primcli 3.0.0-preview.13 → 3.0.0-preview.15

package/dist/oclif/receiver-heal.js

@@ -1,7 +1,7 @@
 import { N as agentProfileDirectory, P as agentProfileName, R as loadConnectedAgentProfile, j as AGENT_PROFILE_ENV } from "../cli-config-Ms_0vNjq.js";
 import { a as backgroundListenStatus, i as backgroundListenRestartable, s as claimBackgroundListenRestart, t as BACKGROUND_LISTEN_RELAUNCH_ENV } from "../listen-background-DyBYca28.js";
-import { d as SESSION_UUID, t as notificationScope } from "../notify-session-cIUz_kxR.js";
-import { Lt as detectAgentRuntime } from "../api-command-D5Tj9C-K.js";
+import { d as SESSION_UUID, t as notificationScope } from "../notify-session-B64Lgv6Z.js";
+import { Rt as detectAgentRuntime } from "../api-command-D5Nbd6Pq.js";
 import { d as readMailJson } from "../shared-mail-files-BAQSGxxz.js";
 import { join } from "node:path";
 import { spawn } from "node:child_process";

package/dist/{repeats-Dj_o6c-X-ykfsraq6.js → repeats-Dj_o6c-X-C1y88ZwJ.js}

@@ -132,6 +132,8 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	getDelivery: () => getDelivery,
 	getDomainAgentAuthorization: () => getDomainAgentAuthorization,
 	getEmail: () => getEmail,
+	getEmailNotificationPreferences: () => getEmailNotificationPreferences,
+	getEmailNotificationSettings: () => getEmailNotificationSettings,
 	getEmailReadable: () => getEmailReadable,
 	getEmailRule: () => getEmailRule,
 	getEmailRuleCoveringMe: () => getEmailRuleCoveringMe,
@@ -339,6 +341,8 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	updateCredentialPolicy: () => updateCredentialPolicy,
 	updateDefaultNetworkMember: () => updateDefaultNetworkMember,
 	updateDomain: () => updateDomain,
+	updateEmailNotificationPreferences: () => updateEmailNotificationPreferences,
+	updateEmailNotificationSettings: () => updateEmailNotificationSettings,
 	updateEmailRule: () => updateEmailRule,
 	updateEndpoint: () => updateEndpoint,
 	updateFilter: () => updateFilter,
@@ -3612,7 +3616,7 @@ const getWebhookDeliveryStats = (options) => (options?.client ?? client).get({
 /**
 * List what you created, or what you were asked
 *
-* The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules, rule requests and objections to rules over their mail (objections only on the dashboard or the Primitive CLI). Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, and the objections to rules they wrote, under their current membership, each naming the member who asked or objected in created_through. A key, an app or an agent has none, and gets both kinds in withheld. With relation=concerning it lists instead what other members did that concerns the person's own mail: each time a rule started covering one of their mailboxes or saved a new version while covering it, named as the rule was then, naming its author in created_through, under their current membership; only on the dashboard or the Primitive CLI. A key, an app or an agent has none, and gets email_rule_coverage in withheld. A notice never reads as ended. Notices are written by a periodic job and can lag: until the notices record a rule starting to cover you, the first page lists that rule as pending (pending_complete says whether that check finished), and as_of says about when the notices last looked. For what covers you now, read GET /email-rules/covering-me.
+* The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules, rule requests and objections to rules over their mail (objections only on the dashboard or the Primitive CLI). Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, and the objections to rules they wrote, under their current membership, each naming the member who asked or objected in created_through. A key, an app or an agent has none, and gets both kinds in withheld. With relation=concerning it lists instead what other members did that concerns the person's own mail: each time a rule started covering one of their mailboxes, saved a new version, or changed who receives its matches while covering it, named as the rule was then, naming its author in created_through, under their current membership; only on the dashboard or the Primitive CLI. A key, an app or an agent has none, and gets email_rule_coverage in withheld. A notice never reads as ended. Notices are written by a periodic job and can lag: until the notices record a rule starting to cover you, the first page lists that rule as pending (pending_complete says whether that check finished), and as_of says about when the notices last looked. For what covers you now, read GET /email-rules/covering-me.
 */
 const listActivityObjects = (options) => (options?.client ?? client).get({
 	security: [{
@@ -3655,7 +3659,7 @@ const compileEmailRule = (options) => (options.client ?? client).post({
 /**
 * Test a rule against received mail
 *
-* Runs a rule over received mail and reports what it would decide for each email (matched, near_miss, no_match, unclassified, skipped or not_found), with a summary of how each top-level condition and question decided. Test an unsaved tree, or a saved rule by rule_id (its current version, as its author). It reads only mail its author can read and its scope covers. A rule you see only because it covers your own mailboxes runs as you, over only those, from the dashboard or the Primitive CLI. Without email_ids it tests the newest emails, at most 200 and none older than 30 days, plus any expected ones. Unclassified emails over 2 hours old are classified first unless classify_missing is false. It records no decision and grants nothing, and stops at about 90 seconds. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).
+* Runs a rule over received mail and reports what it would decide for each email (matched, near_miss, no_match, unclassified, skipped or not_found), with a summary of how each top-level condition and question decided. Test an unsaved tree, a saved rule by rule_id (its current version, as its author), or a pending rule request by request_id (its rule as asked, as you, over your own mailboxes). It reads only mail its author can read and its scope covers. A rule you see only because it covers your own mailboxes runs as you, over only those, from the dashboard or the Primitive CLI. Without email_ids it tests the newest emails, at most 200 and none older than 30 days, plus any expected ones. Unclassified emails over 2 hours old are classified first unless classify_missing is false. It records no decision and grants nothing, and stops at about 90 seconds. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).
 */
 const testEmailRule = (options) => (options.client ?? client).post({
 	security: [{
@@ -3689,7 +3693,7 @@ const generateLookAlikes = (options) => (options.client ?? client).post({
 /**
 * Test a rule against a made-up email
 *
-* Reports what a rule would decide for an email you describe (sender, recipients, subject, plain text, attachment types and file names; optionally automated, from a mailing list, and a spam score), classified and decided as received mail would be. A rule reading a spam score you gave none for decides on none (unset_columns). Nothing is stored. Test an unsaved tree or a saved rule by rule_id. The answer includes what the classifier read. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).
+* Reports what a rule would decide for an email you describe (sender, recipients, subject, plain text, attachment types and file names; optionally automated, from a mailing list, and a spam score), classified and decided as received mail would be. A rule reading a spam score you gave none for decides on none (unset_columns). Nothing is stored. Test an unsaved tree, a saved rule by rule_id, or a pending rule request by request_id (its rule as asked, as you). The answer includes what the classifier read. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).
 */
 const testEmailRuleOnSample = (options) => (options.client ?? client).post({
 	security: [{
@@ -3857,7 +3861,7 @@ const listEmailRuleRequests = (options) => (options?.client ?? client).get({
 /**
 * Ask a member for a rule
 *
-* Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated or shared until they accept, and they may change the rule first. A message (up to 500 characters, fixed once sent) tells them why you ask. At most 5 pending requests to one member and 50 in all. With members:read the answer says whether they can accept it under their role (target_can_accept, target_warning); POST /v1/email-rule-requests/target-check checks first. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).
+* Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated or shared until they accept, and they may change the rule first. A message (up to 500 characters, fixed once sent) tells them why you ask. With an Idempotency-Key, asking again for exactly what a pending request of yours to the same member asks (name, english, tree, explanation and message, naming them the same way) returns that request with existing: true (200), so a retry never asks them twice. At most 5 pending requests to one member and 50 in all. With members:read the answer says whether they can accept it under their role (target_can_accept, target_warning); POST /v1/email-rule-requests/target-check checks first. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).
 */
 const createEmailRuleRequest = (options) => (options.client ?? client).post({
 	security: [{
@@ -4029,7 +4033,7 @@ const listEmailRuleShareEmails = (options) => (options.client ?? client).get({
 /**
 * List the rules over your mail
 *
-* Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.
+* Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. For what happened to one email of yours, every rule's decision on it and, for another member's rule covering you, who receives what it shares: GET /v1/emails/{id}/rule-results (primitive email-rules list-email-rule-results --email-id <email-id>). Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.
 */
 const listEmailRulesCoveringMe = (options) => (options?.client ?? client).get({
 	security: [{
@@ -4042,7 +4046,7 @@ const listEmailRulesCoveringMe = (options) => (options?.client ?? client).get({
 /**
 * Get a rule over your mail
 *
-* One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.
+* One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. For what happened to one email of yours, every rule's decision on it and, for another member's rule covering you, who receives what it shares: GET /v1/emails/{id}/rule-results (primitive email-rules list-email-rule-results --email-id <email-id>). Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.
 */
 const getEmailRuleCoveringMe = (options) => (options.client ?? client).get({
 	security: [{
@@ -4081,7 +4085,7 @@ const listEmailRuleVersionsCoveringMe = (options) => (options.client ?? client).
 /**
 * List objections
 *
-* Objections you made and objections to rules you wrote (by default), only one of the two, or every objection you can see, newest first. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.
+* Objections you made and objections to rules you wrote (by default), only one of the two, or every objection you can see, newest first. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it (optionally with a reason the objector sees), or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.
 */
 const listEmailRuleObjections = (options) => (options?.client ?? client).get({
 	security: [{
@@ -4094,7 +4098,7 @@ const listEmailRuleObjections = (options) => (options?.client ?? client).get({
 /**
 * Object to a rule over your mail
 *
-* Asks the author of a rule that covers one of your own mailboxes now to turn it off. Only a rule that covers you now: one you see only because it once decided on your mail cannot be objected to. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. You may have one pending objection per rule and 50 in all, and object to the same rule again only 10 minutes after you last did, whatever became of it. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.
+* Objects to a rule that covers one of your own mailboxes now: say in the message what you ask its author, to turn it off, narrow it, or explain who receives what it matches. The author answers by accepting, which turns it off, or by declining, optionally with a reason you see; the rule keeps running unless they accept. Only a rule that covers you now: one you see only because it once decided on your mail cannot be objected to. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it (optionally with a reason the objector sees), or the member who made it withdraws it, which clears its message. It never changes after that. You may have one pending objection per rule and 50 in all, and object to the same rule again only 10 minutes after you last did, whatever became of it. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.
 */
 const createEmailRuleObjection = (options) => (options.client ?? client).post({
 	security: [{
@@ -4111,7 +4115,7 @@ const createEmailRuleObjection = (options) => (options.client ?? client).post({
 /**
 * Get an objection
 *
-* One objection you can see. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.
+* One objection you can see. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it (optionally with a reason the objector sees), or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.
 */
 const getEmailRuleObjection = (options) => (options.client ?? client).get({
 	security: [{
@@ -4137,7 +4141,7 @@ const withdrawEmailRuleObjection = (options) => (options.client ?? client).post(
 /**
 * Decline an objection to your rule
 *
-* Declines a pending objection to a rule you wrote, optionally saying why; the rule stays as it is. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.
+* Declines a pending objection to a rule you wrote, optionally saying why (reason), which the member who objected sees; the rule stays as it is. When its message asks you to narrow the rule or explain who receives it, the reason is your answer; narrow it with a new version as well if you agree. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.
 */
 const declineEmailRuleObjection = (options) => (options.client ?? client).post({
 	security: [{
@@ -5170,7 +5174,7 @@ const createKey = (options) => (options.client ?? client).post({
 /**
 * Rotate an API key
 *
-* Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Revoking the successor during the overlap also revokes the old key when you may revoke that one too; the revoke's predecessors_left counts any left working. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
+* Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once, with its name and grant so you can see they carried over. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Revoking the successor during the overlap also revokes the old key when you may revoke that one too; the revoke's predecessors_left counts any left working. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
 */
@@ -5402,6 +5406,74 @@ const updateSearchSettings = (options) => (options.client ?? client).put({
 	}
 });
 /**
+* Get the organization's email notification settings
+*
+* Every kind of notification email Primitive sends the organization's members, and who may turn it off. Each kind lists its label and description, its class, whether it needs an entitlement and whether the organization has it, the organization's mode (null for platform_required) and the modes it may choose, and whether the calling member gets it and may change that.
+*
+* Person only: a dashboard session or the person's own OAuth token (the CLI or an app they connected). API keys, agent connection keys and agents are refused.
+*/
+const getEmailNotificationSettings = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-notification-settings",
+	...options
+});
+/**
+* Change the organization's email notification settings
+*
+* Set the organization's mode for one or more kinds: off (nobody gets it), optional_on (each member gets it unless they turn it off), optional_off (only members who turn it on get it) or required (every member gets it). Kinds left out keep their mode. An unknown kind is refused with 400 (validation_error, details.reason unknown_kind). A platform_required kind is refused with 409 (conflict, details.reason platform_required), and required for an optional kind with 409 (conflict, details.reason mode_not_allowed); nothing is changed. Answers the settings as they now stand. Each kind lists its label and description, its class, whether it needs an entitlement and whether the organization has it, the organization's mode (null for platform_required) and the modes it may choose, and whether the calling member gets it and may change that.
+*
+* Person only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `org_settings.write` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold notification_policy:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
+*/
+const updateEmailNotificationSettings = (options) => (options.client ?? client).put({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-notification-settings",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Get my email notification preferences
+*
+* The notification emails the calling member gets, and which of them they may turn on or off. Each kind lists its label and description, its class, whether it needs an entitlement and whether the organization has it, the organization's mode (null for platform_required) and the modes it may choose, and whether the calling member gets it and may change that.
+*
+* Person only: a dashboard session or the person's own OAuth token (the CLI or an app they connected). The person's role must hold notifications:manage. API keys, agent connection keys and agents are refused.
+*/
+const getEmailNotificationPreferences = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-notification-preferences",
+	...options
+});
+/**
+* Change my email notification preferences
+*
+* Turn one or more kinds on or off for the calling member. Only a kind whose organization mode is optional_on or optional_off can be changed: a platform_required kind, one the organization requires, and one it turned off are refused with 409 (conflict, details.reason not_member_choice, details.org_mode saying which), and nothing is changed. An unknown kind is refused with 400. Answers the preferences as they now stand. Each kind lists its label and description, its class, whether it needs an entitlement and whether the organization has it, the organization's mode (null for platform_required) and the modes it may choose, and whether the calling member gets it and may change that.
+*
+* Person only: a dashboard session or the person's own OAuth token (the CLI or an app they connected). The person's role must hold notifications:manage. API keys, agent connection keys and agents are refused.
+*/
+const updateEmailNotificationPreferences = (options) => (options.client ?? client).put({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-notification-preferences",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
 * List roles
 *
 * Every role in the organization (built-in, template copies and custom roles), with how many members and groups hold each, the templates not yet copied, and whether roles can be assigned now. `unassigned` describes role restricted on a member with no role_id, which is not a role and is never in `roles`. Needs members:read (owners, admins, members and roles that grant it); API keys are refused.
@@ -25862,4 +25934,4 @@ function repeatStopCommand(emailId) {
 	if (!UUID.test(emailId)) throw new TypeError("emailId must be an email UUID");
 	return `primitive repeat stop --id ${emailId.toLowerCase()}`;
 }
-export { parseWebhookEvent as $, simulateRoute as $n, getRepeatingSend as $t, lateMailReread as A, listWakeDispatches as An, deleteWakeSchedule as At, ensureSearchReportsReplyState as B, replyToEmail as Bn, getConversation as Bt, waitOutRetryAfter as C, listOrganizationPeople as Cn, createWakeAuthorization as Ct, encodeReceivedAtSearchCursor as D, listSentAttachmentArchiveMembers as Dn, deleteMemory as Dt, cursorFromAcceptedRows as E, listRoutes as En, deleteContact as Et, AWAITING_VALUES as F, putAgentContactPolicy as Fn, downloadSentAttachmentByFilename as Ft, queryUsesAwaiting as G, sdk_gen_exports as Gn, getFunctionRouting as Gt, formatRepliesCell as H, revokeCredential as Hn, getDefaultNetworkAgent as Ht, REPLY_STATE_UNSUPPORTED_CODE as I, putContact as In, getAccessMode as It, EMAIL_RULE_REQUEST_EVENT_TYPES as J, semanticSearch as Jn, getKey as Jt, replyStateSurfaceForOperation as K, searchEmails as Kn, getFunctionTestRunTrace as Kt, ReplyStateUnsupportedError as L, redeemCreditCode as Ln, getAccount as Lt, sinceFromFlags as M, pollCliLogin as Mn, downloadEmailAttachmentByFilename as Mt, sleep as N, pullWebhookEvent as Nn, downloadEmailAttachmentPart as Nt, fetchEmailSearchPage as O, listSentEmails as On, deleteRoute as Ot, AWAITING_FLAG_DESCRIPTION as P, putAgentContact as Pn, downloadSentAttachmentArchiveMember as Pt, isTrustedSender as Q, setMemory as Qn, getOwnGrant as Qt, assertAwaitingFilterRows as R, removeDefaultNetworkMember as Rn, getAgentContactPolicy as Rt, transientFailure as S, listMailboxAccess as Sn, createRoute as St, collectNewAcceptedEmails as T, listRoles as Tn, deleteAgentContact as Tt, hasReplyState as U, rotateKey as Un, getEmail as Ut, formatAwaitingCell as V, resendAgentSignupVerification as Vn, getCreditBalance as Vt, isAwaitingRejectedError as W, runWakeSchedule as Wn, getFunction as Wt, WEBHOOK_EVENT_TYPES as X, setFunctionRoute as Xn, getOrgRoutingTopology as Xt, SENT_EMAIL_EVENT_TYPES as Y, sendEmail as Yn, getMemory as Yt, isEmailReceivedEvent as Z, setFunctionSecret as Zn, getOutboundStatus as Zt, describeApiFailure as _, listEndpoints as _n, cliLogout as _t, REPEAT_IDLE_MAX_MINUTES as a, leaveOrganization as an, unsetFunctionRoute as ar, assertAutomatedVerdict as at, retryTransient as b, listGroups as bn, createFunction as bt, classifySignalContent as c, listAgentContacts as cn, updateKey as cr, ensureSearchReportsAutomated as ct, parseRepeatTick as d, listDefaultNetworkAgents as dn, updateWakeAuthorization as dr, isAutomatedRejectedError as dt, getSendFrom as en, startAgentClaim as er, parseFromHeader as et, preparePresenceAliveEmail as f, listDefaultNetworkMembers as fn, updateWakeSchedule as fr, addDefaultNetworkMember as ft, WaitDeadlineReached as g, listEmails as gn, __exportAll as gr, checkSendability as gt, sendPreparedSignal as h, listEmailRuleResults as hn, whoami as hr, checkDefaultNetworkContactAdmission as ht, REPEAT_EVERY_MAX_MINUTES as i, inviteAgentConnection as in, testFunction as ir, AutomatedFilterUnsupportedError as it, quoteDslValue as j, listWakeSchedules as jn, downloadEmailAttachmentArchiveMember as jt, filtersFromFlags as k, listWakeAuthorizations as kn, deleteWakeAuthorization as kt, parseInteractionEnvelope as l, listAgentNetworks as ln, updateRepeatingSend as lr, expectedAutomatedVerdicts as lt, repeatStopCommand as m, listEmailAttachmentArchiveMembers as mn, verifyAgentSignup as mr, cancelSentEmailByIdempotencyKey as mt, MAX_PRESENCE_ENVELOPE_BYTES as n, getThread as nn, startCliLogin as nr, AUTOMATED_FLAG_DESCRIPTION as nt, REPEAT_MAX_SENDS_MAX as o, listActivityObjects as on, updateDefaultNetworkMember as or, automatedRejectedError as ot, prepareSignalEmail as p, listDomains as pn, verifyAgentClaim as pr, cancelSentEmail as pt, EMAIL_RULE_OBJECTION_EVENT_TYPES as q, searchMemories as qn, getInboxStatus as qt, PRESENCE_PROBE_TEXT as r, getWakeSchedule as rn, stopRepeatFromEmail as rr, AUTOMATED_VALUES as rt, buildRepeatStopBody as s, listAgentConnections as sn, updateFunction as sr, automatedSurfaceForOperation as st, MAX_INTERACTION_BYTES as t, getSentEmail as tn, startAgentSignup as tr, AUTOMATED_FILTER_UNSUPPORTED_CODE as tt, parsePresenceEnvelope as u, listContacts as un, updateRoute as ur, hasAutomatedVerdict as ut, parseRetryAfter as v, listFunctionLogs as vn, completeWebhookEvent as vt, SINCE_VALUE_HELP as w, listRepeatingSends as wn, createWakeSchedule as wt, retryingOperation as x, listKeys as xn, createKey as xt, pauseForTransientFailure as y, listFunctions as yn, createEndpoint as yt, awaitingRejectedError as z, reorderRoutes as zn, getContact as zt };
+export { isTrustedSender as $, setMemory as $n, getOwnGrant as $t, filtersFromFlags as A, listWakeAuthorizations as An, deleteWakeAuthorization as At, awaitingRejectedError as B, reorderRoutes as Bn, getContact as Bt, transientFailure as C, listMailboxAccess as Cn, createRoute as Ct, cursorFromAcceptedRows as D, listRoutes as Dn, deleteContact as Dt, collectNewAcceptedEmails as E, listRoles as En, deleteAgentContact as Et, AWAITING_FLAG_DESCRIPTION as F, putAgentContact as Fn, downloadSentAttachmentArchiveMember as Ft, isAwaitingRejectedError as G, runWakeSchedule as Gn, getFunction as Gt, formatAwaitingCell as H, resendAgentSignupVerification as Hn, getCreditBalance as Ht, AWAITING_VALUES as I, putAgentContactPolicy as In, downloadSentAttachmentByFilename as It, EMAIL_RULE_OBJECTION_EVENT_TYPES as J, searchMemories as Jn, getInboxStatus as Jt, queryUsesAwaiting as K, sdk_gen_exports as Kn, getFunctionRouting as Kt, REPLY_STATE_UNSUPPORTED_CODE as L, putContact as Ln, getAccessMode as Lt, quoteDslValue as M, listWakeSchedules as Mn, downloadEmailAttachmentArchiveMember as Mt, sinceFromFlags as N, pollCliLogin as Nn, downloadEmailAttachmentByFilename as Nt, encodeReceivedAtSearchCursor as O, listSentAttachmentArchiveMembers as On, deleteMemory as Ot, sleep as P, pullWebhookEvent as Pn, downloadEmailAttachmentPart as Pt, isEmailReceivedEvent as Q, setFunctionSecret as Qn, getOutboundStatus as Qt, ReplyStateUnsupportedError as R, redeemCreditCode as Rn, getAccount as Rt, retryingOperation as S, listKeys as Sn, createKey as St, SINCE_VALUE_HELP as T, listRepeatingSends as Tn, createWakeSchedule as Tt, formatRepliesCell as U, revokeCredential as Un, getDefaultNetworkAgent as Ut, ensureSearchReportsReplyState as V, replyToEmail as Vn, getConversation as Vt, hasReplyState as W, rotateKey as Wn, getEmail as Wt, SENT_EMAIL_EVENT_TYPES as X, sendEmail as Xn, getMemory as Xt, EMAIL_RULE_REQUEST_EVENT_TYPES as Y, semanticSearch as Yn, getKey as Yt, WEBHOOK_EVENT_TYPES as Z, setFunctionRoute as Zn, getOrgRoutingTopology as Zt, backoffDelay as _, listEmails as _n, __exportAll as _r, checkSendability as _t, REPEAT_IDLE_MAX_MINUTES as a, inviteAgentConnection as an, testFunction as ar, AutomatedFilterUnsupportedError as at, pauseForTransientFailure as b, listFunctions as bn, createEndpoint as bt, classifySignalContent as c, listAgentConnections as cn, updateFunction as cr, automatedSurfaceForOperation as ct, parseRepeatTick as d, listContacts as dn, updateRoute as dr, hasAutomatedVerdict as dt, getRepeatingSend as en, simulateRoute as er, parseWebhookEvent as et, preparePresenceAliveEmail as f, listDefaultNetworkAgents as fn, updateWakeAuthorization as fr, isAutomatedRejectedError as ft, WaitDeadlineReached as g, listEmailRuleResults as gn, whoami as gr, checkDefaultNetworkContactAdmission as gt, sendPreparedSignal as h, listEmailAttachmentArchiveMembers as hn, verifyAgentSignup as hr, cancelSentEmailByIdempotencyKey as ht, REPEAT_EVERY_MAX_MINUTES as i, getWakeSchedule as in, stopRepeatFromEmail as ir, AUTOMATED_VALUES as it, lateMailReread as j, listWakeDispatches as jn, deleteWakeSchedule as jt, fetchEmailSearchPage as k, listSentEmails as kn, deleteRoute as kt, parseInteractionEnvelope as l, listAgentContacts as ln, updateKey as lr, ensureSearchReportsAutomated as lt, repeatStopCommand as m, listDomains as mn, verifyAgentClaim as mr, cancelSentEmail as mt, MAX_PRESENCE_ENVELOPE_BYTES as n, getSentEmail as nn, startAgentSignup as nr, AUTOMATED_FILTER_UNSUPPORTED_CODE as nt, REPEAT_MAX_SENDS_MAX as o, leaveOrganization as on, unsetFunctionRoute as or, assertAutomatedVerdict as ot, prepareSignalEmail as p, listDefaultNetworkMembers as pn, updateWakeSchedule as pr, addDefaultNetworkMember as pt, replyStateSurfaceForOperation as q, searchEmails as qn, getFunctionTestRunTrace as qt, PRESENCE_PROBE_TEXT as r, getThread as rn, startCliLogin as rr, AUTOMATED_FLAG_DESCRIPTION as rt, buildRepeatStopBody as s, listActivityObjects as sn, updateDefaultNetworkMember as sr, automatedRejectedError as st, MAX_INTERACTION_BYTES as t, getSendFrom as tn, startAgentClaim as tr, parseFromHeader as tt, parsePresenceEnvelope as u, listAgentNetworks as un, updateRepeatingSend as ur, expectedAutomatedVerdicts as ut, describeApiFailure as v, listEndpoints as vn, cliLogout as vt, waitOutRetryAfter as w, listOrganizationPeople as wn, createWakeAuthorization as wt, retryTransient as x, listGroups as xn, createFunction as xt, parseRetryAfter as y, listFunctionLogs as yn, completeWebhookEvent as yt, assertAwaitingFilterRows as z, removeDefaultNetworkMember as zn, getAgentContactPolicy as zt };

package/dist/{scoped-chat-DVSsLSRw.js → scoped-chat-CocomDwR.js}

@@ -1,4 +1,4 @@
-import { Q as isTrustedSender, b as retryTransient, c as classifySignalContent } from "./repeats-Dj_o6c-X-ykfsraq6.js";
+import { $ as isTrustedSender, c as classifySignalContent, x as retryTransient } from "./repeats-Dj_o6c-X-C1y88ZwJ.js";
 // src/oclif/presence-provenance.ts
 function readPresenceProjection(detail) {
 	if (!detail || typeof detail !== "object") return null;

package/dist/{signal-command-gpH2AhIi.js → signal-command-lJM0763f.js}

@@ -1,15 +1,15 @@
-import { On as listSentEmails, Ut as getEmail, Yn as sendEmail, _ as describeApiFailure, h as sendPreparedSignal, p as prepareSignalEmail, yt as createEndpoint } from "./repeats-Dj_o6c-X-ykfsraq6.js";
-import { Dt as successfulSendOutcome, dt as classifySendError, j as bareAddress, s as extractErrorPayload } from "./api-command-D5Tj9C-K.js";
+import { Wt as getEmail, Xn as sendEmail, bt as createEndpoint, h as sendPreparedSignal, kn as listSentEmails, p as prepareSignalEmail, v as describeApiFailure } from "./repeats-Dj_o6c-X-C1y88ZwJ.js";
+import { M as bareAddress, Ot as successfulSendOutcome, ft as classifySendError, s as extractErrorPayload } from "./api-command-D5Nbd6Pq.js";
 import { recordSentSignal } from "./oclif/auto-signals.js";
 import { _ as acquireListenLock, c as mailTime, d as readMailJson, f as removeMailFile, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, n as invalidSharedMail, o as mailObject, p as syncMailDirectory, r as mailAddress, s as mailString, t as SharedMailStateError, v as compareListenProcessIdentity, x as listenProcessIdentity, y as listenIdentity } from "./shared-mail-files-BAQSGxxz.js";
-import { i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust } from "./scoped-chat-DVSsLSRw.js";
+import { i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust } from "./scoped-chat-CocomDwR.js";
 import { n as tryOwnSharedMail, r as waitForSharedMailChange, t as readSharedMailOwner } from "./shared-mail-watch-BAPMsFNv.js";
 import { Errors } from "@oclif/core";
 import { opendirSync } from "node:fs";
 import { createHash, randomUUID, scryptSync } from "node:crypto";
 import { dirname, join } from "node:path";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
-// ../sdk-node/dist/api-C54bhvOz.js
+// ../sdk-node/dist/api-L6Tdi4am.js
 const jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
 function createSseClient({ onRequest, onSseError, onSseEvent, responseTransformer, responseValidator, sseDefaultRetryDelay, sseMaxRetryAttempts, sseMaxRetryDelay, sseSleepFn, url, ...options }) {
 	let lastEventId;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primcli",
-  "version": "3.0.0-preview.13",
+  "version": "3.0.0-preview.15",
   "publishConfig": {
     "tag": "preview"
   },