending": {
+											"type": "integer",
+											"minimum": 0,
+											"description": "Webhooks still owed it."
+										},
+										"failed": {
+											"type": "integer",
+											"minimum": 0,
+											"description": "Webhooks whose attempts gave up."
+										},
+										"not_sent": {
+											"type": "integer",
+											"minimum": 0,
+											"description": "Webhooks it was not sent to after all."
+										},
+										"hosts": {
+											"type": "array",
+											"items": { "type": "string" },
+											"description": "The sites it was delivered to at the time, named as the covering view names sites; they may differ from the rule's current receivers there."
+										},
+										"hosts_not_listed": {
+											"type": "integer",
+											"minimum": 0,
+											"description": "Sites past the listed ones."
+										}
+									}
+								}
+							},
+							"hidden": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Rules that queued a delivery of it that are not listed: they do not cover your mailboxes now, or are past the 50 one answer judges."
+							},
+							"complete": {
+								"type": "boolean",
+								"description": "False when a delivery may be missing: the email is older than 14 days, or it has more deliveries or rules than one answer reads."
+							}
+						}
+					},
 					"from_name": {
 						"type": ["string", "null"],
 						"description": "Display name from the `From:` header, decoded for display: RFC 2047 encoded words are decoded in their declared charset and folded lines are joined (e.g. `Dana Rúiz` for `=?UTF-8?Q?Dana_R=C3=BAiz?= <dana@example.com>`). Null when the header carries no display name. For display only: identify the sender by `from_email`, never by this name, which the sender chooses freely."
@@ -44543,7 +45165,7 @@ const openapiDocument = {
 						"type": "object",
 						"additionalProperties": false,
 						"required": ["url"],
-						"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of the message gets the same `url`, so send one message per recipient when the URL identifies who to unsubscribe. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
+						"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of a message would get the same `url`, so another recipient could unsubscribe whoever it identifies: a send with `unsubscribe` must have exactly one recipient, one entry across `to`, `cc` and `bcc` (an address given twice counts twice), and a send to more is refused with a `validation_error`. Send one message per recipient, for example with `POST /v1/send-mail/batch`. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
 						"properties": {
 							"url": {
 								"type": "string",
@@ -45615,7 +46237,7 @@ const openapiDocument = {
 						"type": "object",
 						"additionalProperties": false,
 						"required": ["url"],
-						"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of the message gets the same `url`, so send one message per recipient when the URL identifies who to unsubscribe. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
+						"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of a message would get the same `url`, so another recipient could unsubscribe whoever it identifies: a reply with `unsubscribe` must go to the one address it answers, and one with `reply_all` that adds a cc is refused with a `validation_error`. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
 						"properties": {
 							"url": {
 								"type": "string",
@@ -50757,7 +51379,7 @@ const openapiDocument = {
 								},
 								"state": {
 									"type": "string",
-									"description": "Where it stands now: enabled, disabled, deleted or replaced (endpoints and routes), enabled or disabled (filters, wake schedules), live, suspended or deleted (Functions), active, paused or ended (repeating sends), scheduled (scheduled sends), active, suspended, expired or revoked (API keys), pending, claimed, connected or revoked (agents), draft, observe or active (email rules), pending, accepted, declined or withdrawn (rule requests and objections), and for a coverage notice what it told: started (a rule was made or turned active over your mailboxes, or an active rule came to reach you; once per rule, not per mailbox), new_version, or baseline (it already covered you when notices began). pending: a rule started covering your mailbox and the notices have not recorded that start yet (a restart within an hour of the last start notice is recorded without a new one); its id is then the rule's, and created_at when the rule last changed."
+									"description": "Where it stands now: enabled, disabled, deleted or replaced (endpoints and routes), enabled or disabled (filters, wake schedules), live, suspended or deleted (Functions), active, paused or ended (repeating sends), scheduled (scheduled sends), active, suspended, expired or revoked (API keys), pending, claimed, connected or revoked (agents), draft, observe or active (email rules), pending, accepted, declined or withdrawn (rule requests and objections), and for a coverage notice what it told: started (a rule was made or turned active over your mailboxes, or an active rule came to reach you; once per rule, not per mailbox), new_version, receivers_changed (who receives an active rule's matches changed: its keys, webhooks or share), or baseline (it already covered you when notices began). pending: a rule started covering your mailbox and the notices have not recorded that start yet (a restart within an hour of the last start notice is recorded without a new one); its id is then the rule's, and created_at when the rule last changed."
 								},
 								"created_at": {
 									"type": "string",
@@ -50766,7 +51388,7 @@ const openapiDocument = {
 								"ended_at": {
 									"type": ["string", "null"],
 									"format": "date-time",
-									"description": "When it was deleted, replaced or revoked, when an API key expired, when a repeating send stopped, or when a rule request or objection was decided (accepted, declined or withdrawn); null otherwise, as on every coverage notice."
+									"description": "When it was deleted, replaced or revoked, when an API key expired, when a repeating send stopped, or when a rule request or objection was decided (accepted, declined or withdrawn); null otherwise, as on every coverage notice (rule_now marks one whose rule was deleted)."
 								},
 								"owned_now": {
 									"type": "string",
@@ -50796,9 +51418,77 @@ const openapiDocument = {
 									]
 								},
 								"rule_id": {
-									"description": "For email_rule_coverage, always: the rule it is about, since names need not be unique (for pending, the same as id). GET /v1/email-rules/covering-me/{rule_id} shows the rule while it covers you, or as it last decided on your mail; otherwise it answers not_found.",
+									"description": "For email_rule_coverage, always: the rule it is about, since names need not be unique (for pending, the same as id). GET /v1/email-rules/covering-me/{rule_id} shows the rule while it covers you, or as it last decided on your mail; otherwise it answers not_found, with details.reason rule_deleted once a rule you were told of is deleted.",
 									"type": "string",
 									"format": "uuid"
+								},
+								"rule_now": {
+									"description": "For email_rule_coverage: deleted once the rule it is about has been deleted. Left out while it exists, or when that could not be checked.",
+									"type": "string",
+									"enum": ["deleted"]
+								},
+								"receivers_change": {
+									"description": "For a receivers_changed notice: who received the rule's matches before and after, in totals. They can be equal when only an owner or a webhook site changed; covering-me shows them by owner. A rotated key counts once here while the old one still works; covering-me counts both.",
+									"type": "object",
+									"properties": {
+										"before": {
+											"type": "object",
+											"properties": {
+												"keys": {
+													"type": "integer",
+													"minimum": 0
+												},
+												"reads_in_full": {
+													"type": "integer",
+													"minimum": 0,
+													"description": "Of the keys, how many also read your own mail beyond the rule."
+												},
+												"webhooks": {
+													"type": "integer",
+													"minimum": 0
+												},
+												"shares": {
+													"type": "integer",
+													"minimum": 0
+												}
+											},
+											"required": [
+												"keys",
+												"reads_in_full",
+												"webhooks",
+												"shares"
+											]
+										},
+										"after": {
+											"type": "object",
+											"properties": {
+												"keys": {
+													"type": "integer",
+													"minimum": 0
+												},
+												"reads_in_full": {
+													"type": "integer",
+													"minimum": 0,
+													"description": "Of the keys, how many also read your own mail beyond the rule."
+												},
+												"webhooks": {
+													"type": "integer",
+													"minimum": 0
+												},
+												"shares": {
+													"type": "integer",
+													"minimum": 0
+												}
+											},
+											"required": [
+												"keys",
+												"reads_in_full",
+												"webhooks",
+												"shares"
+											]
+										}
+									},
+									"required": ["before", "after"]
 								}
 							},
 							"required": [
@@ -50845,7 +51535,7 @@ const openapiDocument = {
 					"as_of": {
 						"type": ["string", "null"],
 						"format": "date-time",
-						"description": "With relation=concerning only: about when the notices last looked at your organization; null if never or unread. Coverage since may have no notice yet."
+						"description": "With relation=concerning only: about when the notices last looked at your organization; null if never or unread. Coverage since may have no notice yet. They look only while one of its rules could cover someone, so this stops moving while none could."
 					},
 					"pending_complete": {
 						"description": "With relation=concerning, on the first page only: whether the check for rules that started covering you without their start notice (state pending, listed ahead of the notices and beyond limit) was finished. false: some may be missing. Absent where there is nothing to check.",
@@ -51059,6 +51749,44 @@ const openapiDocument = {
 				},
 				"required": ["checked", "matched"]
 			},
+			"EmailRuleScopeUsed": {
+				"type": "object",
+				"properties": {
+					"evaluation_scope": {
+						"type": "string",
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						],
+						"description": "author, own_mailboxes or selected, as a rule's evaluation_scope."
+					},
+					"scope_selection": {
+						"type": ["object", "null"],
+						"properties": {
+							"addresses": {
+								"maxItems": 100,
+								"type": "array",
+								"items": {
+									"type": "string",
+									"maxLength": 320
+								}
+							},
+							"domains": {
+								"maxItems": 50,
+								"type": "array",
+								"items": {
+									"type": "string",
+									"maxLength": 253
+								}
+							}
+						},
+						"required": ["addresses", "domains"],
+						"description": "What a selected scope names; null for any other."
+					}
+				},
+				"required": ["evaluation_scope", "scope_selection"]
+			},
 			"EmailRuleScopeSelection": {
 				"type": "object",
 				"properties": {
@@ -51153,6 +51881,10 @@ const openapiDocument = {
 						"description": "For a grant rule with questions, breadth counted on its conditions alone: the emails its questions are asked about. Null for any other rule, or when not counted in full (as breadth).",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
 					},
+					"breadth_scope": {
+						"description": "The scope breadth and conditions_breadth are counted over: evaluation_scope as sent, by default own_mailboxes. Not the saved rule's scope, which a write sets with evaluation_scope; writes ignore this, as they ignore breadth.",
+						"$ref": "#/components/schemas/EmailRuleScopeUsed"
+					},
 					"sql": {
 						"description": "Present only when include_sql was true.",
 						"type": "object",
@@ -51438,7 +52170,7 @@ const openapiDocument = {
 				"type": "object",
 				"properties": {
 					"tree": {
-						"description": "An unsaved rule tree, as POST /email-rules/compile returned it or written by hand. Give tree or rule_id, not both.",
+						"description": "An unsaved rule tree, as POST /email-rules/compile returned it or written by hand. Give one of tree, rule_id and request_id.",
 						"$ref": "#/components/schemas/EmailRuleTreeInput"
 					},
 					"evaluation_scope": {
@@ -51456,8 +52188,13 @@ const openapiDocument = {
 						"type": "string",
 						"format": "uuid"
 					},
+					"request_id": {
+						"description": "A pending rule request you can see: its rule as asked, tested as you over your own mailboxes (what accepting would share, for the member asked). Give one of tree, rule_id and request_id.",
+						"type": "string",
+						"format": "uuid"
+					},
 					"kind": {
-						"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+						"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule or a request uses its own.",
 						"type": "string",
 						"enum": ["grant", "do_not_share"]
 					},
@@ -51526,6 +52263,20 @@ const openapiDocument = {
 								"type": "integer",
 								"minimum": 0,
 								"description": "The most emails the recent window holds: 200, less one place per expected email."
+							},
+							"scope": {
+								"description": "The scope the test ran with: a saved rule's as stored, over its author's mail (GET /email-rules/{id}/scope: what it reaches now), or a tree's as sent, over yours (by default own_mailboxes). A rule covering you, tested as you: own_mailboxes, your mailboxes it covers.",
+								"$ref": "#/components/schemas/EmailRuleScopeUsed"
+							},
+							"oldest_at": {
+								"type": ["string", "null"],
+								"format": "date-time",
+								"description": "When the oldest email tested arrived, expected ones included; null when none was. The window is the newest 200 the scope reaches, so a narrower scope reaches further back: compare counts only over the same scope and span."
+							},
+							"newest_at": {
+								"type": ["string", "null"],
+								"format": "date-time",
+								"description": "When the newest email tested arrived; null when none was."
 							}
 						},
 						"required": [
@@ -52055,7 +52806,7 @@ const openapiDocument = {
 				"type": "object",
 				"properties": {
 					"tree": {
-						"description": "An unsaved rule tree, as POST /email-rules/compile returned it or written by hand. Give tree or rule_id, not both.",
+						"description": "An unsaved rule tree, as POST /email-rules/compile returned it or written by hand. Give one of tree, rule_id and request_id.",
 						"$ref": "#/components/schemas/EmailRuleTreeInput"
 					},
 					"english": {
@@ -52085,7 +52836,7 @@ const openapiDocument = {
 						"format": "uuid"
 					},
 					"kind": {
-						"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+						"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule or a request uses its own.",
 						"type": "string",
 						"enum": ["grant", "do_not_share"]
 					},
@@ -52173,7 +52924,7 @@ const openapiDocument = {
 				"type": "object",
 				"properties": {
 					"tree": {
-						"description": "An unsaved rule tree, as POST /email-rules/compile returned it or written by hand. Give tree or rule_id, not both.",
+						"description": "An unsaved rule tree, as POST /email-rules/compile returned it or written by hand. Give one of tree, rule_id and request_id.",
 						"$ref": "#/components/schemas/EmailRuleTreeInput"
 					},
 					"evaluation_scope": {
@@ -52191,8 +52942,13 @@ const openapiDocument = {
 						"type": "string",
 						"format": "uuid"
 					},
+					"request_id": {
+						"description": "A pending rule request you can see: its rule as asked, tested as you over your own mailboxes (what accepting would share, for the member asked). Give one of tree, rule_id and request_id.",
+						"type": "string",
+						"format": "uuid"
+					},
 					"kind": {
-						"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+						"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule or a request uses its own.",
 						"type": "string",
 						"enum": ["grant", "do_not_share"]
 					},
@@ -52291,6 +53047,10 @@ const openapiDocument = {
 						],
 						"additionalProperties": false,
 						"description": "A made-up received email. Nothing about it is stored."
+					},
+					"with_protection": {
+						"description": "With true, a grant rule that matches is also judged against the active do-not-share rules over the first recipient's mailbox, which you must read in full and the rule must run over; see protection. Limited to 20 an hour per member.",
+						"type": "boolean"
 					}
 				},
 				"required": ["email"],
@@ -52420,6 +53180,59 @@ const openapiDocument = {
 							"required": ["value", "confidence"]
 						},
 						"description": "What the classifier read from the email, by fact: its value and confidence."
+					},
+					"protection": {
+						"description": "With with_protection: whether a match would be shared. Nothing is stored.",
+						"type": "object",
+						"properties": {
+							"mailbox": {
+								"type": "string",
+								"description": "The mailbox judged: the first recipient."
+							},
+							"outcome": {
+								"type": "string",
+								"enum": [
+									"shared",
+									"withheld",
+									"not_matched"
+								],
+								"description": "not_matched: the rule did not match, so nothing would be shared and no do-not-share rule was judged."
+							},
+							"withheld_by": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"id": {
+											"type": "string",
+											"format": "uuid"
+										},
+										"name": { "type": "string" },
+										"reason": {
+											"type": "string",
+											"enum": ["matched", "undecided"]
+										}
+									},
+									"required": [
+										"id",
+										"name",
+										"reason"
+									]
+								},
+								"description": "Do-not-share rules you can see that would keep it from being shared. undecided: left undecided as real mail would leave it, or not reached by this test (past 50 rules, 10 rules' questions, or the time limit); it is held back either way."
+							},
+							"withheld_by_hidden": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Rules you cannot see that would."
+							}
+						},
+						"required": [
+							"mailbox",
+							"outcome",
+							"withheld_by",
+							"withheld_by_hidden"
+						]
 					}
 				},
 				"required": [
@@ -52497,7 +53310,7 @@ const openapiDocument = {
 						"minimum": 0
 					},
 					"objection_notice": {
-						"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+						"description": "With pending_objections above 0: that members objected (each message says what they ask: to turn it off, narrow it or explain it), and how to answer.",
 						"type": "string"
 					},
 					"created_at": {
@@ -52517,6 +53330,10 @@ const openapiDocument = {
 						"type": "array",
 						"items": { "$ref": "#/components/schemas/EmailRuleScopeWarning" }
 					},
+					"do_not_share_note": {
+						"description": "On a grant rule's create answer: that active do-not-share rules reaching an email run first: one that matches it keeps it from being shared through this rule, and one that cannot decide it holds it back while it is decided again for up to a day; it is shared through this rule only if none of them then matches it.",
+						"type": "string"
+					},
 					"expectations": {
 						"description": "Its saved expectations, each list by email id, as stored: on every create, and on an update that set or removed them.",
 						"type": "object",
@@ -52887,6 +53704,10 @@ const openapiDocument = {
 					"conditions_breadth": {
 						"description": "Ignored.",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
+					},
+					"breadth_scope": {
+						"description": "Ignored (the compile answer's breadth_scope): set a rule's scope with evaluation_scope.",
+						"$ref": "#/components/schemas/EmailRuleScopeUsed"
 					}
 				},
 				"required": [
@@ -52962,7 +53783,7 @@ const openapiDocument = {
 						"minimum": 0
 					},
 					"objection_notice": {
-						"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+						"description": "With pending_objections above 0: that members objected (each message says what they ask: to turn it off, narrow it or explain it), and how to answer.",
 						"type": "string"
 					},
 					"created_at": {
@@ -53069,7 +53890,7 @@ const openapiDocument = {
 						"minimum": 0
 					},
 					"objection_notice": {
-						"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+						"description": "With pending_objections above 0: that members objected (each message says what they ask: to turn it off, narrow it or explain it), and how to answer.",
 						"type": "string"
 					},
 					"created_at": {
@@ -53192,6 +54013,10 @@ const openapiDocument = {
 						"description": "Ignored.",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
 					},
+					"breadth_scope": {
+						"description": "Ignored (the compile answer's breadth_scope): set a rule's scope with evaluation_scope.",
+						"$ref": "#/components/schemas/EmailRuleScopeUsed"
+					},
 					"kind": {
 						"description": "Must be the rule's own (400 kind_mismatch).",
 						"type": "string",
@@ -53486,6 +54311,11 @@ const openapiDocument = {
 									"description": "On a rule over your mail: how many of these keys also list one of your own mailboxes, or its domain, so they read your mail there beyond what this rule matches.",
 									"type": "integer",
 									"minimum": 0
+								},
+								"newest_at": {
+									"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+									"type": "string",
+									"format": "date-time"
 								}
 							},
 							"required": ["owner", "count"]
@@ -53541,6 +54371,11 @@ const openapiDocument = {
 									"description": "Hosts past those listed.",
 									"type": "integer",
 									"minimum": 0
+								},
+								"newest_at": {
+									"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+									"type": "string",
+									"format": "date-time"
 								}
 							},
 							"required": ["owner", "count"]
@@ -53578,6 +54413,11 @@ const openapiDocument = {
 								"count": {
 									"type": "integer",
 									"exclusiveMinimum": 0
+								},
+								"newest_at": {
+									"description": "When the newest of these was made, to the minute: a key, a webhook or the share, or the rule (the share, for what reaches it only through the share) if that was later. Not when a key was given access to this rule, or anything turned back on; a rotated key shows as newly made, and one key on two rules can show the same minute under both.",
+									"type": "string",
+									"format": "date-time"
 								}
 							},
 							"required": ["beneficiary", "count"]
@@ -53741,9 +54581,10 @@ const openapiDocument = {
 									"enum": [
 										"draft",
 										"created_after_email",
+										"outside_scope",
 										null
 									],
-									"description": "What is known about a rule with no result on this email. draft: the rule is a draft now. created_after_email: the rule was created after the email arrived. Null when it has a result, or when nothing is known."
+									"description": "What is known about a rule with no result on this email. draft: the rule is a draft now. created_after_email: the rule was created after the email arrived. outside_scope: the mailbox this email is in is outside what its scope names (its author's own mailboxes, its selection, or all its author reads now), so it does not decide on it. Null when it has a result, or when nothing is known (it may not have decided yet)."
 								},
 								"author_left": {
 									"description": "On a do-not-share rule whose author is no longer a member of the organization: it blocks nothing now, whatever it decided. Absent otherwise.",
@@ -54075,6 +54916,10 @@ const openapiDocument = {
 						"description": "Ignored.",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
 					},
+					"breadth_scope": {
+						"description": "Ignored (the compile answer's breadth_scope): set a rule's scope with evaluation_scope.",
+						"$ref": "#/components/schemas/EmailRuleScopeUsed"
+					},
 					"kind": {
 						"description": "Only grant.",
 						"type": "string",
@@ -54171,7 +55016,7 @@ const openapiDocument = {
 						"type": ["boolean", "null"]
 					},
 					"notice": {
-						"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+						"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, what accepting would share, then where to see what becomes of one email (rule-results). For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 						"type": ["string", "null"]
 					},
 					"target_can_accept": {
@@ -54181,6 +55026,11 @@ const openapiDocument = {
 					"target_warning": {
 						"description": "Why the member asked cannot accept it yet, naming the permission their role lacks. The request is still sent. Null when they can, or when target_can_accept is null.",
 						"type": ["string", "null"]
+					},
+					"existing": {
+						"description": "Present, as true, when the create carried an Idempotency-Key and you already had a pending request to this member asking exactly this (name, english, tree, explanation and message, naming the member the same way): that request is returned (200), and no second one is made or sent.",
+						"type": "boolean",
+						"const": true
 					}
 				},
 				"required": [
@@ -54346,7 +55196,7 @@ const openapiDocument = {
 						"type": ["boolean", "null"]
 					},
 					"notice": {
-						"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+						"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, what accepting would share, then where to see what becomes of one email (rule-results). For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 						"type": ["string", "null"]
 					}
 				},
@@ -54460,7 +55310,7 @@ const openapiDocument = {
 						"minimum": 0
 					},
 					"objection_notice": {
-						"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+						"description": "With pending_objections above 0: that members objected (each message says what they ask: to turn it off, narrow it or explain it), and how to answer.",
 						"type": "string"
 					},
 					"created_at": {
@@ -54706,6 +55556,10 @@ const openapiDocument = {
 						"description": "Ignored.",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
 					},
+					"breadth_scope": {
+						"description": "Ignored (the compile answer's breadth_scope): set a rule's scope with evaluation_scope.",
+						"$ref": "#/components/schemas/EmailRuleScopeUsed"
+					},
 					"kind": {
 						"description": "Only grant.",
 						"type": "string",
@@ -54728,7 +55582,7 @@ const openapiDocument = {
 					"rule": { "$ref": "#/components/schemas/EmailRuleWithVersion" },
 					"share": { "$ref": "#/components/schemas/EmailRuleShare" },
 					"notice": {
-						"description": "What is now shared, in words. When you changed the rule and it can now match mail the request left out by who it was sent to (such as mail where an address is only copied), that comes first.",
+						"description": "What is now shared, in words. When you changed the rule and it can now match mail the request left out by who it was sent to (such as mail where an address is only copied), that comes first; when you changed its english, tree or explanation (edited_on_accept; a new name alone is no change), that rule.current is what you agreed to and request what was asked.",
 						"type": "string"
 					}
 				},
@@ -55079,6 +55933,10 @@ const openapiDocument = {
 						"enum": ["grant", "do_not_share"],
 						"description": "grant: what it matches can be shared. do_not_share: it blocks sharing what it matches."
 					},
+					"do_not_share_note": {
+						"description": "On a grant rule: that the active do-not-share rules over an email run first, keeping from it what they match and holding back what they cannot decide, which is decided again for up to a day and shared only if none of them then matches it.",
+						"type": "string"
+					},
 					"author": {
 						"description": "Who wrote it.",
 						"$ref": "#/components/schemas/EmailRuleCoveringAuthor"
@@ -55168,6 +56026,10 @@ const openapiDocument = {
 						"enum": ["grant", "do_not_share"],
 						"description": "grant: what it matches can be shared. do_not_share: it blocks sharing what it matches."
 					},
+					"do_not_share_note": {
+						"description": "On a grant rule: that the active do-not-share rules over an email run first, keeping from it what they match and holding back what they cannot decide, which is decided again for up to a day and shared only if none of them then matches it.",
+						"type": "string"
+					},
 					"author": {
 						"description": "Who wrote it.",
 						"$ref": "#/components/schemas/EmailRuleCoveringAuthor"
@@ -55391,10 +56253,13 @@ const openapiDocument = {
 						"description": "Whether it is to a rule you wrote, in your current membership."
 					},
 					"message": {
-						"description": "Why the objector objects; null when none was given, or once withdrawn.",
+						"description": "Why they object and what they ask (to turn the rule off, narrow it, or explain who receives it); null when none was given, or once withdrawn.",
+						"type": ["string", "null"]
+					},
+					"decline_reason": {
+						"description": "The author's answer when declining, which the objector sees; null when none was given.",
 						"type": ["string", "null"]
 					},
-					"decline_reason": { "type": ["string", "null"] },
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -55454,7 +56319,7 @@ const openapiDocument = {
 						"type": ["string", "null"],
 						"minLength": 1,
 						"maxLength": 500,
-						"description": "Why you object, up to 500 characters; null or absent for none. The rule's author and the organization's owners and admins see it while it stands; withdrawing clears it."
+						"description": "Why you object and what you ask, up to 500 characters: to turn the rule off, to narrow it, or to explain who receives what it matches. Null or absent for none. The rule's author and the organization's owners and admins see it while it stands; withdrawing clears it."
 					}
 				},
 				"required": ["rule_id"],
@@ -55473,7 +56338,7 @@ const openapiDocument = {
 					"type": ["string", "null"],
 					"minLength": 1,
 					"maxLength": 500,
-					"description": "Why you are declining, up to 500 characters; null or absent for none. The member who objected sees it."
+					"description": "Why you are declining, up to 500 characters; null or absent for none. The member who objected sees it: it is how to answer one that asks you to narrow the rule or explain who receives it."
 				} },
 				"additionalProperties": false
 			},
@@ -59904,6 +60769,14 @@ const openapiDocument = {
 							"additionalProperties": {}
 						}
 					},
+					"mail_limits_available": {
+						"description": "Whether a key limited to some mail (addresses, domains or email rules) would be created now. While false, creating one is refused, so a client offers neither the listed-address presets nor a listed mail reach for a custom key.",
+						"type": "boolean"
+					},
+					"org_reach_available": {
+						"description": "Whether the credential policy lets a new key reach every mailbox. While false, creating one is refused, so a client offers no preset that reaches every mailbox, and a custom key lists its addresses or domains. With mail_limits_available false as well, no key can be created and every preset is unavailable.",
+						"type": "boolean"
+					},
 					"matrix": {
 						"type": "array",
 						"items": {
@@ -60208,6 +61081,36 @@ const openapiDocument = {
 						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
 					},
 					"previous_key_id": { "type": "string" },
+					"name": {
+						"description": "The successor's name: the rotated key's, which it keeps.",
+						"type": ["string", "null"]
+					},
+					"grant": {
+						"description": "The grant the successor holds, as a create answers it: the rotated key's own, carried over unchanged (rules, addresses and domains included).",
+						"type": "object",
+						"properties": {
+							"template": { "type": ["string", "null"] },
+							"credential_grant_id": { "type": ["string", "null"] },
+							"permissions": {
+								"type": ["array", "null"],
+								"items": { "type": "string" }
+							},
+							"mail_scope": {},
+							"resources": {}
+						},
+						"required": [
+							"template",
+							"credential_grant_id",
+							"permissions",
+							"mail_scope",
+							"resources"
+						],
+						"additionalProperties": {}
+					},
+					"rotated_from": {
+						"description": "The rotated key: previous_key_id, under the name GET /v1/keys/{id} gives it.",
+						"type": "string"
+					},
 					"previous_key_expires_at": {
 						"type": "string",
 						"format": "date-time",
@@ -61178,6 +62081,304 @@ const openapiDocument = {
 				"required": ["semantic_search_opt_in"],
 				"additionalProperties": false
 			},
+			"EmailNotifications_getEmailNotificationSettings_Result": {
+				"type": "object",
+				"properties": {
+					"entitled": { "type": "boolean" },
+					"kinds": {
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"kind": { "type": "string" },
+								"label": { "type": "string" },
+								"description": { "type": "string" },
+								"class": {
+									"type": "string",
+									"enum": [
+										"platform_required",
+										"org_requirable",
+										"optional"
+									]
+								},
+								"entitlement_required": { "type": "boolean" },
+								"entitled": { "type": "boolean" },
+								"org_mode": {
+									"type": ["string", "null"],
+									"enum": [
+										"off",
+										"optional_on",
+										"optional_off",
+										"required",
+										null
+									]
+								},
+								"org_mode_is_default": { "type": "boolean" },
+								"org_modes": {
+									"type": "array",
+									"items": {
+										"type": "string",
+										"enum": [
+											"off",
+											"optional_on",
+											"optional_off",
+											"required"
+										]
+									}
+								},
+								"member_enabled": { "type": "boolean" },
+								"member_can_change": { "type": "boolean" }
+							},
+							"required": [
+								"kind",
+								"label",
+								"description",
+								"class",
+								"entitlement_required",
+								"entitled",
+								"org_mode",
+								"org_mode_is_default",
+								"org_modes",
+								"member_enabled",
+								"member_can_change"
+							]
+						}
+					}
+				},
+				"required": ["entitled", "kinds"]
+			},
+			"EmailNotifications_updateEmailNotificationSettings_Result": {
+				"type": "object",
+				"properties": {
+					"entitled": { "type": "boolean" },
+					"kinds": {
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"kind": { "type": "string" },
+								"label": { "type": "string" },
+								"description": { "type": "string" },
+								"class": {
+									"type": "string",
+									"enum": [
+										"platform_required",
+										"org_requirable",
+										"optional"
+									]
+								},
+								"entitlement_required": { "type": "boolean" },
+								"entitled": { "type": "boolean" },
+								"org_mode": {
+									"type": ["string", "null"],
+									"enum": [
+										"off",
+										"optional_on",
+										"optional_off",
+										"required",
+										null
+									]
+								},
+								"org_mode_is_default": { "type": "boolean" },
+								"org_modes": {
+									"type": "array",
+									"items": {
+										"type": "string",
+										"enum": [
+											"off",
+											"optional_on",
+											"optional_off",
+											"required"
+										]
+									}
+								},
+								"member_enabled": { "type": "boolean" },
+								"member_can_change": { "type": "boolean" }
+							},
+							"required": [
+								"kind",
+								"label",
+								"description",
+								"class",
+								"entitlement_required",
+								"entitled",
+								"org_mode",
+								"org_mode_is_default",
+								"org_modes",
+								"member_enabled",
+								"member_can_change"
+							]
+						}
+					}
+				},
+				"required": ["entitled", "kinds"]
+			},
+			"EmailNotifications_updateEmailNotificationSettings_Input": {
+				"type": "object",
+				"properties": { "modes": {
+					"type": "object",
+					"propertyNames": {
+						"type": "string",
+						"pattern": "^[a-z][a-z0-9_]{0,63}$"
+					},
+					"additionalProperties": {
+						"type": "string",
+						"enum": [
+							"off",
+							"optional_on",
+							"optional_off",
+							"required"
+						]
+					}
+				} },
+				"required": ["modes"],
+				"additionalProperties": false
+			},
+			"EmailNotifications_getEmailNotificationPreferences_Result": {
+				"type": "object",
+				"properties": {
+					"entitled": { "type": "boolean" },
+					"kinds": {
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"kind": { "type": "string" },
+								"label": { "type": "string" },
+								"description": { "type": "string" },
+								"class": {
+									"type": "string",
+									"enum": [
+										"platform_required",
+										"org_requirable",
+										"optional"
+									]
+								},
+								"entitlement_required": { "type": "boolean" },
+								"entitled": { "type": "boolean" },
+								"org_mode": {
+									"type": ["string", "null"],
+									"enum": [
+										"off",
+										"optional_on",
+										"optional_off",
+										"required",
+										null
+									]
+								},
+								"org_mode_is_default": { "type": "boolean" },
+								"org_modes": {
+									"type": "array",
+									"items": {
+										"type": "string",
+										"enum": [
+											"off",
+											"optional_on",
+											"optional_off",
+											"required"
+										]
+									}
+								},
+								"member_enabled": { "type": "boolean" },
+								"member_can_change": { "type": "boolean" }
+							},
+							"required": [
+								"kind",
+								"label",
+								"description",
+								"class",
+								"entitlement_required",
+								"entitled",
+								"org_mode",
+								"org_mode_is_default",
+								"org_modes",
+								"member_enabled",
+								"member_can_change"
+							]
+						}
+					}
+				},
+				"required": ["entitled", "kinds"]
+			},
+			"EmailNotifications_updateEmailNotificationPreferences_Result": {
+				"type": "object",
+				"properties": {
+					"entitled": { "type": "boolean" },
+					"kinds": {
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"kind": { "type": "string" },
+								"label": { "type": "string" },
+								"description": { "type": "string" },
+								"class": {
+									"type": "string",
+									"enum": [
+										"platform_required",
+										"org_requirable",
+										"optional"
+									]
+								},
+								"entitlement_required": { "type": "boolean" },
+								"entitled": { "type": "boolean" },
+								"org_mode": {
+									"type": ["string", "null"],
+									"enum": [
+										"off",
+										"optional_on",
+										"optional_off",
+										"required",
+										null
+									]
+								},
+								"org_mode_is_default": { "type": "boolean" },
+								"org_modes": {
+									"type": "array",
+									"items": {
+										"type": "string",
+										"enum": [
+											"off",
+											"optional_on",
+											"optional_off",
+											"required"
+										]
+									}
+								},
+								"member_enabled": { "type": "boolean" },
+								"member_can_change": { "type": "boolean" }
+							},
+							"required": [
+								"kind",
+								"label",
+								"description",
+								"class",
+								"entitlement_required",
+								"entitled",
+								"org_mode",
+								"org_mode_is_default",
+								"org_modes",
+								"member_enabled",
+								"member_can_change"
+							]
+						}
+					}
+				},
+				"required": ["entitled", "kinds"]
+			},
+			"EmailNotifications_updateEmailNotificationPreferences_Input": {
+				"type": "object",
+				"properties": { "preferences": {
+					"type": "object",
+					"propertyNames": {
+						"type": "string",
+						"pattern": "^[a-z][a-z0-9_]{0,63}$"
+					},
+					"additionalProperties": { "type": "boolean" }
+				} },
+				"required": ["preferences"],
+				"additionalProperties": false
+			},
 			"ListRolesResult": {
 				"type": "object",
 				"properties": {
@@ -64076,8 +65277,18 @@ const KEY_WRITE_OPERATION_IDS = /* @__PURE__ */ new Set([
 	"credentials:revoke-credential"
 ]);
 const CREDENTIAL_HEADER_OPERATION_IDS = /* @__PURE__ */ new Set(["emails:import-google-mail-message"]);
+const NOT_YET_OFFERED_OPERATION_IDS = /* @__PURE__ */ new Set([
+	"email-notifications:get-email-notification-preferences",
+	"email-notifications:update-email-notification-preferences",
+	"email-notifications:get-email-notification-settings",
+	"email-notifications:update-email-notification-settings"
+]);
 /** Every operation id the CLI generates no command for. */
-const CLI_OMITTED_OPERATION_IDS = /* @__PURE__ */ new Set([...KEY_WRITE_OPERATION_IDS, ...CREDENTIAL_HEADER_OPERATION_IDS]);
+const CLI_OMITTED_OPERATION_IDS = /* @__PURE__ */ new Set([
+	...KEY_WRITE_OPERATION_IDS,
+	...CREDENTIAL_HEADER_OPERATION_IDS,
+	...NOT_YET_OFFERED_OPERATION_IDS
+]);
 /** The operations the CLI generates commands for: the manifest without CLI_OMITTED_OPERATION_IDS. */
 const cliOperationManifest = operationManifest.filter((operation) => !CLI_OMITTED_OPERATION_IDS.has(`${operation.tagCommand}:${operation.command}`));
 // src/oclif/commands/activity.ts
@@ -64091,16 +65302,79 @@ const API_BASE_URL_FLAG$4 = Flags.string({
 	hidden: true
 });
 const DEFAULT_LIMIT$3 = 50;
-async function call$1(request) {
+/** How long a read of the feed keeps retrying a transient failure. */
+const ACTIVITY_RETRY_MS = 15e3;
+/** The message printed when Primitive could not be reached at all. */
+const NETWORK_ERROR_MESSAGE = "Could not reach Primitive (network error). Try again in a moment.";
+/**
+* The error for a read that got no answer at all: always a plain object, so
+* it prints the same with and without --json. The transport's own code (a
+* host that does not resolve, say) is kept as `cause`, as a word, with no
+* local detail.
+*/
+function networkErrorPayload(error) {
+	const cause = error instanceof Error ? error.cause : void 0;
+	const code = cause && typeof cause === "object" ? cause.code : void 0;
+	return {
+		code: "network_error",
+		message: NETWORK_ERROR_MESSAGE,
+		...typeof code === "string" && /^[A-Z0-9_]+$/.test(code) ? { cause: code } : {}
+	};
+}
+/**
+* One page read, retried as the CLI's waits retry a read: a rate limit, a
+* 502, 503 or 504, or a network error is tried again with backoff, up to
+* ACTIVITY_ATTEMPTS times within ACTIVITY_RETRY_MS. A read that throws is
+* taken as the network error it is. A wait (a Retry-After, or the backoff)
+* longer than the time left is not slept on: the failure is returned at once.
+*/
+async function readWithRetry(read) {
+	const deadline = Date.now() + ACTIVITY_RETRY_MS;
+	for (let attempt = 0;; attempt += 1) {
+		let result;
+		try {
+			result = await read();
+		} catch (error) {
+			result = { error };
+		}
+		const failure = transientFailure(result);
+		if (!failure || attempt + 1 >= 4) return result;
+		const wait = failure.retryAfterMs ?? backoffDelay(attempt);
+		if (wait > deadline - Date.now()) return result;
+		if (!await pauseForTransientFailure({
+			...failure,
+			retryAfterMs: wait
+		}, attempt, { deadline })) return result;
+	}
+}
+async function call$1(read) {
 	try {
-		const result = await request;
-		if (result.error !== void 0 || !result.response?.ok) return {
+		const result = await readWithRetry(read);
+		if (transientFailure(result)?.reason === "network") return {
 			ok: false,
-			payload: result.error === void 0 || result.error === null || typeof result.error === "string" ? {
-				code: "http_error",
-				message: typeof result.error === "string" && result.error.trim() || `HTTP ${result.response?.status ?? ""}`.trim()
-			} : extractErrorPayload(result.error)
+			payload: networkErrorPayload(result.error)
 		};
+		if (result.error !== void 0 || !result.response?.ok) {
+			const status = result.response?.status;
+			if (result.error instanceof Error) return {
+				ok: false,
+				response: result.response,
+				payload: {
+					code: "response_error",
+					message: `The answer could not be read${status ? ` (HTTP ${status})` : ""}. Try again in a moment.`
+				}
+			};
+			const extracted = result.error === void 0 || result.error === null || typeof result.error === "string" ? void 0 : extractErrorPayload(result.error);
+			const coded = extracted !== null && typeof extracted === "object" && typeof extracted.code === "string";
+			return {
+				ok: false,
+				response: result.response,
+				payload: coded ? extracted : {
+					code: "http_error",
+					message: typeof result.error === "string" && result.error.trim() || `HTTP ${status ?? ""}`.trim()
+				}
+			};
+		}
 		const data = result.data;
 		return {
 			ok: true,
@@ -64109,7 +65383,7 @@ async function call$1(request) {
 	} catch (error) {
 		return {
 			ok: false,
-			payload: extractErrorPayload(error)
+			payload: networkErrorPayload(error)
 		};
 	}
 }
@@ -64175,15 +65449,56 @@ function formatAskedRows(items, complete = false) {
 	const line = (cells) => cells.map((cell, i) => i === cells.length - 1 ? cell : cell.padEnd(widths[i] ?? 0)).join("  ");
 	return [line(header), ...rows.map(line)].join("\n");
 }
+const TOTAL_KEYS = [
+	"keys",
+	"reads_in_full",
+	"webhooks",
+	"shares"
+];
+/** `value` as receiver totals: an object whose four counts are all non-negative integers. */
+function receiverTotals(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+	const totals = value;
+	return TOTAL_KEYS.every((key) => {
+		const count = totals[key];
+		return typeof count === "number" && Number.isInteger(count) && count >= 0;
+	}) ? totals : null;
+}
+/**
+* What a receivers_changed notice says changed, from its totals before and
+* after: "keys 3 to 2 (1 to 0 also reading your mail beyond the rule),
+* webhooks 2 to 1",
+* or, when the totals are equal (an owner or a webhook site changed), that
+* they are. Null for any other notice, and for one whose totals are missing
+* or not counts (an older server).
+*/
+function receiversChangeText(item) {
+	if (item.state !== "receivers_changed") return null;
+	const change = item.receivers_change;
+	const before = receiverTotals(change?.before);
+	const after = receiverTotals(change?.after);
+	if (!before || !after) return null;
+	const moved = (key) => before[key] !== after[key];
+	const span = (key) => `${before[key]} to ${after[key]}`;
+	const full = moved("reads_in_full") ? ` (${span("reads_in_full")} also reading your mail beyond the rule)` : "";
+	const changed = [
+		...moved("keys") ? [`keys ${span("keys")}${full}`] : full ? [`keys ${after.keys}${full}`] : [],
+		...moved("webhooks") ? [`webhooks ${span("webhooks")}`] : [],
+		...moved("shares") ? [`shares ${span("shares")}`] : []
+	];
+	return changed.length > 0 ? changed.join(", ") : "same totals, an owner or webhook site changed";
+}
 /** Where to see what covers you now, whatever the notices have caught up with. */
 const COVERING_NOW = `\`primitive email-rule-oversight list-email-rules-covering-me\` shows what covers you now.`;
 /**
-* One line per coverage notice: what it told (started, new_version, or
-* baseline for a rule that already covered you when notices began), when, the
-* rule's name then, and its author; and, first, each rule that covers you now
-* whose notice is not written yet (pending, dated when the rule last
-* changed), then the rule's id (rule_id; a pending row's own id is the
-* rule's), never the notice's own id, which no command takes.
+* One line per coverage notice: what it told (started, new_version,
+* receivers_changed, or baseline for a rule that already covered you when
+* notices began), when, the rule's name then, and its author; and, first,
+* each rule that covers you now whose notice is not written yet (pending,
+* dated when the rule last changed), then the rule's id (rule_id; a pending
+* row's own id is the rule's), never the notice's own id, which no command
+* takes; and, when any row is a receivers_changed notice with its totals,
+* what changed in them (CHANGE).
 * `complete` says the listing is the whole of it (from the first page to the
 * last, nothing withheld). Even then an empty one is no promise that nothing
 * covers you: notices can lag, so it
@@ -64195,24 +65510,30 @@ function formatConcerningRows(items, complete = false, asOf, pendingComplete) {
 	const rows = items.map((item) => [
 		item.state,
 		minute(item.created_at),
-		item.name ?? "(unnamed)",
+		`${item.name ?? "(unnamed)"}${item.rule_now === "deleted" ? " (deleted)" : ""}`,
 		item.created_through.name ?? item.created_through.id ?? "",
 		item.rule_id ?? (item.state === "pending" ? item.id : "")
 	]);
+	const changes = items.map((item) => receiversChangeText(item));
+	const withChange = changes.some((change) => change !== null);
+	if (withChange) for (const [i, row] of rows.entries()) row.push(changes[i] ?? "");
 	const header = [
 		"NOTICE",
 		"WHEN (UTC)",
 		"RULE",
 		"AUTHOR",
-		"RULE ID"
+		"RULE ID",
+		...withChange ? ["CHANGE"] : []
 	];
 	const widths = header.map((h, i) => Math.max(h.length, ...rows.map((row) => (row[i] ?? "").length)));
 	const line = (cells) => cells.map((cell, i) => i === cells.length - 1 ? cell : cell.padEnd(widths[i] ?? 0)).join("  ").trimEnd();
 	const pending = items.some((item) => item.state === "pending") ? ["", `pending: the rule covers you now and its notice is not written yet. ${COVERING_NOW}`] : [];
+	const receivers = items.some((item) => item.state === "receivers_changed") ? ["", "receivers_changed: who receives the rule's matches changed, with the totals before and after where the server sends them. `primitive email-rule-oversight get-email-rule-covering-me <rule-id>` shows who receives them now, by owner, while the rule covers you."] : [];
 	return [
 		line(header),
 		...rows.map(line),
 		...pending,
+		...receivers,
 		...unfinished ? ["", pending.length > 0 ? unfinished : `${unfinished} ${COVERING_NOW}`] : []
 	].join("\n");
 }
@@ -64250,7 +65571,7 @@ async function runActivityList(command, flags, relation) {
 	let pendingComplete;
 	let cursor = flags.cursor;
 	for (let page = 0; page < (flags.all ? 50 : 1); page += 1) {
-		const result = await call$1(listActivityObjects({
+		const result = await call$1(() => listActivityObjects({
 			client: auth.apiClient.client,
 			query: {
 				...relation !== "created" ? { relation } : {},
@@ -64262,7 +65583,12 @@ async function runActivityList(command, flags, relation) {
 		}));
 		if (!result.ok) {
 			if (flags.json) process.stderr.write(`${JSON.stringify(result.payload)}\n`);
-			else writeErrorWithHints(result.payload);
+			else {
+				writeErrorWithHints(result.payload, result.response);
+				const cause = result.payload?.cause;
+				const hint = typeof cause === "string" ? networkErrorHint(cause) : void 0;
+				if (hint) process.stderr.write(`${hint}\n`);
+			}
 			surfaceUnauthorizedHint({
 				auth: auth.auth,
 				baseUrlOverridden: auth.baseUrlOverridden,
@@ -64378,7 +65704,7 @@ var ActivityAskedCommand = class ActivityAskedCommand extends Command {
 	}
 };
 var ActivityConcerningCommand = class ActivityConcerningCommand extends Command {
-	static description = `List what other members did that concerns your own mail, newest first: each time another member's rule started covering your mailboxes, that is, it was made or turned active over them or an active rule came to reach you, once per rule, not per mailbox (started), or saved a new version while covering it (new_version), named as the rule was then, with its author. A rule that already covered you when these notices began is listed once as baseline. A rule in draft or observe grants and blocks nothing and gets no notice while it stays there, though \`primitive email-rule-oversight list-email-rules-covering-me\` lists it; turning it active is what is listed, and a rule that covers you again within an hour of its last started or baseline notice gets no new one, though a version it saved meanwhile is listed as new_version. A rule that stops covering you, a rename, and changes to its keys, webhooks or share are not listed.
+	static description = `List what other members did that concerns your own mail, newest first: each time another member's rule started covering your mailboxes, that is, it was made or turned active over them or an active rule came to reach you, once per rule, not per mailbox (started), saved a new version while covering it (new_version), or changed who receives its matches: its keys, webhooks or share (receivers_changed, with the totals before and after in the table, and under receivers_change with --json, at most once every 15 minutes for a rule), named as the rule was then, with its author. A rule that already covered you when these notices began is listed once as baseline. A rule in draft or observe grants and blocks nothing and gets no notice while it stays there, though \`primitive email-rule-oversight list-email-rules-covering-me\` lists it; turning it active is what is listed, and a rule that covers you again within an hour of its last started or baseline notice gets no new one, though a version it saved meanwhile is listed as new_version, and a change in who receives its matches as receivers_changed. A rule that stops covering you and a rename are not listed.
 
   Notices can lag. Until a start is written, a rule that now covers you is listed first as pending, dated when the rule last changed, and with --json its id is the rule's. When the check for such rules did not finish, the listing says so and --json carries pending_complete: false; run it again in a moment.
 
@@ -71553,7 +72879,7 @@ async function checkAskedOfYou(client, now = Date.now()) {
 	const waiting = asked.more ? [`at least ${requests + objections} rule requests and objections`] : [...requests > 0 ? [plural$1(requests, "rule request")] : [], ...objections > 0 ? [plural$1(objections, "objection")] : []];
 	const items = concerning?.items ?? [];
 	const pending = items.filter((item) => item.state === "pending").length;
-	const notices = items.filter((item) => (item.state === "started" || item.state === "new_version") && Date.parse(item.created_at) >= since).length;
+	const notices = items.filter((item) => (item.state === "started" || item.state === "new_version" || item.state === "receivers_changed") && Date.parse(item.created_at) >= since).length;
 	const parts = [
 		...waiting.length > 0 ? [`${waiting.join(" and ")} waiting for you`] : [],
 		...ASKED_KINDS.filter((kind) => hidden.has(kind)).map((kind) => `${kind === "email_rule_request" ? "rule requests" : "objections"} not shown to this credential`),
@@ -71603,7 +72929,7 @@ function checkReceiverStart(configDir, profileName) {
 	}
 }
 var DoctorCommand = class DoctorCommand extends Command {
-	static description = `Run a one-shot environment health check: Node version, proxy env, CLI auth resolution, /account reachability, verified-domain status, and, signed in as yourself, the rule requests and objections waiting for you and the rules that recently started covering your mail. With PRIMITIVE_AGENT_PROFILE selected, reports saved identity offline and points to whoami and exact listener status instead of account-only checks. Prints actionable hints for each warning or failure.`;
+	static description = `Run a one-shot environment health check: Node version, proxy env, CLI auth resolution, /account reachability, verified-domain status, and, signed in as yourself, the rule requests and objections waiting for you and the rules over your mail that recently started covering it or changed. With PRIMITIVE_AGENT_PROFILE selected, reports saved identity offline and points to whoami and exact listener status instead of account-only checks. Prints actionable hints for each warning or failure.`;
 	static summary = "Check the local environment and live API for common problems";
 	static examples = ["<%= config.bin %> doctor", "<%= config.bin %> doctor --api-key prim_..."];
 	static flags = {
@@ -74703,8 +76029,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^3.0.0-preview.13";
-const CLI_VERSION_RANGE = "^3.0.0-preview.13";
+const SDK_VERSION_RANGE = "^3.0.0-preview.15";
+const CLI_VERSION_RANGE = "^3.0.0-preview.15";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -78092,6 +79418,39 @@ function keyNotes(key) {
 		return typeof description === "string" ? [description] : [];
 	});
 }
+/** Whether a note says the key reads a whole mailbox beside its email rules. */
+function isWholeMailboxNote(note) {
+	return note !== null && typeof note === "object" && note.reason === "whole_mailbox";
+}
+/**
+* The addresses and domains a key reads in full beside its email rules: the
+* whole_mailbox notes of its address_warnings, read loosely.
+*/
+function wholeMailboxAddresses(notes) {
+	if (!Array.isArray(notes)) return [];
+	return notes.flatMap((note) => {
+		if (!isWholeMailboxNote(note)) return [];
+		const address = note.address;
+		return typeof address === "string" && address ? [address] : [];
+	});
+}
+/**
+* What a key create or update says when the key reads whole mailboxes beside
+* its email rules: on stderr as a Warning line, or under --json in the
+* document's whole_mailbox_warning (the JSON guard keeps stderr empty, and the
+* answer's warnings are the server's objects). Null when it does not. The
+* exit code is not changed: the key is made or changed as asked.
+*/
+function wholeMailboxWarning(keyId, notes) {
+	if (!Array.isArray(notes) || !notes.some(isWholeMailboxNote)) return null;
+	const addresses = wholeMailboxAddresses(notes);
+	return `This key reads ${addresses.length > 0 ? `every email at ${addresses.join(", ")}` : "every email at an address or domain it lists"}, not only the emails its rules grant. An address or domain listed beside a rule is read in full. To limit a key to the rules' emails, create one with the same permissions and only --rule for its mail (no --address or --domain), then revoke this one with \`primitive keys revoke ${keyId}\`.`;
+}
+/** The notes other than whole_mailbox, which wholeMailboxWarning says instead. */
+function otherNotes(notes) {
+	if (!Array.isArray(notes)) return [];
+	return notes.filter((note) => note !== null && typeof note === "object" && !isWholeMailboxNote(note));
+}
 function formatKeyRows(rows, options = {}) {
 	if (rows.length === 0) return options.includeRevoked ? "No API keys, revoked or not." : "No API keys. Revoked keys are left out; pass --include-revoked to list them too.";
 	return rows.map((row) => {
@@ -78099,9 +79458,16 @@ function formatKeyRows(rows, options = {}) {
 		const revoked = row.status === "revoked" ? ` [revoked${row.revoked_at ? ` ${row.revoked_at}` : ""}]` : "";
 		const count = keyNotes(row).length;
 		const notes = count > 0 ? ` [${count} ${count === 1 ? "note" : "notes"}: primitive keys get ${row.id}]` : "";
-		return `${row.id}  ${row.key_prefix}  ${row.name ?? "(unnamed)"}  ${describePermissions(row.grant)}  mail: ${describeMailScope(row.grant)}  expires ${row.expires_at ?? "never"}  last used ${row.last_used_at ?? "never"}${suspended}${revoked}${notes}`;
+		const inFull = wholeMailboxAddresses(row.address_warnings);
+		const whole = inFull.length > 0 ? ` [reads all mail at ${inFull.join(", ")}, not only its rules' emails]` : "";
+		return `${row.id}  ${row.key_prefix}  ${row.name ?? "(unnamed)"}  ${describePermissions(row.grant)}  mail: ${describeMailScope(row.grant)}  expires ${row.expires_at ?? "never"}  last used ${row.last_used_at ?? "never"}${suspended}${revoked}${whole}${notes}`;
 	}).join("\n");
 }
+/** The detail line for the mailboxes a key reads in full beside its rules. */
+function wholeMailboxLines(key) {
+	const inFull = wholeMailboxAddresses(key.address_warnings);
+	return inFull.length > 0 ? [`In full:      ${inFull.join(", ")} (listed beside its rules, so every email there is read, not only what the rules grant)`] : [];
+}
 function formatKeyDetail(key) {
 	const lines = [
 		`Name:         ${key.name ?? "(unnamed)"}`,
@@ -78109,6 +79475,7 @@ function formatKeyDetail(key) {
 		`Prefix:       ${key.key_prefix}`,
 		`Kind:         ${key.kind}`,
 		`Mail:         ${describeMailScope(key.grant)}`,
+		...wholeMailboxLines(key),
 		`Created:      ${key.created_at ?? "unknown"}`,
 		`Expires:      ${key.expires_at ?? "never"}`,
 		`Last used:    ${key.last_used_at ?? "never"}`,
@@ -78208,13 +79575,16 @@ function buildCreateGrant(choice) {
 * The mail scope fields a change can restate. `ended_rules` (rules the key
 * lists that read nothing any more: a deleted rule, or a share that ended) is
 * read only: a change never sends it back, so the key is saved without them.
+* `rule_versions` (each listed rule's current version, its state and when
+* that version was saved) is read only too, and is never sent back.
 */
 const RESTATABLE_SCOPE_FIELDS = /* @__PURE__ */ new Set([
 	"addresses",
 	"domains",
 	"rules",
 	"depth",
-	"ended_rules"
+	"ended_rules",
+	"rule_versions"
 ]);
 /** Whether a change touches the key's email rules at all. */
 function changesRules(change) {
@@ -78311,7 +79681,7 @@ function buildUpdatedGrant(current, change) {
 	}
 	if (!scope || typeof scope !== "object" || Array.isArray(scope)) return {
 		ok: false,
-		message: "This key's mail scope could not be read. Change it in the dashboard."
+		message: "This key's mail scope could not be read. Change the key in the dashboard, or create a key with what you need and revoke this one."
 	};
 	const record = scope;
 	const addresses = stringList(record.addresses ?? []);
@@ -78324,9 +79694,21 @@ function buildUpdatedGrant(current, change) {
 		message: `${readdedEnded.id} reads nothing any more (${readdedEnded.reason}), so it cannot be added back to the key.`
 	};
 	const rules = heldRules ? nextRules(heldRules, change) : null;
-	if (!addresses || !domains || !rules || Object.keys(record).some((field) => !RESTATABLE_SCOPE_FIELDS.has(field))) return {
+	const unknownFields = Object.keys(record).filter((field) => !RESTATABLE_SCOPE_FIELDS.has(field));
+	if (unknownFields.length > 0) {
+		const one = unknownFields.length === 1;
+		return {
+			ok: false,
+			message: `This key's mail scope has ${one ? "a setting" : "settings"} the CLI cannot restate (${unknownFields.join(", ")}), and a change here could drop ${one ? "it" : "them"}. Change the key in the dashboard, or create a key with what you need and revoke this one.`
+		};
+	}
+	if (!addresses || !domains || !rules) return {
 		ok: false,
-		message: "This key's mail scope has settings the CLI cannot restate. Change it in the dashboard."
+		message: `This key's mail scope has ${[
+			...addresses ? [] : ["addresses"],
+			...domains ? [] : ["domains"],
+			...rules ? [] : ["rules"]
+		].join(" and ")} the CLI could not read. Change the key in the dashboard, or create a key with what you need and revoke this one.`
 	};
 	if (addresses.length === 0 && domains.length === 0 && rules.length === 0) {
 		if ((heldRules?.length ?? 0) === 0 && ended.length > 0) return {
@@ -78469,7 +79851,7 @@ var KeysCreateCommand = class KeysCreateCommand extends Command {
 
   The secret is printed once, on its own line on stdout (in the JSON with --json). Store it right away: it is not shown again and the CLI does not save it.
 
-  A key limited to email rules (--rule, repeatable) reaches only the mail those rules match. Give it mail:read with --permission, or use --preset own_addresses_read_only.
+  A key limited to email rules (--rule, repeatable) reaches only the mail those rules match. Give it mail:read with --permission, or use --preset own_addresses_read_only. An --address or --domain given beside --rule is read in full, every email there and not only what the rules match: the key is still made, and the command warns on stderr, or in whole_mailbox_warning with --json.
 
   ${keyPermissionsHelp()}`;
 	static summary = "Create an API key";
@@ -78549,9 +79931,13 @@ var KeysCreateCommand = class KeysCreateCommand extends Command {
 		const key = result.data;
 		if (!flags.json) {
 			writeWarnings(key.warnings);
-			writeWarnings(key.address_warnings);
+			writeWarnings(otherNotes(key.address_warnings));
 		}
-		printSecret(this, Boolean(flags.json), key, key.key, [
+		const whole = wholeMailboxWarning(key.id, key.address_warnings);
+		printSecret(this, Boolean(flags.json), whole ? {
+			...key,
+			whole_mailbox_warning: whole
+		} : key, key.key, [
 			`Created API key ${key.name ?? "(unnamed)"} (${key.id}), prefix ${key.key_prefix}.`,
 			`Permissions: ${describePermissions({
 				template: key.grant.template,
@@ -78565,6 +79951,7 @@ var KeysCreateCommand = class KeysCreateCommand extends Command {
 			})}`,
 			`Expires: ${key.expires_at ?? "never"}`
 		].join("\n"));
+		if (whole && !flags.json) process.stderr.write(`Warning: ${whole}\n`);
 	}
 };
 var KeysRotateCommand = class KeysRotateCommand extends Command {
@@ -78627,11 +80014,11 @@ var KeysRotateCommand = class KeysRotateCommand extends Command {
 var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 	static description = `Change an API key's permissions, email rules, name or expiry. It keeps its id and secret.
 
-  --add and --remove take permissions (repeatable, or comma-separated); \`primitive keys create --help-full\` lists the permissions a key can hold. --add-rule and --remove-rule add email rules to the key or take them off, and keep its other rules. --rule replaces every rule the key has with the ones given, so pass all the rules it should keep; it cannot be combined with --add-rule or --remove-rule. --expires-at gives it a new expiry: a later one extends it, within your organization's credential policy, and is how to keep a key working past its expiry (rotating keeps the expiry). --no-expiry removes it where the policy allows. An expired key cannot be extended. Everything else about the key stays as it is, and the output lists any rules a change took off.
+  --add and --remove take permissions (repeatable, or comma-separated); \`primitive keys create --help-full\` lists the permissions a key can hold. --add-rule and --remove-rule add email rules to the key or take them off, and keep its other rules. --rule replaces every rule the key has with the ones given, so pass all the rules it should keep; it cannot be combined with --add-rule or --remove-rule. --expires-at gives it a new expiry: a later one extends it, within your organization's credential policy, and is how to keep a key working past its expiry (rotating keeps the expiry). --no-expiry removes it where the policy allows. An expired key cannot be extended. Everything else about the key stays as it is, and the output lists any rules a change took off. When the key's grant is written and it lists an address or domain beside its rules, which it reads in full, the command warns on stderr, or in whole_mailbox_warning with --json.
 
   The change runs directly; if your organization requires approval, the command prints the approval link and takes --step-up-token, as for a new key. A key never holds more than you do.
 
-  With --json it prints the key as it is now, in the shape keys get prints, with changed, warnings and address_warnings alongside, notice when its permissions or mail changed, rules_added when a change put rules on it (each with granted_emails, how many emails the rule has already shared), rules_removed when a change took rules off, and rules_not_on_key for rules asked to be taken off that it did not have. A permission or rule change that leaves the grant as it is, with no --name, --expires-at or --no-expiry, sends nothing and prints the key with changed: []. If the key cannot be read back after the change, key_error says why and only the change's fields are printed.`;
+  With --json it prints the key as it is now, in the shape keys get prints, with changed, warnings and address_warnings alongside, notice when its permissions or mail changed, rules_added when a change put rules on it (each with granted_emails, how many emails the rule has already shared), rules_removed when a change took rules off, rules_not_on_key for rules asked to be taken off that it did not have, and whole_mailbox_warning when the grant written reads a whole mailbox beside its rules. A permission or rule change that leaves the grant as it is, with no --name, --expires-at or --no-expiry, sends nothing and prints the key with changed: []. If the key cannot be read back after the change, key_error says why and only the change's fields are printed.`;
 	static summary = "Change an API key";
 	static examples = [
 		"<%= config.bin %> keys update 0f0e0d0c-0b0a-4908-8706-050403020100 --add mail:send,mail:reply",
@@ -78765,6 +80152,7 @@ var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 			path: { id: args.id }
 		})) : null;
 		const standingNotes = after?.ok ? after.data.address_warnings : void 0;
+		const whole = grantChanged ? wholeMailboxWarning(args.id, result.data.address_warnings) : null;
 		if (flags.json) {
 			this.log(JSON.stringify({
 				...after?.ok ? after.data : {},
@@ -78773,12 +80161,13 @@ var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 				...grantChanged ? { notice: HELD_REQUEST_NOTICE } : {},
 				...grantChanged && rulesRemoved.length > 0 ? { rules_removed: rulesRemoved } : {},
 				...rulesNotOnKey.length > 0 ? { rules_not_on_key: rulesNotOnKey } : {},
-				...after && !after.ok ? { key_error: after.payload } : {}
+				...after && !after.ok ? { key_error: after.payload } : {},
+				...whole ? { whole_mailbox_warning: whole } : {}
 			}, null, 2));
 			return;
 		}
 		writeWarnings(result.data.warnings);
-		writeWarnings(result.data.address_warnings);
+		writeWarnings(whole ? otherNotes(result.data.address_warnings) : result.data.address_warnings);
 		const changed = result.data.changed;
 		this.log(changed.length > 0 ? `Updated key ${args.id}: ${changed.join(", ")}.` : `Key ${args.id} already matched; nothing changed.`);
 		if (after?.ok) {
@@ -78788,6 +80177,7 @@ var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 		if (grantChanged && rulesRemoved.length > 0) this.log(`Rules taken off: ${rulesRemoved.join(", ")}`);
 		if (changed.includes("expires_at")) this.log(`Expires: ${expiry.expiresAt ?? "never"}`);
 		if (grantChanged) process.stderr.write(`${HELD_REQUEST_NOTICE}\n`);
+		if (whole) process.stderr.write(`Warning: ${whole}\n`);
 	}
 };
 /**
@@ -83241,9 +84631,51 @@ function compareVersions(a, b) {
 	}
 	return 0;
 }
-async function npmLatestVersion(fetchImpl) {
+function parseVersion(value) {
+	const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value.trim());
+	if (!match) return null;
+	return {
+		core: match.slice(1, 4).map(Number),
+		prerelease: match[4] ? match[4].split(".") : []
+	};
+}
+/** Whether a version is a prerelease, such as 3.0.0-preview.12. */
+function isPrerelease(version) {
+	return (parseVersion(version)?.prerelease.length ?? 0) > 0;
+}
+/**
+* Compare two versions in semver order, prereleases included: 3.0.0-preview.9
+* is older than 3.0.0-preview.12, which is older than 3.0.0. Null when either
+* is not a version.
+*/
+function compareReleaseVersions(a, b) {
+	const left = parseVersion(a);
+	const right = parseVersion(b);
+	if (!left || !right) return null;
+	for (let index = 0; index < 3; index++) {
+		const difference = (left.core[index] ?? 0) - (right.core[index] ?? 0);
+		if (difference) return Math.sign(difference);
+	}
+	if (left.prerelease.length === 0 || right.prerelease.length === 0) return Math.sign(right.prerelease.length - left.prerelease.length);
+	const length = Math.max(left.prerelease.length, right.prerelease.length);
+	for (let index = 0; index < length; index++) {
+		const l = left.prerelease[index];
+		const r = right.prerelease[index];
+		if (l === void 0) return -1;
+		if (r === void 0) return 1;
+		const ln = /^\d+$/.test(l) ? Number(l) : null;
+		const rn = /^\d+$/.test(r) ? Number(r) : null;
+		if (ln !== null && rn !== null) {
+			if (ln !== rn) return Math.sign(ln - rn);
+		} else if (ln !== null) return -1;
+		else if (rn !== null) return 1;
+		else if (l !== r) return l < r ? -1 : 1;
+	}
+	return 0;
+}
+async function npmLatestVersion(fetchImpl, tag = "latest") {
 	try {
-		const response = await fetchImpl("https://registry.npmjs.org/primitive/latest", {
+		const response = await fetchImpl(`https://registry.npmjs.org/primitive/${tag}`, {
 			headers: { accept: "application/json" },
 			redirect: "follow",
 			signal: AbortSignal.timeout(3e3)
@@ -83920,11 +85352,23 @@ async function runMachineDoctor(options) {
 		"cli.version": { inspect: async () => {
 			const version = options.cliVersion;
 			if (options.minCliVersion) {
-				const compared = compareVersions(version, options.minCliVersion);
+				const compared = isPrerelease(version) ? compareReleaseVersions(version, options.minCliVersion) : compareVersions(version, options.minCliVersion);
 				if (compared === null) return check("cli.version", "warn", `Cannot compare ${version} with the required ${options.minCliVersion}.`);
 				if (compared < 0) return check("cli.version", "fail", `${version} is older than the required ${options.minCliVersion}.`, { action: "update_cli" });
 			}
-			const latest = await (options.latestVersion ?? (() => npmLatestVersion(fetchImpl)))();
+			const readLatest = options.latestVersion ?? (() => npmLatestVersion(fetchImpl));
+			if (isPrerelease(version)) {
+				const [latest, preview] = await Promise.all([readLatest(), (options.previewVersion ?? (() => npmLatestVersion(fetchImpl, "preview")))()]);
+				const released = latest ? compareReleaseVersions(version, latest) : null;
+				if (released !== null && released < 0) return check("cli.version", "warn", `${version} is a preview older than the latest release ${latest}. Install it with \`npm install -g primitive@latest\`.`, { action: "update_cli" });
+				const previewBehind = preview ? compareReleaseVersions(version, preview) : null;
+				if (previewBehind !== null && previewBehind < 0) return check("cli.version", "warn", `${version} is older than the newest preview ${preview}. Install it with \`npm install -g primitive@preview\`.`, { action: "update_cli" });
+				if (previewBehind === 0) return check("cli.version", "ok", `${version} is the newest preview.`);
+				if (previewBehind !== null) return check("cli.version", "ok", `${version} is not older than the newest preview ${preview}.`);
+				const met = options.minCliVersion ? ` meets the required ${options.minCliVersion};` : ";";
+				return check("cli.version", released !== null || options.minCliVersion ? "ok" : "skip", preview ? `${version}; the newest preview could not be compared with it (the tag is not a version).` : released !== null ? `${version} is not older than the latest release ${latest}; the newest preview could not be checked.` : `${version}${met} neither the latest release nor the newest preview could be checked.`);
+			}
+			const latest = await readLatest();
 			if (!latest) return options.minCliVersion ? check("cli.version", "ok", `${version} meets the required ${options.minCliVersion}; the latest release could not be checked.`) : check("cli.version", "skip", `${version}; the latest release could not be checked.`);
 			const behind = compareVersions(version, latest);
 			if (behind !== null && behind < 0) return check("cli.version", "warn", `${version} is older than the latest release ${latest}.`, { action: "update_cli" });
@@ -86208,7 +87652,10 @@ var ReplyCommand = class ReplyCommand extends Command {
 			description: "Reply to everyone on the email: the sender (or Reply-To) as To, every other To and Cc address as Cc, minus your own address. Bcc is never included.",
 			exclusive: ["fyi"]
 		}),
-		body: Flags.string({ description: "Plain-text reply body. Either --body or --html (or both) is required, except with --fyi." }),
+		body: Flags.string({
+			aliases: ["text"],
+			description: "Plain-text reply body (--text is the same flag). Either --body or --html (or both) is required, except with --fyi."
+		}),
 		"body-file": Flags.string({ description: "Read the plain-text reply body from a UTF-8 file; this does not attach the file. Use --attachment for attachments. Mutually exclusive with --body and --body-stdin." }),
 		"body-stdin": Flags.boolean({ description: "Read the plain-text reply body from stdin. Mutually exclusive with --body and --body-file. Stdin can only be consumed once." }),
 		html: Flags.string({ description: "HTML reply body. Either --body or --html (or both) is required." }),
@@ -87545,7 +88992,10 @@ var SendCommand = class SendCommand extends Command {
 		}),
 		from: Flags.string({ description: "Sender address. Without it: a connected agent's own address, your member address on your own login, or a key's one granted address; otherwise the command asks for --from, except that a credential without mail:send is refused by that permission." }),
 		subject: Flags.string({ description: "Subject line. Defaults to the first line of --body / --html when omitted." }),
-		body: Flags.string({ description: "Plain-text message body. Either --body or --html (or both) is required." }),
+		body: Flags.string({
+			aliases: ["text"],
+			description: "Plain-text message body (--text is the same flag). Either --body or --html (or both) is required."
+		}),
 		"body-file": Flags.string({ description: "Read the plain-text message body from a UTF-8 file. This does not attach the file; use --attachment for file attachments. Mutually exclusive with --body and --body-stdin." }),
 		"body-stdin": Flags.boolean({ description: "Read the plain-text message body from stdin. Mutually exclusive with --body and --body-file. Stdin can only be consumed once." }),
 		html: Flags.string({ description: "HTML message body. Either --body or --html (or both) is required." }),