primcli 3.0.0-preview.2 → 3.0.0-preview.4

package/dist/{repeats-Dj_o6c-X-BzXj5ICh.js → repeats-Dj_o6c-X-BwGkVE7e.js}

@@ -52,6 +52,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	cancelSentEmailByIdempotencyKey: () => cancelSentEmailByIdempotencyKey,
 	checkDefaultNetworkContactAdmission: () => checkDefaultNetworkContactAdmission,
 	checkDomainDns: () => checkDomainDns,
+	checkEmailRuleRequestTarget: () => checkEmailRuleRequestTarget,
 	checkSendability: () => checkSendability,
 	checkVanityInboxName: () => checkVanityInboxName,
 	claimAgentConnection: () => claimAgentConnection,
@@ -85,6 +86,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	deleteDomain: () => deleteDomain,
 	deleteEmail: () => deleteEmail,
 	deleteEmailRule: () => deleteEmailRule,
+	deleteEmailRuleRequest: () => deleteEmailRuleRequest,
 	deleteEndpoint: () => deleteEndpoint,
 	deleteFilter: () => deleteFilter,
 	deleteFunction: () => deleteFunction,
@@ -131,6 +133,9 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	getEmailRuleRequest: () => getEmailRuleRequest,
 	getEmailRuleScope: () => getEmailRuleScope,
 	getEmailRuleShare: () => getEmailRuleShare,
+	getEmailRuleVocabulary: () => getEmailRuleVocabulary,
+	getEndpoint: () => getEndpoint,
+	getEndpointSigningSecret: () => getEndpointSigningSecret,
 	getFunction: () => getFunction,
 	getFunctionDeployment: () => getFunctionDeployment,
 	getFunctionInvocation: () => getFunctionInvocation,
@@ -276,6 +281,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	revokeOAuthGrant: () => revokeOAuthGrant,
 	revokeOrganizationInvitation: () => revokeOrganizationInvitation,
 	revokeProjectInvitation: () => revokeProjectInvitation,
+	rotateEndpointSigningSecret: () => rotateEndpointSigningSecret,
 	rotateKey: () => rotateKey,
 	rotateWebhookSecret: () => rotateWebhookSecret,
 	runWakeSchedule: () => runWakeSchedule,
@@ -664,10 +670,7 @@ const getStorageStats = (options) => (options?.client ?? client).get({
 * secret exists yet, one is generated automatically on first
 * access.
 *
-* Signing is account-scoped, not per-endpoint. Every webhook
-* delivery from any of your registered endpoints is signed
-* with this single secret. Rotate via
-* `POST /account/webhook-secret/rotate`.
+* Every webhook is signed with this secret unless it has its own. Rotate this secret via `POST /account/webhook-secret/rotate`. A webhook whose signed_with is own_secret is signed with its own secret instead; read it from GET /endpoints/{id}/signing-secret. A webhook's own secret rotates via `POST /endpoints/{id}/signing-secret/rotate`.
 *
 * **Secret format**: the returned string looks base64-shaped
 * (e.g. `XNHBBW8VqoBjRfNs1tkZj11jTk...`) but is NOT base64.
@@ -1217,10 +1220,7 @@ const listEndpoints = (options) => (options?.client ?? client).get({
 * instead. Subject to plan limits on the number of active
 * endpoints.
 *
-* **Signing is account-scoped, not per-endpoint.** This call
-* does not return any signing material; every endpoint on the
-* account uses the same webhook secret, fetched via
-* `GET /account/webhook-secret`. See the API-level "Webhook
+* **Signing.** A webhook is signed with the organization's webhook secret (`GET /account/webhook-secret`) unless it has its own. A webhook made as a person's own, or by an API key limited to some mailboxes, a third-party app or an agent delegate for itself, is made with its own secret: the response carries it once as `signing_secret`, and `GET /endpoints/{id}/signing-secret` returns it afterwards. Other webhooks, those a person who can read every mailbox makes among them, sign with the organization's secret until given their own. `signed_with` on the endpoint says which secret signs it. See the API-level "Webhook
 * signing" section for the full wire format (header name,
 * signed string, hash algo, secret format, tolerance) and a
 * language-agnostic verification recipe.
@@ -1264,11 +1264,22 @@ const deleteEndpoint = (options) => (options.client ?? client).delete({
 	...options
 });
 /**
+* Get an endpoint
+*
+* One endpoint, as GET /endpoints shows it, to a caller who would see it there. Any other id, a deleted endpoint's included, answers 404.
+*/
+const getEndpoint = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}",
+	...options
+});
+/**
 * Update a webhook endpoint
 *
-* Updates an active webhook endpoint. If the URL is changed, the old
-* endpoint is deactivated and a new one is created (or an existing
-* deactivated endpoint with the new URL is reactivated).
+* Updates an active webhook endpoint. Changing the URL keeps the endpoint: its id, recipient routes, signing secret, delivery history and any deliveries still owed to it stay with it, and owed deliveries go to the new URL. Another active endpoint at the new URL is refused.
 *
 *
 * Pull destinations cannot be assigned a URL, function or recipient-routing domain. Existing endpoint deletion disconnects the destination; creating a new destination does not backfill historical events.
@@ -3579,9 +3590,22 @@ const getWebhookDeliveryStats = (options) => (options?.client ?? client).get({
 	...options
 });
 /**
+* Read the column catalog
+*
+* What a rule tree you write yourself can say: each column of the current vocabulary with its type, source, meaning, operators and the value each takes, options, and whether it takes min_confidence; and the tree's limits, its stored size included. Built from the checks a saved or tested tree must pass. A tree is {version: tree_version, vocabulary: version, when, questions}. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
+*/
+const getEmailRuleVocabulary = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rules/vocabulary",
+	...options
+});
+/**
 * Compile a rule description
 *
-* Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to three yes/no questions, asked about an email only after its conditions match. Nothing is saved. The SQL the rule renders to is returned only when include_sql is true. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to three yes/no questions, asked about an email only after its conditions match. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default), so a warning can say when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const compileEmailRule = (options) => (options.client ?? client).post({
 	security: [{
@@ -3598,7 +3622,7 @@ const compileEmailRule = (options) => (options.client ?? client).post({
 /**
 * Test a rule against received mail
 *
-* Runs a rule over received mail and reports what it would decide for each email: matched, near_miss, no_match, unclassified or not_found. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version, run with its author's access). Either way the rule reads only mail its author can read, and only what its scope covers. Without email_ids, the newest emails it can read are tested, at most 200 and none older than 30 days. Emails not classified yet that arrived more than 2 hours ago are classified first and their classification is saved, unless classify_missing is false; newer ones are left to normal classification and reported unclassified with reason pending. The rule itself records nothing and grants nothing. Classification and the rule's own questions stop at about 90 seconds; run the test again to continue where it stopped. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Runs a rule over received mail and reports what it would decide for each email (matched, near_miss, no_match, unclassified or not_found), with a summary: how each top-level condition and question decided and, when nothing matched, what stopped it. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version, run with its author's access). The rule reads only mail its author can read and its scope covers; an unsaved tree covers only your own mail unless evaluation_scope names more. Without email_ids, the newest emails it can read are tested, at most 200 and none older than 30 days; expected emails (expect, or a saved rule's saved expectations) are tested whatever their age. Unclassified emails more than 2 hours old are classified first and their classification saved, unless classify_missing is false; newer ones are reported unclassified, pending. The rule itself records and grants nothing. Classification and the rule's questions stop at about 90 seconds; a rerun continues the classification where it stopped. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const testEmailRule = (options) => (options.client ?? client).post({
 	security: [{
@@ -3615,7 +3639,7 @@ const testEmailRule = (options) => (options.client ?? client).post({
 /**
 * Test a rule against a made-up email
 *
-* Reports what a rule would decide for an email you describe: its sender, recipients, subject, plain text and attachment types, and optionally whether it is automated or from a mailing list and its spam score. The email is classified the way received mail is, and the rule's conditions and its own questions are decided as they would be for received mail with that content and those signals, received now. Without them it is not automated and not from a mailing list; a rule that reads a spam score you gave none for is decided on no score, and spam_score is listed in unset_columns. Nothing is stored: no email, classification or decision. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version). The answer includes what the classifier read from the email. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Reports what a rule would decide for an email you describe (sender, recipients, subject, plain text, attachment types; optionally whether it is automated or from a mailing list, and its spam score), received now: it is classified, and the conditions and questions decided, as received mail would be. By default it is not automated or from a list; a rule reading a spam score you gave none for decides on none (spam_score is then in unset_columns). Nothing is stored. Test an unsaved tree (covering only your own mail unless evaluation_scope names more) or a saved rule by rule_id. The answer includes what the classifier read. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const testEmailRuleOnSample = (options) => (options.client ?? client).post({
 	security: [{
@@ -3632,7 +3656,7 @@ const testEmailRuleOnSample = (options) => (options.client ?? client).post({
 /**
 * List rules
 *
-* The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. With matched_email_id, only the rules that matched that email. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. Each carries its scope (evaluation_scope, and scope_selection for a selected rule). With matched_email_id, only the rules that matched that email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRules = (options) => (options?.client ?? client).get({
 	security: [{
@@ -3645,7 +3669,7 @@ const listEmailRules = (options) => (options?.client ?? client).get({
 /**
 * Create a rule
 *
-* Saves a rule as version 1, from a compile response or a tree you wrote. The tree is checked against the column contract. New rules start in observe, where what the rule matches is recorded and nothing is granted; draft is not evaluated. The caller is the rule's author, and the rule never reaches mail the author cannot read. evaluation_scope (author when omitted) chooses whose mail it runs over; scope_selection may name only what you can read. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Saves a rule as version 1 from a compile response or a tree you wrote, checked against the column contract; without an explanation the server writes one. It starts in observe (what it matches is recorded, nothing granted or blocked) unless state is draft (not evaluated). You are its author, and it never reaches mail you cannot read. evaluation_scope is own_mailboxes (your own mail) unless you name author (all you can read) or selected; scope_selection may name only what you can read. The answer carries the scope as stored. expectations saves emails it must match and must not; the answer judges them (expectations_check). kind do_not_share blocks sharing: it runs before every other rule, and while active no rule shares an email it matches or cannot decide; a key cannot list it (details.reason rule_blocks_sharing). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const createEmailRule = (options) => (options.client ?? client).post({
 	security: [{
@@ -3662,7 +3686,7 @@ const createEmailRule = (options) => (options.client ?? client).post({
 /**
 * Delete a rule
 *
-* Deletes a rule with its versions, its decisions and the access it granted. The author, or a caller who reads the whole organization's mail, may delete it; while it is shared with another member, only the author or someone who manages members from the dashboard. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Deletes a rule with its versions, its decisions and the access it granted. The author, or a caller who reads the whole organization's mail, may delete it; while it is shared with another member, only the author or someone who manages members from the dashboard. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const deleteEmailRule = (options) => (options.client ?? client).delete({
 	security: [{
@@ -3675,7 +3699,7 @@ const deleteEmailRule = (options) => (options.client ?? client).delete({
 /**
 * Read a rule
 *
-* A rule and its current version. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* A rule, its scope (evaluation_scope, and scope_selection for a selected rule), its current version and its saved expectations. What the scope comes to for its author now is GET /email-rules/{id}/scope. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const getEmailRule = (options) => (options.client ?? client).get({
 	security: [{
@@ -3688,7 +3712,7 @@ const getEmailRule = (options) => (options.client ?? client).get({
 /**
 * Change a rule
 *
-* Renames the rule, saves a new version (english, tree and explanation together; earlier versions are kept unchanged), changes its state (draft, disabled; observe; or active) or changes whose mail it runs over (evaluation_scope, with scope_selection when selected). Only the rule's author may rename it, add a version, change its scope or move it to observe or active; anyone else who can see it may only disable it (state draft), and while it is shared with another member only if they manage members from the dashboard. Omit evaluation_scope to keep the current scope. A scope change saves a new version with the same conditions; what was granted stays. A shared rule keeps its scope. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Renames the rule, saves a new version (english and tree together, with an explanation or one the server writes; earlier versions stay), changes its state (draft is off; observe; active), whose mail it runs over (evaluation_scope, with scope_selection when selected) or its saved expectations (each saved version and new set is judged in expectations_check). Anyone but its author who sees it may only disable it (state draft), and while it is shared only if they manage members from the dashboard. Without evaluation_scope the scope stays; a scope change saves a new version with the same conditions, and what was granted stays. A shared rule keeps its scope; a kind never changes. Send if_version, the current_version you read, so a write never replaces a version saved since. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const updateEmailRule = (options) => (options.client ?? client).patch({
 	security: [{
@@ -3705,7 +3729,7 @@ const updateEmailRule = (options) => (options.client ?? client).patch({
 /**
 * List a rule's decisions
 *
-* What the rule decided for each email it was evaluated against, newest first: whether it matched, whether it nearly did, how each part decided and the answers to its questions. Only decisions on emails the caller can read are listed. With matched, only matches (true) or only the rest (false). Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* What the rule decided for each email it was evaluated against, newest first: whether it matched, whether it nearly did, how each part decided and the answers to its questions, with which email it was (from_address, subject, received_at). Only decisions on emails the caller can read are listed. With matched, only matches (true) or only the rest (false). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRuleDecisions = (options) => (options.client ?? client).get({
 	security: [{
@@ -3718,7 +3742,7 @@ const listEmailRuleDecisions = (options) => (options.client ?? client).get({
 /**
 * List every rule's result on an email
 *
-* Every rule the caller can see and what it decided about this email: those that matched, those that did not, and those that have not run on it, with what is known about them. A result names the version of the rule that decided and carries that version's conditions and questions. Only a caller who can read the email gets an answer, and a rule the caller cannot see is left out. At most 50 rules are listed, those with a result first; hidden counts the rest. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Every rule you can see and what it decided about this email (matched, not matched, or not run, with what is known), in the words of the version that decided. A matched do_not_share rule keeps rules from sharing the email while it is active; what was shared before then stays shared. Only a caller who can read the email gets an answer. classification is what the classifier read from the email, every fact as rule conditions read it, so you can see why a rule did or did not match. At most 50 rules are listed, those with a result first; hidden counts the rest. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRuleResults = (options) => (options.client ?? client).get({
 	security: [{
@@ -3731,7 +3755,7 @@ const listEmailRuleResults = (options) => (options.client ?? client).get({
 /**
 * Read versions of a rule
 *
-* The named versions of a rule, as they were written: what each one's conditions and questions were, so a decision can be read against the version that made it. Numbers that are not versions of the rule are left out. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* A rule's versions as they were written: what each one's conditions and questions were, so a decision can be read against the version that made it. Without versions, every version newest first, a page at a time (meta.cursor). With versions, only those named, oldest first; numbers that are not versions of the rule are left out. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRuleVersions = (options) => (options.client ?? client).get({
 	security: [{
@@ -3744,7 +3768,7 @@ const listEmailRuleVersions = (options) => (options.client ?? client).get({
 /**
 * Read what a rule covers
 *
-* Whose mail the rule runs over, and what that comes to now: a rule never reaches further than what its author can read when it runs, so what a selected rule names and its author can no longer read stops matching. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Whose mail the rule runs over, and what that comes to now: a rule never reaches further than what its author can read when it runs, so what a selected rule names and its author can no longer read stops matching. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const getEmailRuleScope = (options) => (options.client ?? client).get({
 	security: [{
@@ -3757,7 +3781,7 @@ const getEmailRuleScope = (options) => (options.client ?? client).get({
 /**
 * List what a rule can cover
 *
-* How much the caller can read, and the inboxes and domains the caller can read, which is what they may name when a rule runs over selected inboxes and domains. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* How much the caller can read, and the inboxes and domains the caller can read, which is what they may name when a rule runs over selected inboxes and domains. For a caller who reads the whole organization, addresses lists the inboxes known as someone's (member addresses, members' verified work emails at the organization's domains, agents' addresses and inboxes with shared access), not every address that receives mail: may_name_unlisted says when an address that is not listed, such as an inbox nobody has claimed, may be named too. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRuleScopeOptions = (options) => (options?.client ?? client).get({
 	security: [{
@@ -3770,7 +3794,7 @@ const listEmailRuleScopeOptions = (options) => (options?.client ?? client).get({
 /**
 * List rule requests
 *
-* Rule requests, newest first: those made to you (box incoming, the default), those you made (outgoing), or every one you can see (all). Pending ones by default; status decided lists accepted, declined and withdrawn ones, and any lists both. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Rule requests, newest first: those made to you (box incoming, the default), those you made (outgoing), or every one you can see (all). Pending ones by default; status decided lists accepted, declined and withdrawn ones, and any lists both. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRuleRequests = (options) => (options?.client ?? client).get({
 	security: [{
@@ -3783,7 +3807,7 @@ const listEmailRuleRequests = (options) => (options?.client ?? client).get({
 /**
 * Ask a member for a rule
 *
-* Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address (at most 30 lookups by address an hour). Nothing is evaluated and nothing is shared until they accept, and they may change the rule first; they see the request and can preview what it matches in their own mail. You may have at most 5 pending requests to one member and 50 in all. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address (at most 30 lookups by address an hour). Nothing is evaluated and nothing is shared until they accept, and they may change the rule first; they see the request and can preview what it matches in their own mail. You may have at most 5 pending requests to one member and 50 in all. If you can list members (members:read), the answer also says whether they can accept it under their role (target_can_accept), and if not, why (target_warning); the request is sent either way. To find out before asking, use POST /v1/email-rule-requests/target-check. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const createEmailRuleRequest = (options) => (options.client ?? client).post({
 	security: [{
@@ -3798,9 +3822,39 @@ const createEmailRuleRequest = (options) => (options.client ?? client).post({
 	}
 });
 /**
+* Check whether a member can accept a rule request
+*
+* Says, before you ask, whether a member could accept a rule request now under their role, and if not, which permission their role lacks. Nothing is sent and nothing is recorded. Needs members:read, as listing members and their roles does. At most 60 checks an hour. Name them by user id, or by their member mailbox address (counted with asking: at most 30 lookups by address an hour). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
+*/
+const checkEmailRuleRequestTarget = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rule-requests/target-check",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Delete a withdrawn rule request
+*
+* Deletes a request you withdrew, for everyone who could see it. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
+*/
+const deleteEmailRuleRequest = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rule-requests/{id}",
+	...options
+});
+/**
 * Read a rule request
 *
-* A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const getEmailRuleRequest = (options) => (options.client ?? client).get({
 	security: [{
@@ -3813,7 +3867,7 @@ const getEmailRuleRequest = (options) => (options.client ?? client).get({
 /**
 * Decline a rule request
 *
-* Declines a pending request made to you. Nothing is written but the decision. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Declines a pending request made to you. Nothing is written but the decision. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const declineEmailRuleRequest = (options) => (options.client ?? client).post({
 	security: [{
@@ -3826,7 +3880,7 @@ const declineEmailRuleRequest = (options) => (options.client ?? client).post({
 /**
 * Withdraw a rule request
 *
-* Withdraws a pending request you made. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Withdraws a pending request you made. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const withdrawEmailRuleRequest = (options) => (options.client ?? client).post({
 	security: [{
@@ -3839,7 +3893,7 @@ const withdrawEmailRuleRequest = (options) => (options.client ?? client).post({
 /**
 * Accept a rule request
 *
-* Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked. Send no body to accept it as asked, or change it first with english, tree and explanation together. Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Also needs mail:send_as_member: a role that can only read this mailbox is refused. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Also needs mail:share_own (sharing your own mail through email rules, which only shows it and never sends): a role without it is refused, whether or not it can send. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const acceptEmailRuleRequest = (options) => (options.client ?? client).post({
 	security: [{
@@ -3856,7 +3910,7 @@ const acceptEmailRuleRequest = (options) => (options.client ?? client).post({
 /**
 * List rule shares
 *
-* Lists rules shared with you, rules you share, or every share you can see. A share is visible to its two people and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Lists rules shared with you, rules you share, or every share you can see. A share is visible to its two people and the organization's owners and admins. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRuleShares = (options) => (options?.client ?? client).get({
 	security: [{
@@ -3895,7 +3949,7 @@ const endEmailRuleShare = (options) => (options.client ?? client).delete({
 /**
 * Get a rule share
 *
-* One share. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* One share. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const getEmailRuleShare = (options) => (options.client ?? client).get({
 	security: [{
@@ -3906,9 +3960,9 @@ const getEmailRuleShare = (options) => (options.client ?? client).get({
 	...options
 });
 /**
-* List the emails a rule share has given you
+* List the emails a rule share has given
 *
-* The emails a rule shared with you has matched, newest first, as the email list shows them. Only the person it was shared with can list them, from the dashboard or the Primitive CLI. An ended share lists nothing. A page can be short or empty and still carry a cursor: keep reading until meta.cursor is null.
+* The emails a rule share has given, newest first, as the email list shows them, each with shared_at: when the share's rule first matched it. For the person it was shared with: what they can read through it now, so an ended share lists nothing. For the person sharing their mail: everything it has handed over while it ran, including after it ended, so they can see what left their mailbox; while the share's rule is off this answers email_rule_not_active instead. Only those two people can list them, from the dashboard or the Primitive CLI. A page can be short or empty and still carry a cursor: keep reading until meta.cursor is null.
 */
 const listEmailRuleShareEmails = (options) => (options.client ?? client).get({
 	security: [{
@@ -4475,7 +4529,7 @@ const checkSendability = (options) => (options.client ?? client).post({
 /**
 * Get a webhook delivery
 *
-* One webhook delivery attempt record, by the id listDeliveries returns.
+* One webhook delivery attempt record, by the id listDeliveries returns, with every attempt of the same delivery (a retry is recorded as a new attempt with its own id).
 */
 const getDelivery = (options) => (options.client ?? client).get({
 	security: [{
@@ -4726,7 +4780,7 @@ const updateGroup = (options) => (options.client ?? client).patch({
 /**
 * List every credential
 *
-* Every credential that can act in the organization: API keys, Function keys, agent connection keys, connected apps (OAuth), agent delegates and, where enabled, CLI logins. Secrets are never returned. Filter with kind. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* Every credential that can act in the organization: API keys, Function keys, agent connection keys, connected apps (OAuth), agent delegates and, where enabled, CLI logins. Secrets are never returned. A key's grant.mail_scope.depth is raw only when it holds mail.raw:read and its scope lists an address or a domain, otherwise content. Filter with kind. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.
 */
@@ -4741,9 +4795,9 @@ const listCredentials = (options) => (options?.client ?? client).get({
 /**
 * Revoke a credential
 *
-* Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up keeps working and is listed in standing_objects for review. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up keeps working and is listed in standing_objects for review. The person's own Primitive CLI login revokes an API key (kind org_key) as the person, with no step-up unless the organization's credential policy sets cli_writes_require_approval (then it takes a keys.create step-up); every other kind (a connected key named as org_key included, 403 grant_forbidden target_not_covered), and every other app even with a step-up, is refused outside the dashboard (403). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
-* Person only: a dashboard session. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.
+* Person only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.
 */
 const revokeCredential = (options) => (options.client ?? client).post({
 	security: [{
@@ -4760,7 +4814,7 @@ const revokeCredential = (options) => (options.client ?? client).post({
 /**
 * Revoke every credential (emergency)
 *
-* The emergency response to a leak: revokes every API key, agent connection key and connected app created since a time, rotates the organization Function key and every running Function's own key, and optionally suspends Functions. Owners only, from a dashboard session, and the body must confirm with "revoke all". Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* The emergency response to a leak: revokes every API key, agent connection key and connected app created since a time, rotates the organization Function key and every running Function's own key, and optionally suspends Functions. Owners only, from a dashboard session, and the body must confirm with "revoke all". Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credentials:revoke_all. API keys, agent connection keys and agents are refused.
 */
@@ -4779,7 +4833,7 @@ const revokeAllCredentials = (options) => (options.client ?? client).post({
 /**
 * Read the credential audit trail
 *
-* Credential events (created, rotated, edited, revoked, used with a step-up, policy changes), newest first, with a cursor. format=csv returns the same page as CSV. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* Credential events (created, rotated, edited, revoked, used with a step-up, policy changes), newest first, with a cursor. format=csv returns the same page as CSV. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credential_events:read. API keys, agent connection keys and agents are refused.
 */
@@ -4794,7 +4848,7 @@ const listCredentialEvents = (options) => (options?.client ?? client).get({
 /**
 * Read the credential policy
 *
-* The organization credential policy: key lifetime and expiry rules, who may create super admin keys, whether members may create keys and the other rules every new key is held to. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* The organization credential policy: key lifetime and expiry rules, who may create super admin keys, whether members may create keys and the other rules every new key is held to. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.
 */
@@ -4809,7 +4863,7 @@ const getCredentialPolicy = (options) => (options?.client ?? client).get({
 /**
 * Change the credential policy
 *
-* Change one or more policy rules. Admins may only tighten the policy; loosening any rule needs an owner. Owners and admins are emailed about every change. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* Change one or more policy rules. Admins may only tighten the policy; loosening any rule needs an owner. Owners and admins are emailed about every change. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credential_policy:manage. API keys, agent connection keys and agents are refused.
 */
@@ -4828,7 +4882,7 @@ const updateCredentialPolicy = (options) => (options.client ?? client).patch({
 /**
 * Read the key builder
 *
-* The key presets the caller may use (each with whether it is available and why not), the permission matrix for custom keys and the policy in force. An area marked org_wide_only (Members) is listed only to a person who holds its permission, and only a custom key with no addresses or domains may hold it. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* The key presets the caller may use (each with whether it is available and why not), the permission matrix for custom keys and the policy in force. An area marked org_wide_only (Members) is listed only to a person who holds its permission, and only a custom key with no addresses or domains may hold it. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.
 */
@@ -4843,7 +4897,7 @@ const getKeyBuilder = (options) => (options?.client ?? client).get({
 /**
 * List API keys
 *
-* Key metadata, never a secret: name, prefix, grant, creator, last use, expiry and suspension. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* Key metadata, never a secret: name, prefix, grant, creator, last use, expiry, suspension and whether each key works now (status). A grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.
 */
@@ -4858,9 +4912,9 @@ const listKeys = (options) => (options?.client ?? client).get({
 /**
 * Create an API key
 *
-* Create an API key, super admin or narrowed to a preset or a custom permission set, optionally with an expiry and conditions. The secret is returned once. A key never holds more than the person creating it; the credential policy decides who may create which keys. grant is required: a request without it is refused (400 validation_error, details.reason grant_required), never treated as super admin. A custom key must say which mail it reaches: the addresses and domains it lists (grant.addresses, grant.domains), or every mailbox in the organization with grant.mail_scope "org", which cannot be combined with them; one that says neither is refused (400 validation_error, details.reason mail_scope_required). Super admin, Send only and Read only reach every mailbox by definition. members:read is only for an org-wide custom key: naming it with grant.addresses or grant.domains is refused (400). Owners and admins are emailed about every super admin key. Send an Idempotency-Key to retry safely: a second create by the same person under the same key makes no second key and is refused (409 idempotency_key_reused) with the first key's id in error.details.key_id, so a caller whose first answer was lost can revoke that key. The onboarding field is for the dashboard only. The Primitive CLI takes the same step-up; the Primitive app's token is refused, even with one. While the organization's keys API is not enabled, this answers 404 feature_disabled, except that a dashboard session may still create a super admin key (the dashboard's own create).
+* Create an API key, super admin or narrowed to a preset or a custom permission set, optionally with an expiry and conditions. The secret is returned once. A key never holds more than the person creating it; the credential policy decides who may create which keys. grant is required: a request without it is refused (400 validation_error, details.reason grant_required), never treated as super admin. A custom key must say which mail it reaches: the addresses and domains it lists (grant.addresses, grant.domains), or every mailbox in the organization with grant.mail_scope "org", which cannot be combined with them; one that says neither is refused (400 validation_error, details.reason mail_scope_required). Super admin, Send only and Read only reach every mailbox by definition. members:read is only for an org-wide custom key: naming it with grant.addresses or grant.domains is refused (400). Owners and admins are emailed about every super admin key. Send an Idempotency-Key to retry safely: a second create by the same person under the same key makes no second key and is refused (409 idempotency_key_reused) with the first key's id in error.details.key_id, so a caller whose first answer was lost can revoke that key. The onboarding field is for the dashboard only. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. While the organization's keys API is not enabled, this answers 404 feature_disabled (details.feature keys_api; contact Primitive to turn it on), except that a dashboard session may still create a super admin key (the dashboard's own create).
 *
-* Person only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
+* Person only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
 */
 const createKey = (options) => (options.client ?? client).post({
 	security: [{
@@ -4877,9 +4931,9 @@ const createKey = (options) => (options.client ?? client).post({
 /**
 * Rotate an API key
 *
-* Mint a successor with the same grant and return its secret once. The old key keeps working for overlap_seconds, then stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner created is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The Primitive CLI takes the same step-up; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
-* Person only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
+* Person only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
 */
 const rotateKey = (options) => (options.client ?? client).post({
 	security: [{
@@ -4896,7 +4950,7 @@ const rotateKey = (options) => (options.client ?? client).post({
 /**
 * Get an API key
 *
-* One key's metadata, never its secret. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* One key's metadata, never its secret, with whether it works now (status). Its grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.
 */
@@ -4911,9 +4965,9 @@ const getKey = (options) => (options.client ?? client).get({
 /**
 * Change an API key
 *
-* Rename a key, change its expiry, its grant or its conditions, or suspend it. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. The Primitive CLI takes the same step-up; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* Rename a key, change its expiry, its grant or its conditions, or suspend it. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
-* Person only: a dashboard session, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one an OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
+* Person only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
 */
 const updateKey = (options) => (options.client ?? client).patch({
 	security: [{
@@ -4930,7 +4984,7 @@ const updateKey = (options) => (options.client ?? client).patch({
 /**
 * Suggest a least-privilege grant for a key
 *
-* The permissions a key used over the last 30 days, as a custom grant that would have served every successful call (also as builder areas), the narrowest mail scope its calls support (depth is deprecated: raw when it downloaded raw MIME, otherwise content) (the mailboxes of the messages it named and sent, with notes on what the request log cannot account for), and whether it is unused. Calls to routes only the super admin key can use (groups and mailbox access) derive no permission, since a custom key is refused there; super_admin_only_calls counts them. usage gives the same window anonymized: successful and failed requests per UTC day, the routes called by their declared template (never the called path) with the permission each needed, and how many mailboxes the key read and sent from (counts only, and only for a person with access to the whole organization's mail). Nothing is applied: narrowing is a change to the key (PATCH /v1/keys/:id). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.
+* The permissions a key used over the last 30 days, as a custom grant that would have served every successful call (also as builder areas), the narrowest mail scope its calls support (depth is deprecated: raw when it downloaded raw MIME, otherwise content) (the mailboxes of the messages it named and sent, with notes on what the request log cannot account for), and whether it is unused. Calls to routes only the super admin key can use (groups and mailbox access) derive no permission, since a custom key is refused there; super_admin_only_calls counts them. usage gives the same window anonymized: successful and failed requests per UTC day, the routes called by their declared template (never the called path) with the permission each needed, and how many mailboxes the key read and sent from (counts only, and only for a person with access to the whole organization's mail). Nothing is applied: narrowing is a change to the key (PATCH /v1/keys/:id). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.
 */
@@ -5124,7 +5178,7 @@ const listRoles = (options) => (options?.client ?? client).get({
 /**
 * Create a custom role
 *
-* A role nobody can use to gain access they do not hold: its permissions and mail scope must be within the author's own. mail_scope is "org" (the default) or { addresses, domains }; any other value is refused with 400 `validation_error`. Every role that reaches mail reads it in full, and raw MIME follows the role's mail.raw:read; `depth` is deprecated and ignored. Its mail scope names no other member's personal mailbox: otherwise 403 `grant_forbidden` with `details.reason` `personal_mailbox_member_only`. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `roles.write` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs roles:assign. API keys are refused.
+* A role nobody can use to gain access they do not hold: its permissions and mail scope must be within the author's own. mail_scope is "org" (the default) or { addresses, domains }; any other value is refused with 400 `validation_error`. Every role that reaches mail reads it in full, and raw MIME follows the role's mail.raw:read; `depth` is deprecated and ignored. Its mail scope names no other member's personal mailbox: otherwise 403 `grant_forbidden` with `details.reason` `personal_mailbox_member_only`. Each permission must have what it requires in the same role: mail:read for mail.raw:read, mail.search:semantic, mail:share_own, changes:read and webhooks:read; mail:send for mail:send_batch and mail:send_as_member; functions:deploy for templates:install; agent_connections:manage for agent_connections:custom_domains. Otherwise 400 `validation_error` with `details.reason` `unmet_requirement`, `details.permission` and `details.requires`. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `roles.write` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs roles:assign. API keys are refused.
 */
 const createRole = (options) => (options.client ?? client).post({
 	security: [{
@@ -5154,7 +5208,7 @@ const deleteRole = (options) => (options.client ?? client).delete({
 /**
 * Change a custom role
 *
-* A new version of the role, with a new `id`: the version you edited is retired, the response is the new one (same `key`, `version` one higher), and every member and group holding the role moves to it. The old id answers 404 `not_found` from then on, so store the returned `id` (or look the role up by `key` in GET /roles) before editing or assigning it again. Every holder whose access shrinks goes through the reduction path. mail_scope follows the same rules as creating a role; a role whose stored scope cannot be read must be sent a new mail_scope, otherwise 400 `validation_error` with `details.reason` `invalid_mail_scope`.  A personal mailbox the new version adds must be the author's own, and every holder must be the member of each personal mailbox it names: otherwise 403 `grant_forbidden` with `details.reason` `personal_mailbox_member_only`. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `roles.write` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs roles:assign. API keys are refused.
+* A new version of the role, with a new `id`: the version you edited is retired, the response is the new one (same `key`, `version` one higher), and every member and group holding the role moves to it. The old id answers 404 `not_found` from then on, so store the returned `id` (or look the role up by `key` in GET /roles) before editing or assigning it again. Every holder whose access shrinks goes through the reduction path. mail_scope follows the same rules as creating a role; a role whose stored scope cannot be read must be sent a new mail_scope, otherwise 400 `validation_error` with `details.reason` `invalid_mail_scope`.  A personal mailbox the new version adds must be the author's own, and every holder must be the member of each personal mailbox it names: otherwise 403 `grant_forbidden` with `details.reason` `personal_mailbox_member_only`. Each permission in the new version must have what it requires in the same role, as when creating one, including permissions carried over unchanged. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `roles.write` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs roles:assign. API keys are refused.
 */
 const updateRole = (options) => (options.client ?? client).patch({
 	security: [{
@@ -5377,7 +5431,7 @@ const listSuspensions = (options) => (options?.client ?? client).get({
 /**
 * Decide a suspension
 *
-* Keep, narrow or revoke one suspended or flagged item. Keeping it, and revoking an API key, needs the decider to cover it (revoking an uncovered key is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.
+* Keep, narrow or revoke one suspended or flagged item. Keeping it, and revoking an API key, needs the decider to cover it (revoking an uncovered key is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. A rule share paused by a role change (`email_rule_share`) takes keep, which leaves it paused, or revoke, which ends the share and needs confirm: true (the person it was shared with loses the emails already shared; without it, 409 `confirmation_required`, as for revoking a filter). Neither of the share's two people may keep it (`grant_forbidden`, `share_decision_forbidden`). Access a person gave on their own mailbox (`mailbox_access`) takes keep or revoke, and both need delegations:manage; revoke removes only what that person gave on that mailbox. Nobody the access reaches, nor the person who gave it, may keep it (`grant_forbidden`, `mailbox_access_decision_forbidden`). Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.
 */
 const decideSuspension = (options) => (options.client ?? client).post({
 	security: [{
@@ -5499,6 +5553,32 @@ const releaseSentEmail = (options) => (options.client ?? client).post({
 	}
 });
 /**
+* Get a webhook's own signing secret
+*
+* The secret deliveries to this webhook are signed with, when it signs with its own (signed_with is own_secret). Verify the Primitive-Signature header with it. A webhook a person owns is given its secret the first time it is asked for. A webhook that signs with the organization's secret answers 409 conflict: rotate its signing secret to give it its own. Answered to the person who owns the webhook; for a webhook an API key owns, to the key that acts for it and the person who holds that key; for one a third-party app or an agent delegate owns, to that app or delegate; and for a webhook the organization owns, to a caller who may change it and holds webhook_secret:read.
+*/
+const getEndpointSigningSecret = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}/signing-secret",
+	...options
+});
+/**
+* Rotate a webhook's signing secret, or give it its own
+*
+* Replaces the webhook's own signing secret, or gives a webhook that signs with the organization's secret one of its own, and returns it. Deliveries are signed with the new secret at once, so update the handler at the same time. Answered to the person who owns the webhook; for a webhook an API key owns, to the key that acts for it and the person who holds that key; for one a third-party app or an agent delegate owns, to that app or delegate; and for a webhook the organization owns, to a caller who may change it and holds webhook_secret:read.
+*/
+const rotateEndpointSigningSecret = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}/signing-secret/rotate",
+	...options
+});
+/**
 * Send a batch of emails in one request
 *
 * Send up to 100 independent messages in a single call. Each message uses the same body schema and the same send path as `POST /send-mail`, so auth, validation, rate limiting, and idempotency apply per message. Messages are processed independently: one failing does not fail the others. Every message gets an entry in `results` carrying either `data` (on success) or `error` (on failure), with the original `index`.
@@ -6935,7 +7015,7 @@ function parseFromHeader(header) {
 		value: { address: address.toLowerCase() }
 	};
 }
-// ../sdk-node/dist/trust-BNsucxtE.js
+// ../sdk-node/dist/understanding-CNZLYYam.js
 /**
 * AUTO-GENERATED - DO NOT EDIT
 * Run `pnpm generate:validator` to regenerate.
@@ -7073,9 +7153,12 @@ const schema12 = {
 				},
 				"content": {
 					"type": "object",
-					"if": { "properties": { "raw": { "type": "null" } } },
-					"then": { "properties": { "download": { "type": "null" } } },
-					"else": { "properties": { "download": { "type": "object" } } },
+					"if": { "required": ["raw"] },
+					"then": {
+						"if": { "properties": { "raw": { "type": "null" } } },
+						"then": { "properties": { "download": { "type": "null" } } },
+						"else": { "properties": { "download": { "type": "object" } } }
+					},
 					"properties": {
 						"raw": {
 							"anyOf": [{ "$ref": "#/definitions/RawContent" }, { "type": "null" }],
@@ -15400,13 +15483,11 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 					let valid10 = true;
 					const _errs64 = errors;
 					if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
-						if (data29.raw !== void 0) {
-							if (data29.raw !== null) {
-								const err65 = {};
-								if (vErrors === null) vErrors = [err65];
-								else vErrors.push(err65);
-								errors++;
-							}
+						if (data29.raw === void 0 && "raw") {
+							const err65 = {};
+							if (vErrors === null) vErrors = [err65];
+							else vErrors.push(err65);
+							errors++;
 						}
 					}
 					var _valid0 = _errs64 === errors;
@@ -15415,93 +15496,129 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 						if (_errs63) vErrors.length = _errs63;
 						else vErrors = null;
 					}
-					let ifClause0;
 					if (_valid0) {
+						const _errs65 = errors;
+						const _errs66 = errors;
+						let valid11 = true;
 						const _errs67 = errors;
 						if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
-							if (data29.download !== void 0) {
-								if (data29.download !== null) {
-									const err66 = {
-										instancePath: instancePath + "/email/content/download",
-										schemaPath: "#/properties/email/properties/content/then/properties/download/type",
-										keyword: "type",
-										params: { type: "null" },
-										message: "must be null"
-									};
+							if (data29.raw !== void 0) {
+								if (data29.raw !== null) {
+									const err66 = {};
 									if (vErrors === null) vErrors = [err66];
 									else vErrors.push(err66);
 									errors++;
 								}
 							}
 						}
-						var _valid0 = _errs67 === errors;
-						valid10 = _valid0;
-						ifClause0 = "then";
-					} else {
-						const _errs70 = errors;
-						if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
-							if (data29.download !== void 0) {
-								let data32 = data29.download;
-								if (!(data32 && typeof data32 == "object" && !Array.isArray(data32))) {
-									const err67 = {
-										instancePath: instancePath + "/email/content/download",
-										schemaPath: "#/properties/email/properties/content/else/properties/download/type",
-										keyword: "type",
-										params: { type: "object" },
-										message: "must be object"
-									};
-									if (vErrors === null) vErrors = [err67];
-									else vErrors.push(err67);
-									errors++;
+						var _valid1 = _errs67 === errors;
+						errors = _errs66;
+						if (vErrors !== null) {
+							if (_errs66) vErrors.length = _errs66;
+							else vErrors = null;
+						}
+						let ifClause0;
+						if (_valid1) {
+							const _errs70 = errors;
+							if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
+								if (data29.download !== void 0) {
+									if (data29.download !== null) {
+										const err67 = {
+											instancePath: instancePath + "/email/content/download",
+											schemaPath: "#/properties/email/properties/content/then/then/properties/download/type",
+											keyword: "type",
+											params: { type: "null" },
+											message: "must be null"
+										};
+										if (vErrors === null) vErrors = [err67];
+										else vErrors.push(err67);
+										errors++;
+									}
 								}
 							}
+							var _valid1 = _errs70 === errors;
+							valid11 = _valid1;
+							ifClause0 = "then";
+						} else {
+							const _errs73 = errors;
+							if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
+								if (data29.download !== void 0) {
+									let data32 = data29.download;
+									if (!(data32 && typeof data32 == "object" && !Array.isArray(data32))) {
+										const err68 = {
+											instancePath: instancePath + "/email/content/download",
+											schemaPath: "#/properties/email/properties/content/then/else/properties/download/type",
+											keyword: "type",
+											params: { type: "object" },
+											message: "must be object"
+										};
+										if (vErrors === null) vErrors = [err68];
+										else vErrors.push(err68);
+										errors++;
+									}
+								}
+							}
+							var _valid1 = _errs73 === errors;
+							valid11 = _valid1;
+							ifClause0 = "else";
 						}
-						var _valid0 = _errs70 === errors;
+						if (!valid11) {
+							const err69 = {
+								instancePath: instancePath + "/email/content",
+								schemaPath: "#/properties/email/properties/content/then/if",
+								keyword: "if",
+								params: { failingKeyword: ifClause0 },
+								message: "must match \"" + ifClause0 + "\" schema"
+							};
+							if (vErrors === null) vErrors = [err69];
+							else vErrors.push(err69);
+							errors++;
+						}
+						var _valid0 = _errs65 === errors;
 						valid10 = _valid0;
-						ifClause0 = "else";
 					}
 					if (!valid10) {
-						const err68 = {
+						const err70 = {
 							instancePath: instancePath + "/email/content",
 							schemaPath: "#/properties/email/properties/content/if",
 							keyword: "if",
-							params: { failingKeyword: ifClause0 },
-							message: "must match \"" + ifClause0 + "\" schema"
+							params: { failingKeyword: "then" },
+							message: "must match \"then\" schema"
 						};
-						if (vErrors === null) vErrors = [err68];
-						else vErrors.push(err68);
+						if (vErrors === null) vErrors = [err70];
+						else vErrors.push(err70);
 						errors++;
 					}
 					if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
 						if (data29.raw === void 0) {
-							const err69 = {
+							const err71 = {
 								instancePath: instancePath + "/email/content",
 								schemaPath: "#/properties/email/properties/content/required",
 								keyword: "required",
 								params: { missingProperty: "raw" },
 								message: "must have required property 'raw'"
 							};
-							if (vErrors === null) vErrors = [err69];
-							else vErrors.push(err69);
+							if (vErrors === null) vErrors = [err71];
+							else vErrors.push(err71);
 							errors++;
 						}
 						if (data29.download === void 0) {
-							const err70 = {
+							const err72 = {
 								instancePath: instancePath + "/email/content",
 								schemaPath: "#/properties/email/properties/content/required",
 								keyword: "required",
 								params: { missingProperty: "download" },
 								message: "must have required property 'download'"
 							};
-							if (vErrors === null) vErrors = [err70];
-							else vErrors.push(err70);
+							if (vErrors === null) vErrors = [err72];
+							else vErrors.push(err72);
 							errors++;
 						}
 						if (data29.raw !== void 0) {
 							let data33 = data29.raw;
-							const _errs74 = errors;
-							let valid15 = false;
-							const _errs75 = errors;
+							const _errs77 = errors;
+							let valid16 = false;
+							const _errs78 = errors;
 							if (!validate12$1(data33, {
 								instancePath: instancePath + "/email/content/raw",
 								parentData: data29,
@@ -15511,40 +15628,40 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 								vErrors = vErrors === null ? validate12$1.errors : vErrors.concat(validate12$1.errors);
 								errors = vErrors.length;
 							}
-							var _valid1 = _errs75 === errors;
-							valid15 = valid15 || _valid1;
-							if (!valid15) {
-								const _errs76 = errors;
+							var _valid2 = _errs78 === errors;
+							valid16 = valid16 || _valid2;
+							if (!valid16) {
+								const _errs79 = errors;
 								if (data33 !== null) {
-									const err71 = {
+									const err73 = {
 										instancePath: instancePath + "/email/content/raw",
 										schemaPath: "#/properties/email/properties/content/properties/raw/anyOf/1/type",
 										keyword: "type",
 										params: { type: "null" },
 										message: "must be null"
 									};
-									if (vErrors === null) vErrors = [err71];
-									else vErrors.push(err71);
+									if (vErrors === null) vErrors = [err73];
+									else vErrors.push(err73);
 									errors++;
 								}
-								var _valid1 = _errs76 === errors;
-								valid15 = valid15 || _valid1;
+								var _valid2 = _errs79 === errors;
+								valid16 = valid16 || _valid2;
 							}
-							if (!valid15) {
-								const err72 = {
+							if (!valid16) {
+								const err74 = {
 									instancePath: instancePath + "/email/content/raw",
 									schemaPath: "#/properties/email/properties/content/properties/raw/anyOf",
 									keyword: "anyOf",
 									params: {},
 									message: "must match a schema in anyOf"
 								};
-								if (vErrors === null) vErrors = [err72];
-								else vErrors.push(err72);
+								if (vErrors === null) vErrors = [err74];
+								else vErrors.push(err74);
 								errors++;
 							} else {
-								errors = _errs74;
+								errors = _errs77;
 								if (vErrors !== null) {
-									if (_errs74) vErrors.length = _errs74;
+									if (_errs77) vErrors.length = _errs77;
 									else vErrors = null;
 								}
 							}
@@ -15552,79 +15669,79 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 						if (data29.download !== void 0) {
 							let data34 = data29.download;
 							if (!(data34 && typeof data34 == "object" && !Array.isArray(data34)) && data34 !== null) {
-								const err73 = {
+								const err75 = {
 									instancePath: instancePath + "/email/content/download",
 									schemaPath: "#/properties/email/properties/content/properties/download/type",
 									keyword: "type",
 									params: { type: schema12.properties.email.properties.content.properties.download.type },
 									message: "must be object,null"
 								};
-								if (vErrors === null) vErrors = [err73];
-								else vErrors.push(err73);
+								if (vErrors === null) vErrors = [err75];
+								else vErrors.push(err75);
 								errors++;
 							}
 							if (data34 && typeof data34 == "object" && !Array.isArray(data34)) {
 								if (data34.url === void 0) {
-									const err74 = {
+									const err76 = {
 										instancePath: instancePath + "/email/content/download",
 										schemaPath: "#/properties/email/properties/content/properties/download/required",
 										keyword: "required",
 										params: { missingProperty: "url" },
 										message: "must have required property 'url'"
 									};
-									if (vErrors === null) vErrors = [err74];
-									else vErrors.push(err74);
+									if (vErrors === null) vErrors = [err76];
+									else vErrors.push(err76);
 									errors++;
 								}
 								if (data34.expires_at === void 0) {
-									const err75 = {
+									const err77 = {
 										instancePath: instancePath + "/email/content/download",
 										schemaPath: "#/properties/email/properties/content/properties/download/required",
 										keyword: "required",
 										params: { missingProperty: "expires_at" },
 										message: "must have required property 'expires_at'"
 									};
-									if (vErrors === null) vErrors = [err75];
-									else vErrors.push(err75);
+									if (vErrors === null) vErrors = [err77];
+									else vErrors.push(err77);
 									errors++;
 								}
 								if (data34.url !== void 0) {
 									let data35 = data34.url;
 									if (typeof data35 === "string") {
 										if (!pattern4.test(data35)) {
-											const err76 = {
+											const err78 = {
 												instancePath: instancePath + "/email/content/download/url",
 												schemaPath: "#/properties/email/properties/content/properties/download/properties/url/pattern",
 												keyword: "pattern",
 												params: { pattern: "^https?://" },
 												message: "must match pattern \"^https?://\""
 											};
-											if (vErrors === null) vErrors = [err76];
-											else vErrors.push(err76);
+											if (vErrors === null) vErrors = [err78];
+											else vErrors.push(err78);
 											errors++;
 										}
 										if (!formats4.test(data35)) {
-											const err77 = {
+											const err79 = {
 												instancePath: instancePath + "/email/content/download/url",
 												schemaPath: "#/properties/email/properties/content/properties/download/properties/url/format",
 												keyword: "format",
 												params: { format: "uri" },
 												message: "must match format \"uri\""
 											};
-											if (vErrors === null) vErrors = [err77];
-											else vErrors.push(err77);
+											if (vErrors === null) vErrors = [err79];
+											else vErrors.push(err79);
 											errors++;
 										}
 									} else {
-										const err78 = {
+										const err80 = {
 											instancePath: instancePath + "/email/content/download/url",
 											schemaPath: "#/properties/email/properties/content/properties/download/properties/url/type",
 											keyword: "type",
 											params: { type: "string" },
 											message: "must be string"
 										};
-										if (vErrors === null) vErrors = [err78];
-										else vErrors.push(err78);
+										if (vErrors === null) vErrors = [err80];
+										else vErrors.push(err80);
 										errors++;
 									}
 								}
@@ -15632,42 +15749,42 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 									let data36 = data34.expires_at;
 									if (typeof data36 === "string") {
 										if (!formats0$1.test(data36)) {
-											const err79 = {
+											const err81 = {
 												instancePath: instancePath + "/email/content/download/expires_at",
 												schemaPath: "#/properties/email/properties/content/properties/download/properties/expires_at/format",
 												keyword: "format",
 												params: { format: "date-time" },
 												message: "must match format \"date-time\""
 											};
-											if (vErrors === null) vErrors = [err79];
-											else vErrors.push(err79);
+											if (vErrors === null) vErrors = [err81];
+											else vErrors.push(err81);
 											errors++;
 										}
 									} else {
-										const err80 = {
+										const err82 = {
 											instancePath: instancePath + "/email/content/download/expires_at",
 											schemaPath: "#/properties/email/properties/content/properties/download/properties/expires_at/type",
 											keyword: "type",
 											params: { type: "string" },
 											message: "must be string"
 										};
-										if (vErrors === null) vErrors = [err80];
-										else vErrors.push(err80);
+										if (vErrors === null) vErrors = [err82];
+										else vErrors.push(err82);
 										errors++;
 									}
 								}
 							}
 						}
 					} else {
-						const err81 = {
+						const err83 = {
 							instancePath: instancePath + "/email/content",
 							schemaPath: "#/properties/email/properties/content/type",
 							keyword: "type",
 							params: { type: "object" },
 							message: "must be object"
 						};
-						if (vErrors === null) vErrors = [err81];
-						else vErrors.push(err81);
+						if (vErrors === null) vErrors = [err83];
+						else vErrors.push(err83);
 						errors++;
 					}
 				}
@@ -15706,123 +15823,123 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 				}
 				if (data14.relay !== void 0) {
 					let data40 = data14.relay;
-					const _errs88 = errors;
-					let valid17 = false;
-					const _errs89 = errors;
+					const _errs91 = errors;
+					let valid18 = false;
+					const _errs92 = errors;
 					if (data40 && typeof data40 == "object" && !Array.isArray(data40)) {
 						if (data40.hostname === void 0) {
-							const err82 = {
+							const err84 = {
 								instancePath: instancePath + "/email/relay",
 								schemaPath: "#/definitions/EmailRelay/required",
 								keyword: "required",
 								params: { missingProperty: "hostname" },
 								message: "must have required property 'hostname'"
 							};
-							if (vErrors === null) vErrors = [err82];
-							else vErrors.push(err82);
+							if (vErrors === null) vErrors = [err84];
+							else vErrors.push(err84);
 							errors++;
 						}
 						if (data40.via === void 0) {
-							const err83 = {
+							const err85 = {
 								instancePath: instancePath + "/email/relay",
 								schemaPath: "#/definitions/EmailRelay/required",
 								keyword: "required",
 								params: { missingProperty: "via" },
 								message: "must have required property 'via'"
 							};
-							if (vErrors === null) vErrors = [err83];
-							else vErrors.push(err83);
+							if (vErrors === null) vErrors = [err85];
+							else vErrors.push(err85);
 							errors++;
 						}
 						if (data40.hostname !== void 0) {
 							if (typeof data40.hostname !== "string") {
-								const err84 = {
+								const err86 = {
 									instancePath: instancePath + "/email/relay/hostname",
 									schemaPath: "#/definitions/EmailRelay/properties/hostname/type",
 									keyword: "type",
 									params: { type: "string" },
 									message: "must be string"
 								};
-								if (vErrors === null) vErrors = [err84];
-								else vErrors.push(err84);
+								if (vErrors === null) vErrors = [err86];
+								else vErrors.push(err86);
 								errors++;
 							}
 						}
 						if (data40.via !== void 0) {
 							if (typeof data40.via !== "string") {
-								const err85 = {
+								const err87 = {
 									instancePath: instancePath + "/email/relay/via",
 									schemaPath: "#/definitions/EmailRelay/properties/via/type",
 									keyword: "type",
 									params: { type: "string" },
 									message: "must be string"
 								};
-								if (vErrors === null) vErrors = [err85];
-								else vErrors.push(err85);
+								if (vErrors === null) vErrors = [err87];
+								else vErrors.push(err87);
 								errors++;
 							}
 						}
 					} else {
-						const err86 = {
+						const err88 = {
 							instancePath: instancePath + "/email/relay",
 							schemaPath: "#/definitions/EmailRelay/type",
 							keyword: "type",
 							params: { type: "object" },
 							message: "must be object"
 						};
-						if (vErrors === null) vErrors = [err86];
-						else vErrors.push(err86);
+						if (vErrors === null) vErrors = [err88];
+						else vErrors.push(err88);
 						errors++;
 					}
-					var _valid2 = _errs89 === errors;
-					valid17 = valid17 || _valid2;
-					if (!valid17) {
-						const _errs96 = errors;
+					var _valid3 = _errs92 === errors;
+					valid18 = valid18 || _valid3;
+					if (!valid18) {
+						const _errs99 = errors;
 						if (data40 !== null) {
-							const err87 = {
+							const err89 = {
 								instancePath: instancePath + "/email/relay",
 								schemaPath: "#/properties/email/properties/relay/anyOf/1/type",
 								keyword: "type",
 								params: { type: "null" },
 								message: "must be null"
 							};
-							if (vErrors === null) vErrors = [err87];
-							else vErrors.push(err87);
+							if (vErrors === null) vErrors = [err89];
+							else vErrors.push(err89);
 							errors++;
 						}
-						var _valid2 = _errs96 === errors;
-						valid17 = valid17 || _valid2;
+						var _valid3 = _errs99 === errors;
+						valid18 = valid18 || _valid3;
 					}
-					if (!valid17) {
-						const err88 = {
+					if (!valid18) {
+						const err90 = {
 							instancePath: instancePath + "/email/relay",
 							schemaPath: "#/properties/email/properties/relay/anyOf",
 							keyword: "anyOf",
 							params: {},
 							message: "must match a schema in anyOf"
 						};
-						if (vErrors === null) vErrors = [err88];
-						else vErrors.push(err88);
+						if (vErrors === null) vErrors = [err90];
+						else vErrors.push(err90);
 						errors++;
 					} else {
-						errors = _errs88;
+						errors = _errs91;
 						if (vErrors !== null) {
-							if (_errs88) vErrors.length = _errs88;
+							if (_errs91) vErrors.length = _errs91;
 							else vErrors = null;
 						}
 					}
 				}
 				if (data14.automated !== void 0) {
 					if (typeof data14.automated !== "boolean") {
-						const err89 = {
+						const err91 = {
 							instancePath: instancePath + "/email/automated",
 							schemaPath: "#/properties/email/properties/automated/type",
 							keyword: "type",
 							params: { type: "boolean" },
 							message: "must be boolean"
 						};
-						if (vErrors === null) vErrors = [err89];
-						else vErrors.push(err89);
+						if (vErrors === null) vErrors = [err91];
+						else vErrors.push(err91);
 						errors++;
 					}
 				}
@@ -15831,53 +15948,53 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 					if (Array.isArray(data44)) {
 						const len1 = data44.length;
 						for (let i1 = 0; i1 < len1; i1++) if (typeof data44[i1] !== "string") {
-							const err90 = {
+							const err92 = {
 								instancePath: instancePath + "/email/automated_reasons/" + i1,
 								schemaPath: "#/properties/email/properties/automated_reasons/items/type",
 								keyword: "type",
 								params: { type: "string" },
 								message: "must be string"
 							};
-							if (vErrors === null) vErrors = [err90];
-							else vErrors.push(err90);
+							if (vErrors === null) vErrors = [err92];
+							else vErrors.push(err92);
 							errors++;
 						}
 					} else {
-						const err91 = {
+						const err93 = {
 							instancePath: instancePath + "/email/automated_reasons",
 							schemaPath: "#/properties/email/properties/automated_reasons/type",
 							keyword: "type",
 							params: { type: "array" },
 							message: "must be array"
 						};
-						if (vErrors === null) vErrors = [err91];
-						else vErrors.push(err91);
+						if (vErrors === null) vErrors = [err93];
+						else vErrors.push(err93);
 						errors++;
 					}
 				}
 			} else {
-				const err92 = {
+				const err94 = {
 					instancePath: instancePath + "/email",
 					schemaPath: "#/properties/email/type",
 					keyword: "type",
 					params: { type: "object" },
 					message: "must be object"
 				};
-				if (vErrors === null) vErrors = [err92];
-				else vErrors.push(err92);
+				if (vErrors === null) vErrors = [err94];
+				else vErrors.push(err94);
 				errors++;
 			}
 		}
 	} else {
-		const err93 = {
+		const err95 = {
 			instancePath,
 			schemaPath: "#/type",
 			keyword: "type",
 			params: { type: "object" },
 			message: "must be object"
 		};
-		if (vErrors === null) vErrors = [err93];
-		else vErrors.push(err93);
+		if (vErrors === null) vErrors = [err95];
+		else vErrors.push(err95);
 		errors++;
 	}
 	validate11$1.errors = vErrors;
@@ -16084,10 +16201,10 @@ function formatValidationIssue(error, input) {
 	switch (error.keyword) {
 		case "required": {
 			const missing = String(error.params.missingProperty ?? "unknown");
-			const prefix = field === "payload" ? "payload" : field;
+			const missingField = field === "payload" ? missing : `${field}.${missing}`;
 			return {
-				field: prefix === "payload" ? missing : `${prefix}.${missing}`,
-				message: `Missing required field: ${missing}`,
+				field: missingField,
+				message: `Missing required field: ${missingField}`,
 				suggestion: `Add the required field "${missing}" to the webhook payload.`
 			};
 		}
@@ -24289,11 +24406,6 @@ function combineQ(q, domain) {
 	const parts = [q?.trim(), domain ? `domain:${quoteDslValue(domain.trim())}` : void 0].filter((part) => Boolean(part));
 	return parts.length > 0 ? parts.join(" ") : void 0;
 }
-function normalizeIsoDate(value, label) {
-	const parsed = new Date(value);
-	if (Number.isNaN(parsed.getTime())) throw new Error(`${label} must be a valid date or ISO-8601 timestamp.`);
-	return parsed.toISOString();
-}
 function filtersFromFlags(flags) {
 	if (flags.automated !== void 0 && !AUTOMATED_VALUES.includes(flags.automated)) throw new Error("--automated must be true or false.");
 	return {
@@ -24312,9 +24424,30 @@ function filtersFromFlags(flags) {
 		to: flags.to
 	};
 }
-function sinceFromFlags(flags) {
-	if (flags.since) return normalizeIsoDate(flags.since, "--since");
-	return flags["include-existing"] ? void 0 : (/* @__PURE__ */ new Date()).toISOString();
+const SINCE_DURATION = /^(\d+)\s*(s|m|h|d)$/i;
+const SINCE_UNIT_MS = {
+	s: 1e3,
+	m: 6e4,
+	h: 36e5,
+	d: 864e5
+};
+/** How --since reads: a date or timestamp, or a duration ago (`15m`). */
+const SINCE_VALUE_HELP = "an ISO-8601 timestamp or date, or a duration ago such as 30s, 15m, 2h or 1d";
+/**
+* Read --since: an ISO-8601 timestamp or date, or a duration before `now`
+* (`30s`, `15m`, `2h`, `1d`).
+*/
+function parseSince(value, now = Date.now()) {
+	if (/^\s*\d+\s*$/.test(value)) throw new Error(`--since needs a unit on a duration, for example ${value.trim()}m; it takes ${SINCE_VALUE_HELP}.`);
+	const duration = SINCE_DURATION.exec(value.trim());
+	const unit = duration ? SINCE_UNIT_MS[duration[2].toLowerCase()] : void 0;
+	const parsed = duration && unit !== void 0 ? new Date(now - Number(duration[1]) * unit) : new Date(value);
+	if (Number.isNaN(parsed.getTime()) || parsed.getTime() < 0) throw new Error(`--since must be ${SINCE_VALUE_HELP}.`);
+	return parsed.toISOString();
+}
+function sinceFromFlags(flags, now = Date.now()) {
+	if (flags.since) return parseSince(flags.since, now);
+	return flags["include-existing"] ? void 0 : new Date(now).toISOString();
 }
 function buildEmailSearchQuery(params) {
 	const query = {
@@ -25336,4 +25469,4 @@ function repeatStopCommand(emailId) {
 	if (!UUID.test(emailId)) throw new TypeError("emailId must be an email UUID");
 	return `primitive repeat stop --id ${emailId.toLowerCase()}`;
 }
-export { AutomatedFilterUnsupportedError as $, updateRoute as $n, listAgentContacts as $t, sleep as A, resendAgentSignupVerification as An, getAccessMode as At, hasReplyState as B, setFunctionSecret as Bn, getFunctionTestRunTrace as Bt, collectNewAcceptedEmails as C, putAgentContact as Cn, deleteWakeAuthorization as Ct, filtersFromFlags as D, removeDefaultNetworkMember as Dn, downloadEmailAttachmentPart as Dt, fetchEmailSearchPage as E, redeemCreditCode as En, downloadEmailAttachmentByFilename as Et, assertAwaitingFilterRows as F, searchEmails as Fn, getCreditBalance as Ft, WEBHOOK_EVENT_TYPES as G, startCliLogin as Gn, getOwnGrant as Gt, queryUsesAwaiting as H, simulateRoute as Hn, getKey as Ht, awaitingRejectedError as I, searchMemories as In, getDefaultNetworkAgent as It, parseWebhookEvent as J, unsetFunctionRoute as Jn, getThread as Jt, isEmailReceivedEvent as K, stopRepeatFromEmail as Kn, getRepeatingSend as Kt, ensureSearchReportsReplyState as L, semanticSearch as Ln, getEmail as Lt, AWAITING_VALUES as M, rotateKey as Mn, getAgentContactPolicy as Mt, REPLY_STATE_UNSUPPORTED_CODE as N, runWakeSchedule as Nn, getContact as Nt, quoteDslValue as O, reorderRoutes as On, downloadSentAttachmentArchiveMember as Ot, ReplyStateUnsupportedError as P, sdk_gen_exports as Pn, getConversation as Pt, AUTOMATED_VALUES as Q, updateRepeatingSend as Qn, listAgentConnections as Qt, formatAwaitingCell as R, sendEmail as Rn, getFunction as Rt, transientFailure as S, pullWebhookEvent as Sn, deleteRoute as St, encodeReceivedAtSearchCursor as T, putContact as Tn, downloadEmailAttachmentArchiveMember as Tt, replyStateSurfaceForOperation as U, startAgentClaim as Un, getMemory as Ut, isAwaitingRejectedError as V, setMemory as Vn, getInboxStatus as Vt, SENT_EMAIL_EVENT_TYPES as W, startAgentSignup as Wn, getOrgRoutingTopology as Wt, AUTOMATED_FILTER_UNSUPPORTED_CODE as X, updateFunction as Xn, inviteAgentConnection as Xt, parseFromHeader as Y, updateDefaultNetworkMember as Yn, getWakeSchedule as Yt, AUTOMATED_FLAG_DESCRIPTION as Z, updateKey as Zn, leaveOrganization as Zt, describeApiFailure as _, listSentEmails as _n, createWakeAuthorization as _t, REPEAT_IDLE_MAX_MINUTES as a, listEmailAttachmentArchiveMembers as an, hasAutomatedVerdict as at, retryTransient as b, listWakeSchedules as bn, deleteContact as bt, classifySignalContent as c, listFunctionLogs as cn, cancelSentEmail as ct, parseRepeatTick as d, listKeys as dn, cliLogout as dt, listAgentNetworks as en, updateWakeAuthorization as er, assertAutomatedVerdict as et, preparePresenceAliveEmail as f, listMailboxAccess as fn, completeWebhookEvent as ft, WaitDeadlineReached as g, listSentAttachmentArchiveMembers as gn, createRoute as gt, sendPreparedSignal as h, listRoutes as hn, createKey as ht, REPEAT_EVERY_MAX_MINUTES as i, listDomains as in, __exportAll as ir, expectedAutomatedVerdicts as it, AWAITING_FLAG_DESCRIPTION as j, revokeCredential as jn, getAccount as jt, sinceFromFlags as k, replyToEmail as kn, downloadSentAttachmentByFilename as kt, parseInteractionEnvelope as l, listFunctions as ln, cancelSentEmailByIdempotencyKey as lt, repeatStopCommand as m, listRoles as mn, createFunction as mt, MAX_PRESENCE_ENVELOPE_BYTES as n, listDefaultNetworkAgents as nn, verifyAgentClaim as nr, automatedSurfaceForOperation as nt, REPEAT_MAX_SENDS_MAX as o, listEmails as on, isAutomatedRejectedError as ot, prepareSignalEmail as p, listRepeatingSends as pn, createEndpoint as pt, isTrustedSender as q, testFunction as qn, getSentEmail as qt, PRESENCE_PROBE_TEXT as r, listDefaultNetworkMembers as rn, verifyAgentSignup as rr, ensureSearchReportsAutomated as rt, buildRepeatStopBody as s, listEndpoints as sn, addDefaultNetworkMember as st, MAX_INTERACTION_BYTES as t, listContacts as tn, updateWakeSchedule as tr, automatedRejectedError as tt, parsePresenceEnvelope as u, listGroups as un, checkDefaultNetworkContactAdmission as ut, parseRetryAfter as v, listWakeAuthorizations as vn, createWakeSchedule as vt, cursorFromAcceptedRows as w, putAgentContactPolicy as wn, deleteWakeSchedule as wt, retryingOperation as x, pollCliLogin as xn, deleteMemory as xt, pauseForTransientFailure as y, listWakeDispatches as yn, deleteAgentContact as yt, formatRepliesCell as z, setFunctionRoute as zn, getFunctionRouting as zt };
+export { AUTOMATED_VALUES as $, updateFunction as $n, listAgentConnections as $t, sinceFromFlags as A, removeDefaultNetworkMember as An, downloadSentAttachmentByFilename as At, formatRepliesCell as B, semanticSearch as Bn, getFunctionRouting as Bt, SINCE_VALUE_HELP as C, listWakeSchedules as Cn, deleteRoute as Ct, fetchEmailSearchPage as D, putAgentContactPolicy as Dn, downloadEmailAttachmentByFilename as Dt, encodeReceivedAtSearchCursor as E, putAgentContact as En, downloadEmailAttachmentArchiveMember as Et, ReplyStateUnsupportedError as F, rotateKey as Fn, getConversation as Ft, SENT_EMAIL_EVENT_TYPES as G, simulateRoute as Gn, getOrgRoutingTopology as Gt, isAwaitingRejectedError as H, setFunctionRoute as Hn, getInboxStatus as Ht, assertAwaitingFilterRows as I, runWakeSchedule as In, getCreditBalance as It, isTrustedSender as J, startCliLogin as Jn, getSentEmail as Jt, WEBHOOK_EVENT_TYPES as K, startAgentClaim as Kn, getOwnGrant as Kt, awaitingRejectedError as L, sdk_gen_exports as Ln, getDefaultNetworkAgent as Lt, AWAITING_FLAG_DESCRIPTION as M, replyToEmail as Mn, getAccount as Mt, AWAITING_VALUES as N, resendAgentSignupVerification as Nn, getAgentContactPolicy as Nt, filtersFromFlags as O, putContact as On, downloadEmailAttachmentPart as Ot, REPLY_STATE_UNSUPPORTED_CODE as P, revokeCredential as Pn, getContact as Pt, AUTOMATED_FLAG_DESCRIPTION as Q, updateDefaultNetworkMember as Qn, leaveOrganization as Qt, ensureSearchReportsReplyState as R, searchEmails as Rn, getEmail as Rt, transientFailure as S, listWakeDispatches as Sn, deleteMemory as St, cursorFromAcceptedRows as T, pullWebhookEvent as Tn, deleteWakeSchedule as Tt, queryUsesAwaiting as U, setFunctionSecret as Un, getKey as Ut, hasReplyState as V, sendEmail as Vn, getFunctionTestRunTrace as Vt, replyStateSurfaceForOperation as W, setMemory as Wn, getMemory as Wt, parseFromHeader as X, testFunction as Xn, getWakeSchedule as Xt, parseWebhookEvent as Y, stopRepeatFromEmail as Yn, getThread as Yt, AUTOMATED_FILTER_UNSUPPORTED_CODE as Z, unsetFunctionRoute as Zn, inviteAgentConnection as Zt, describeApiFailure as _, listRoles as _n, createRoute as _t, REPEAT_IDLE_MAX_MINUTES as a, listDomains as an, verifyAgentClaim as ar, expectedAutomatedVerdicts as at, retryTransient as b, listSentEmails as bn, deleteAgentContact as bt, classifySignalContent as c, listEmails as cn, addDefaultNetworkMember as ct, parseRepeatTick as d, listFunctions as dn, checkDefaultNetworkContactAdmission as dt, listAgentContacts as en, updateKey as er, AutomatedFilterUnsupportedError as et, preparePresenceAliveEmail as f, listGroups as fn, cliLogout as ft, WaitDeadlineReached as g, listRepeatingSends as gn, createKey as gt, sendPreparedSignal as h, listOrganizationPeople as hn, createFunction as ht, REPEAT_EVERY_MAX_MINUTES as i, listDefaultNetworkMembers as in, updateWakeSchedule as ir, ensureSearchReportsAutomated as it, sleep as j, reorderRoutes as jn, getAccessMode as jt, quoteDslValue as k, redeemCreditCode as kn, downloadSentAttachmentArchiveMember as kt, parseInteractionEnvelope as l, listEndpoints as ln, cancelSentEmail as lt, repeatStopCommand as m, listMailboxAccess as mn, createEndpoint as mt, MAX_PRESENCE_ENVELOPE_BYTES as n, listContacts as nn, updateRoute as nr, automatedRejectedError as nt, REPEAT_MAX_SENDS_MAX as o, listEmailAttachmentArchiveMembers as on, verifyAgentSignup as or, hasAutomatedVerdict as ot, prepareSignalEmail as p, listKeys as pn, completeWebhookEvent as pt, isEmailReceivedEvent as q, startAgentSignup as qn, getRepeatingSend as qt, PRESENCE_PROBE_TEXT as r, listDefaultNetworkAgents as rn, updateWakeAuthorization as rr, automatedSurfaceForOperation as rt, buildRepeatStopBody as s, listEmailRuleResults as sn, __exportAll as sr, isAutomatedRejectedError as st, MAX_INTERACTION_BYTES as t, listAgentNetworks as tn, updateRepeatingSend as tr, assertAutomatedVerdict as tt, parsePresenceEnvelope as u, listFunctionLogs as un, cancelSentEmailByIdempotencyKey as ut, parseRetryAfter as v, listRoutes as vn, createWakeAuthorization as vt, collectNewAcceptedEmails as w, pollCliLogin as wn, deleteWakeAuthorization as wt, retryingOperation as x, listWakeAuthorizations as xn, deleteContact as xt, pauseForTransientFailure as y, listSentAttachmentArchiveMembers as yn, createWakeSchedule as yt, formatAwaitingCell as z, searchMemories as zn, getFunction as zt };