primcli 3.0.0-preview.3 → 3.0.0-preview.5

package/dist/{repeats-Dj_o6c-X-BKHiZsYv.js → repeats-Dj_o6c-X-Ix28GRRc.js}

@@ -52,6 +52,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	cancelSentEmailByIdempotencyKey: () => cancelSentEmailByIdempotencyKey,
 	checkDefaultNetworkContactAdmission: () => checkDefaultNetworkContactAdmission,
 	checkDomainDns: () => checkDomainDns,
+	checkEmailRuleRequestTarget: () => checkEmailRuleRequestTarget,
 	checkSendability: () => checkSendability,
 	checkVanityInboxName: () => checkVanityInboxName,
 	claimAgentConnection: () => claimAgentConnection,
@@ -85,6 +86,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	deleteDomain: () => deleteDomain,
 	deleteEmail: () => deleteEmail,
 	deleteEmailRule: () => deleteEmailRule,
+	deleteEmailRuleRequest: () => deleteEmailRuleRequest,
 	deleteEndpoint: () => deleteEndpoint,
 	deleteFilter: () => deleteFilter,
 	deleteFunction: () => deleteFunction,
@@ -131,6 +133,9 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	getEmailRuleRequest: () => getEmailRuleRequest,
 	getEmailRuleScope: () => getEmailRuleScope,
 	getEmailRuleShare: () => getEmailRuleShare,
+	getEmailRuleVocabulary: () => getEmailRuleVocabulary,
+	getEndpoint: () => getEndpoint,
+	getEndpointSigningSecret: () => getEndpointSigningSecret,
 	getFunction: () => getFunction,
 	getFunctionDeployment: () => getFunctionDeployment,
 	getFunctionInvocation: () => getFunctionInvocation,
@@ -160,6 +165,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	getRelayAutoJoin: () => getRelayAutoJoin,
 	getRepeatingSend: () => getRepeatingSend,
 	getSearchSettings: () => getSearchSettings,
+	getSendFrom: () => getSendFrom,
 	getSendPermissions: () => getSendPermissions,
 	getSentEmail: () => getSentEmail,
 	getSentHourlyStats: () => getSentHourlyStats,
@@ -175,6 +181,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	inviteOrganizationMember: () => inviteOrganizationMember,
 	inviteProjectMember: () => inviteProjectMember,
 	leaveOrganization: () => leaveOrganization,
+	listActivityObjects: () => listActivityObjects,
 	listAddressNotes: () => listAddressNotes,
 	listAddressNotesBatch: () => listAddressNotesBatch,
 	listAgentConnections: () => listAgentConnections,
@@ -276,6 +283,7 @@ var sdk_gen_exports = /* @__PURE__ */ __exportAll({
 	revokeOAuthGrant: () => revokeOAuthGrant,
 	revokeOrganizationInvitation: () => revokeOrganizationInvitation,
 	revokeProjectInvitation: () => revokeProjectInvitation,
+	rotateEndpointSigningSecret: () => rotateEndpointSigningSecret,
 	rotateKey: () => rotateKey,
 	rotateWebhookSecret: () => rotateWebhookSecret,
 	runWakeSchedule: () => runWakeSchedule,
@@ -664,10 +672,7 @@ const getStorageStats = (options) => (options?.client ?? client).get({
 * secret exists yet, one is generated automatically on first
 * access.
 *
-* Signing is account-scoped, not per-endpoint. Every webhook
-* delivery from any of your registered endpoints is signed
-* with this single secret. Rotate via
-* `POST /account/webhook-secret/rotate`.
+* Every webhook is signed with this secret unless it has its own. Rotate this secret via `POST /account/webhook-secret/rotate`. A webhook whose signed_with is own_secret is signed with its own secret instead; read it from GET /endpoints/{id}/signing-secret. A webhook's own secret rotates via `POST /endpoints/{id}/signing-secret/rotate`.
 *
 * **Secret format**: the returned string looks base64-shaped
 * (e.g. `XNHBBW8VqoBjRfNs1tkZj11jTk...`) but is NOT base64.
@@ -1217,10 +1222,7 @@ const listEndpoints = (options) => (options?.client ?? client).get({
 * instead. Subject to plan limits on the number of active
 * endpoints.
 *
-* **Signing is account-scoped, not per-endpoint.** This call
-* does not return any signing material; every endpoint on the
-* account uses the same webhook secret, fetched via
-* `GET /account/webhook-secret`. See the API-level "Webhook
+* **Signing.** A webhook is signed with the organization's webhook secret (`GET /account/webhook-secret`) unless it has its own. A webhook made as a person's own, or by an API key limited to some mailboxes, a third-party app or an agent delegate for itself, is made with its own secret: the response carries it once as `signing_secret`, and `GET /endpoints/{id}/signing-secret` returns it afterwards. Other webhooks, those a person who can read every mailbox makes among them, sign with the organization's secret until given their own. `signed_with` on the endpoint says which secret signs it. See the API-level "Webhook
 * signing" section for the full wire format (header name,
 * signed string, hash algo, secret format, tolerance) and a
 * language-agnostic verification recipe.
@@ -1264,11 +1266,22 @@ const deleteEndpoint = (options) => (options.client ?? client).delete({
 	...options
 });
 /**
+* Get an endpoint
+*
+* One endpoint, as GET /endpoints shows it, to a caller who would see it there. Any other id, a deleted endpoint's included, answers 404.
+*/
+const getEndpoint = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}",
+	...options
+});
+/**
 * Update a webhook endpoint
 *
-* Updates an active webhook endpoint. If the URL is changed, the old
-* endpoint is deactivated and a new one is created (or an existing
-* deactivated endpoint with the new URL is reactivated).
+* Updates an active webhook endpoint. Changing the URL keeps the endpoint: its id, recipient routes, signing secret, delivery history and any deliveries still owed to it stay with it, and owed deliveries go to the new URL. Another active endpoint at the new URL is refused.
 *
 *
 * Pull destinations cannot be assigned a URL, function or recipient-routing domain. Existing endpoint deletion disconnects the destination; creating a new destination does not backfill historical events.
@@ -1633,6 +1646,7 @@ const listRoutes = (options) => (options?.client ?? client).get({
 * transaction, enabling per-address function routing (e.g.
 * `alice@acme.com -> functionA`).
 *
+* A route that could never deliver is refused: an exact pattern that the endpoint's owner may not receive, or that the route's own owner may not act on, answers 400 validation_error with details.reason endpoint_owner_access or route_owner_access and details.recipient. A wildcard or regex route to an owned endpoint is written, with warnings saying it delivers only what the owner may receive. A route written disabled is judged when it is turned on.
 */
 const createRoute = (options) => (options.client ?? client).post({
 	security: [{
@@ -1698,7 +1712,7 @@ const deleteRoute = (options) => (options.client ?? client).delete({
 /**
 * Update a recipient route
 *
-* Update a recipient route
+* A route that could never deliver is refused: an exact pattern that the endpoint's owner may not receive, or that the route's own owner may not act on, answers 400 validation_error with details.reason endpoint_owner_access or route_owner_access and details.recipient. A wildcard or regex route to an owned endpoint is written, with warnings saying it delivers only what the owner may receive. A route written disabled is judged when it is turned on.
 */
 const updateRoute = (options) => (options.client ?? client).patch({
 	security: [{
@@ -3579,9 +3593,35 @@ const getWebhookDeliveryStats = (options) => (options?.client ?? client).get({
 	...options
 });
 /**
+* List what you created
+*
+* The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules and rule requests. Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self.
+*/
+const listActivityObjects = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/activity/objects",
+	...options
+});
+/**
+* Read the column catalog
+*
+* What a rule tree you write yourself can say: each column of the current vocabulary with its type, source, meaning, operators and the value each takes, options, and whether it takes min_confidence; and the tree's limits, its stored size included. Built from the checks a saved or tested tree must pass. A tree is {version: tree_version, vocabulary: version, when, questions}. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
+*/
+const getEmailRuleVocabulary = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rules/vocabulary",
+	...options
+});
+/**
 * Compile a rule description
 *
-* Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to three yes/no questions, asked about an email only after its conditions match. Nothing is saved. The SQL the rule renders to is returned only when include_sql is true. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Turns a plain-English description of which received emails to match into a rule tree over the published column contract, with a plain-English explanation of what it matches, the assumptions made, and warnings for anything the columns cannot express. Where the columns fall short the rule may carry up to three yes/no questions, asked about an email only after its conditions match. Nothing is saved. A rule with no questions has its conditions counted, read only, over the caller's recent classified mail (what a test of it covers by default), so a warning can say when it matches nearly all of it. The SQL the rule renders to is returned only when include_sql is true. kind do_not_share compiles a do-not-share rule for recall: conditions only as narrow as the description says, the judgement of what it describes put into questions, and with nothing a column decides for certain, conditions that hold for every email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const compileEmailRule = (options) => (options.client ?? client).post({
 	security: [{
@@ -3598,7 +3638,7 @@ const compileEmailRule = (options) => (options.client ?? client).post({
 /**
 * Test a rule against received mail
 *
-* Runs a rule over received mail and reports what it would decide for each email: matched, near_miss, no_match, unclassified or not_found. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version, run with its author's access). Either way the rule reads only mail its author can read, and only what its scope covers; an unsaved tree covers only your own mail unless evaluation_scope names more. Without email_ids, the newest emails it can read are tested, at most 200 and none older than 30 days. Emails not classified yet that arrived more than 2 hours ago are classified first and their classification is saved, unless classify_missing is false; newer ones are left to normal classification and reported unclassified with reason pending. The rule itself records nothing and grants nothing. Classification and the rule's own questions stop at about 90 seconds; run the test again to continue where it stopped. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Runs a rule over received mail and reports what it would decide for each email (matched, near_miss, no_match, unclassified, skipped or not_found), with a summary: how each top-level condition and question decided and, when nothing matched, what stopped it. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version, run with its author's access). The rule reads only mail its author can read and its scope covers; an unsaved tree covers only your own mail unless evaluation_scope names more. Without email_ids, the newest emails it can read are tested, at most 200 and none older than 30 days; expected emails (expect, or a saved rule's saved expectations) are tested whatever their age. Unclassified emails more than 2 hours old are classified first and their classification saved, unless classify_missing is false; newer ones are reported unclassified, pending. The rule itself records and grants nothing. Classification and the rule's questions stop at about 90 seconds; a rerun continues the classification where it stopped. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const testEmailRule = (options) => (options.client ?? client).post({
 	security: [{
@@ -3615,7 +3655,7 @@ const testEmailRule = (options) => (options.client ?? client).post({
 /**
 * Test a rule against a made-up email
 *
-* Reports what a rule would decide for an email you describe: its sender, recipients, subject, plain text and attachment types, and optionally whether it is automated or from a mailing list and its spam score. The email is classified the way received mail is, and the rule's conditions and its own questions are decided as they would be for received mail with that content and those signals, received now. Without them it is not automated and not from a mailing list; a rule that reads a spam score you gave none for is decided on no score, and spam_score is listed in unset_columns. Nothing is stored: no email, classification or decision. Test an unsaved tree from a compile response, or a saved rule by rule_id (its current version); an unsaved tree is run as covering only your own mail unless evaluation_scope names more, as on POST /email-rules/test. The answer includes what the classifier read from the email. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Reports what a rule would decide for an email you describe (sender, recipients, subject, plain text, attachment types; optionally whether it is automated or from a mailing list, and its spam score), received now: it is classified, and the conditions and questions decided, as received mail would be. By default it is not automated or from a list; a rule reading a spam score you gave none for decides on none (spam_score is then in unset_columns). Nothing is stored. Test an unsaved tree (covering only your own mail unless evaluation_scope names more) or a saved rule by rule_id. The answer includes what the classifier read. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const testEmailRuleOnSample = (options) => (options.client ?? client).post({
 	security: [{
@@ -3632,7 +3672,7 @@ const testEmailRuleOnSample = (options) => (options.client ?? client).post({
 /**
 * List rules
 *
-* The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. Each carries its scope (evaluation_scope, and scope_selection for a selected rule). With matched_email_id, only the rules that matched that email. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* The rules the caller can see, newest first: their own, or every member's rules for a caller who reads the whole organization's mail. Each carries its scope (evaluation_scope, and scope_selection for a selected rule). With matched_email_id, only the rules that matched that email. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRules = (options) => (options?.client ?? client).get({
 	security: [{
@@ -3645,7 +3685,7 @@ const listEmailRules = (options) => (options?.client ?? client).get({
 /**
 * Create a rule
 *
-* Saves a rule as version 1, from a compile response or a tree you wrote. The tree is checked against the column contract. New rules start in observe, where what the rule matches is recorded and nothing is granted or blocked; draft is not evaluated. The caller is the rule's author, and the rule never reaches mail the author cannot read. evaluation_scope chooses whose mail it runs over: own_mailboxes (only your own mail) when omitted, so any other scope (author for all you can read, or selected) is named; scope_selection may name only what you can read. The answer carries the scope as stored. kind do_not_share makes a rule that blocks sharing: it runs before every other rule, and while it is active no rule shares an email it matches or cannot decide. A key cannot list one (details.reason rule_blocks_sharing on the key). Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Saves a rule as version 1 from a compile response or a tree you wrote, checked against the column contract; without an explanation the server writes one. It starts in observe (what it matches is recorded, nothing granted or blocked) unless state is draft (not evaluated). You are its author, and it never reaches mail you cannot read. evaluation_scope is own_mailboxes (your own mail) unless you name author (all you can read) or selected; scope_selection may name only what you can read. The answer carries the scope as stored. expectations saves emails it must match and must not; the answer judges them (expectations_check). kind do_not_share blocks sharing: it runs before every other rule, and while active no rule shares an email it matches or cannot decide; a key cannot list it (details.reason rule_blocks_sharing). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const createEmailRule = (options) => (options.client ?? client).post({
 	security: [{
@@ -3662,7 +3702,7 @@ const createEmailRule = (options) => (options.client ?? client).post({
 /**
 * Delete a rule
 *
-* Deletes a rule with its versions, its decisions and the access it granted. The author, or a caller who reads the whole organization's mail, may delete it; while it is shared with another member, only the author or someone who manages members from the dashboard. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Deletes a rule with its versions, its decisions and the access it granted. The author, or a caller who reads the whole organization's mail, may delete it; while it is shared with another member, only the author or someone who manages members from the dashboard. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const deleteEmailRule = (options) => (options.client ?? client).delete({
 	security: [{
@@ -3675,7 +3715,7 @@ const deleteEmailRule = (options) => (options.client ?? client).delete({
 /**
 * Read a rule
 *
-* A rule, its scope (evaluation_scope, and scope_selection for a selected rule) and its current version. What the scope comes to for its author now is GET /email-rules/{id}/scope. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* A rule, its scope (evaluation_scope, and scope_selection for a selected rule), its current version and its saved expectations. What the scope comes to for its author now is GET /email-rules/{id}/scope. The SQL the version renders to is included only when include_sql is true. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const getEmailRule = (options) => (options.client ?? client).get({
 	security: [{
@@ -3688,7 +3728,7 @@ const getEmailRule = (options) => (options.client ?? client).get({
 /**
 * Change a rule
 *
-* Renames the rule, saves a new version (english, tree and explanation together; earlier versions are kept unchanged), changes its state (draft, disabled; observe; or active) or changes whose mail it runs over (evaluation_scope, with scope_selection when selected). Only the rule's author may rename it, add a version, change its scope or move it to observe or active; anyone else who can see it may only disable it (state draft), and while it is shared with another member only if they manage members from the dashboard. Omit evaluation_scope to keep the current scope. A scope change saves a new version with the same conditions; what was granted stays. A shared rule keeps its scope. A rule's kind never changes. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Renames the rule, saves a new version (english and tree together, with an explanation or one the server writes; earlier versions stay), changes its state (draft is off; observe; active), whose mail it runs over (evaluation_scope, with scope_selection when selected) or its saved expectations (each saved version and new set is judged in expectations_check). Anyone but its author who sees it may only disable it (state draft), and while it is shared only if they manage members from the dashboard. Without evaluation_scope the scope stays; a scope change saves a new version with the same conditions, and what was granted stays. A shared rule keeps its scope; a kind never changes. Send if_version, the current_version you read, so a write never replaces a version saved since. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const updateEmailRule = (options) => (options.client ?? client).patch({
 	security: [{
@@ -3705,7 +3745,7 @@ const updateEmailRule = (options) => (options.client ?? client).patch({
 /**
 * List a rule's decisions
 *
-* What the rule decided for each email it was evaluated against, newest first: whether it matched, whether it nearly did, how each part decided and the answers to its questions. Only decisions on emails the caller can read are listed. With matched, only matches (true) or only the rest (false). Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* What the rule decided for each email it was evaluated against, newest first: whether it matched, whether it nearly did, how each part decided and the answers to its questions, with which email it was (from_address, subject, received_at). Only decisions on emails the caller can read are listed. With matched, only matches (true) or only the rest (false). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRuleDecisions = (options) => (options.client ?? client).get({
 	security: [{
@@ -3718,7 +3758,7 @@ const listEmailRuleDecisions = (options) => (options.client ?? client).get({
 /**
 * List every rule's result on an email
 *
-* Every rule the caller can see and what it decided about this email: those that matched, those that did not, and those that have not run on it, with what is known about them. A result names the version of the rule that decided and carries that version's conditions and questions. A matched rule with kind do_not_share keeps rules from sharing the email while it is active; anything shared before then stays shared. Only a caller who can read the email gets an answer, and a rule the caller cannot see is left out. At most 50 rules are listed, those with a result first; hidden counts the rest. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Every rule you can see and what it decided about this email (matched, not matched, or not run, with what is known), in the words of the version that decided. A matched do_not_share rule keeps rules from sharing the email while it is active; what was shared before then stays shared. Only a caller who can read the email gets an answer. classification is what the classifier read from the email, every fact as rule conditions read it, so you can see why a rule did or did not match. At most 50 rules are listed, those with a result first; hidden counts the rest. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRuleResults = (options) => (options.client ?? client).get({
 	security: [{
@@ -3731,7 +3771,7 @@ const listEmailRuleResults = (options) => (options.client ?? client).get({
 /**
 * Read versions of a rule
 *
-* The named versions of a rule, as they were written: what each one's conditions and questions were, so a decision can be read against the version that made it. Numbers that are not versions of the rule are left out. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* A rule's versions as they were written: what each one's conditions and questions were, so a decision can be read against the version that made it. Without versions, every version newest first, a page at a time (meta.cursor). With versions, only those named, oldest first; numbers that are not versions of the rule are left out. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRuleVersions = (options) => (options.client ?? client).get({
 	security: [{
@@ -3744,7 +3784,7 @@ const listEmailRuleVersions = (options) => (options.client ?? client).get({
 /**
 * Read what a rule covers
 *
-* Whose mail the rule runs over, and what that comes to now: a rule never reaches further than what its author can read when it runs, so what a selected rule names and its author can no longer read stops matching. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Whose mail the rule runs over, and what that comes to now: a rule never reaches further than what its author can read when it runs, so what a selected rule names and its author can no longer read stops matching. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const getEmailRuleScope = (options) => (options.client ?? client).get({
 	security: [{
@@ -3757,7 +3797,7 @@ const getEmailRuleScope = (options) => (options.client ?? client).get({
 /**
 * List what a rule can cover
 *
-* How much the caller can read, and the inboxes and domains the caller can read, which is what they may name when a rule runs over selected inboxes and domains. For a caller who reads the whole organization, addresses lists the inboxes known as someone's (member addresses, members' verified work emails at the organization's domains, agents' addresses and inboxes with shared access), not every address that receives mail: may_name_unlisted says when an address that is not listed, such as an inbox nobody has claimed, may be named too. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* How much the caller can read, and the inboxes and domains the caller can read, which is what they may name when a rule runs over selected inboxes and domains. For a caller who reads the whole organization, addresses lists the inboxes known as someone's (member addresses, members' verified work emails at the organization's domains, agents' addresses and inboxes with shared access), not every address that receives mail: may_name_unlisted says when an address that is not listed, such as an inbox nobody has claimed, may be named too. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRuleScopeOptions = (options) => (options?.client ?? client).get({
 	security: [{
@@ -3770,7 +3810,7 @@ const listEmailRuleScopeOptions = (options) => (options?.client ?? client).get({
 /**
 * List rule requests
 *
-* Rule requests, newest first: those made to you (box incoming, the default), those you made (outgoing), or every one you can see (all). Pending ones by default; status decided lists accepted, declined and withdrawn ones, and any lists both. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Rule requests, newest first: those made to you (box incoming, the default), those you made (outgoing), or every one you can see (all). Pending ones by default; status decided lists accepted, declined and withdrawn ones, and any lists both. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRuleRequests = (options) => (options?.client ?? client).get({
 	security: [{
@@ -3783,7 +3823,7 @@ const listEmailRuleRequests = (options) => (options?.client ?? client).get({
 /**
 * Ask a member for a rule
 *
-* Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address (at most 30 lookups by address an hour). Nothing is evaluated and nothing is shared until they accept, and they may change the rule first; they see the request and can preview what it matches in their own mail. You may have at most 5 pending requests to one member and 50 in all. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated and nothing is shared until they accept, and they may change the rule first; they see the request and can preview what it matches in their own mail. You may have at most 5 pending requests to one member and 50 in all. If you can list members (members:read), the answer also says whether they can accept it under their role (target_can_accept), and if not, why (target_warning); the request is sent either way. To find out before asking, use POST /v1/email-rule-requests/target-check. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const createEmailRuleRequest = (options) => (options.client ?? client).post({
 	security: [{
@@ -3798,9 +3838,39 @@ const createEmailRuleRequest = (options) => (options.client ?? client).post({
 	}
 });
 /**
+* Check whether a member can accept a rule request
+*
+* Says, before you ask, whether a member could accept a rule request now under their role, and if not, which permission their role lacks. Nothing is sent and nothing is recorded. Needs members:read, as listing members and their roles does. At most 60 checks an hour. Name them by user id, or by their member mailbox address or verified work email (counted with asking: at most 30 lookups by address an hour). Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
+*/
+const checkEmailRuleRequestTarget = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rule-requests/target-check",
+	...options,
+	headers: {
+		...options.body !== void 0 && { "Content-Type": "application/json" },
+		...options.headers
+	}
+});
+/**
+* Delete a withdrawn rule request
+*
+* Deletes a request you withdrew, for everyone who could see it. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
+*/
+const deleteEmailRuleRequest = (options) => (options.client ?? client).delete({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/email-rule-requests/{id}",
+	...options
+});
+/**
 * Read a rule request
 *
-* A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const getEmailRuleRequest = (options) => (options.client ?? client).get({
 	security: [{
@@ -3813,7 +3883,7 @@ const getEmailRuleRequest = (options) => (options.client ?? client).get({
 /**
 * Decline a rule request
 *
-* Declines a pending request made to you. Nothing is written but the decision. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Declines a pending request made to you. Nothing is written but the decision. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const declineEmailRuleRequest = (options) => (options.client ?? client).post({
 	security: [{
@@ -3826,7 +3896,7 @@ const declineEmailRuleRequest = (options) => (options.client ?? client).post({
 /**
 * Withdraw a rule request
 *
-* Withdraws a pending request you made. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Withdraws a pending request you made. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const withdrawEmailRuleRequest = (options) => (options.client ?? client).post({
 	security: [{
@@ -3839,7 +3909,7 @@ const withdrawEmailRuleRequest = (options) => (options.client ?? client).post({
 /**
 * Accept a rule request
 *
-* Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked. Send no body to accept it as asked, or change it first with english, tree and explanation together. Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Also needs mail:send_as_member: a role that can only read this mailbox is refused. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Also needs mail:share_own (sharing your own mail through email rules, which only shows it and never sends): a role without it is refused, whether or not it can send. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const acceptEmailRuleRequest = (options) => (options.client ?? client).post({
 	security: [{
@@ -3856,7 +3926,7 @@ const acceptEmailRuleRequest = (options) => (options.client ?? client).post({
 /**
 * List rule shares
 *
-* Lists rules shared with you, rules you share, or every share you can see. A share is visible to its two people and the organization's owners and admins. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* Lists rules shared with you, rules you share, or every share you can see. A share is visible to its two people and the organization's owners and admins. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const listEmailRuleShares = (options) => (options?.client ?? client).get({
 	security: [{
@@ -3895,7 +3965,7 @@ const endEmailRuleShare = (options) => (options.client ?? client).delete({
 /**
 * Get a rule share
 *
-* One share. Needs mail:read, a credential acting as a member with their full access (API keys, agent keys and narrowed tokens are refused), and the email rules feature on the organization.
+* One share. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.
 */
 const getEmailRuleShare = (options) => (options.client ?? client).get({
 	security: [{
@@ -3906,9 +3976,9 @@ const getEmailRuleShare = (options) => (options.client ?? client).get({
 	...options
 });
 /**
-* List the emails a rule share has given you
+* List the emails a rule share has given
 *
-* The emails a rule shared with you has matched, newest first, as the email list shows them. Only the person it was shared with can list them, from the dashboard or the Primitive CLI. An ended share lists nothing. A page can be short or empty and still carry a cursor: keep reading until meta.cursor is null.
+* The emails a rule share has given, newest first, as the email list shows them, each with shared_at. For the person it was shared with: what they can read through it now, so an ended share lists nothing, and shared_at is when the share's rule first matched the email. For the person sharing their mail: everything it has handed over while it ran, including after it ended and whatever the rule's state now, so they can see what left their mailbox, and shared_at is when it was handed over. Only those two people can list them, from the dashboard or the Primitive CLI. A page can be short or empty and still carry a cursor: keep reading until meta.cursor is null.
 */
 const listEmailRuleShareEmails = (options) => (options.client ?? client).get({
 	security: [{
@@ -4133,6 +4203,19 @@ const getOwnGrant = (options) => (options?.client ?? client).get({
 	...options
 });
 /**
+* List the addresses this credential can send from
+*
+* The From addresses the calling credential may send from with POST /send-mail, and the one a send that names no From should use. Every address listed is one that send would accept as From for this credential, recipients aside. A connected agent's default is its own address. A person's default is their own member address, for a session and for every OAuth login of theirs, an agent's included. Any other credential has a default only when exactly one address and no domain is listed, and never a person's own member address. When there is no default, `reason` says why. `domains` lists the domains at which the credential may send from any address that is not reserved to someone else or left out of its grant; each is one GET /outbound/status lists as sendable for it. A credential that cannot send new mail, or one in an account where outbound mail is not enabled, gets no addresses and no domains. Every credential may ask about itself, a connected agent's key included, except a Function-bound key limited to its Function's own operations (403 function_scope_forbidden). It answers nothing about any other credential.
+*/
+const getSendFrom = (options) => (options?.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/whoami/send-from",
+	...options
+});
+/**
 * List consumer Inbox routing rules
 *
 * Mailbox-scoped exact visible audiences, excluding the owner and Bcc. Direct and group audiences are independent. Restores persist an explicit Conversations rule. New writes require the observed version (zero creates); only an identical latest mutation with its original expected version can be retried. Stale writes return mail_routing_conflict. Source messages and read state are unchanged. Merge paged rules by version; responses are never cached.
@@ -4475,7 +4558,7 @@ const checkSendability = (options) => (options.client ?? client).post({
 /**
 * Get a webhook delivery
 *
-* One webhook delivery attempt record, by the id listDeliveries returns.
+* One webhook delivery attempt record, by the id listDeliveries returns, with every attempt of the same delivery (a retry is recorded as a new attempt with its own id).
 */
 const getDelivery = (options) => (options.client ?? client).get({
 	security: [{
@@ -4523,7 +4606,7 @@ const revokeOrganizationInvitation = (options) => (options.client ?? client).del
 	...options
 });
 /**
-* Requires a current human organization membership, or an org-wide API key: a super admin key, or a custom key with no addresses or domains whose grant holds members:read. A key lists members as the person it belongs to, at that person's live grant, and only while that person still holds members:read. Narrowed, Function and connected keys are refused. No local paths or existing conversation history are shared.
+* Requires a current human organization membership, or an org-wide API key: a super admin key, or a custom key with no addresses or domains whose grant holds members:read. A key lists members as the person it belongs to, at that person's live grant, and only while that person still holds members:read. Narrowed, Function and connected keys are refused. A caller holding members:read also gets each person's mail_access. No local paths or existing conversation history are shared.
 */
 const listOrganizationPeople = (options) => (options?.client ?? client).get({
 	security: [{
@@ -4636,7 +4719,7 @@ const revokeProjectInvitation = (options) => (options.client ?? client).delete({
 /**
 * List mailbox access
 *
-* Every access entry in the organization: who (a member, group, agent or address) may read, draft or send for each mailbox or domain. An entry that reads a mailbox reads the full email; raw MIME follows the person's mail.raw:read. `depth` is deprecated: it is accepted and ignored, and new entries record content. Needs members:read: a person, or an org-wide API key whose person holds it.
+* Every access entry in the organization: who (a member, group, agent or address) may read, draft or send for each mailbox or domain. An entry that reads a mailbox reads the full email; raw MIME follows the person's mail.raw:read. `depth` is deprecated: it is accepted and ignored, and new entries record content. With no entries, `note` says where each member's mail access comes from instead. Needs members:read: a person, or an org-wide API key whose person holds it.
 */
 const listMailboxAccess = (options) => (options?.client ?? client).get({
 	security: [{
@@ -4726,7 +4809,7 @@ const updateGroup = (options) => (options.client ?? client).patch({
 /**
 * List every credential
 *
-* Every credential that can act in the organization: API keys, Function keys, agent connection keys, connected apps (OAuth), agent delegates and, where enabled, CLI logins. Secrets are never returned. Filter with kind. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.
+* Every credential that can act in the organization: API keys, Function keys, agent connection keys, connected apps (OAuth), agent delegates and, where enabled, CLI logins. Secrets are never returned. A key's grant.mail_scope.depth is raw only when it holds mail.raw:read and its scope lists an address or a domain, otherwise content. Filter with kind. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.
 */
@@ -4741,9 +4824,9 @@ const listCredentials = (options) => (options?.client ?? client).get({
 /**
 * Revoke a credential
 *
-* Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up keeps working and is listed in standing_objects for review. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.
+* Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up keeps working and is listed in standing_objects for review. The person's own Primitive CLI login revokes an API key (kind org_key) as the person, with no step-up unless the organization's credential policy sets cli_writes_require_approval (then it takes a keys.create step-up); every other kind (a connected key named as org_key included, 403 grant_forbidden target_not_covered), and every other app even with a step-up, is refused outside the dashboard (403). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
-* Person only: a dashboard session. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.
+* Person only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.
 */
 const revokeCredential = (options) => (options.client ?? client).post({
 	security: [{
@@ -4760,7 +4843,7 @@ const revokeCredential = (options) => (options.client ?? client).post({
 /**
 * Revoke every credential (emergency)
 *
-* The emergency response to a leak: revokes every API key, agent connection key and connected app created since a time, rotates the organization Function key and every running Function's own key, and optionally suspends Functions. Owners only, from a dashboard session, and the body must confirm with "revoke all". Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.
+* The emergency response to a leak: revokes every API key, agent connection key and connected app created since a time, rotates the organization Function key and every running Function's own key, and optionally suspends Functions. Owners only, from a dashboard session, and the body must confirm with "revoke all". Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credentials:revoke_all. API keys, agent connection keys and agents are refused.
 */
@@ -4779,7 +4862,7 @@ const revokeAllCredentials = (options) => (options.client ?? client).post({
 /**
 * Read the credential audit trail
 *
-* Credential events (created, rotated, edited, revoked, used with a step-up, policy changes), newest first, with a cursor. format=csv returns the same page as CSV. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.
+* Credential events (created, rotated, edited, revoked, used with a step-up, policy changes), newest first, with a cursor. format=csv returns the same page as CSV. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credential_events:read. API keys, agent connection keys and agents are refused.
 */
@@ -4794,7 +4877,7 @@ const listCredentialEvents = (options) => (options?.client ?? client).get({
 /**
 * Read the credential policy
 *
-* The organization credential policy: key lifetime and expiry rules, who may create super admin keys, whether members may create keys and the other rules every new key is held to. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.
+* The organization credential policy: key lifetime and expiry rules, who may create super admin keys, whether members may create keys and the other rules every new key is held to. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.
 */
@@ -4809,7 +4892,7 @@ const getCredentialPolicy = (options) => (options?.client ?? client).get({
 /**
 * Change the credential policy
 *
-* Change one or more policy rules. Admins may only tighten the policy; loosening any rule needs an owner. Owners and admins are emailed about every change. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.
+* Change one or more policy rules. Admins may only tighten the policy; loosening any rule needs an owner. Owners and admins are emailed about every change. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credential_policy:manage. API keys, agent connection keys and agents are refused.
 */
@@ -4828,7 +4911,7 @@ const updateCredentialPolicy = (options) => (options.client ?? client).patch({
 /**
 * Read the key builder
 *
-* The key presets the caller may use (each with whether it is available and why not), the permission matrix for custom keys and the policy in force. An area marked org_wide_only (Members) is listed only to a person who holds its permission, and only a custom key with no addresses or domains may hold it. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.
+* The key presets the caller may use (each with whether it is available and why not), the permission matrix for custom keys and the policy in force. An area marked org_wide_only (Members) is listed only to a person who holds its permission, and only a custom key with no addresses or domains may hold it. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.
 */
@@ -4843,7 +4926,7 @@ const getKeyBuilder = (options) => (options?.client ?? client).get({
 /**
 * List API keys
 *
-* Key metadata, never a secret: name, prefix, grant, creator, last use, expiry and suspension. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.
+* Key metadata, never a secret: name, prefix, grant, creator, last use, expiry, suspension and whether each key works now (status). A grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.
 */
@@ -4858,9 +4941,9 @@ const listKeys = (options) => (options?.client ?? client).get({
 /**
 * Create an API key
 *
-* Create an API key, super admin or narrowed to a preset or a custom permission set, optionally with an expiry and conditions. The secret is returned once. A key never holds more than the person creating it; the credential policy decides who may create which keys. grant is required: a request without it is refused (400 validation_error, details.reason grant_required), never treated as super admin. A custom key must say which mail it reaches: the addresses and domains it lists (grant.addresses, grant.domains), or every mailbox in the organization with grant.mail_scope "org", which cannot be combined with them; one that says neither is refused (400 validation_error, details.reason mail_scope_required). Super admin, Send only and Read only reach every mailbox by definition. members:read is only for an org-wide custom key: naming it with grant.addresses or grant.domains is refused (400). Owners and admins are emailed about every super admin key. Send an Idempotency-Key to retry safely: a second create by the same person under the same key makes no second key and is refused (409 idempotency_key_reused) with the first key's id in error.details.key_id, so a caller whose first answer was lost can revoke that key. The onboarding field is for the dashboard only. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules); the Primitive app's token is refused, even with one. While the organization's keys API is not enabled, this answers 404 feature_disabled (details.feature keys_api; only Primitive turns it on), except that a dashboard session may still create a super admin key (the dashboard's own create).
+* Create an API key, super admin or narrowed to a preset or a custom permission set, optionally with an expiry and conditions. The secret is returned once. A key never holds more than the person creating it; the credential policy decides who may create which keys. grant is required: a request without it is refused (400 validation_error, details.reason grant_required), never treated as super admin. A custom key must say which mail it reaches: the addresses and domains it lists (grant.addresses, grant.domains), or every mailbox in the organization with grant.mail_scope "org", which cannot be combined with them; one that says neither is refused (400 validation_error, details.reason mail_scope_required). Super admin, Send only and Read only reach every mailbox by definition. members:read is only for an org-wide custom key: naming it with grant.addresses or grant.domains is refused (400). Owners and admins are emailed about every super admin key. Send an Idempotency-Key to retry safely: a second create by the same person under the same key makes no second key and is refused (409 idempotency_key_reused) with the first key's id in error.details.key_id, so a caller whose first answer was lost can revoke that key. The onboarding field is for the dashboard only. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. While the organization's keys API is not enabled, this answers 404 feature_disabled (details.feature keys_api; contact Primitive to turn it on), except that a dashboard session may still create a super admin key (the dashboard's own create).
 *
-* Person only: a dashboard session, the person's own Primitive CLI login with no step-up, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
+* Person only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
 */
 const createKey = (options) => (options.client ?? client).post({
 	security: [{
@@ -4877,9 +4960,9 @@ const createKey = (options) => (options.client ?? client).post({
 /**
 * Rotate an API key
 *
-* Mint a successor with the same grant and return its secret once. The old key keeps working for overlap_seconds, then stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner created is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules); the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.
+* Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
-* Person only: a dashboard session, the person's own Primitive CLI login with no step-up, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
+* Person only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
 */
 const rotateKey = (options) => (options.client ?? client).post({
 	security: [{
@@ -4896,7 +4979,7 @@ const rotateKey = (options) => (options.client ?? client).post({
 /**
 * Get an API key
 *
-* One key's metadata, never its secret. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.
+* One key's metadata, never its secret, with whether it works now (status). Its grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.
 */
@@ -4911,9 +4994,9 @@ const getKey = (options) => (options.client ?? client).get({
 /**
 * Change an API key
 *
-* Rename a key, change its expiry, its grant or its conditions, or suspend it. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules); the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.
+* Rename a key, change its expiry, its grant or its conditions, or suspend it. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
-* Person only: a dashboard session, the person's own Primitive CLI login with no step-up, or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
+* Person only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.
 */
 const updateKey = (options) => (options.client ?? client).patch({
 	security: [{
@@ -4930,7 +5013,7 @@ const updateKey = (options) => (options.client ?? client).patch({
 /**
 * Suggest a least-privilege grant for a key
 *
-* The permissions a key used over the last 30 days, as a custom grant that would have served every successful call (also as builder areas), the narrowest mail scope its calls support (depth is deprecated: raw when it downloaded raw MIME, otherwise content) (the mailboxes of the messages it named and sent, with notes on what the request log cannot account for), and whether it is unused. Calls to routes only the super admin key can use (groups and mailbox access) derive no permission, since a custom key is refused there; super_admin_only_calls counts them. usage gives the same window anonymized: successful and failed requests per UTC day, the routes called by their declared template (never the called path) with the permission each needed, and how many mailboxes the key read and sent from (counts only, and only for a person with access to the whole organization's mail). Nothing is applied: narrowing is a change to the key (PATCH /v1/keys/:id). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Only Primitive turns these on.
+* The permissions a key used over the last 30 days, as a custom grant that would have served every successful call (also as builder areas), the narrowest mail scope its calls support (depth is deprecated: raw when it downloaded raw MIME, otherwise content) (the mailboxes of the messages it named and sent, with notes on what the request log cannot account for), and whether it is unused. Calls to routes only the super admin key can use (groups and mailbox access) derive no permission, since a custom key is refused there; super_admin_only_calls counts them. usage gives the same window anonymized: successful and failed requests per UTC day, the routes called by their declared template (never the called path) with the permission each needed, and how many mailboxes the key read and sent from (counts only, and only for a person with access to the whole organization's mail). Nothing is applied: narrowing is a change to the key (PATCH /v1/keys/:id). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.
 *
 * Person only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.
 */
@@ -5111,7 +5194,7 @@ const updateSearchSettings = (options) => (options.client ?? client).put({
 /**
 * List roles
 *
-* Every role in the organization (built-in, template copies and custom roles), with how many members and groups hold each, the templates not yet copied, and whether roles can be assigned now. Any person (a session or OAuth token); API keys are refused.
+* Every role in the organization (built-in, template copies and custom roles), with how many members and groups hold each, the templates not yet copied, and whether roles can be assigned now. `unassigned` describes role restricted on a member with no role_id, which is not a role and is never in `roles`. Any person (a session or OAuth token); API keys are refused.
 */
 const listRoles = (options) => (options?.client ?? client).get({
 	security: [{
@@ -5124,7 +5207,7 @@ const listRoles = (options) => (options?.client ?? client).get({
 /**
 * Create a custom role
 *
-* A role nobody can use to gain access they do not hold: its permissions and mail scope must be within the author's own. mail_scope is "org" (the default) or { addresses, domains }; any other value is refused with 400 `validation_error`. Every role that reaches mail reads it in full, and raw MIME follows the role's mail.raw:read; `depth` is deprecated and ignored. Its mail scope names no other member's personal mailbox: otherwise 403 `grant_forbidden` with `details.reason` `personal_mailbox_member_only`. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `roles.write` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs roles:assign. API keys are refused.
+* A role nobody can use to gain access they do not hold: its permissions and mail scope must be within the author's own. mail_scope is "org" (the default) or { addresses, domains }; any other value is refused with 400 `validation_error`. Every role that reaches mail reads it in full, and raw MIME follows the role's mail.raw:read; `depth` is deprecated and ignored. Its mail scope names no other member's personal mailbox: otherwise 403 `grant_forbidden` with `details.reason` `personal_mailbox_member_only`. Each permission must have what it requires in the same role: mail:read for mail.raw:read, mail.search:semantic, mail:share_own, changes:read and webhooks:read; mail:send for mail:send_batch and mail:send_as_member; functions:deploy for templates:install; agent_connections:manage for agent_connections:custom_domains. Otherwise 400 `validation_error` with `details.reason` `unmet_requirement`, `details.permission` and `details.requires`. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `roles.write` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs roles:assign. API keys are refused.
 */
 const createRole = (options) => (options.client ?? client).post({
 	security: [{
@@ -5154,7 +5237,7 @@ const deleteRole = (options) => (options.client ?? client).delete({
 /**
 * Change a custom role
 *
-* A new version of the role, with a new `id`: the version you edited is retired, the response is the new one (same `key`, `version` one higher), and every member and group holding the role moves to it. The old id answers 404 `not_found` from then on, so store the returned `id` (or look the role up by `key` in GET /roles) before editing or assigning it again. Every holder whose access shrinks goes through the reduction path. mail_scope follows the same rules as creating a role; a role whose stored scope cannot be read must be sent a new mail_scope, otherwise 400 `validation_error` with `details.reason` `invalid_mail_scope`.  A personal mailbox the new version adds must be the author's own, and every holder must be the member of each personal mailbox it names: otherwise 403 `grant_forbidden` with `details.reason` `personal_mailbox_member_only`. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `roles.write` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs roles:assign. API keys are refused.
+* A new version of the role, with a new `id`: the version you edited is retired, the response is the new one (same `key`, `version` one higher), and every member and group holding the role moves to it. The old id answers 404 `not_found` from then on, so store the returned `id` (or look the role up by `key` in GET /roles) before editing or assigning it again. Every holder whose access shrinks goes through the reduction path. mail_scope follows the same rules as creating a role; a role whose stored scope cannot be read must be sent a new mail_scope, otherwise 400 `validation_error` with `details.reason` `invalid_mail_scope`.  A personal mailbox the new version adds must be the author's own, and every holder must be the member of each personal mailbox it names: otherwise 403 `grant_forbidden` with `details.reason` `personal_mailbox_member_only`. Each permission in the new version must have what it requires in the same role, as when creating one, including permissions carried over unchanged. Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `roles.write` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs roles:assign. API keys are refused.
 */
 const updateRole = (options) => (options.client ?? client).patch({
 	security: [{
@@ -5377,7 +5460,7 @@ const listSuspensions = (options) => (options?.client ?? client).get({
 /**
 * Decide a suspension
 *
-* Keep, narrow or revoke one suspended or flagged item. Keeping it, and revoking an API key, needs the decider to cover it (revoking an uncovered key is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. A rule share paused by a role change (`email_rule_share`) takes keep, which leaves it paused, or revoke, which ends the share and needs confirm: true (the person it was shared with loses the emails already shared; without it, 409 `confirmation_required`). Neither of the share's two people may keep it (`grant_forbidden`, `share_decision_forbidden`). Access a person gave on their own mailbox (`mailbox_access`) takes keep or revoke, and both need delegations:manage; revoke removes only what that person gave on that mailbox. Nobody the access reaches, nor the person who gave it, may keep it (`grant_forbidden`, `mailbox_access_decision_forbidden`). Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.
+* Keep, narrow or revoke one suspended or flagged item. Keeping it, and revoking an API key, needs the decider to cover it (revoking an uncovered key is refused with `grant_forbidden`, `target_not_covered`). Keeping an API key rotated (`rotate: true`, other than the shared Function key) also revokes its older secrets still in a rotation overlap, and needs keys:manage on both the credential and the person: without it, or if the decider lost members:manage meanwhile, it is refused with `grant_forbidden` (`keys_manage_required` or `actor_access_changed`) and nothing is rotated. A rule share paused by a role change (`email_rule_share`) takes keep, which leaves it paused, or revoke, which ends the share and needs confirm: true (the person it was shared with loses the emails already shared; without it, 409 `confirmation_required`, as for revoking a filter). Neither of the share's two people may keep it (`grant_forbidden`, `share_decision_forbidden`). Access a person gave on their own mailbox (`mailbox_access`) takes keep or revoke, and both need delegations:manage; revoke removes only what that person gave on that mailbox. Nobody the access reaches, nor the person who gave it, may keep it (`grant_forbidden`, `mailbox_access_decision_forbidden`). Person only: a dashboard session, or the person's own OAuth or CLI token with a session step-up of purpose `suspensions.decide` (the person confirms at the step_up_url a 403 step_up_required answer carries, which names this client, then send the token in the Primitive-Step-Up header; the token works only with the client it was confirmed for). Needs members:manage. API keys are refused.
 */
 const decideSuspension = (options) => (options.client ?? client).post({
 	security: [{
@@ -5499,6 +5582,32 @@ const releaseSentEmail = (options) => (options.client ?? client).post({
 	}
 });
 /**
+* Get a webhook's own signing secret
+*
+* The secret deliveries to this webhook are signed with, when it signs with its own (signed_with is own_secret). Verify the Primitive-Signature header with it. A webhook a person owns is given its secret the first time it is asked for. A webhook that signs with the organization's secret answers 409 conflict: rotate its signing secret to give it its own. Answered to the person who owns the webhook; for a webhook an API key owns, to the key that acts for it and the person who holds that key; for one a third-party app or an agent delegate owns, to that app or delegate; and for a webhook the organization owns, to a caller who may change it and holds webhook_secret:read.
+*/
+const getEndpointSigningSecret = (options) => (options.client ?? client).get({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}/signing-secret",
+	...options
+});
+/**
+* Rotate a webhook's signing secret, or give it its own
+*
+* Replaces the webhook's own signing secret, or gives a webhook that signs with the organization's secret one of its own, and returns it. Deliveries are signed with the new secret at once, so update the handler at the same time. Answered to the person who owns the webhook; for a webhook an API key owns, to the key that acts for it and the person who holds that key; for one a third-party app or an agent delegate owns, to that app or delegate; and for a webhook the organization owns, to a caller who may change it and holds webhook_secret:read.
+*/
+const rotateEndpointSigningSecret = (options) => (options.client ?? client).post({
+	security: [{
+		scheme: "bearer",
+		type: "http"
+	}],
+	url: "/endpoints/{id}/signing-secret/rotate",
+	...options
+});
+/**
 * Send a batch of emails in one request
 *
 * Send up to 100 independent messages in a single call. Each message uses the same body schema and the same send path as `POST /send-mail`, so auth, validation, rate limiting, and idempotency apply per message. Messages are processed independently: one failing does not fail the others. Every message gets an entry in `results` carrying either `data` (on success) or `error` (on failure), with the original `index`.
@@ -6935,7 +7044,7 @@ function parseFromHeader(header) {
 		value: { address: address.toLowerCase() }
 	};
 }
-// ../sdk-node/dist/trust-BNsucxtE.js
+// ../sdk-node/dist/understanding-CNZLYYam.js
 /**
 * AUTO-GENERATED - DO NOT EDIT
 * Run `pnpm generate:validator` to regenerate.
@@ -7073,9 +7182,12 @@ const schema12 = {
 				},
 				"content": {
 					"type": "object",
-					"if": { "properties": { "raw": { "type": "null" } } },
-					"then": { "properties": { "download": { "type": "null" } } },
-					"else": { "properties": { "download": { "type": "object" } } },
+					"if": { "required": ["raw"] },
+					"then": {
+						"if": { "properties": { "raw": { "type": "null" } } },
+						"then": { "properties": { "download": { "type": "null" } } },
+						"else": { "properties": { "download": { "type": "object" } } }
+					},
 					"properties": {
 						"raw": {
 							"anyOf": [{ "$ref": "#/definitions/RawContent" }, { "type": "null" }],
@@ -15400,13 +15512,11 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 					let valid10 = true;
 					const _errs64 = errors;
 					if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
-						if (data29.raw !== void 0) {
-							if (data29.raw !== null) {
-								const err65 = {};
-								if (vErrors === null) vErrors = [err65];
-								else vErrors.push(err65);
-								errors++;
-							}
+						if (data29.raw === void 0 && "raw") {
+							const err65 = {};
+							if (vErrors === null) vErrors = [err65];
+							else vErrors.push(err65);
+							errors++;
 						}
 					}
 					var _valid0 = _errs64 === errors;
@@ -15415,93 +15525,129 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 						if (_errs63) vErrors.length = _errs63;
 						else vErrors = null;
 					}
-					let ifClause0;
 					if (_valid0) {
+						const _errs65 = errors;
+						const _errs66 = errors;
+						let valid11 = true;
 						const _errs67 = errors;
 						if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
-							if (data29.download !== void 0) {
-								if (data29.download !== null) {
-									const err66 = {
-										instancePath: instancePath + "/email/content/download",
-										schemaPath: "#/properties/email/properties/content/then/properties/download/type",
-										keyword: "type",
-										params: { type: "null" },
-										message: "must be null"
-									};
+							if (data29.raw !== void 0) {
+								if (data29.raw !== null) {
+									const err66 = {};
 									if (vErrors === null) vErrors = [err66];
 									else vErrors.push(err66);
 									errors++;
 								}
 							}
 						}
-						var _valid0 = _errs67 === errors;
-						valid10 = _valid0;
-						ifClause0 = "then";
-					} else {
-						const _errs70 = errors;
-						if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
-							if (data29.download !== void 0) {
-								let data32 = data29.download;
-								if (!(data32 && typeof data32 == "object" && !Array.isArray(data32))) {
-									const err67 = {
-										instancePath: instancePath + "/email/content/download",
-										schemaPath: "#/properties/email/properties/content/else/properties/download/type",
-										keyword: "type",
-										params: { type: "object" },
-										message: "must be object"
-									};
-									if (vErrors === null) vErrors = [err67];
-									else vErrors.push(err67);
-									errors++;
+						var _valid1 = _errs67 === errors;
+						errors = _errs66;
+						if (vErrors !== null) {
+							if (_errs66) vErrors.length = _errs66;
+							else vErrors = null;
+						}
+						let ifClause0;
+						if (_valid1) {
+							const _errs70 = errors;
+							if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
+								if (data29.download !== void 0) {
+									if (data29.download !== null) {
+										const err67 = {
+											instancePath: instancePath + "/email/content/download",
+											schemaPath: "#/properties/email/properties/content/then/then/properties/download/type",
+											keyword: "type",
+											params: { type: "null" },
+											message: "must be null"
+										};
+										if (vErrors === null) vErrors = [err67];
+										else vErrors.push(err67);
+										errors++;
+									}
 								}
 							}
+							var _valid1 = _errs70 === errors;
+							valid11 = _valid1;
+							ifClause0 = "then";
+						} else {
+							const _errs73 = errors;
+							if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
+								if (data29.download !== void 0) {
+									let data32 = data29.download;
+									if (!(data32 && typeof data32 == "object" && !Array.isArray(data32))) {
+										const err68 = {
+											instancePath: instancePath + "/email/content/download",
+											schemaPath: "#/properties/email/properties/content/then/else/properties/download/type",
+											keyword: "type",
+											params: { type: "object" },
+											message: "must be object"
+										};
+										if (vErrors === null) vErrors = [err68];
+										else vErrors.push(err68);
+										errors++;
+									}
+								}
+							}
+							var _valid1 = _errs73 === errors;
+							valid11 = _valid1;
+							ifClause0 = "else";
 						}
-						var _valid0 = _errs70 === errors;
+						if (!valid11) {
+							const err69 = {
+								instancePath: instancePath + "/email/content",
+								schemaPath: "#/properties/email/properties/content/then/if",
+								keyword: "if",
+								params: { failingKeyword: ifClause0 },
+								message: "must match \"" + ifClause0 + "\" schema"
+							};
+							if (vErrors === null) vErrors = [err69];
+							else vErrors.push(err69);
+							errors++;
+						}
+						var _valid0 = _errs65 === errors;
 						valid10 = _valid0;
-						ifClause0 = "else";
 					}
 					if (!valid10) {
-						const err68 = {
+						const err70 = {
 							instancePath: instancePath + "/email/content",
 							schemaPath: "#/properties/email/properties/content/if",
 							keyword: "if",
-							params: { failingKeyword: ifClause0 },
-							message: "must match \"" + ifClause0 + "\" schema"
+							params: { failingKeyword: "then" },
+							message: "must match \"then\" schema"
 						};
-						if (vErrors === null) vErrors = [err68];
-						else vErrors.push(err68);
+						if (vErrors === null) vErrors = [err70];
+						else vErrors.push(err70);
 						errors++;
 					}
 					if (data29 && typeof data29 == "object" && !Array.isArray(data29)) {
 						if (data29.raw === void 0) {
-							const err69 = {
+							const err71 = {
 								instancePath: instancePath + "/email/content",
 								schemaPath: "#/properties/email/properties/content/required",
 								keyword: "required",
 								params: { missingProperty: "raw" },
 								message: "must have required property 'raw'"
 							};
-							if (vErrors === null) vErrors = [err69];
-							else vErrors.push(err69);
+							if (vErrors === null) vErrors = [err71];
+							else vErrors.push(err71);
 							errors++;
 						}
 						if (data29.download === void 0) {
-							const err70 = {
+							const err72 = {
 								instancePath: instancePath + "/email/content",
 								schemaPath: "#/properties/email/properties/content/required",
 								keyword: "required",
 								params: { missingProperty: "download" },
 								message: "must have required property 'download'"
 							};
-							if (vErrors === null) vErrors = [err70];
-							else vErrors.push(err70);
+							if (vErrors === null) vErrors = [err72];
+							else vErrors.push(err72);
 							errors++;
 						}
 						if (data29.raw !== void 0) {
 							let data33 = data29.raw;
-							const _errs74 = errors;
-							let valid15 = false;
-							const _errs75 = errors;
+							const _errs77 = errors;
+							let valid16 = false;
+							const _errs78 = errors;
 							if (!validate12$1(data33, {
 								instancePath: instancePath + "/email/content/raw",
 								parentData: data29,
@@ -15511,40 +15657,40 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 								vErrors = vErrors === null ? validate12$1.errors : vErrors.concat(validate12$1.errors);
 								errors = vErrors.length;
 							}
-							var _valid1 = _errs75 === errors;
-							valid15 = valid15 || _valid1;
-							if (!valid15) {
-								const _errs76 = errors;
+							var _valid2 = _errs78 === errors;
+							valid16 = valid16 || _valid2;
+							if (!valid16) {
+								const _errs79 = errors;
 								if (data33 !== null) {
-									const err71 = {
+									const err73 = {
 										instancePath: instancePath + "/email/content/raw",
 										schemaPath: "#/properties/email/properties/content/properties/raw/anyOf/1/type",
 										keyword: "type",
 										params: { type: "null" },
 										message: "must be null"
 									};
-									if (vErrors === null) vErrors = [err71];
-									else vErrors.push(err71);
+									if (vErrors === null) vErrors = [err73];
+									else vErrors.push(err73);
 									errors++;
 								}
-								var _valid1 = _errs76 === errors;
-								valid15 = valid15 || _valid1;
+								var _valid2 = _errs79 === errors;
+								valid16 = valid16 || _valid2;
 							}
-							if (!valid15) {
-								const err72 = {
+							if (!valid16) {
+								const err74 = {
 									instancePath: instancePath + "/email/content/raw",
 									schemaPath: "#/properties/email/properties/content/properties/raw/anyOf",
 									keyword: "anyOf",
 									params: {},
 									message: "must match a schema in anyOf"
 								};
-								if (vErrors === null) vErrors = [err72];
-								else vErrors.push(err72);
+								if (vErrors === null) vErrors = [err74];
+								else vErrors.push(err74);
 								errors++;
 							} else {
-								errors = _errs74;
+								errors = _errs77;
 								if (vErrors !== null) {
-									if (_errs74) vErrors.length = _errs74;
+									if (_errs77) vErrors.length = _errs77;
 									else vErrors = null;
 								}
 							}
@@ -15552,79 +15698,79 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 						if (data29.download !== void 0) {
 							let data34 = data29.download;
 							if (!(data34 && typeof data34 == "object" && !Array.isArray(data34)) && data34 !== null) {
-								const err73 = {
+								const err75 = {
 									instancePath: instancePath + "/email/content/download",
 									schemaPath: "#/properties/email/properties/content/properties/download/type",
 									keyword: "type",
 									params: { type: schema12.properties.email.properties.content.properties.download.type },
 									message: "must be object,null"
 								};
-								if (vErrors === null) vErrors = [err73];
-								else vErrors.push(err73);
+								if (vErrors === null) vErrors = [err75];
+								else vErrors.push(err75);
 								errors++;
 							}
 							if (data34 && typeof data34 == "object" && !Array.isArray(data34)) {
 								if (data34.url === void 0) {
-									const err74 = {
+									const err76 = {
 										instancePath: instancePath + "/email/content/download",
 										schemaPath: "#/properties/email/properties/content/properties/download/required",
 										keyword: "required",
 										params: { missingProperty: "url" },
 										message: "must have required property 'url'"
 									};
-									if (vErrors === null) vErrors = [err74];
-									else vErrors.push(err74);
+									if (vErrors === null) vErrors = [err76];
+									else vErrors.push(err76);
 									errors++;
 								}
 								if (data34.expires_at === void 0) {
-									const err75 = {
+									const err77 = {
 										instancePath: instancePath + "/email/content/download",
 										schemaPath: "#/properties/email/properties/content/properties/download/required",
 										keyword: "required",
 										params: { missingProperty: "expires_at" },
 										message: "must have required property 'expires_at'"
 									};
-									if (vErrors === null) vErrors = [err75];
-									else vErrors.push(err75);
+									if (vErrors === null) vErrors = [err77];
+									else vErrors.push(err77);
 									errors++;
 								}
 								if (data34.url !== void 0) {
 									let data35 = data34.url;
 									if (typeof data35 === "string") {
 										if (!pattern4.test(data35)) {
-											const err76 = {
+											const err78 = {
 												instancePath: instancePath + "/email/content/download/url",
 												schemaPath: "#/properties/email/properties/content/properties/download/properties/url/pattern",
 												keyword: "pattern",
 												params: { pattern: "^https?://" },
 												message: "must match pattern \"^https?://\""
 											};
-											if (vErrors === null) vErrors = [err76];
-											else vErrors.push(err76);
+											if (vErrors === null) vErrors = [err78];
+											else vErrors.push(err78);
 											errors++;
 										}
 										if (!formats4.test(data35)) {
-											const err77 = {
+											const err79 = {
 												instancePath: instancePath + "/email/content/download/url",
 												schemaPath: "#/properties/email/properties/content/properties/download/properties/url/format",
 												keyword: "format",
 												params: { format: "uri" },
 												message: "must match format \"uri\""
 											};
-											if (vErrors === null) vErrors = [err77];
-											else vErrors.push(err77);
+											if (vErrors === null) vErrors = [err79];
+											else vErrors.push(err79);
 											errors++;
 										}
 									} else {
-										const err78 = {
+										const err80 = {
 											instancePath: instancePath + "/email/content/download/url",
 											schemaPath: "#/properties/email/properties/content/properties/download/properties/url/type",
 											keyword: "type",
 											params: { type: "string" },
 											message: "must be string"
 										};
-										if (vErrors === null) vErrors = [err78];
-										else vErrors.push(err78);
+										if (vErrors === null) vErrors = [err80];
+										else vErrors.push(err80);
 										errors++;
 									}
 								}
@@ -15632,42 +15778,42 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 									let data36 = data34.expires_at;
 									if (typeof data36 === "string") {
 										if (!formats0$1.test(data36)) {
-											const err79 = {
+											const err81 = {
 												instancePath: instancePath + "/email/content/download/expires_at",
 												schemaPath: "#/properties/email/properties/content/properties/download/properties/expires_at/format",
 												keyword: "format",
 												params: { format: "date-time" },
 												message: "must match format \"date-time\""
 											};
-											if (vErrors === null) vErrors = [err79];
-											else vErrors.push(err79);
+											if (vErrors === null) vErrors = [err81];
+											else vErrors.push(err81);
 											errors++;
 										}
 									} else {
-										const err80 = {
+										const err82 = {
 											instancePath: instancePath + "/email/content/download/expires_at",
 											schemaPath: "#/properties/email/properties/content/properties/download/properties/expires_at/type",
 											keyword: "type",
 											params: { type: "string" },
 											message: "must be string"
 										};
-										if (vErrors === null) vErrors = [err80];
-										else vErrors.push(err80);
+										if (vErrors === null) vErrors = [err82];
+										else vErrors.push(err82);
 										errors++;
 									}
 								}
 							}
 						}
 					} else {
-						const err81 = {
+						const err83 = {
 							instancePath: instancePath + "/email/content",
 							schemaPath: "#/properties/email/properties/content/type",
 							keyword: "type",
 							params: { type: "object" },
 							message: "must be object"
 						};
-						if (vErrors === null) vErrors = [err81];
-						else vErrors.push(err81);
+						if (vErrors === null) vErrors = [err83];
+						else vErrors.push(err83);
 						errors++;
 					}
 				}
@@ -15706,123 +15852,123 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 				}
 				if (data14.relay !== void 0) {
 					let data40 = data14.relay;
-					const _errs88 = errors;
-					let valid17 = false;
-					const _errs89 = errors;
+					const _errs91 = errors;
+					let valid18 = false;
+					const _errs92 = errors;
 					if (data40 && typeof data40 == "object" && !Array.isArray(data40)) {
 						if (data40.hostname === void 0) {
-							const err82 = {
+							const err84 = {
 								instancePath: instancePath + "/email/relay",
 								schemaPath: "#/definitions/EmailRelay/required",
 								keyword: "required",
 								params: { missingProperty: "hostname" },
 								message: "must have required property 'hostname'"
 							};
-							if (vErrors === null) vErrors = [err82];
-							else vErrors.push(err82);
+							if (vErrors === null) vErrors = [err84];
+							else vErrors.push(err84);
 							errors++;
 						}
 						if (data40.via === void 0) {
-							const err83 = {
+							const err85 = {
 								instancePath: instancePath + "/email/relay",
 								schemaPath: "#/definitions/EmailRelay/required",
 								keyword: "required",
 								params: { missingProperty: "via" },
 								message: "must have required property 'via'"
 							};
-							if (vErrors === null) vErrors = [err83];
-							else vErrors.push(err83);
+							if (vErrors === null) vErrors = [err85];
+							else vErrors.push(err85);
 							errors++;
 						}
 						if (data40.hostname !== void 0) {
 							if (typeof data40.hostname !== "string") {
-								const err84 = {
+								const err86 = {
 									instancePath: instancePath + "/email/relay/hostname",
 									schemaPath: "#/definitions/EmailRelay/properties/hostname/type",
 									keyword: "type",
 									params: { type: "string" },
 									message: "must be string"
 								};
-								if (vErrors === null) vErrors = [err84];
-								else vErrors.push(err84);
+								if (vErrors === null) vErrors = [err86];
+								else vErrors.push(err86);
 								errors++;
 							}
 						}
 						if (data40.via !== void 0) {
 							if (typeof data40.via !== "string") {
-								const err85 = {
+								const err87 = {
 									instancePath: instancePath + "/email/relay/via",
 									schemaPath: "#/definitions/EmailRelay/properties/via/type",
 									keyword: "type",
 									params: { type: "string" },
 									message: "must be string"
 								};
-								if (vErrors === null) vErrors = [err85];
-								else vErrors.push(err85);
+								if (vErrors === null) vErrors = [err87];
+								else vErrors.push(err87);
 								errors++;
 							}
 						}
 					} else {
-						const err86 = {
+						const err88 = {
 							instancePath: instancePath + "/email/relay",
 							schemaPath: "#/definitions/EmailRelay/type",
 							keyword: "type",
 							params: { type: "object" },
 							message: "must be object"
 						};
-						if (vErrors === null) vErrors = [err86];
-						else vErrors.push(err86);
+						if (vErrors === null) vErrors = [err88];
+						else vErrors.push(err88);
 						errors++;
 					}
-					var _valid2 = _errs89 === errors;
-					valid17 = valid17 || _valid2;
-					if (!valid17) {
-						const _errs96 = errors;
+					var _valid3 = _errs92 === errors;
+					valid18 = valid18 || _valid3;
+					if (!valid18) {
+						const _errs99 = errors;
 						if (data40 !== null) {
-							const err87 = {
+							const err89 = {
 								instancePath: instancePath + "/email/relay",
 								schemaPath: "#/properties/email/properties/relay/anyOf/1/type",
 								keyword: "type",
 								params: { type: "null" },
 								message: "must be null"
 							};
-							if (vErrors === null) vErrors = [err87];
-							else vErrors.push(err87);
+							if (vErrors === null) vErrors = [err89];
+							else vErrors.push(err89);
 							errors++;
 						}
-						var _valid2 = _errs96 === errors;
-						valid17 = valid17 || _valid2;
+						var _valid3 = _errs99 === errors;
+						valid18 = valid18 || _valid3;
 					}
-					if (!valid17) {
-						const err88 = {
+					if (!valid18) {
+						const err90 = {
 							instancePath: instancePath + "/email/relay",
 							schemaPath: "#/properties/email/properties/relay/anyOf",
 							keyword: "anyOf",
 							params: {},
 							message: "must match a schema in anyOf"
 						};
-						if (vErrors === null) vErrors = [err88];
-						else vErrors.push(err88);
+						if (vErrors === null) vErrors = [err90];
+						else vErrors.push(err90);
 						errors++;
 					} else {
-						errors = _errs88;
+						errors = _errs91;
 						if (vErrors !== null) {
-							if (_errs88) vErrors.length = _errs88;
+							if (_errs91) vErrors.length = _errs91;
 							else vErrors = null;
 						}
 					}
 				}
 				if (data14.automated !== void 0) {
 					if (typeof data14.automated !== "boolean") {
-						const err89 = {
+						const err91 = {
 							instancePath: instancePath + "/email/automated",
 							schemaPath: "#/properties/email/properties/automated/type",
 							keyword: "type",
 							params: { type: "boolean" },
 							message: "must be boolean"
 						};
-						if (vErrors === null) vErrors = [err89];
-						else vErrors.push(err89);
+						if (vErrors === null) vErrors = [err91];
+						else vErrors.push(err91);
 						errors++;
 					}
 				}
@@ -15831,53 +15977,53 @@ function validate11$1(data, { instancePath = "", parentData, parentDataProperty,
 					if (Array.isArray(data44)) {
 						const len1 = data44.length;
 						for (let i1 = 0; i1 < len1; i1++) if (typeof data44[i1] !== "string") {
-							const err90 = {
+							const err92 = {
 								instancePath: instancePath + "/email/automated_reasons/" + i1,
 								schemaPath: "#/properties/email/properties/automated_reasons/items/type",
 								keyword: "type",
 								params: { type: "string" },
 								message: "must be string"
 							};
-							if (vErrors === null) vErrors = [err90];
-							else vErrors.push(err90);
+							if (vErrors === null) vErrors = [err92];
+							else vErrors.push(err92);
 							errors++;
 						}
 					} else {
-						const err91 = {
+						const err93 = {
 							instancePath: instancePath + "/email/automated_reasons",
 							schemaPath: "#/properties/email/properties/automated_reasons/type",
 							keyword: "type",
 							params: { type: "array" },
 							message: "must be array"
 						};
-						if (vErrors === null) vErrors = [err91];
-						else vErrors.push(err91);
+						if (vErrors === null) vErrors = [err93];
+						else vErrors.push(err93);
 						errors++;
 					}
 				}
 			} else {
-				const err92 = {
+				const err94 = {
 					instancePath: instancePath + "/email",
 					schemaPath: "#/properties/email/type",
 					keyword: "type",
 					params: { type: "object" },
 					message: "must be object"
 				};
-				if (vErrors === null) vErrors = [err92];
-				else vErrors.push(err92);
+				if (vErrors === null) vErrors = [err94];
+				else vErrors.push(err94);
 				errors++;
 			}
 		}
 	} else {
-		const err93 = {
+		const err95 = {
 			instancePath,
 			schemaPath: "#/type",
 			keyword: "type",
 			params: { type: "object" },
 			message: "must be object"
 		};
-		if (vErrors === null) vErrors = [err93];
-		else vErrors.push(err93);
+		if (vErrors === null) vErrors = [err95];
+		else vErrors.push(err95);
 		errors++;
 	}
 	validate11$1.errors = vErrors;
@@ -16084,10 +16230,10 @@ function formatValidationIssue(error, input) {
 	switch (error.keyword) {
 		case "required": {
 			const missing = String(error.params.missingProperty ?? "unknown");
-			const prefix = field === "payload" ? "payload" : field;
+			const missingField = field === "payload" ? missing : `${field}.${missing}`;
 			return {
-				field: prefix === "payload" ? missing : `${prefix}.${missing}`,
-				message: `Missing required field: ${missing}`,
+				field: missingField,
+				message: `Missing required field: ${missingField}`,
 				suggestion: `Add the required field "${missing}" to the webhook payload.`
 			};
 		}
@@ -24289,11 +24435,6 @@ function combineQ(q, domain) {
 	const parts = [q?.trim(), domain ? `domain:${quoteDslValue(domain.trim())}` : void 0].filter((part) => Boolean(part));
 	return parts.length > 0 ? parts.join(" ") : void 0;
 }
-function normalizeIsoDate(value, label) {
-	const parsed = new Date(value);
-	if (Number.isNaN(parsed.getTime())) throw new Error(`${label} must be a valid date or ISO-8601 timestamp.`);
-	return parsed.toISOString();
-}
 function filtersFromFlags(flags) {
 	if (flags.automated !== void 0 && !AUTOMATED_VALUES.includes(flags.automated)) throw new Error("--automated must be true or false.");
 	return {
@@ -24312,9 +24453,30 @@ function filtersFromFlags(flags) {
 		to: flags.to
 	};
 }
-function sinceFromFlags(flags) {
-	if (flags.since) return normalizeIsoDate(flags.since, "--since");
-	return flags["include-existing"] ? void 0 : (/* @__PURE__ */ new Date()).toISOString();
+const SINCE_DURATION = /^(\d+)\s*(s|m|h|d)$/i;
+const SINCE_UNIT_MS = {
+	s: 1e3,
+	m: 6e4,
+	h: 36e5,
+	d: 864e5
+};
+/** How --since reads: a date or timestamp, or a duration ago (`15m`). */
+const SINCE_VALUE_HELP = "an ISO-8601 timestamp or date, or a duration ago such as 30s, 15m, 2h or 1d";
+/**
+* Read --since: an ISO-8601 timestamp or date, or a duration before `now`
+* (`30s`, `15m`, `2h`, `1d`).
+*/
+function parseSince(value, now = Date.now()) {
+	if (/^\s*\d+\s*$/.test(value)) throw new Error(`--since needs a unit on a duration, for example ${value.trim()}m; it takes ${SINCE_VALUE_HELP}.`);
+	const duration = SINCE_DURATION.exec(value.trim());
+	const unit = duration ? SINCE_UNIT_MS[duration[2].toLowerCase()] : void 0;
+	const parsed = duration && unit !== void 0 ? new Date(now - Number(duration[1]) * unit) : new Date(value);
+	if (Number.isNaN(parsed.getTime()) || parsed.getTime() < 0) throw new Error(`--since must be ${SINCE_VALUE_HELP}.`);
+	return parsed.toISOString();
+}
+function sinceFromFlags(flags, now = Date.now()) {
+	if (flags.since) return parseSince(flags.since, now);
+	return flags["include-existing"] ? void 0 : new Date(now).toISOString();
 }
 function buildEmailSearchQuery(params) {
 	const query = {
@@ -25336,4 +25498,4 @@ function repeatStopCommand(emailId) {
 	if (!UUID.test(emailId)) throw new TypeError("emailId must be an email UUID");
 	return `primitive repeat stop --id ${emailId.toLowerCase()}`;
 }
-export { AutomatedFilterUnsupportedError as $, updateRoute as $n, listAgentContacts as $t, sleep as A, resendAgentSignupVerification as An, getAccessMode as At, hasReplyState as B, setFunctionSecret as Bn, getFunctionTestRunTrace as Bt, collectNewAcceptedEmails as C, putAgentContact as Cn, deleteWakeAuthorization as Ct, filtersFromFlags as D, removeDefaultNetworkMember as Dn, downloadEmailAttachmentPart as Dt, fetchEmailSearchPage as E, redeemCreditCode as En, downloadEmailAttachmentByFilename as Et, assertAwaitingFilterRows as F, searchEmails as Fn, getCreditBalance as Ft, WEBHOOK_EVENT_TYPES as G, startCliLogin as Gn, getOwnGrant as Gt, queryUsesAwaiting as H, simulateRoute as Hn, getKey as Ht, awaitingRejectedError as I, searchMemories as In, getDefaultNetworkAgent as It, parseWebhookEvent as J, unsetFunctionRoute as Jn, getThread as Jt, isEmailReceivedEvent as K, stopRepeatFromEmail as Kn, getRepeatingSend as Kt, ensureSearchReportsReplyState as L, semanticSearch as Ln, getEmail as Lt, AWAITING_VALUES as M, rotateKey as Mn, getAgentContactPolicy as Mt, REPLY_STATE_UNSUPPORTED_CODE as N, runWakeSchedule as Nn, getContact as Nt, quoteDslValue as O, reorderRoutes as On, downloadSentAttachmentArchiveMember as Ot, ReplyStateUnsupportedError as P, sdk_gen_exports as Pn, getConversation as Pt, AUTOMATED_VALUES as Q, updateRepeatingSend as Qn, listAgentConnections as Qt, formatAwaitingCell as R, sendEmail as Rn, getFunction as Rt, transientFailure as S, pullWebhookEvent as Sn, deleteRoute as St, encodeReceivedAtSearchCursor as T, putContact as Tn, downloadEmailAttachmentArchiveMember as Tt, replyStateSurfaceForOperation as U, startAgentClaim as Un, getMemory as Ut, isAwaitingRejectedError as V, setMemory as Vn, getInboxStatus as Vt, SENT_EMAIL_EVENT_TYPES as W, startAgentSignup as Wn, getOrgRoutingTopology as Wt, AUTOMATED_FILTER_UNSUPPORTED_CODE as X, updateFunction as Xn, inviteAgentConnection as Xt, parseFromHeader as Y, updateDefaultNetworkMember as Yn, getWakeSchedule as Yt, AUTOMATED_FLAG_DESCRIPTION as Z, updateKey as Zn, leaveOrganization as Zt, describeApiFailure as _, listSentEmails as _n, createWakeAuthorization as _t, REPEAT_IDLE_MAX_MINUTES as a, listEmailAttachmentArchiveMembers as an, hasAutomatedVerdict as at, retryTransient as b, listWakeSchedules as bn, deleteContact as bt, classifySignalContent as c, listFunctionLogs as cn, cancelSentEmail as ct, parseRepeatTick as d, listKeys as dn, cliLogout as dt, listAgentNetworks as en, updateWakeAuthorization as er, assertAutomatedVerdict as et, preparePresenceAliveEmail as f, listMailboxAccess as fn, completeWebhookEvent as ft, WaitDeadlineReached as g, listSentAttachmentArchiveMembers as gn, createRoute as gt, sendPreparedSignal as h, listRoutes as hn, createKey as ht, REPEAT_EVERY_MAX_MINUTES as i, listDomains as in, __exportAll as ir, expectedAutomatedVerdicts as it, AWAITING_FLAG_DESCRIPTION as j, revokeCredential as jn, getAccount as jt, sinceFromFlags as k, replyToEmail as kn, downloadSentAttachmentByFilename as kt, parseInteractionEnvelope as l, listFunctions as ln, cancelSentEmailByIdempotencyKey as lt, repeatStopCommand as m, listRoles as mn, createFunction as mt, MAX_PRESENCE_ENVELOPE_BYTES as n, listDefaultNetworkAgents as nn, verifyAgentClaim as nr, automatedSurfaceForOperation as nt, REPEAT_MAX_SENDS_MAX as o, listEmails as on, isAutomatedRejectedError as ot, prepareSignalEmail as p, listRepeatingSends as pn, createEndpoint as pt, isTrustedSender as q, testFunction as qn, getSentEmail as qt, PRESENCE_PROBE_TEXT as r, listDefaultNetworkMembers as rn, verifyAgentSignup as rr, ensureSearchReportsAutomated as rt, buildRepeatStopBody as s, listEndpoints as sn, addDefaultNetworkMember as st, MAX_INTERACTION_BYTES as t, listContacts as tn, updateWakeSchedule as tr, automatedRejectedError as tt, parsePresenceEnvelope as u, listGroups as un, checkDefaultNetworkContactAdmission as ut, parseRetryAfter as v, listWakeAuthorizations as vn, createWakeSchedule as vt, cursorFromAcceptedRows as w, putAgentContactPolicy as wn, deleteWakeSchedule as wt, retryingOperation as x, pollCliLogin as xn, deleteMemory as xt, pauseForTransientFailure as y, listWakeDispatches as yn, deleteAgentContact as yt, formatRepliesCell as z, setFunctionRoute as zn, getFunctionRouting as zt };
+export { AUTOMATED_VALUES as $, stopRepeatFromEmail as $n, getWakeSchedule as $t, sinceFromFlags as A, putAgentContact as An, downloadSentAttachmentArchiveMember as At, formatRepliesCell as B, runWakeSchedule as Bn, getFunction as Bt, SINCE_VALUE_HELP as C, listSentAttachmentArchiveMembers as Cn, deleteMemory as Ct, fetchEmailSearchPage as D, listWakeSchedules as Dn, downloadEmailAttachmentArchiveMember as Dt, encodeReceivedAtSearchCursor as E, listWakeDispatches as En, deleteWakeSchedule as Et, ReplyStateUnsupportedError as F, reorderRoutes as Fn, getContact as Ft, SENT_EMAIL_EVENT_TYPES as G, sendEmail as Gn, getMemory as Gt, isAwaitingRejectedError as H, searchEmails as Hn, getFunctionTestRunTrace as Ht, assertAwaitingFilterRows as I, replyToEmail as In, getConversation as It, isTrustedSender as J, setMemory as Jn, getOwnGrant as Jt, WEBHOOK_EVENT_TYPES as K, setFunctionRoute as Kn, getOrgRoutingTopology as Kt, awaitingRejectedError as L, resendAgentSignupVerification as Ln, getCreditBalance as Lt, AWAITING_FLAG_DESCRIPTION as M, putContact as Mn, getAccessMode as Mt, AWAITING_VALUES as N, redeemCreditCode as Nn, getAccount as Nt, filtersFromFlags as O, pollCliLogin as On, downloadEmailAttachmentByFilename as Ot, REPLY_STATE_UNSUPPORTED_CODE as P, removeDefaultNetworkMember as Pn, getAgentContactPolicy as Pt, AUTOMATED_FLAG_DESCRIPTION as Q, startCliLogin as Qn, getThread as Qt, ensureSearchReportsReplyState as R, revokeCredential as Rn, getDefaultNetworkAgent as Rt, transientFailure as S, listRoutes as Sn, deleteContact as St, cursorFromAcceptedRows as T, listWakeAuthorizations as Tn, deleteWakeAuthorization as Tt, queryUsesAwaiting as U, searchMemories as Un, getInboxStatus as Ut, hasReplyState as V, sdk_gen_exports as Vn, getFunctionRouting as Vt, replyStateSurfaceForOperation as W, semanticSearch as Wn, getKey as Wt, parseFromHeader as X, startAgentClaim as Xn, getSendFrom as Xt, parseWebhookEvent as Y, simulateRoute as Yn, getRepeatingSend as Yt, AUTOMATED_FILTER_UNSUPPORTED_CODE as Z, startAgentSignup as Zn, getSentEmail as Zt, describeApiFailure as _, listKeys as _n, createKey as _t, REPEAT_IDLE_MAX_MINUTES as a, listAgentNetworks as an, updateRepeatingSend as ar, expectedAutomatedVerdicts as at, retryTransient as b, listRepeatingSends as bn, createWakeSchedule as bt, classifySignalContent as c, listDefaultNetworkMembers as cn, updateWakeSchedule as cr, addDefaultNetworkMember as ct, parseRepeatTick as d, listEmailRuleResults as dn, whoami as dr, checkDefaultNetworkContactAdmission as dt, inviteAgentConnection as en, testFunction as er, AutomatedFilterUnsupportedError as et, preparePresenceAliveEmail as f, listEmails as fn, __exportAll as fr, checkSendability as ft, WaitDeadlineReached as g, listGroups as gn, createFunction as gt, sendPreparedSignal as h, listFunctions as hn, createEndpoint as ht, REPEAT_EVERY_MAX_MINUTES as i, listAgentContacts as in, updateKey as ir, ensureSearchReportsAutomated as it, sleep as j, putAgentContactPolicy as jn, downloadSentAttachmentByFilename as jt, quoteDslValue as k, pullWebhookEvent as kn, downloadEmailAttachmentPart as kt, parseInteractionEnvelope as l, listDomains as ln, verifyAgentClaim as lr, cancelSentEmail as lt, repeatStopCommand as m, listFunctionLogs as mn, completeWebhookEvent as mt, MAX_PRESENCE_ENVELOPE_BYTES as n, listActivityObjects as nn, updateDefaultNetworkMember as nr, automatedRejectedError as nt, REPEAT_MAX_SENDS_MAX as o, listContacts as on, updateRoute as or, hasAutomatedVerdict as ot, prepareSignalEmail as p, listEndpoints as pn, cliLogout as pt, isEmailReceivedEvent as q, setFunctionSecret as qn, getOutboundStatus as qt, PRESENCE_PROBE_TEXT as r, listAgentConnections as rn, updateFunction as rr, automatedSurfaceForOperation as rt, buildRepeatStopBody as s, listDefaultNetworkAgents as sn, updateWakeAuthorization as sr, isAutomatedRejectedError as st, MAX_INTERACTION_BYTES as t, leaveOrganization as tn, unsetFunctionRoute as tr, assertAutomatedVerdict as tt, parsePresenceEnvelope as u, listEmailAttachmentArchiveMembers as un, verifyAgentSignup as ur, cancelSentEmailByIdempotencyKey as ut, parseRetryAfter as v, listMailboxAccess as vn, createRoute as vt, collectNewAcceptedEmails as w, listSentEmails as wn, deleteRoute as wt, retryingOperation as x, listRoles as xn, deleteAgentContact as xt, pauseForTransientFailure as y, listOrganizationPeople as yn, createWakeAuthorization as yt, formatAwaitingCell as z, rotateKey as zn, getEmail as zt };