primcli 3.0.0-preview.14 → 3.0.0-preview.15

package/dist/oclif/index.js

@@ -1,12 +1,12 @@
-import { $ as interactionNextActions, $t as ConnectedAgentKeyRequiredError, A as openBrowser, B as serverRelationship, Bt as runtimeSessionVariableList, C as approveThenRerunHint, Ct as sendIdentityFields, D as canOfferCopyHotkey, Dt as serializeErrorPayload, E as withApproval, Et as sentHistoryWindowStart, F as formatMailWakeLine, Ft as identitySuggestions, G as claimPendingMail, Gt as readCallerMailFor, H as wakeReadCommand, Ht as withFlagSuggestion, I as latestOwnOutbound, It as loadSkillLine, J as pendingMailPath, Jt as isEmailId, K as clearConsumedPendingMail, Kt as classificationFactLines, L as readThreadContext, Lt as currentMailSessionKey, M as bareAddress, Mt as connectNextSteps, N as describeWake, O as formatBrowserLoginInstructions, Ot as successfulSendOutcome, P as displayAddress, Pt as generatedAgentName, Q as interactionHumanLine, Qt as withAttachmentWait, R as sentInThread, Rt as detectAgentRuntime, S as STEP_UP_TOKEN_FLAG_DESCRIPTION, St as reportSendCommandResult, T as terminalApprovalIo, Tt as sendWaitClampNotice, U as wakeRecipientField, Ut as emptyEmailListHint, Vt as formatAlreadySentNotice, W as wakeRelationship, Wt as mailReach, X as recordPendingMail, Xt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, Y as readPendingMail, Yt as noFactsMessage, Z as removePendingMail, Zt as ATTACHMENT_WAIT_MAX_MS, _ as surfaceUnauthorizedHint, _n as sanitizeForTerminal, _t as formatPriorRepliesCheckSkipped, a as createOperationCommand, an as resolveCliApiRequestConfig, at as MAX_SEND_WAIT_TIMEOUT_MS, b as BROWSER_FLAG_DESCRIPTION, bt as formatSendRecordFailureSummary, c as formatErrorPayload, cn as RESTRICTED_ROLE_NOTE, ct as assertValidIdempotencyKey, d as isGrantRefusal, dn as isBuiltInRoleKey, dt as checkPriorReplies, et as readEmailInteraction, f as networkErrorHint, fn as revokeUserLogin, ft as classifySendError, g as runWithTiming, gn as routeWarningLines, gt as formatDeletedEarlierSendNotice, h as refusalDetails, hn as switchCurrentOrg, ht as followUpCommandPrefix, i as TIME_FLAG_DESCRIPTION, in as refuseOrgSelectionForProfile, it as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, j as explainPendingMailNotFound, jt as cliInvocation, k as listenForCopyHotkey, kt as thrownErrorExitCode, l as hasControlCharacter$1, ln as credentialsFromUserLogin, lt as buildFollowUpCommand, m as readTextFileFlag, mn as roleKeyText, mt as excludeSignalReplies, n as API_ERROR_CODES, nn as createCliApiClient, nt as replyInteractionWarning, o as extractErrorCode, on as selectedOrgFromEnv, ot as SEND_OUTCOME_HELP, p as parameterFlagName, pn as roleKeyLabel, pt as deriveSendIdempotencyKey, q as clearReadPendingMail, qt as classificationOf, r as OPERATION_PATH_FLAGS, rn as refreshStoredCliCredentials, s as extractErrorPayload, sn as CliOrgRefusedError, st as apiResultHttpStatus, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createAuthenticatedCliApiClient, tt as replyExpectation, u as headerFlagName, un as fetchCliOrgs, ut as buildThrownSendFailureEnvelope, v as takesStepUp, vn as setKnownCommands, vt as formatPriorRepliesWarning, w as promptLine$2, wt as sendOutcomeExitCode, x as STEP_UP_HEADER$1, xt as priorRepliesThatWentOut, y as writeErrorWithHints, yn as operationManifest, yt as formatSendFailureSummary, z as serverMuted, zt as detectRuntimeSession } from "../api-command-BTOIanV1.js";
-import { $n as setMemory, $t as getOwnGrant, A as filtersFromFlags, An as listWakeAuthorizations, At as deleteWakeAuthorization, B as awaitingRejectedError, Bn as reorderRoutes, C as transientFailure, Cn as listMailboxAccess, Ct as createRoute, D as cursorFromAcceptedRows, Dn as listRoutes, E as collectNewAcceptedEmails, En as listRoles, F as AWAITING_FLAG_DESCRIPTION, Ft as downloadSentAttachmentArchiveMember, G as isAwaitingRejectedError, Gn as runWakeSchedule, Gt as getFunction, H as formatAwaitingCell, Hn as resendAgentSignupVerification, Ht as getCreditBalance, I as AWAITING_VALUES, It as downloadSentAttachmentByFilename, Jn as searchMemories, Jt as getInboxStatus, K as queryUsesAwaiting, Kt as getFunctionRouting, L as REPLY_STATE_UNSUPPORTED_CODE, Lt as getAccessMode, M as quoteDslValue, Mn as listWakeSchedules, Mt as downloadEmailAttachmentArchiveMember, N as sinceFromFlags, Nn as pollCliLogin, Nt as downloadEmailAttachmentByFilename, O as encodeReceivedAtSearchCursor, On as listSentAttachmentArchiveMembers, Ot as deleteMemory, P as sleep$3, Pn as pullWebhookEvent, Q as isEmailReceivedEvent, Qn as setFunctionSecret, Qt as getOutboundStatus, R as ReplyStateUnsupportedError, Rn as redeemCreditCode, Rt as getAccount, S as retryingOperation, Sn as listKeys, St as createKey, T as SINCE_VALUE_HELP, Tn as listRepeatingSends, Tt as createWakeSchedule, U as formatRepliesCell, Un as revokeCredential, Ut as getDefaultNetworkAgent, V as ensureSearchReportsReplyState, Vn as replyToEmail, Vt as getConversation, W as hasReplyState, Wn as rotateKey, Wt as getEmail, Xn as sendEmail, Xt as getMemory, Yn as semanticSearch, Yt as getKey, Zn as setFunctionRoute, Zt as getOrgRoutingTopology, _ as backoffDelay, _n as listEmails, _t as checkSendability, a as REPEAT_IDLE_MAX_MINUTES, ar as testFunction, at as AutomatedFilterUnsupportedError, b as pauseForTransientFailure, bn as listFunctions, bt as createEndpoint, cr as updateFunction, d as parseRepeatTick, dr as updateRoute, dt as hasAutomatedVerdict, en as getRepeatingSend, er as simulateRoute, et as parseWebhookEvent, f as preparePresenceAliveEmail, fn as listDefaultNetworkAgents, fr as updateWakeAuthorization, ft as isAutomatedRejectedError, g as WaitDeadlineReached, gn as listEmailRuleResults, gr as whoami, gt as checkDefaultNetworkContactAdmission, hn as listEmailAttachmentArchiveMembers, hr as verifyAgentSignup, ht as cancelSentEmailByIdempotencyKey, i as REPEAT_EVERY_MAX_MINUTES, in as getWakeSchedule, ir as stopRepeatFromEmail, it as AUTOMATED_VALUES, j as lateMailReread, jn as listWakeDispatches, jt as deleteWakeSchedule, k as fetchEmailSearchPage, kn as listSentEmails, kt as deleteRoute, l as parseInteractionEnvelope, ln as listAgentContacts, lr as updateKey, m as repeatStopCommand, mn as listDomains, mr as verifyAgentClaim, mt as cancelSentEmail, nn as getSentEmail, nr as startAgentSignup, nt as AUTOMATED_FILTER_UNSUPPORTED_CODE, o as REPEAT_MAX_SENDS_MAX, on as leaveOrganization, or as unsetFunctionRoute, ot as assertAutomatedVerdict, p as prepareSignalEmail, pn as listDefaultNetworkMembers, pr as updateWakeSchedule, pt as addDefaultNetworkMember, qn as searchEmails, qt as getFunctionTestRunTrace, rn as getThread, rr as startCliLogin, rt as AUTOMATED_FLAG_DESCRIPTION, s as buildRepeatStopBody, sn as listActivityObjects, sr as updateDefaultNetworkMember, st as automatedRejectedError, tn as getSendFrom, tr as startAgentClaim, tt as parseFromHeader, u as parsePresenceEnvelope, un as listAgentNetworks, ur as updateRepeatingSend, v as describeApiFailure, vn as listEndpoints, vt as cliLogout, w as waitOutRetryAfter, wn as listOrganizationPeople, wt as createWakeAuthorization, x as retryTransient, xn as listGroups, xt as createFunction, yn as listFunctionLogs, yt as completeWebhookEvent, z as assertAwaitingFilterRows, zn as removeDefaultNetworkMember, zt as getAgentContactPolicy } from "../repeats-Dj_o6c-X-B7sSj0oc.js";
-import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-b_0jyPIk.js";
+import { $ as interactionNextActions, $t as ConnectedAgentKeyRequiredError, A as openBrowser, B as serverRelationship, Bt as runtimeSessionVariableList, C as approveThenRerunHint, Ct as sendIdentityFields, D as canOfferCopyHotkey, Dt as serializeErrorPayload, E as withApproval, Et as sentHistoryWindowStart, F as formatMailWakeLine, Ft as identitySuggestions, G as claimPendingMail, Gt as readCallerMailFor, H as wakeReadCommand, Ht as withFlagSuggestion, I as latestOwnOutbound, It as loadSkillLine, J as pendingMailPath, Jt as isEmailId, K as clearConsumedPendingMail, Kt as classificationFactLines, L as readThreadContext, Lt as currentMailSessionKey, M as bareAddress, Mt as connectNextSteps, N as describeWake, O as formatBrowserLoginInstructions, Ot as successfulSendOutcome, P as displayAddress, Pt as generatedAgentName, Q as interactionHumanLine, Qt as withAttachmentWait, R as sentInThread, Rt as detectAgentRuntime, S as STEP_UP_TOKEN_FLAG_DESCRIPTION, St as reportSendCommandResult, T as terminalApprovalIo, Tt as sendWaitClampNotice, U as wakeRecipientField, Ut as emptyEmailListHint, Vt as formatAlreadySentNotice, W as wakeRelationship, Wt as mailReach, X as recordPendingMail, Xt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, Y as readPendingMail, Yt as noFactsMessage, Z as removePendingMail, Zt as ATTACHMENT_WAIT_MAX_MS, _ as surfaceUnauthorizedHint, _n as sanitizeForTerminal, _t as formatPriorRepliesCheckSkipped, a as createOperationCommand, an as resolveCliApiRequestConfig, at as MAX_SEND_WAIT_TIMEOUT_MS, b as BROWSER_FLAG_DESCRIPTION, bt as formatSendRecordFailureSummary, c as formatErrorPayload, cn as RESTRICTED_ROLE_NOTE, ct as assertValidIdempotencyKey, d as isGrantRefusal, dn as isBuiltInRoleKey, dt as checkPriorReplies, et as readEmailInteraction, f as networkErrorHint, fn as revokeUserLogin, ft as classifySendError, g as runWithTiming, gn as routeWarningLines, gt as formatDeletedEarlierSendNotice, h as refusalDetails, hn as switchCurrentOrg, ht as followUpCommandPrefix, i as TIME_FLAG_DESCRIPTION, in as refuseOrgSelectionForProfile, it as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, j as explainPendingMailNotFound, jt as cliInvocation, k as listenForCopyHotkey, kt as thrownErrorExitCode, l as hasControlCharacter$1, ln as credentialsFromUserLogin, lt as buildFollowUpCommand, m as readTextFileFlag, mn as roleKeyText, mt as excludeSignalReplies, n as API_ERROR_CODES, nn as createCliApiClient, nt as replyInteractionWarning, o as extractErrorCode, on as selectedOrgFromEnv, ot as SEND_OUTCOME_HELP, p as parameterFlagName, pn as roleKeyLabel, pt as deriveSendIdempotencyKey, q as clearReadPendingMail, qt as classificationOf, r as OPERATION_PATH_FLAGS, rn as refreshStoredCliCredentials, s as extractErrorPayload, sn as CliOrgRefusedError, st as apiResultHttpStatus, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createAuthenticatedCliApiClient, tt as replyExpectation, u as headerFlagName, un as fetchCliOrgs, ut as buildThrownSendFailureEnvelope, v as takesStepUp, vn as setKnownCommands, vt as formatPriorRepliesWarning, w as promptLine$2, wt as sendOutcomeExitCode, x as STEP_UP_HEADER$1, xt as priorRepliesThatWentOut, y as writeErrorWithHints, yn as operationManifest, yt as formatSendFailureSummary, z as serverMuted, zt as detectRuntimeSession } from "../api-command-D5Nbd6Pq.js";
+import { $n as setMemory, $t as getOwnGrant, A as filtersFromFlags, An as listWakeAuthorizations, At as deleteWakeAuthorization, B as awaitingRejectedError, Bn as reorderRoutes, C as transientFailure, Cn as listMailboxAccess, Ct as createRoute, D as cursorFromAcceptedRows, Dn as listRoutes, E as collectNewAcceptedEmails, En as listRoles, F as AWAITING_FLAG_DESCRIPTION, Ft as downloadSentAttachmentArchiveMember, G as isAwaitingRejectedError, Gn as runWakeSchedule, Gt as getFunction, H as formatAwaitingCell, Hn as resendAgentSignupVerification, Ht as getCreditBalance, I as AWAITING_VALUES, It as downloadSentAttachmentByFilename, Jn as searchMemories, Jt as getInboxStatus, K as queryUsesAwaiting, Kt as getFunctionRouting, L as REPLY_STATE_UNSUPPORTED_CODE, Lt as getAccessMode, M as quoteDslValue, Mn as listWakeSchedules, Mt as downloadEmailAttachmentArchiveMember, N as sinceFromFlags, Nn as pollCliLogin, Nt as downloadEmailAttachmentByFilename, O as encodeReceivedAtSearchCursor, On as listSentAttachmentArchiveMembers, Ot as deleteMemory, P as sleep$3, Pn as pullWebhookEvent, Q as isEmailReceivedEvent, Qn as setFunctionSecret, Qt as getOutboundStatus, R as ReplyStateUnsupportedError, Rn as redeemCreditCode, Rt as getAccount, S as retryingOperation, Sn as listKeys, St as createKey, T as SINCE_VALUE_HELP, Tn as listRepeatingSends, Tt as createWakeSchedule, U as formatRepliesCell, Un as revokeCredential, Ut as getDefaultNetworkAgent, V as ensureSearchReportsReplyState, Vn as replyToEmail, Vt as getConversation, W as hasReplyState, Wn as rotateKey, Wt as getEmail, Xn as sendEmail, Xt as getMemory, Yn as semanticSearch, Yt as getKey, Zn as setFunctionRoute, Zt as getOrgRoutingTopology, _ as backoffDelay, _n as listEmails, _t as checkSendability, a as REPEAT_IDLE_MAX_MINUTES, ar as testFunction, at as AutomatedFilterUnsupportedError, b as pauseForTransientFailure, bn as listFunctions, bt as createEndpoint, cr as updateFunction, d as parseRepeatTick, dr as updateRoute, dt as hasAutomatedVerdict, en as getRepeatingSend, er as simulateRoute, et as parseWebhookEvent, f as preparePresenceAliveEmail, fn as listDefaultNetworkAgents, fr as updateWakeAuthorization, ft as isAutomatedRejectedError, g as WaitDeadlineReached, gn as listEmailRuleResults, gr as whoami, gt as checkDefaultNetworkContactAdmission, hn as listEmailAttachmentArchiveMembers, hr as verifyAgentSignup, ht as cancelSentEmailByIdempotencyKey, i as REPEAT_EVERY_MAX_MINUTES, in as getWakeSchedule, ir as stopRepeatFromEmail, it as AUTOMATED_VALUES, j as lateMailReread, jn as listWakeDispatches, jt as deleteWakeSchedule, k as fetchEmailSearchPage, kn as listSentEmails, kt as deleteRoute, l as parseInteractionEnvelope, ln as listAgentContacts, lr as updateKey, m as repeatStopCommand, mn as listDomains, mr as verifyAgentClaim, mt as cancelSentEmail, nn as getSentEmail, nr as startAgentSignup, nt as AUTOMATED_FILTER_UNSUPPORTED_CODE, o as REPEAT_MAX_SENDS_MAX, on as leaveOrganization, or as unsetFunctionRoute, ot as assertAutomatedVerdict, p as prepareSignalEmail, pn as listDefaultNetworkMembers, pr as updateWakeSchedule, pt as addDefaultNetworkMember, qn as searchEmails, qt as getFunctionTestRunTrace, rn as getThread, rr as startCliLogin, rt as AUTOMATED_FLAG_DESCRIPTION, s as buildRepeatStopBody, sn as listActivityObjects, sr as updateDefaultNetworkMember, st as automatedRejectedError, tn as getSendFrom, tr as startAgentClaim, tt as parseFromHeader, u as parsePresenceEnvelope, un as listAgentNetworks, ur as updateRepeatingSend, v as describeApiFailure, vn as listEndpoints, vt as cliLogout, w as waitOutRetryAfter, wn as listOrganizationPeople, wt as createWakeAuthorization, x as retryTransient, xn as listGroups, xt as createFunction, yn as listFunctionLogs, yt as completeWebhookEvent, z as assertAwaitingFilterRows, zn as removeDefaultNetworkMember, zt as getAgentContactPolicy } from "../repeats-Dj_o6c-X-C1y88ZwJ.js";
+import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-B64Lgv6Z.js";
 import { A as AGENT_ADDRESS_ENV, C as saveCliCredentials, D as loadActiveChatState, E as deleteChatState, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadChatConversationByLocalId, P as agentProfileName, R as loadConnectedAgentProfile, S as resolveCliAuth, T as chatStatePath, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as loadCliCredentials, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as saveActiveChatState, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveSignupCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-Ms_0vNjq.js";
 import { C as resolveListenSubscription, S as normalizeListenOrigin, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, y as listenIdentity } from "../shared-mail-files-BAQSGxxz.js";
-import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-BTkDAKda.js";
-import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-Cqmn-k7q.js";
+import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-DyGP7wDs.js";
+import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-CocomDwR.js";
 import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, readWorkingLease, restoreAutoWorking } from "./auto-signals.js";
-import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-ewPBzvjU.js";
+import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-lJM0763f.js";
 import { a as thrownErrorBody, i as runStreamingJson, n as guardJsonOutputCommands, r as jsonOutputRequested, t as JSON_OUTPUT_FLAG } from "../json-output-ch756TXV.js";
 import { a as backgroundListenStatus, c as runBackgroundListen, d as stopBackgroundListen, f as verifyBackgroundListenTarget, o as backgroundListenToken, r as backgroundListenConfiguration, u as startBackgroundListen } from "../listen-background-DyBYca28.js";
 import { ORG_SELECTION_ENV } from "./global-org-flag.js";
@@ -226,7 +226,7 @@ const openapiDocument = {
 		},
 		{
 			"name": "Email Rule Oversight",
-			"description": "The email rules that reach your own mailboxes, whoever wrote them, read-only, and your objections to them: asking a rule's author to turn it off. The organization needs the email rules feature, and the caller must be a member with mail:read on their own dashboard session or the Primitive CLI, not narrowed.",
+			"description": "The email rules that reach your own mailboxes, whoever wrote them, read-only, and your objections to them: asking a rule's author to turn it off, narrow it or explain it. The organization needs the email rules feature, and the caller must be a member with mail:read on their own dashboard session or the Primitive CLI, not narrowed.",
 			"x-openapi-spec": "https://api.primitive.dev/v1/openapi/tags/email-rule-oversight"
 		},
 		{
@@ -22117,7 +22117,7 @@ const openapiDocument = {
 		"/email-rules/test": { "post": {
 			"operationId": "testEmailRule",
 			"summary": "Test a rule against received mail",
-			"description": "Runs a rule over received mail and reports what it would decide for each email (matched, near_miss, no_match, unclassified, skipped or not_found), with a summary of how each top-level condition and question decided. Test an unsaved tree, or a saved rule by rule_id (its current version, as its author). It reads only mail its author can read and its scope covers. A rule you see only because it covers your own mailboxes runs as you, over only those, from the dashboard or the Primitive CLI. Without email_ids it tests the newest emails, at most 200 and none older than 30 days, plus any expected ones. Unclassified emails over 2 hours old are classified first unless classify_missing is false. It records no decision and grants nothing, and stops at about 90 seconds. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
+			"description": "Runs a rule over received mail and reports what it would decide for each email (matched, near_miss, no_match, unclassified, skipped or not_found), with a summary of how each top-level condition and question decided. Test an unsaved tree, a saved rule by rule_id (its current version, as its author), or a pending rule request by request_id (its rule as asked, as you, over your own mailboxes). It reads only mail its author can read and its scope covers. A rule you see only because it covers your own mailboxes runs as you, over only those, from the dashboard or the Primitive CLI. Without email_ids it tests the newest emails, at most 200 and none older than 30 days, plus any expected ones. Unclassified emails over 2 hours old are classified first unless classify_missing is false. It records no decision and grants nothing, and stops at about 90 seconds. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"requestBody": {
@@ -22140,7 +22140,7 @@ const openapiDocument = {
 					}
 				},
 				"400": {
-					"description": "validation_error: give exactly one of tree and rule_id, at most 200 email_ids (with the expected emails), 1 to 100 expected emails none in both lists (or only expect.samples, up to 20), and a tree that is valid for the column contract. evaluation_scope, scope_selection and kind go only with tree. A saved rule whose current version no longer renders answers details.reason version_not_renderable; email_ids that with its saved expectations name over 200 emails, too_many_emails.",
+					"description": "validation_error: give exactly one of tree, rule_id and request_id, at most 200 email_ids (with the expected emails), 1 to 100 expected emails none in both lists (or only expect.samples, up to 20), and a tree that is valid for the column contract. evaluation_scope, scope_selection and kind go only with tree. A saved rule's current version or a request's rule that no longer renders answers details.reason version_not_renderable; email_ids that with its saved expectations name over 200 emails, too_many_emails.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"401": {
@@ -22167,11 +22167,11 @@ const openapiDocument = {
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
-					"description": "not_found: rule_id names no rule you can see or that covers your mailboxes (details.reason rule_not_found).",
+					"description": "not_found: rule_id names no rule you can see or that covers your mailboxes (details.reason rule_not_found), or request_id no rule request you can see (request_not_found).",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"409": {
-					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree or a rule covering you, the caller). details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox, no_shareable_mailbox or no_selected_mailbox.",
+					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree, a request or a rule covering you, the caller). details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox, no_shareable_mailbox or no_selected_mailbox. email_rule_request_not_pending: request_id names a request already decided.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -22319,7 +22319,7 @@ const openapiDocument = {
 		"/email-rules/test-sample": { "post": {
 			"operationId": "testEmailRuleOnSample",
 			"summary": "Test a rule against a made-up email",
-			"description": "Reports what a rule would decide for an email you describe (sender, recipients, subject, plain text, attachment types and file names; optionally automated, from a mailing list, and a spam score), classified and decided as received mail would be. A rule reading a spam score you gave none for decides on none (unset_columns). Nothing is stored. Test an unsaved tree or a saved rule by rule_id. The answer includes what the classifier read. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
+			"description": "Reports what a rule would decide for an email you describe (sender, recipients, subject, plain text, attachment types and file names; optionally automated, from a mailing list, and a spam score), classified and decided as received mail would be. A rule reading a spam score you gave none for decides on none (unset_columns). Nothing is stored. Test an unsaved tree, a saved rule by rule_id, or a pending rule request by request_id (its rule as asked, as you). The answer includes what the classifier read. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"requestBody": {
@@ -22342,7 +22342,7 @@ const openapiDocument = {
 					}
 				},
 				"400": {
-					"description": "validation_error: give exactly one of tree and rule_id (evaluation_scope, scope_selection and kind only with tree), an email with a sender, 1 to 50 To addresses (and up to 50 Cc), and a text body, and a tree that is valid for the column contract and within the size limits for a saved rule. A saved rule whose current version no longer renders answers details.reason version_not_renderable.",
+					"description": "validation_error: give exactly one of tree, rule_id and request_id (evaluation_scope, scope_selection and kind only with tree), an email with a sender, 1 to 50 To addresses (and up to 50 Cc), and a text body, and a tree that is valid for the column contract and within the size limits for a saved rule. A saved rule's current version or a request's rule that no longer renders answers details.reason version_not_renderable. With with_protection: not_a_grant_rule, or protection_mailbox_outside_rule when the rule does not run over the first recipient.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"401": {
@@ -22365,15 +22365,15 @@ const openapiDocument = {
 					}
 				},
 				"403": {
-					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. email_rule_scope_not_readable: scope_selection names something you cannot read. forbidden with details.reason covering_view_only: you read this rule only in the covering view, since it decided on your mail before and covers none of your mailboxes now (details.covering_view).",
+					"description": "feature_not_enabled: this organization lacks the email rules feature; permission refusals answer forbidden or grant_forbidden. email_rule_scope_not_readable: scope_selection names something you cannot read. forbidden with details.reason covering_view_only: you read this rule only in the covering view, since it decided on your mail before and covers none of your mailboxes now (details.covering_view). grant_forbidden protection_mailbox_not_read: with_protection at a mailbox you do not read in full.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
-					"description": "not_found: rule_id names no rule you can see or that covers your mailboxes (details.reason rule_not_found).",
+					"description": "not_found: rule_id names no rule you can see or that covers your mailboxes (details.reason rule_not_found), or request_id no rule request you can see (request_not_found).",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"409": {
-					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree or a rule covering you, you), so it would decide nothing for real. details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox, no_shareable_mailbox or no_selected_mailbox.",
+					"description": "email_rule_author_unresolvable: the rule cannot run as its author (for an unsaved tree, a request or a rule covering you, you), so it would decide nothing for real. details.reason is left, revoked, suspended, membership_ended, no_mail_read, no_own_mailbox, no_shareable_mailbox or no_selected_mailbox. email_rule_request_not_pending: request_id names a request already decided.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -22398,6 +22398,10 @@ const openapiDocument = {
 							}
 						}
 					} }
+				},
+				"503": {
+					"description": "service_unavailable: with_protection could not read the do-not-share rules in time (protection_unavailable), or its limit could not be checked (protection_limit_unavailable).",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				}
 			},
 			"x-primitive-permission": ["mail:read"],
@@ -23502,7 +23506,7 @@ const openapiDocument = {
 			"post": {
 				"operationId": "createEmailRuleRequest",
 				"summary": "Ask a member for a rule",
-				"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated or shared until they accept, and they may change the rule first. A message (up to 500 characters, fixed once sent) tells them why you ask. At most 5 pending requests to one member and 50 in all. With members:read the answer says whether they can accept it under their role (target_can_accept, target_warning); POST /v1/email-rule-requests/target-check checks first. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
+				"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated or shared until they accept, and they may change the rule first. A message (up to 500 characters, fixed once sent) tells them why you ask. With an Idempotency-Key, asking again for exactly what a pending request of yours to the same member asks (name, english, tree, explanation and message, naming them the same way) returns that request with existing: true (200), so a retry never asks them twice. At most 5 pending requests to one member and 50 in all. With members:read the answer says whether they can accept it under their role (target_can_accept, target_warning); POST /v1/email-rule-requests/target-check checks first. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token).",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"requestBody": {
@@ -23510,6 +23514,20 @@ const openapiDocument = {
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateEmailRuleRequestRequest" } } }
 				},
 				"responses": {
+					"200": {
+						"description": "The pending request this create matched (existing: true): no second one was made.",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"required": ["data"],
+							"properties": { "data": { "$ref": "#/components/schemas/CreateEmailRuleRequestResult" } }
+						}] } } },
+						"headers": {
+							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
+							"ratelimit-remaining": { "$ref": "#/components/headers/ratelimit-remaining" },
+							"ratelimit-reset": { "$ref": "#/components/headers/ratelimit-reset" },
+							"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
+						}
+					},
 					"201": {
 						"description": "Ask a member for a rule",
 						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
@@ -23581,18 +23599,18 @@ const openapiDocument = {
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					}
 				},
-				"x-primitive-permission": ["mail:read"],
 				"parameters": [{
 					"name": "Idempotency-Key",
 					"in": "header",
 					"required": false,
-					"description": "Optional, and not used to deduplicate: this operation stores no result by the key, so a retry with the same key runs the request again. Operations that need a credential refuse a key that is empty, longer than 255 characters or not printable ASCII with 400 `validation_error` and echo a valid one in the Idempotency-Key response header; operations that need none ignore it.",
+					"description": "Optional. With a key, a create identical to a pending request of yours to the same member (name, english, tree, explanation and message, naming the member the same way) returns that request with existing: true (200) instead of making a second one. The key itself is not stored, so any key does this, and a create without one is never matched to an existing request. A key that is empty, longer than 255 characters or not printable ASCII is refused with 400 `validation_error`; a valid one is echoed in the Idempotency-Key response header.",
 					"schema": {
 						"type": "string",
 						"minLength": 1,
 						"maxLength": 255
 					}
-				}]
+				}],
+				"x-primitive-permission": ["mail:read"]
 			},
 			"get": {
 				"operationId": "listEmailRuleRequests",
@@ -24863,7 +24881,7 @@ const openapiDocument = {
 		"/email-rules/covering-me": { "get": {
 			"operationId": "listEmailRulesCoveringMe",
 			"summary": "List the rules over your mail",
-			"description": "Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+			"description": "Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. For what happened to one email of yours, every rule's decision on it and, for another member's rule covering you, who receives what it shares: GET /v1/emails/{id}/rule-results (primitive email-rules list-email-rule-results --email-id <email-id>). Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -24961,7 +24979,7 @@ const openapiDocument = {
 		"/email-rules/covering-me/{id}": { "get": {
 			"operationId": "getEmailRuleCoveringMe",
 			"summary": "Get a rule over your mail",
-			"description": "One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+			"description": "One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, the member each belongs to (or the organization), and the sites the webhooks deliver to. You do not see which keys, webhooks or shares they are (no ids, names, prefixes, or URLs beyond the site), the other inboxes and domains its scope names, or its saved expectations. For what happened to one email of yours, every rule's decision on it and, for another member's rule covering you, who receives what it shares: GET /v1/emails/{id}/rule-results (primitive email-rules list-email-rule-results --email-id <email-id>). Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -25013,7 +25031,7 @@ const openapiDocument = {
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
-					"description": "not_found: no rule with this id covers your mailboxes or decided on your mail.",
+					"description": "not_found: no rule with this id covers your mailboxes or decided on your mail; details.reason rule_deleted (with details.rule_name) for one deleted after you were told it covered you.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -25139,7 +25157,7 @@ const openapiDocument = {
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
-					"description": "not_found: no rule with this id covers your mailboxes or decided on your mail.",
+					"description": "not_found: no rule with this id covers your mailboxes or decided on your mail; details.reason rule_deleted (with details.rule_name) for one deleted after you were told it covered you.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -25267,7 +25285,7 @@ const openapiDocument = {
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"404": {
-					"description": "not_found: no rule with this id covers your mailboxes or decided on your mail.",
+					"description": "not_found: no rule with this id covers your mailboxes or decided on your mail; details.reason rule_deleted (with details.rule_name) for one deleted after you were told it covered you.",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": {
@@ -25300,7 +25318,7 @@ const openapiDocument = {
 			"post": {
 				"operationId": "createEmailRuleObjection",
 				"summary": "Object to a rule over your mail",
-				"description": "Asks the author of a rule that covers one of your own mailboxes now to turn it off. Only a rule that covers you now: one you see only because it once decided on your mail cannot be objected to. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. You may have one pending objection per rule and 50 in all, and object to the same rule again only 10 minutes after you last did, whatever became of it. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+				"description": "Objects to a rule that covers one of your own mailboxes now: say in the message what you ask its author, to turn it off, narrow it, or explain who receives what it matches. The author answers by accepting, which turns it off, or by declining, optionally with a reason you see; the rule keeps running unless they accept. Only a rule that covers you now: one you see only because it once decided on your mail cannot be objected to. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it (optionally with a reason the objector sees), or the member who made it withdraws it, which clears its message. It never changes after that. You may have one pending objection per rule and 50 in all, and object to the same rule again only 10 minutes after you last did, whatever became of it. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 				"tags": ["Email Rule Oversight"],
 				"security": [{ "BearerAuth": [] }],
 				"requestBody": {
@@ -25401,7 +25419,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "listEmailRuleObjections",
 				"summary": "List objections",
-				"description": "Objections you made and objections to rules you wrote (by default), only one of the two, or every objection you can see, newest first. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+				"description": "Objections you made and objections to rules you wrote (by default), only one of the two, or every objection you can see, newest first. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it (optionally with a reason the objector sees), or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 				"tags": ["Email Rule Oversight"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [
@@ -25535,7 +25553,7 @@ const openapiDocument = {
 		"/email-rule-objections/{id}": { "get": {
 			"operationId": "getEmailRuleObjection",
 			"summary": "Get an objection",
-			"description": "One objection you can see. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it, or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+			"description": "One objection you can see. An objection is seen by the member who made it, the rule's author and the organization's owners and admins. It stays pending until the rule's author accepts it, turning the rule off, or declines it (optionally with a reason the objector sees), or the member who made it withdraws it, which clears its message. It never changes after that. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -25717,7 +25735,7 @@ const openapiDocument = {
 		"/email-rule-objections/{id}/decline": { "post": {
 			"operationId": "declineEmailRuleObjection",
 			"summary": "Decline an objection to your rule",
-			"description": "Declines a pending objection to a rule you wrote, optionally saying why; the rule stays as it is. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
+			"description": "Declines a pending objection to a rule you wrote, optionally saying why (reason), which the member who objected sees; the rule stays as it is. When its message asks you to narrow the rule or explain who receives it, the reason is your answer; narrow it with a new version as well if you agree. Needs mail:read, the email rules feature, and a member's own full-access credential (no API key, agent key or narrowed token). Only on your own dashboard session or the Primitive CLI.",
 			"tags": ["Email Rule Oversight"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -34803,7 +34821,7 @@ const openapiDocument = {
 			"summary": "Rotate an API key",
 			"tags": ["Credentials"],
 			"security": [{ "BearerAuth": [] }],
-			"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Revoking the successor during the overlap also revokes the old key when you may revoke that one too; the revoke's predecessors_left counts any left working. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+			"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once, with its name and grant so you can see they carried over. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Revoking the successor during the overlap also revokes the old key when you may revoke that one too; the revoke's predecessors_left counts any left working. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 			"x-primitive-person-only": {
 				"access": "step_up",
 				"step_up_purpose": "keys.create",
@@ -43237,8 +43255,14 @@ const openapiDocument = {
 						"format": "date-time"
 					},
 					"raw_size_bytes": { "type": ["integer", "null"] },
-					"webhook_status": { "$ref": "#/components/schemas/EmailWebhookStatus" },
-					"webhook_attempt_count": { "type": "integer" },
+					"webhook_status": {
+						"$ref": "#/components/schemas/EmailWebhookStatus",
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its delivery state. `pending` with 0 attempts can also mean no route webhook took it."
+					},
+					"webhook_attempt_count": {
+						"type": "integer",
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its attempts."
+					},
 					"thread_id": {
 						"type": ["string", "null"],
 						"format": "uuid",
@@ -43736,17 +43760,31 @@ const openapiDocument = {
 						"format": "date-time"
 					},
 					"rejection_reason": { "type": ["string", "null"] },
-					"webhook_status": { "$ref": "#/components/schemas/EmailWebhookStatus" },
-					"webhook_attempt_count": { "type": "integer" },
+					"webhook_status": {
+						"$ref": "#/components/schemas/EmailWebhookStatus",
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its delivery state. `pending` with 0 attempts can also mean no route webhook took it."
+					},
+					"webhook_attempt_count": {
+						"type": "integer",
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its attempts."
+					},
 					"webhook_last_attempt_at": {
 						"type": ["string", "null"],
-						"format": "date-time"
+						"format": "date-time",
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its last attempt."
+					},
+					"webhook_last_status_code": {
+						"type": ["integer", "null"],
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. What it last answered."
+					},
+					"webhook_last_error": {
+						"type": ["string", "null"],
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. Its last error."
 					},
-					"webhook_last_status_code": { "type": ["integer", "null"] },
-					"webhook_last_error": { "type": ["string", "null"] },
 					"webhook_fired_at": {
 						"type": ["string", "null"],
-						"format": "date-time"
+						"format": "date-time",
+						"description": "The email's own routed delivery only (where routing sent it); a rule's deliveries never change this, and are in `rule_deliveries` on GET /emails/{id} for the mailbox's owner. When it was delivered."
 					},
 					"smtp_helo": { "type": ["string", "null"] },
 					"smtp_mail_from": {
@@ -44040,6 +44078,81 @@ const openapiDocument = {
 							}
 						}
 					},
+					"rule_deliveries": {
+						"type": ["object", "null"],
+						"description": "Where Email Rules delivered this email by webhook, for the owner of the mailbox it is at, on their own dashboard session or the Primitive CLI. Null for everyone else, and when it could not be read in time. A key reading it through a rule is not a delivery.",
+						"required": [
+							"rules",
+							"hidden",
+							"complete"
+						],
+						"properties": {
+							"rules": {
+								"type": "array",
+								"description": "Each rule over your mail that queued a webhook delivery of this email, newest rule first.",
+								"items": {
+									"type": "object",
+									"required": [
+										"rule_id",
+										"name",
+										"delivered",
+										"pending",
+										"failed",
+										"not_sent",
+										"hosts",
+										"hosts_not_listed"
+									],
+									"properties": {
+										"rule_id": {
+											"type": "string",
+											"format": "uuid",
+											"description": "The rule. A webhook sent it through several rules counts under one."
+										},
+										"name": { "type": "string" },
+										"delivered": {
+											"type": "integer",
+											"minimum": 0,
+											"description": "Webhooks it was delivered to."
+										},
+										"pending": {
+											"type": "integer",
+											"minimum": 0,
+											"description": "Webhooks still owed it."
+										},
+										"failed": {
+											"type": "integer",
+											"minimum": 0,
+											"description": "Webhooks whose attempts gave up."
+										},
+										"not_sent": {
+											"type": "integer",
+											"minimum": 0,
+											"description": "Webhooks it was not sent to after all."
+										},
+										"hosts": {
+											"type": "array",
+											"items": { "type": "string" },
+											"description": "The sites it was delivered to at the time, named as the covering view names sites; they may differ from the rule's current receivers there."
+										},
+										"hosts_not_listed": {
+											"type": "integer",
+											"minimum": 0,
+											"description": "Sites past the listed ones."
+										}
+									}
+								}
+							},
+							"hidden": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Rules that queued a delivery of it that are not listed: they do not cover your mailboxes now, or are past the 50 one answer judges."
+							},
+							"complete": {
+								"type": "boolean",
+								"description": "False when a delivery may be missing: the email is older than 14 days, or it has more deliveries or rules than one answer reads."
+							}
+						}
+					},
 					"from_name": {
 						"type": ["string", "null"],
 						"description": "Display name from the `From:` header, decoded for display: RFC 2047 encoded words are decoded in their declared charset and folded lines are joined (e.g. `Dana Rúiz` for `=?UTF-8?Q?Dana_R=C3=BAiz?= <dana@example.com>`). Null when the header carries no display name. For display only: identify the sender by `from_email`, never by this name, which the sender chooses freely."
@@ -45052,7 +45165,7 @@ const openapiDocument = {
 						"type": "object",
 						"additionalProperties": false,
 						"required": ["url"],
-						"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of the message gets the same `url`, so send one message per recipient when the URL identifies who to unsubscribe. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
+						"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of a message would get the same `url`, so another recipient could unsubscribe whoever it identifies: a send with `unsubscribe` must have exactly one recipient, one entry across `to`, `cc` and `bcc` (an address given twice counts twice), and a send to more is refused with a `validation_error`. Send one message per recipient, for example with `POST /v1/send-mail/batch`. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
 						"properties": {
 							"url": {
 								"type": "string",
@@ -46124,7 +46237,7 @@ const openapiDocument = {
 						"type": "object",
 						"additionalProperties": false,
 						"required": ["url"],
-						"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of the message gets the same `url`, so send one message per recipient when the URL identifies who to unsubscribe. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
+						"description": "One-click unsubscribe for the message. Primitive writes a `List-Unsubscribe` header naming `url` (and `mailto` when given) and, unless `one_click` is false, `List-Unsubscribe-Post: List-Unsubscribe=One-Click` (RFC 8058), and DKIM-signs both. A receiver that offers one-click unsubscribe sends an HTTPS POST to `url` with the form body `List-Unsubscribe=One-Click`; your endpoint records the unsubscribe. Every recipient of a message would get the same `url`, so another recipient could unsubscribe whoever it identifies: a reply with `unsubscribe` must go to the one address it answers, and one with `reply_all` that adds a cc is refused with a `validation_error`. The `headers` map refuses both header names, so this field is the only way to set them, and the headers it adds count toward the 25 entries `headers` may hold. A field whose rendered `List-Unsubscribe` would pass 980 characters is refused. Not accepted on a repeating send.",
 						"properties": {
 							"url": {
 								"type": "string",
@@ -51275,7 +51388,7 @@ const openapiDocument = {
 								"ended_at": {
 									"type": ["string", "null"],
 									"format": "date-time",
-									"description": "When it was deleted, replaced or revoked, when an API key expired, when a repeating send stopped, or when a rule request or objection was decided (accepted, declined or withdrawn); null otherwise, as on every coverage notice."
+									"description": "When it was deleted, replaced or revoked, when an API key expired, when a repeating send stopped, or when a rule request or objection was decided (accepted, declined or withdrawn); null otherwise, as on every coverage notice (rule_now marks one whose rule was deleted)."
 								},
 								"owned_now": {
 									"type": "string",
@@ -51305,10 +51418,15 @@ const openapiDocument = {
 									]
 								},
 								"rule_id": {
-									"description": "For email_rule_coverage, always: the rule it is about, since names need not be unique (for pending, the same as id). GET /v1/email-rules/covering-me/{rule_id} shows the rule while it covers you, or as it last decided on your mail; otherwise it answers not_found.",
+									"description": "For email_rule_coverage, always: the rule it is about, since names need not be unique (for pending, the same as id). GET /v1/email-rules/covering-me/{rule_id} shows the rule while it covers you, or as it last decided on your mail; otherwise it answers not_found, with details.reason rule_deleted once a rule you were told of is deleted.",
 									"type": "string",
 									"format": "uuid"
 								},
+								"rule_now": {
+									"description": "For email_rule_coverage: deleted once the rule it is about has been deleted. Left out while it exists, or when that could not be checked.",
+									"type": "string",
+									"enum": ["deleted"]
+								},
 								"receivers_change": {
 									"description": "For a receivers_changed notice: who received the rule's matches before and after, in totals. They can be equal when only an owner or a webhook site changed; covering-me shows them by owner. A rotated key counts once here while the old one still works; covering-me counts both.",
 									"type": "object",
@@ -51417,7 +51535,7 @@ const openapiDocument = {
 					"as_of": {
 						"type": ["string", "null"],
 						"format": "date-time",
-						"description": "With relation=concerning only: about when the notices last looked at your organization; null if never or unread. Coverage since may have no notice yet."
+						"description": "With relation=concerning only: about when the notices last looked at your organization; null if never or unread. Coverage since may have no notice yet. They look only while one of its rules could cover someone, so this stops moving while none could."
 					},
 					"pending_complete": {
 						"description": "With relation=concerning, on the first page only: whether the check for rules that started covering you without their start notice (state pending, listed ahead of the notices and beyond limit) was finished. false: some may be missing. Absent where there is nothing to check.",
@@ -51631,6 +51749,44 @@ const openapiDocument = {
 				},
 				"required": ["checked", "matched"]
 			},
+			"EmailRuleScopeUsed": {
+				"type": "object",
+				"properties": {
+					"evaluation_scope": {
+						"type": "string",
+						"enum": [
+							"author",
+							"own_mailboxes",
+							"selected"
+						],
+						"description": "author, own_mailboxes or selected, as a rule's evaluation_scope."
+					},
+					"scope_selection": {
+						"type": ["object", "null"],
+						"properties": {
+							"addresses": {
+								"maxItems": 100,
+								"type": "array",
+								"items": {
+									"type": "string",
+									"maxLength": 320
+								}
+							},
+							"domains": {
+								"maxItems": 50,
+								"type": "array",
+								"items": {
+									"type": "string",
+									"maxLength": 253
+								}
+							}
+						},
+						"required": ["addresses", "domains"],
+						"description": "What a selected scope names; null for any other."
+					}
+				},
+				"required": ["evaluation_scope", "scope_selection"]
+			},
 			"EmailRuleScopeSelection": {
 				"type": "object",
 				"properties": {
@@ -51725,6 +51881,10 @@ const openapiDocument = {
 						"description": "For a grant rule with questions, breadth counted on its conditions alone: the emails its questions are asked about. Null for any other rule, or when not counted in full (as breadth).",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
 					},
+					"breadth_scope": {
+						"description": "The scope breadth and conditions_breadth are counted over: evaluation_scope as sent, by default own_mailboxes. Not the saved rule's scope, which a write sets with evaluation_scope; writes ignore this, as they ignore breadth.",
+						"$ref": "#/components/schemas/EmailRuleScopeUsed"
+					},
 					"sql": {
 						"description": "Present only when include_sql was true.",
 						"type": "object",
@@ -52010,7 +52170,7 @@ const openapiDocument = {
 				"type": "object",
 				"properties": {
 					"tree": {
-						"description": "An unsaved rule tree, as POST /email-rules/compile returned it or written by hand. Give tree or rule_id, not both.",
+						"description": "An unsaved rule tree, as POST /email-rules/compile returned it or written by hand. Give one of tree, rule_id and request_id.",
 						"$ref": "#/components/schemas/EmailRuleTreeInput"
 					},
 					"evaluation_scope": {
@@ -52028,8 +52188,13 @@ const openapiDocument = {
 						"type": "string",
 						"format": "uuid"
 					},
+					"request_id": {
+						"description": "A pending rule request you can see: its rule as asked, tested as you over your own mailboxes (what accepting would share, for the member asked). Give one of tree, rule_id and request_id.",
+						"type": "string",
+						"format": "uuid"
+					},
 					"kind": {
-						"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+						"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule or a request uses its own.",
 						"type": "string",
 						"enum": ["grant", "do_not_share"]
 					},
@@ -52098,6 +52263,20 @@ const openapiDocument = {
 								"type": "integer",
 								"minimum": 0,
 								"description": "The most emails the recent window holds: 200, less one place per expected email."
+							},
+							"scope": {
+								"description": "The scope the test ran with: a saved rule's as stored, over its author's mail (GET /email-rules/{id}/scope: what it reaches now), or a tree's as sent, over yours (by default own_mailboxes). A rule covering you, tested as you: own_mailboxes, your mailboxes it covers.",
+								"$ref": "#/components/schemas/EmailRuleScopeUsed"
+							},
+							"oldest_at": {
+								"type": ["string", "null"],
+								"format": "date-time",
+								"description": "When the oldest email tested arrived, expected ones included; null when none was. The window is the newest 200 the scope reaches, so a narrower scope reaches further back: compare counts only over the same scope and span."
+							},
+							"newest_at": {
+								"type": ["string", "null"],
+								"format": "date-time",
+								"description": "When the newest email tested arrived; null when none was."
 							}
 						},
 						"required": [
@@ -52627,7 +52806,7 @@ const openapiDocument = {
 				"type": "object",
 				"properties": {
 					"tree": {
-						"description": "An unsaved rule tree, as POST /email-rules/compile returned it or written by hand. Give tree or rule_id, not both.",
+						"description": "An unsaved rule tree, as POST /email-rules/compile returned it or written by hand. Give one of tree, rule_id and request_id.",
 						"$ref": "#/components/schemas/EmailRuleTreeInput"
 					},
 					"english": {
@@ -52657,7 +52836,7 @@ const openapiDocument = {
 						"format": "uuid"
 					},
 					"kind": {
-						"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+						"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule or a request uses its own.",
 						"type": "string",
 						"enum": ["grant", "do_not_share"]
 					},
@@ -52745,7 +52924,7 @@ const openapiDocument = {
 				"type": "object",
 				"properties": {
 					"tree": {
-						"description": "An unsaved rule tree, as POST /email-rules/compile returned it or written by hand. Give tree or rule_id, not both.",
+						"description": "An unsaved rule tree, as POST /email-rules/compile returned it or written by hand. Give one of tree, rule_id and request_id.",
 						"$ref": "#/components/schemas/EmailRuleTreeInput"
 					},
 					"evaluation_scope": {
@@ -52763,8 +52942,13 @@ const openapiDocument = {
 						"type": "string",
 						"format": "uuid"
 					},
+					"request_id": {
+						"description": "A pending rule request you can see: its rule as asked, tested as you over your own mailboxes (what accepting would share, for the member asked). Give one of tree, rule_id and request_id.",
+						"type": "string",
+						"format": "uuid"
+					},
 					"kind": {
-						"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule uses its own.",
+						"description": "For an unsaved tree: do_not_share tests it as a rule that blocks sharing, so an email it cannot decide counts as matched. A saved rule or a request uses its own.",
 						"type": "string",
 						"enum": ["grant", "do_not_share"]
 					},
@@ -52863,6 +53047,10 @@ const openapiDocument = {
 						],
 						"additionalProperties": false,
 						"description": "A made-up received email. Nothing about it is stored."
+					},
+					"with_protection": {
+						"description": "With true, a grant rule that matches is also judged against the active do-not-share rules over the first recipient's mailbox, which you must read in full and the rule must run over; see protection. Limited to 20 an hour per member.",
+						"type": "boolean"
 					}
 				},
 				"required": ["email"],
@@ -52992,6 +53180,59 @@ const openapiDocument = {
 							"required": ["value", "confidence"]
 						},
 						"description": "What the classifier read from the email, by fact: its value and confidence."
+					},
+					"protection": {
+						"description": "With with_protection: whether a match would be shared. Nothing is stored.",
+						"type": "object",
+						"properties": {
+							"mailbox": {
+								"type": "string",
+								"description": "The mailbox judged: the first recipient."
+							},
+							"outcome": {
+								"type": "string",
+								"enum": [
+									"shared",
+									"withheld",
+									"not_matched"
+								],
+								"description": "not_matched: the rule did not match, so nothing would be shared and no do-not-share rule was judged."
+							},
+							"withheld_by": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"id": {
+											"type": "string",
+											"format": "uuid"
+										},
+										"name": { "type": "string" },
+										"reason": {
+											"type": "string",
+											"enum": ["matched", "undecided"]
+										}
+									},
+									"required": [
+										"id",
+										"name",
+										"reason"
+									]
+								},
+								"description": "Do-not-share rules you can see that would keep it from being shared. undecided: left undecided as real mail would leave it, or not reached by this test (past 50 rules, 10 rules' questions, or the time limit); it is held back either way."
+							},
+							"withheld_by_hidden": {
+								"type": "integer",
+								"minimum": 0,
+								"description": "Rules you cannot see that would."
+							}
+						},
+						"required": [
+							"mailbox",
+							"outcome",
+							"withheld_by",
+							"withheld_by_hidden"
+						]
 					}
 				},
 				"required": [
@@ -53069,7 +53310,7 @@ const openapiDocument = {
 						"minimum": 0
 					},
 					"objection_notice": {
-						"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+						"description": "With pending_objections above 0: that members objected (each message says what they ask: to turn it off, narrow it or explain it), and how to answer.",
 						"type": "string"
 					},
 					"created_at": {
@@ -53089,6 +53330,10 @@ const openapiDocument = {
 						"type": "array",
 						"items": { "$ref": "#/components/schemas/EmailRuleScopeWarning" }
 					},
+					"do_not_share_note": {
+						"description": "On a grant rule's create answer: that active do-not-share rules reaching an email run first: one that matches it keeps it from being shared through this rule, and one that cannot decide it holds it back while it is decided again for up to a day; it is shared through this rule only if none of them then matches it.",
+						"type": "string"
+					},
 					"expectations": {
 						"description": "Its saved expectations, each list by email id, as stored: on every create, and on an update that set or removed them.",
 						"type": "object",
@@ -53459,6 +53704,10 @@ const openapiDocument = {
 					"conditions_breadth": {
 						"description": "Ignored.",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
+					},
+					"breadth_scope": {
+						"description": "Ignored (the compile answer's breadth_scope): set a rule's scope with evaluation_scope.",
+						"$ref": "#/components/schemas/EmailRuleScopeUsed"
 					}
 				},
 				"required": [
@@ -53534,7 +53783,7 @@ const openapiDocument = {
 						"minimum": 0
 					},
 					"objection_notice": {
-						"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+						"description": "With pending_objections above 0: that members objected (each message says what they ask: to turn it off, narrow it or explain it), and how to answer.",
 						"type": "string"
 					},
 					"created_at": {
@@ -53641,7 +53890,7 @@ const openapiDocument = {
 						"minimum": 0
 					},
 					"objection_notice": {
-						"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+						"description": "With pending_objections above 0: that members objected (each message says what they ask: to turn it off, narrow it or explain it), and how to answer.",
 						"type": "string"
 					},
 					"created_at": {
@@ -53764,6 +54013,10 @@ const openapiDocument = {
 						"description": "Ignored.",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
 					},
+					"breadth_scope": {
+						"description": "Ignored (the compile answer's breadth_scope): set a rule's scope with evaluation_scope.",
+						"$ref": "#/components/schemas/EmailRuleScopeUsed"
+					},
 					"kind": {
 						"description": "Must be the rule's own (400 kind_mismatch).",
 						"type": "string",
@@ -54328,9 +54581,10 @@ const openapiDocument = {
 									"enum": [
 										"draft",
 										"created_after_email",
+										"outside_scope",
 										null
 									],
-									"description": "What is known about a rule with no result on this email. draft: the rule is a draft now. created_after_email: the rule was created after the email arrived. Null when it has a result, or when nothing is known."
+									"description": "What is known about a rule with no result on this email. draft: the rule is a draft now. created_after_email: the rule was created after the email arrived. outside_scope: the mailbox this email is in is outside what its scope names (its author's own mailboxes, its selection, or all its author reads now), so it does not decide on it. Null when it has a result, or when nothing is known (it may not have decided yet)."
 								},
 								"author_left": {
 									"description": "On a do-not-share rule whose author is no longer a member of the organization: it blocks nothing now, whatever it decided. Absent otherwise.",
@@ -54662,6 +54916,10 @@ const openapiDocument = {
 						"description": "Ignored.",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
 					},
+					"breadth_scope": {
+						"description": "Ignored (the compile answer's breadth_scope): set a rule's scope with evaluation_scope.",
+						"$ref": "#/components/schemas/EmailRuleScopeUsed"
+					},
 					"kind": {
 						"description": "Only grant.",
 						"type": "string",
@@ -54758,7 +55016,7 @@ const openapiDocument = {
 						"type": ["boolean", "null"]
 					},
 					"notice": {
-						"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+						"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, what accepting would share, then where to see what becomes of one email (rule-results). For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 						"type": ["string", "null"]
 					},
 					"target_can_accept": {
@@ -54768,6 +55026,11 @@ const openapiDocument = {
 					"target_warning": {
 						"description": "Why the member asked cannot accept it yet, naming the permission their role lacks. The request is still sent. Null when they can, or when target_can_accept is null.",
 						"type": ["string", "null"]
+					},
+					"existing": {
+						"description": "Present, as true, when the create carried an Idempotency-Key and you already had a pending request to this member asking exactly this (name, english, tree, explanation and message, naming the member the same way): that request is returned (200), and no second one is made or sent.",
+						"type": "boolean",
+						"const": true
 					}
 				},
 				"required": [
@@ -54933,7 +55196,7 @@ const openapiDocument = {
 						"type": ["boolean", "null"]
 					},
 					"notice": {
-						"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+						"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, what accepting would share, then where to see what becomes of one email (rule-results). For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 						"type": ["string", "null"]
 					}
 				},
@@ -55047,7 +55310,7 @@ const openapiDocument = {
 						"minimum": 0
 					},
 					"objection_notice": {
-						"description": "With pending_objections above 0: that members asked you to turn it off, and how to answer.",
+						"description": "With pending_objections above 0: that members objected (each message says what they ask: to turn it off, narrow it or explain it), and how to answer.",
 						"type": "string"
 					},
 					"created_at": {
@@ -55293,6 +55556,10 @@ const openapiDocument = {
 						"description": "Ignored.",
 						"anyOf": [{ "$ref": "#/components/schemas/EmailRuleBreadth" }, { "type": "null" }]
 					},
+					"breadth_scope": {
+						"description": "Ignored (the compile answer's breadth_scope): set a rule's scope with evaluation_scope.",
+						"$ref": "#/components/schemas/EmailRuleScopeUsed"
+					},
 					"kind": {
 						"description": "Only grant.",
 						"type": "string",
@@ -55315,7 +55582,7 @@ const openapiDocument = {
 					"rule": { "$ref": "#/components/schemas/EmailRuleWithVersion" },
 					"share": { "$ref": "#/components/schemas/EmailRuleShare" },
 					"notice": {
-						"description": "What is now shared, in words. When you changed the rule and it can now match mail the request left out by who it was sent to (such as mail where an address is only copied), that comes first.",
+						"description": "What is now shared, in words. When you changed the rule and it can now match mail the request left out by who it was sent to (such as mail where an address is only copied), that comes first; when you changed its english, tree or explanation (edited_on_accept; a new name alone is no change), that rule.current is what you agreed to and request what was asked.",
 						"type": "string"
 					}
 				},
@@ -55666,6 +55933,10 @@ const openapiDocument = {
 						"enum": ["grant", "do_not_share"],
 						"description": "grant: what it matches can be shared. do_not_share: it blocks sharing what it matches."
 					},
+					"do_not_share_note": {
+						"description": "On a grant rule: that the active do-not-share rules over an email run first, keeping from it what they match and holding back what they cannot decide, which is decided again for up to a day and shared only if none of them then matches it.",
+						"type": "string"
+					},
 					"author": {
 						"description": "Who wrote it.",
 						"$ref": "#/components/schemas/EmailRuleCoveringAuthor"
@@ -55755,6 +56026,10 @@ const openapiDocument = {
 						"enum": ["grant", "do_not_share"],
 						"description": "grant: what it matches can be shared. do_not_share: it blocks sharing what it matches."
 					},
+					"do_not_share_note": {
+						"description": "On a grant rule: that the active do-not-share rules over an email run first, keeping from it what they match and holding back what they cannot decide, which is decided again for up to a day and shared only if none of them then matches it.",
+						"type": "string"
+					},
 					"author": {
 						"description": "Who wrote it.",
 						"$ref": "#/components/schemas/EmailRuleCoveringAuthor"
@@ -55978,10 +56253,13 @@ const openapiDocument = {
 						"description": "Whether it is to a rule you wrote, in your current membership."
 					},
 					"message": {
-						"description": "Why the objector objects; null when none was given, or once withdrawn.",
+						"description": "Why they object and what they ask (to turn the rule off, narrow it, or explain who receives it); null when none was given, or once withdrawn.",
+						"type": ["string", "null"]
+					},
+					"decline_reason": {
+						"description": "The author's answer when declining, which the objector sees; null when none was given.",
 						"type": ["string", "null"]
 					},
-					"decline_reason": { "type": ["string", "null"] },
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -56041,7 +56319,7 @@ const openapiDocument = {
 						"type": ["string", "null"],
 						"minLength": 1,
 						"maxLength": 500,
-						"description": "Why you object, up to 500 characters; null or absent for none. The rule's author and the organization's owners and admins see it while it stands; withdrawing clears it."
+						"description": "Why you object and what you ask, up to 500 characters: to turn the rule off, to narrow it, or to explain who receives what it matches. Null or absent for none. The rule's author and the organization's owners and admins see it while it stands; withdrawing clears it."
 					}
 				},
 				"required": ["rule_id"],
@@ -56060,7 +56338,7 @@ const openapiDocument = {
 					"type": ["string", "null"],
 					"minLength": 1,
 					"maxLength": 500,
-					"description": "Why you are declining, up to 500 characters; null or absent for none. The member who objected sees it."
+					"description": "Why you are declining, up to 500 characters; null or absent for none. The member who objected sees it: it is how to answer one that asks you to narrow the rule or explain who receives it."
 				} },
 				"additionalProperties": false
 			},
@@ -60803,6 +61081,36 @@ const openapiDocument = {
 						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
 					},
 					"previous_key_id": { "type": "string" },
+					"name": {
+						"description": "The successor's name: the rotated key's, which it keeps.",
+						"type": ["string", "null"]
+					},
+					"grant": {
+						"description": "The grant the successor holds, as a create answers it: the rotated key's own, carried over unchanged (rules, addresses and domains included).",
+						"type": "object",
+						"properties": {
+							"template": { "type": ["string", "null"] },
+							"credential_grant_id": { "type": ["string", "null"] },
+							"permissions": {
+								"type": ["array", "null"],
+								"items": { "type": "string" }
+							},
+							"mail_scope": {},
+							"resources": {}
+						},
+						"required": [
+							"template",
+							"credential_grant_id",
+							"permissions",
+							"mail_scope",
+							"resources"
+						],
+						"additionalProperties": {}
+					},
+					"rotated_from": {
+						"description": "The rotated key: previous_key_id, under the name GET /v1/keys/{id} gives it.",
+						"type": "string"
+					},
 					"previous_key_expires_at": {
 						"type": "string",
 						"format": "date-time",
@@ -65202,7 +65510,7 @@ function formatConcerningRows(items, complete = false, asOf, pendingComplete) {
 	const rows = items.map((item) => [
 		item.state,
 		minute(item.created_at),
-		item.name ?? "(unnamed)",
+		`${item.name ?? "(unnamed)"}${item.rule_now === "deleted" ? " (deleted)" : ""}`,
 		item.created_through.name ?? item.created_through.id ?? "",
 		item.rule_id ?? (item.state === "pending" ? item.id : "")
 	]);
@@ -75721,8 +76029,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^3.0.0-preview.14";
-const CLI_VERSION_RANGE = "^3.0.0-preview.14";
+const SDK_VERSION_RANGE = "^3.0.0-preview.15";
+const CLI_VERSION_RANGE = "^3.0.0-preview.15";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and