primcli 3.0.0-preview.5 → 3.0.0-preview.6

package/dist/{api-command-DIo8Rg0w.js → api-command-CRjIK1QL.js}

@@ -1,4 +1,4 @@
-import { F as ReplyStateUnsupportedError, G as SENT_EMAIL_EVENT_TYPES, H as isAwaitingRejectedError, I as assertAwaitingFilterRows, K as WEBHOOK_EVENT_TYPES, L as awaitingRejectedError, Qt as getThread, R as ensureSearchReportsReplyState, Vn as sdk_gen_exports, W as replyStateSurfaceForOperation, at as expectedAutomatedVerdicts, et as AutomatedFilterUnsupportedError, it as ensureSearchReportsAutomated, nt as automatedRejectedError, pn as listEndpoints, rt as automatedSurfaceForOperation, st as isAutomatedRejectedError, tt as assertAutomatedVerdict, v as parseRetryAfter, zt as getEmail } from "./repeats-Dj_o6c-X-Ix28GRRc.js";
+import { B as ensureSearchReportsReplyState, Ht as getEmail, J as SENT_EMAIL_EVENT_TYPES, K as replyStateSurfaceForOperation, L as ReplyStateUnsupportedError, R as assertAwaitingFilterRows, W as isAwaitingRejectedError, Wn as sdk_gen_exports, Y as WEBHOOK_EVENT_TYPES, Zt as getOwnGrant, at as automatedRejectedError, ct as expectedAutomatedVerdicts, gn as listEndpoints, it as assertAutomatedVerdict, ot as automatedSurfaceForOperation, q as EMAIL_RULE_REQUEST_EVENT_TYPES, rt as AutomatedFilterUnsupportedError, st as ensureSearchReportsAutomated, tn as getThread, ut as isAutomatedRejectedError, v as parseRetryAfter, z as awaitingRejectedError } from "./repeats-Dj_o6c-X-CP0h4alF.js";
 import { C as saveCliCredentials, F as agentProfilesDirectory, H as requireDefaultLoginProfile, N as agentProfileDirectory, R as loadConnectedAgentProfile, S as resolveCliAuth, W as PrimitiveApiClient, _ as deleteCliCredentials, b as loadCliCredentials, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, i as loadCliConfig, j as AGENT_PROFILE_ENV, m as cliAccessTokenExpiresAt, p as acquireCliCredentialsLock, w as saveSignupCredentials, x as normalizeApiBaseUrl, y as detectPrimitiveKeyEnvMisname } from "./cli-config-Ms_0vNjq.js";
 import "./oclif/global-org-flag.js";
 import { d as readMailJson, h as writeMailJson, m as withMailLock, p as syncMailDirectory, u as privateMailPermissions } from "./shared-mail-files-BAQSGxxz.js";
@@ -663,7 +663,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "whoami",
-		"description": "Current authenticated identity. member_address is null for machine credentials or an unavailable member address.",
+		"description": "Current authenticated identity. member_address is null for machine credentials or an unavailable member address. email (your own sign-in email) and role_name (your role as the members list labels it) are set only when you are signed in as yourself, in the dashboard or with your own Primitive CLI or app login, and are null for API keys, Functions, connected agents, agent signup logins and other apps acting for you.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "whoami",
@@ -721,6 +721,14 @@ const operationManifest = [
 				"request_id": { "type": "string" },
 				"auth_method": { "type": ["string", "null"] },
 				"key_id": { "type": ["string", "null"] },
+				"email": {
+					"description": "Your own sign-in email, when you are signed in as yourself: in the dashboard, or with your own Primitive CLI or app login. Null for API keys, Functions, connected agents, agent signup logins and other apps acting for you.",
+					"type": ["string", "null"]
+				},
+				"role_name": {
+					"description": "Your role as the organization's members list labels it: a template or custom role as \"<name> (template)\" or \"<name> (custom)\", otherwise Owner, Admin, Member or Restricted. Null for the same credentials as email.",
+					"type": ["string", "null"]
+				},
 				"grant": {
 					"type": ["object", "null"],
 					"propertyNames": { "type": "string" },
@@ -757,7 +765,9 @@ const operationManifest = [
 				"role",
 				"request_id",
 				"auth_method",
-				"key_id"
+				"key_id",
+				"email",
+				"role_name"
 			]
 		},
 		"sdkName": "whoami",
@@ -769,7 +779,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-activity-objects",
-		"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules and rule requests. Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self.",
+		"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules and rule requests. Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, under their current membership, each naming the member who asked in created_through. A key, an app or an agent has none, and gets email_rule_request in withheld.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listActivityObjects",
@@ -777,7 +787,15 @@ const operationManifest = [
 		"pathParams": [],
 		"queryParams": [
 			{
-				"description": "Only these kinds, comma-separated: function, endpoint, function_trigger, pull_subscription, recipient_route, filter_rule, wake_schedule, repeating_send, scheduled_send, api_key, agent_connection, email_rule, email_rule_request. Defaults to every kind the caller can have created (a person's own kinds only for a person).",
+				"default": "created",
+				"description": "created (the default) or asked.",
+				"enum": ["created", "asked"],
+				"name": "relation",
+				"required": false,
+				"type": "string"
+			},
+			{
+				"description": "Only these kinds, comma-separated: function, endpoint, function_trigger, pull_subscription, recipient_route, filter_rule, wake_schedule, repeating_send, scheduled_send, api_key, agent_connection, email_rule, email_rule_request. Defaults to every kind the caller can have created (a person's own kinds only for a person). With relation=asked, only email_rule_request, which is also the default.",
 				"enum": null,
 				"name": "kind",
 				"required": false,
@@ -822,7 +840,7 @@ const operationManifest = [
 			"properties": {
 				"covers": {
 					"type": "string",
-					"description": "you: what a person created through any credential of theirs (their dashboard session, their own CLI or app login, apps and agent delegates acting for them, their API keys while theirs, their personal agents). this_credential: what the calling key, app or agent created itself."
+					"description": "you: what a person created through any credential of theirs, or with relation=asked what others asked of them (their dashboard session, their own CLI or app login, apps and agent delegates acting for them, their API keys while theirs, their personal agents). this_credential: what the calling key, app or agent created itself."
 				},
 				"items": {
 					"type": "array",
@@ -854,21 +872,21 @@ const operationManifest = [
 							"owned_now": {
 								"type": "string",
 								"enum": ["you", "someone_else"],
-								"description": "you: it is still yours: never transferred, or transferred back to you. someone_else: it was transferred and another person holds it now."
+								"description": "you: it is still yours: never transferred, or transferred back to you. someone_else: it was transferred and another person holds it now, or, with relation=asked, another member made it."
 							},
 							"created_through": {
 								"type": "object",
 								"properties": {
 									"kind": {
 										"type": "string",
-										"description": "The kind of credential it was created through: org_key, function_key, connected_key, oauth, agent_delegate or member (the person themselves)."
+										"description": "The kind of credential it was created through: org_key, function_key, connected_key, oauth, agent_delegate or member (the person themselves). With relation=asked, member: the member who asked."
 									},
 									"id": {
-										"description": "In a person's view, the person's own user id for member, and an API key's id where they may read their keys (for a person limited to their own keys, only a key they still hold). Null otherwise, and always null in one credential's view, where it is the calling credential itself.",
+										"description": "In a person's view, the person's own user id for member, and an API key's id where they may read their keys (for a person limited to their own keys, only a key they still hold). Null otherwise, and always null in one credential's view, where it is the calling credential itself. With relation=asked, the user id of the member who asked.",
 										"type": ["string", "null"]
 									},
 									"name": {
-										"description": "In a person's view, what that credential of theirs is called: an app login by its app, an API key by its name, an agent's key by its address. Null otherwise, and for the person themselves.",
+										"description": "In a person's view, what that credential of theirs is called: an app login by its app, an API key by its name, an agent's key by its address. Null otherwise, and for the person themselves. With relation=asked, the name of the member who asked.",
 										"type": ["string", "null"]
 									}
 								},
@@ -929,7 +947,7 @@ const operationManifest = [
 			]
 		},
 		"sdkName": "listActivityObjects",
-		"summary": "List what you created",
+		"summary": "List what you created, or what you were asked",
 		"tag": "Activity",
 		"tagCommand": "activity"
 	},
@@ -9450,7 +9468,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-key",
-		"description": "One key's metadata, never its secret, with whether it works now (status). Its grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
+		"description": "One key's metadata, never its secret, with whether it works now (status). A revoked key whose record is kept is answered too, with status revoked, revoked_at and revoked_by, under the same access rules as a key that works: one the caller may not read is 404, revoked or not. Its grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. A rule the key lists that reads nothing any more (a deleted rule, or a share that ended) is listed under grant.mail_scope.ended_rules, each with its id and reason (rule_deleted or share_ended), and not under rules. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getKey",
@@ -9484,12 +9502,25 @@ const operationManifest = [
 				"grant": {
 					"type": "object",
 					"properties": {
+						"ref": {
+							"description": "The grant this read shows. Send it as expected_grant_ref on PATCH /v1/keys/{id} so the change is refused (409 conflict, details.reason grant_changed) if the grant has changed since this read.",
+							"type": "string"
+						},
 						"template": { "type": ["string", "null"] },
 						"permissions": {
 							"type": ["array", "null"],
 							"items": { "type": "string" }
 						},
-						"mail_scope": {}
+						"mail_scope": {},
+						"resources": {
+							"type": ["object", "null"],
+							"propertyNames": { "type": "string" },
+							"additionalProperties": {
+								"type": "array",
+								"items": { "type": "string" }
+							},
+							"description": "The Functions, domains, endpoints or routes the key is limited to, by type; null when it has no such limits. A grant change on a key with limits must drop them on purpose, with grant.resources {} (otherwise 409 conflict, details.reason key_has_resource_limits)."
+						}
 					},
 					"required": [
 						"template",
@@ -9505,14 +9536,31 @@ const operationManifest = [
 				"expires_at": { "type": ["string", "null"] },
 				"suspended": { "type": "boolean" },
 				"status": {
-					"description": "Whether the key works now: active; suspended (refused until the suspension is lifted); expired (refused since expires_at); or inactive, for an agent connection key whose connection cannot act (not claimed, revoked, its domain not verified, or its owner no longer a member). A revoked key is not listed. An endpoint's owner_key_status reports an expired key as suspended.",
+					"description": "Whether the key works now: active; suspended (refused until the suspension is lifted); expired (refused since expires_at); inactive, for an agent connection key whose connection cannot act (not claimed, revoked, its domain not verified, or its owner no longer a member); or revoked, which it stays for good and which no unrevoked key ever shows. A revoked key is listed only with include_revoked=true, and GET /v1/keys/{id} answers it. An endpoint's owner_key_status reports an expired key as suspended.",
 					"type": "string",
 					"enum": [
 						"active",
 						"suspended",
 						"expired",
-						"inactive"
+						"inactive",
+						"revoked"
 					]
+				},
+				"revoked_at": {
+					"description": "When the key was revoked (ISO 8601); null for a key that is not revoked.",
+					"type": ["string", "null"]
+				},
+				"revoked_by": {
+					"description": "The user id of the person who revoked the key from their own dashboard session, step-up or Primitive CLI login; null for a key that is not revoked, and for one revoked any other way (by an API key, another app or token, or an automatic process such as secret scanning).",
+					"type": ["string", "null"]
+				},
+				"rotated_from": {
+					"description": "The id of the key this key was rotated from (POST /v1/keys/{id}/rotate made this key in its place); null for a key not made by rotation, when the caller may not read that key, or when its record is gone. A revoked one is still named: GET /v1/keys/{id} answers it.",
+					"type": ["string", "null"]
+				},
+				"rotated_to": {
+					"description": "The id of the newest key rotated from this key that the caller may read; null until it is rotated, or when the caller may read no key rotated from it. A revoked one is still named: GET /v1/keys/{id} answers it.",
+					"type": ["string", "null"]
 				}
 			},
 			"required": [
@@ -10049,7 +10097,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-credentials",
-		"description": "Every credential that can act in the organization: API keys, Function keys, agent connection keys, connected apps (OAuth), agent delegates and, where enabled, CLI logins. Secrets are never returned. A key's grant.mail_scope.depth is raw only when it holds mail.raw:read and its scope lists an address or a domain, otherwise content. Filter with kind. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.",
+		"description": "Every credential that can act in the organization: API keys, Function keys, agent connection keys, connected apps (OAuth), agent delegates and, where enabled, CLI logins. Secrets are never returned. A key's grant.mail_scope.depth is raw only when it holds mail.raw:read and its scope lists an address or a domain, otherwise content. A rule the key lists that reads nothing any more (a deleted rule, or a share that ended) is listed under grant.mail_scope.ended_rules, each with its id and reason (rule_deleted or share_ended), and not under rules. Filter with kind. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listCredentials",
@@ -10286,7 +10334,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-keys",
-		"description": "Key metadata, never a secret: name, prefix, grant, creator, last use, expiry, suspension and whether each key works now (status). A grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
+		"description": "Key metadata, never a secret: name, prefix, grant, creator, last use, expiry, suspension and whether each key works now (status). Revoked keys are left out unless include_revoked is true, which lists them too with status revoked, revoked_at and revoked_by, under the same access rules as keys that work. A grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. A rule the key lists that reads nothing any more (a deleted rule, or a share that ended) is listed under grant.mail_scope.ended_rules, each with its id and reason (rule_deleted or share_ended), and not under rules. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listKeys",
@@ -10298,6 +10346,12 @@ const operationManifest = [
 			"name": "cursor",
 			"required": false,
 			"type": "string"
+		}, {
+			"description": "true to list revoked keys as well, newest first among the rest; false (the default) lists only keys that are not revoked. The cursor does not carry it: send it with every page.",
+			"enum": ["true", "false"],
+			"name": "include_revoked",
+			"required": false,
+			"type": "string"
 		}],
 		"headerParams": [],
 		"permissions": ["keys:read"],
@@ -10325,12 +10379,25 @@ const operationManifest = [
 							"grant": {
 								"type": "object",
 								"properties": {
+									"ref": {
+										"description": "The grant this read shows. Send it as expected_grant_ref on PATCH /v1/keys/{id} so the change is refused (409 conflict, details.reason grant_changed) if the grant has changed since this read.",
+										"type": "string"
+									},
 									"template": { "type": ["string", "null"] },
 									"permissions": {
 										"type": ["array", "null"],
 										"items": { "type": "string" }
 									},
-									"mail_scope": {}
+									"mail_scope": {},
+									"resources": {
+										"type": ["object", "null"],
+										"propertyNames": { "type": "string" },
+										"additionalProperties": {
+											"type": "array",
+											"items": { "type": "string" }
+										},
+										"description": "The Functions, domains, endpoints or routes the key is limited to, by type; null when it has no such limits. A grant change on a key with limits must drop them on purpose, with grant.resources {} (otherwise 409 conflict, details.reason key_has_resource_limits)."
+									}
 								},
 								"required": [
 									"template",
@@ -10346,14 +10413,31 @@ const operationManifest = [
 							"expires_at": { "type": ["string", "null"] },
 							"suspended": { "type": "boolean" },
 							"status": {
-								"description": "Whether the key works now: active; suspended (refused until the suspension is lifted); expired (refused since expires_at); or inactive, for an agent connection key whose connection cannot act (not claimed, revoked, its domain not verified, or its owner no longer a member). A revoked key is not listed. An endpoint's owner_key_status reports an expired key as suspended.",
+								"description": "Whether the key works now: active; suspended (refused until the suspension is lifted); expired (refused since expires_at); inactive, for an agent connection key whose connection cannot act (not claimed, revoked, its domain not verified, or its owner no longer a member); or revoked, which it stays for good and which no unrevoked key ever shows. A revoked key is listed only with include_revoked=true, and GET /v1/keys/{id} answers it. An endpoint's owner_key_status reports an expired key as suspended.",
 								"type": "string",
 								"enum": [
 									"active",
 									"suspended",
 									"expired",
-									"inactive"
+									"inactive",
+									"revoked"
 								]
+							},
+							"revoked_at": {
+								"description": "When the key was revoked (ISO 8601); null for a key that is not revoked.",
+								"type": ["string", "null"]
+							},
+							"revoked_by": {
+								"description": "The user id of the person who revoked the key from their own dashboard session, step-up or Primitive CLI login; null for a key that is not revoked, and for one revoked any other way (by an API key, another app or token, or an automatic process such as secret scanning).",
+								"type": ["string", "null"]
+							},
+							"rotated_from": {
+								"description": "The id of the key this key was rotated from (POST /v1/keys/{id}/rotate made this key in its place); null for a key not made by rotation, when the caller may not read that key, or when its record is gone. A revoked one is still named: GET /v1/keys/{id} answers it.",
+								"type": ["string", "null"]
+							},
+							"rotated_to": {
+								"description": "The id of the newest key rotated from this key that the caller may read; null until it is rotated, or when the caller may read no key rotated from it. A revoked one is still named: GET /v1/keys/{id} answers it.",
+								"type": ["string", "null"]
 							}
 						},
 						"required": [
@@ -10472,7 +10556,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "revoke-credential",
-		"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up keeps working and is listed in standing_objects for review. The person's own Primitive CLI login revokes an API key (kind org_key) as the person, with no step-up unless the organization's credential policy sets cli_writes_require_approval (then it takes a keys.create step-up); every other kind (a connected key named as org_key included, 403 grant_forbidden target_not_covered), and every other app even with a step-up, is refused outside the dashboard (403). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
+		"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up or owns is listed in standing_objects for review, and for an API key also what it carries on for the keys it was rotated from. An organization-owned object (org_owned true) keeps working; any other keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to, except that a block filter an app made keeps blocking, within the reach the app had, unless the person revoking chose to stop it. An API key (kind org_key or connected_key) that is already revoked, and whose record is kept, answers 200 with already_revoked true and revoked 0, to a caller who could have revoked it; anyone else gets the answer they would get for a key that does not exist. The person's own Primitive CLI login revokes an API key (kind org_key) as the person, with no step-up unless the organization's credential policy sets cli_writes_require_approval (then it takes a keys.create step-up); every other kind (a connected key named as org_key included, 403 grant_forbidden target_not_covered), and every other app even with a step-up, is refused outside the dashboard (403). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "revokeCredential",
@@ -10583,6 +10667,51 @@ const operationManifest = [
 						},
 						"required": ["kind", "id"]
 					}
+				},
+				"already_revoked": {
+					"description": "true when the API key was already revoked, so nothing changed and revoked is 0. Absent otherwise. GET /v1/keys/{id} says when and by whom, to a caller who may read the key.",
+					"type": "boolean"
+				},
+				"keep_failed": {
+					"description": "Items you chose to keep that could not be taken over after the revocation. Each stopped with it, unless someone else had taken it over in the meantime.",
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"kind": { "type": "string" },
+							"id": { "type": "string" }
+						},
+						"required": ["kind", "id"]
+					}
+				},
+				"standing_objects": {
+					"description": "What the credential set up or owns, listed for review, and for an API key also what it carries on for the keys it was rotated from. Revoking deletes none of it.",
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"kind": {
+								"type": "string",
+								"description": "endpoint, function_trigger, pull_subscription, recipient_route, filter_rule or wake_schedule."
+							},
+							"id": { "type": "string" },
+							"label": {
+								"type": "string",
+								"description": "A webhook's URL, a pull subscription's name (or pull when it has none), a route's or filter's pattern, or a wake schedule's command and the address it wakes (command to address). A Function trigger's label is function: look it up by id."
+							},
+							"org_owned": {
+								"type": "boolean",
+								"description": "true: the organization owns it, and it keeps working. false: the credential owns it itself, as with everything a third-party app or agent delegate made, a webhook made with a narrowed API key, or a wake schedule made with a key that does not cover super_admin. It keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to or kept it. Revoking a third-party app or agent delegate turns these off, except that a block filter it made keeps blocking, within the reach the app had, unless the person revoking chose to stop it."
+							}
+						},
+						"required": [
+							"kind",
+							"id",
+							"label",
+							"org_owned"
+						],
+						"additionalProperties": {}
+					}
 				}
 			},
 			"required": [
@@ -10601,7 +10730,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "rotate-key",
-		"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+		"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "rotateKey",
@@ -10631,12 +10760,20 @@ const operationManifest = [
 		"access": "step_up",
 		"requestSchema": {
 			"type": "object",
-			"properties": { "overlap_seconds": {
-				"description": "How long the old key keeps working, in seconds, up to 604800 (7 days), and never past its own expires_at. 86400 (24 hours) when omitted. 0 stops the old key at once: use it when rotating because the secret leaked.",
-				"type": "integer",
-				"minimum": 0,
-				"maximum": 604800
-			} },
+			"properties": {
+				"overlap_seconds": {
+					"description": "How long the old key keeps working, in seconds, up to 604800 (7 days), and never past its own expires_at. 86400 (24 hours) when omitted. 0 stops the old key at once: use it when rotating because the secret leaked.",
+					"type": "integer",
+					"minimum": 0,
+					"maximum": 604800
+				},
+				"expires_at": {
+					"type": ["string", "null"],
+					"format": "date-time",
+					"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
+					"description": "The new key's expiry. Omitted, it keeps the old key's expiry: rotating alone never extends a key. A time sets it, within the organization's credential policy (its maximum key lifetime counts from now); null makes it never expire, where the policy allows. Needs keys:manage, as changing a key does. The old key stops when the overlap ends, or at this expiry if that comes first."
+				}
+			},
 			"additionalProperties": false
 		},
 		"responseSchema": {
@@ -10655,7 +10792,7 @@ const operationManifest = [
 					"type": "string",
 					"format": "date-time",
 					"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
-					"description": "When the old key stops working: the time of the rotation plus overlap_seconds (24 hours when it was omitted, now when it was 0), or the key's own expires_at when that comes first."
+					"description": "When the old key stops working: the time of the rotation plus overlap_seconds (24 hours when it was omitted, now when it was 0), or the key's own expires_at, or the expires_at given to the new key, whichever comes first."
 				}
 			},
 			"required": [
@@ -10767,7 +10904,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "update-key",
-		"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+		"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. A later expires_at extends the key, which is how to keep a key working past its expiry (rotating keeps it, unless the rotation gives the new key an expires_at): it is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and like any loosening needs the person to be allowed to create a key with the key's access. An expired key's expiry cannot be changed (409 conflict, details.reason key_expired); make a new key instead. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. It replaces the whole grant: send expected_grant_ref (grant.ref from GET /v1/keys/{id}) to have it refused (409 conflict, details.reason grant_changed) if the grant changed since that read; a grant change sent without it answers grant_unguarded: true. On a key limited to selected resources (grant.resources), a grant change must drop the limits on purpose with a custom grant and grant.resources {}; one that leaves them out is refused (409 conflict, details.reason key_has_resource_limits) and nothing changes. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 		"hasJsonBody": true,
 		"method": "PATCH",
 		"operationId": "updateKey",
@@ -10800,7 +10937,8 @@ const operationManifest = [
 				"expires_at": {
 					"type": ["string", "null"],
 					"format": "date-time",
-					"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
+					"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
+					"description": "A new expiry. A later time extends the key and an earlier one ends it sooner, within the organization's credential policy (its maximum key lifetime counts from now); null removes the expiry, where the policy allows. A rotated-out key's expiry can only be brought forward, and an expired key's cannot be changed."
 				},
 				"grant": { "anyOf": [{
 					"type": "string",
@@ -10956,6 +11094,11 @@ const operationManifest = [
 						],
 						"additionalProperties": {}
 					}
+				},
+				"grant_unguarded": {
+					"description": "Present, as true, when the grant was changed without expected_grant_ref, so the change was not checked against changes made since the key was read. Send grant.ref from GET /v1/keys/{id} as expected_grant_ref to have such a change refused instead (409 conflict, details.reason grant_changed).",
+					"type": "boolean",
+					"const": true
 				}
 			},
 			"required": [
@@ -12773,7 +12916,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "accept-email-rule-request",
-		"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Also needs mail:share_own (sharing your own mail through email rules, which only shows it and never sends): a role without it is refused, whether or not it can send. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Before accepting, test it on your mail: pass the request's tree to POST /v1/email-rules/test. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up. Nothing is stored, and it needs no access beyond testing a rule of your own. Accepting also needs mail:share_own (sharing your own mail through email rules, which only shows it and never sends): a role without it is refused, whether or not it can send. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "acceptEmailRuleRequest",
@@ -12933,7 +13076,8 @@ const operationManifest = [
 						},
 						"warnings": {
 							"type": "array",
-							"items": { "type": "string" }
+							"items": { "type": "string" },
+							"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
 						},
 						"compiled_by": { "type": "string" },
 						"vocabulary": { "type": "string" },
@@ -13016,6 +13160,14 @@ const operationManifest = [
 							"type": ["string", "null"],
 							"format": "uuid",
 							"description": "The share accepting created, while it exists."
+						},
+						"message": {
+							"description": "What the member asking wrote about why; null when they wrote nothing.",
+							"type": ["string", "null"]
+						},
+						"decline_reason": {
+							"description": "Why the member asked declined it; null unless they gave a reason when declining.",
+							"type": ["string", "null"]
 						}
 					},
 					"required": [
@@ -13232,8 +13384,10 @@ const operationManifest = [
 								"removed_by_beneficiary",
 								"stopped_by_admin",
 								"rule_changed",
+								"rule_deleted",
 								null
-							]
+							],
+							"description": "Why it ended, once it has: stopped_by_granter, removed_by_beneficiary, stopped_by_admin, rule_changed (a new version of the rule was saved) or rule_deleted (the rule was deleted; the share keeps its record, and the rule is no longer shown). Null while it has not."
 						},
 						"accepted_rule_version": {
 							"type": "integer",
@@ -13994,7 +14148,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "create-email-rule-request",
-		"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated and nothing is shared until they accept, and they may change the rule first; they see the request and can preview what it matches in their own mail. You may have at most 5 pending requests to one member and 50 in all. If you can list members (members:read), the answer also says whether they can accept it under their role (target_can_accept), and if not, why (target_warning); the request is sent either way. To find out before asking, use POST /v1/email-rule-requests/target-check. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated and nothing is shared until they accept, and they may change the rule first; they see the request and can preview what it matches in their own mail. A message (up to 500 characters) tells them why you are asking; they see it with the request, and it cannot be changed later. You may have at most 5 pending requests to one member and 50 in all. If you can list members (members:read), the answer also says whether they can accept it under their role (target_can_accept), and if not, why (target_warning); the request is sent either way. To find out before asking, use POST /v1/email-rule-requests/target-check. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "createEmailRuleRequest",
@@ -14031,6 +14185,12 @@ const operationManifest = [
 					"maxLength": 200,
 					"description": "A short name for the rule."
 				},
+				"message": {
+					"type": ["string", "null"],
+					"minLength": 1,
+					"maxLength": 500,
+					"description": "A short note to the member asked about why you are asking, up to 500 characters; null or absent for none. They see it with the request; it cannot be changed later."
+				},
 				"english": {
 					"type": "string",
 					"minLength": 1,
@@ -14162,7 +14322,8 @@ const operationManifest = [
 				},
 				"warnings": {
 					"type": "array",
-					"items": { "type": "string" }
+					"items": { "type": "string" },
+					"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
 				},
 				"compiled_by": { "type": "string" },
 				"vocabulary": { "type": "string" },
@@ -14246,6 +14407,14 @@ const operationManifest = [
 					"format": "uuid",
 					"description": "The share accepting created, while it exists."
 				},
+				"message": {
+					"description": "What the member asking wrote about why; null when they wrote nothing.",
+					"type": ["string", "null"]
+				},
+				"decline_reason": {
+					"description": "Why the member asked declined it; null unless they gave a reason when declining.",
+					"type": ["string", "null"]
+				},
 				"target_can_accept": {
 					"description": "Whether the member asked can accept it now under their role. Null unless you can list members and their roles (members:read), or when it could not be read.",
 					"type": ["boolean", "null"]
@@ -14287,8 +14456,8 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "decline-email-rule-request",
-		"description": "Declines a pending request made to you. Nothing is written but the decision. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
-		"hasJsonBody": false,
+		"description": "Declines a pending request made to you. Nothing is written but the decision and, if you give one, its reason (reason, up to 500 characters), which the member who asked sees with the request. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "declineEmailRuleRequest",
 		"path": "/email-rule-requests/{id}/decline",
@@ -14309,7 +14478,16 @@ const operationManifest = [
 		}],
 		"permissions": ["mail:read"],
 		"access": null,
-		"requestSchema": null,
+		"requestSchema": {
+			"type": "object",
+			"properties": { "reason": {
+				"type": ["string", "null"],
+				"minLength": 1,
+				"maxLength": 500,
+				"description": "Why you are declining, up to 500 characters; null or absent for none. The member who asked sees it with the request."
+			} },
+			"additionalProperties": false
+		},
 		"responseSchema": {
 			"type": "object",
 			"properties": {
@@ -14365,7 +14543,8 @@ const operationManifest = [
 				},
 				"warnings": {
 					"type": "array",
-					"items": { "type": "string" }
+					"items": { "type": "string" },
+					"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
 				},
 				"compiled_by": { "type": "string" },
 				"vocabulary": { "type": "string" },
@@ -14448,6 +14627,14 @@ const operationManifest = [
 					"type": ["string", "null"],
 					"format": "uuid",
 					"description": "The share accepting created, while it exists."
+				},
+				"message": {
+					"description": "What the member asking wrote about why; null when they wrote nothing.",
+					"type": ["string", "null"]
+				},
+				"decline_reason": {
+					"description": "Why the member asked declined it; null unless they gave a reason when declining.",
+					"type": ["string", "null"]
 				}
 			},
 			"required": [
@@ -14482,7 +14669,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "delete-email-rule",
-		"description": "Deletes a rule with its versions, its decisions and the access it granted. The author, or a caller who reads the whole organization's mail, may delete it; while it is shared with another member, only the author or someone who manages members from the dashboard. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "Deletes a rule with its versions, its decisions and the access it granted. A rule that was ever shared with another member keeps the record of its share: the share ends with end_reason rule_deleted, and the member who shared can still list what it handed over, while the rule is no longer shown and reads nothing. The answer lists the shares the delete ended (ended_shares) and the keys, not revoked, that still list the rule, which now read nothing through it: those you may read as key metadata by id, name and prefix (keys), and how many others (other_keys). keys and other_keys are left out when the keys could not be read. The author, or a caller who reads the whole organization's mail, may delete it; while it is shared with another member, only the author or someone who manages members from the dashboard. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": false,
 		"method": "DELETE",
 		"operationId": "deleteEmailRule",
@@ -14501,7 +14688,41 @@ const operationManifest = [
 		"requestSchema": null,
 		"responseSchema": {
 			"type": "object",
-			"properties": { "deleted": { "type": "boolean" } },
+			"properties": {
+				"deleted": { "type": "boolean" },
+				"ended_shares": {
+					"description": "The shares of this rule that the delete ended (end_reason rule_deleted). Each keeps its record.",
+					"type": "array",
+					"items": {
+						"type": "string",
+						"format": "uuid"
+					}
+				},
+				"keys": {
+					"description": "The API keys, not revoked, that still list the rule and that you may read (GET /v1/keys). They now read nothing through it; edit or revoke them. Left out, with other_keys, when the keys could not be read.",
+					"type": "array",
+					"items": {
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"name": { "type": ["string", "null"] },
+							"key_prefix": { "type": "string" }
+						},
+						"required": [
+							"id",
+							"name",
+							"key_prefix"
+						]
+					}
+				},
+				"other_keys": {
+					"description": "How many more keys, not revoked, list the rule that you may not read. They are not named.",
+					"type": "integer"
+				}
+			},
 			"required": ["deleted"]
 		},
 		"sdkName": "deleteEmailRule",
@@ -14793,7 +15014,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-email-rule-request",
-		"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. If you are the member asked, you can try the rule as proposed before answering: pass the request's tree to POST /v1/email-rules/test to test it on mail you have received. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up. Nothing is stored, and it needs no access beyond testing a rule of your own. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getEmailRuleRequest",
@@ -14865,7 +15086,8 @@ const operationManifest = [
 				},
 				"warnings": {
 					"type": "array",
-					"items": { "type": "string" }
+					"items": { "type": "string" },
+					"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
 				},
 				"compiled_by": { "type": "string" },
 				"vocabulary": { "type": "string" },
@@ -14948,6 +15170,14 @@ const operationManifest = [
 					"type": ["string", "null"],
 					"format": "uuid",
 					"description": "The share accepting created, while it exists."
+				},
+				"message": {
+					"description": "What the member asking wrote about why; null when they wrote nothing.",
+					"type": ["string", "null"]
+				},
+				"decline_reason": {
+					"description": "Why the member asked declined it; null unless they gave a reason when declining.",
+					"type": ["string", "null"]
 				}
 			},
 			"required": [
@@ -15158,8 +15388,10 @@ const operationManifest = [
 						"removed_by_beneficiary",
 						"stopped_by_admin",
 						"rule_changed",
+						"rule_deleted",
 						null
-					]
+					],
+					"description": "Why it ended, once it has: stopped_by_granter, removed_by_beneficiary, stopped_by_admin, rule_changed (a new version of the rule was saved) or rule_deleted (the rule was deleted; the share keeps its record, and the rule is no longer shown). Null while it has not."
 				},
 				"accepted_rule_version": {
 					"type": "integer",
@@ -15553,6 +15785,39 @@ const operationManifest = [
 						"type": "boolean",
 						"const": true
 					},
+					"withheld_by": {
+						"description": "Set when do-not-share rules kept this match from being shared, so no key or webhook got it through the rule: those you can see, and why.",
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"id": {
+									"type": "string",
+									"format": "uuid"
+								},
+								"name": { "type": "string" },
+								"reason": {
+									"type": "string",
+									"enum": [
+										"matched",
+										"undecided",
+										"outside_scope_stale"
+									],
+									"description": "undecided: it had not decided the email, which blocks too. outside_scope_stale: cleared as outside its scope, and its author now reads the email."
+								}
+							},
+							"required": [
+								"id",
+								"name",
+								"reason"
+							]
+						}
+					},
+					"withheld_by_hidden": {
+						"type": "integer",
+						"minimum": 0,
+						"description": "With withheld_by: how many more kept it back that you cannot see, or that were deleted since. Those rules are not shown; an admin can see them."
+					},
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -15703,7 +15968,8 @@ const operationManifest = [
 					},
 					"warnings": {
 						"type": "array",
-						"items": { "type": "string" }
+						"items": { "type": "string" },
+						"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
 					},
 					"compiled_by": { "type": "string" },
 					"vocabulary": { "type": "string" },
@@ -15786,6 +16052,14 @@ const operationManifest = [
 						"type": ["string", "null"],
 						"format": "uuid",
 						"description": "The share accepting created, while it exists."
+					},
+					"message": {
+						"description": "What the member asking wrote about why; null when they wrote nothing.",
+						"type": ["string", "null"]
+					},
+					"decline_reason": {
+						"description": "Why the member asked declined it; null unless they gave a reason when declining.",
+						"type": ["string", "null"]
 					}
 				},
 				"required": [
@@ -15841,6 +16115,36 @@ const operationManifest = [
 		"responseSchema": {
 			"type": "object",
 			"properties": {
+				"email": {
+					"description": "The email these results are about, so a saved answer says which one it was.",
+					"type": "object",
+					"properties": {
+						"id": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"from_address": {
+							"description": "The sender address, as GET /v1/emails/{id} shows it.",
+							"type": ["string", "null"]
+						},
+						"recipient": {
+							"type": "string",
+							"description": "The mailbox this copy of the email was received in, as GET /v1/emails/{id} shows it."
+						},
+						"subject": { "type": ["string", "null"] },
+						"received_at": {
+							"type": "string",
+							"format": "date-time"
+						}
+					},
+					"required": [
+						"id",
+						"from_address",
+						"recipient",
+						"subject",
+						"received_at"
+					]
+				},
 				"rules": {
 					"type": "array",
 					"items": {
@@ -15873,6 +16177,10 @@ const operationManifest = [
 										"description": "The version of the rule that decided."
 									},
 									"matched": { "type": "boolean" },
+									"near_miss": {
+										"description": "Not matched, but nearly: its questions did not all say yes, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). False when detail_withheld is true. Decisions recorded under the earlier definition counted an exclusion too.",
+										"type": "boolean"
+									},
 									"parts": {
 										"type": "array",
 										"items": {
@@ -15948,10 +16256,43 @@ const operationManifest = [
 										}, { "type": "null" }]
 									},
 									"detail_withheld": {
-										"description": "Present, as true, on a result for an email whose content cannot be read (withheld, failed to parse or discarded): matched still says what the rule decided, but how it got there was read from that content, so parts and question_answers are empty. Absent otherwise.",
+										"description": "Present, as true, on a result for an email whose content cannot be read (withheld, failed to parse or discarded): matched still says what the rule decided, but how it got there was read from that content, so parts and question_answers are empty and near_miss is false. Absent otherwise.",
 										"type": "boolean",
 										"const": true
 									},
+									"withheld_by": {
+										"description": "Set when do-not-share rules kept this match from being shared, so no key or webhook got it through the rule: those you can see, and why.",
+										"type": "array",
+										"items": {
+											"type": "object",
+											"properties": {
+												"id": {
+													"type": "string",
+													"format": "uuid"
+												},
+												"name": { "type": "string" },
+												"reason": {
+													"type": "string",
+													"enum": [
+														"matched",
+														"undecided",
+														"outside_scope_stale"
+													],
+													"description": "undecided: it had not decided the email, which blocks too. outside_scope_stale: cleared as outside its scope, and its author now reads the email."
+												}
+											},
+											"required": [
+												"id",
+												"name",
+												"reason"
+											]
+										}
+									},
+									"withheld_by_hidden": {
+										"type": "integer",
+										"minimum": 0,
+										"description": "With withheld_by: how many more kept it back that you cannot see, or that were deleted since. Those rules are not shown; an admin can see them."
+									},
 									"created_at": {
 										"type": "string",
 										"format": "date-time"
@@ -16524,8 +16865,10 @@ const operationManifest = [
 							"removed_by_beneficiary",
 							"stopped_by_admin",
 							"rule_changed",
+							"rule_deleted",
 							null
-						]
+						],
+						"description": "Why it ended, once it has: stopped_by_granter, removed_by_beneficiary, stopped_by_admin, rule_changed (a new version of the rule was saved) or rule_deleted (the rule was deleted; the share keeps its record, and the rule is no longer shown). Null while it has not."
 					},
 					"accepted_rule_version": {
 						"type": "integer",
@@ -16997,8 +17340,10 @@ const operationManifest = [
 							"removed_by_beneficiary",
 							"stopped_by_admin",
 							"rule_changed",
+							"rule_deleted",
 							null
-						]
+						],
+						"description": "Why it ended, once it has: stopped_by_granter, removed_by_beneficiary, stopped_by_admin, rule_changed (a new version of the rule was saved) or rule_deleted (the rule was deleted; the share keeps its record, and the rule is no longer shown). Null while it has not."
 					},
 					"accepted_rule_version": {
 						"type": "integer",
@@ -17420,6 +17765,10 @@ const operationManifest = [
 								"format": "date-time"
 							},
 							"from_address": { "type": ["string", "null"] },
+							"recipient": {
+								"description": "The mailbox this copy of the email was received in, as GET /v1/emails/{id} shows it. Given with received_at, from_address and subject, so absent for not_found.",
+								"type": "string"
+							},
 							"subject": { "type": ["string", "null"] },
 							"parts": {
 								"description": "How each top-level part of the rule decided. Present for matched, near_miss and no_match.",
@@ -18577,7 +18926,8 @@ const operationManifest = [
 				},
 				"warnings": {
 					"type": "array",
-					"items": { "type": "string" }
+					"items": { "type": "string" },
+					"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
 				},
 				"compiled_by": { "type": "string" },
 				"vocabulary": { "type": "string" },
@@ -18660,6 +19010,14 @@ const operationManifest = [
 					"type": ["string", "null"],
 					"format": "uuid",
 					"description": "The share accepting created, while it exists."
+				},
+				"message": {
+					"description": "What the member asking wrote about why; null when they wrote nothing.",
+					"type": ["string", "null"]
+				},
+				"decline_reason": {
+					"description": "Why the member asked declined it; null unless they gave a reason when declining.",
+					"type": ["string", "null"]
 				}
 			},
 			"required": [
@@ -20473,7 +20831,7 @@ const operationManifest = [
 				"type": "string"
 			},
 			{
-				"description": "Exact case-insensitive delivered recipient mailbox, applied before pagination. Combines with existing filters and cursors; does not search message text.",
+				"description": "Exact case-insensitive delivered recipient mailbox, applied before pagination. Combines with existing filters and cursors; does not search message text. It filters only the mail the caller can read, and is never refused for that (200): a mailbox outside the caller's mail access lists nothing, and one the caller reads only in part (for example through an email rule) lists only that part. For a caller limited to some mailboxes, meta.recipient_outside_access or meta.recipient_rules_only says so when the mailbox is neither one of its addresses nor on one of its domains.",
 				"enum": null,
 				"name": "recipient",
 				"required": false,
@@ -21955,7 +22313,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "create-endpoint",
-		"description": "Creates a new webhook endpoint. If a deactivated endpoint\nwith the same URL and domain exists, it is reactivated\ninstead. Subject to plan limits on the number of active\nendpoints.\n\n**Signing.** A webhook is signed with the organization's webhook secret (`GET /account/webhook-secret`) unless it has its own. A webhook made as a person's own, or by an API key limited to some mailboxes, a third-party app or an agent delegate for itself, is made with its own secret: the response carries it once as `signing_secret`, and `GET /endpoints/{id}/signing-secret` returns it afterwards. Other webhooks, those a person who can read every mailbox makes among them, sign with the organization's secret until given their own. `signed_with` on the endpoint says which secret signs it. See the API-level \"Webhook\nsigning\" section for the full wire format (header name,\nsigned string, hash algo, secret format, tolerance) and a\nlanguage-agnostic verification recipe.\n\nAfter creating the endpoint, fire a test delivery against\nit via `POST /endpoints/{id}/test` to confirm your verifier\naccepts the signature.\n\n\nFor local receiving, use kind=pull and a stable name, without url, function_id or domain_id. Named creation resumes the same active destination; omitted filters preserve its selection, while conflicting supplied configuration returns 409. New unfiltered destinations receive all subsequently ready eligible event types within their credential scope. Connected-agent credentials automatically create private subscriptions restricted to inbound email for their assigned address. Names are isolated per credential; revocation or replacement deletes its subscriptions. Address-scoped events contain parsed mail without raw MIME, signed download links, routing metadata, or sibling envelope recipients. Pull destinations do not occupy HTTP routing slots. Signing-secret setup and a test HTTP delivery are not required for pull receiving.\n\nFor local receiving, use kind=pull and a stable name, without url, function_id or domain_id. Named creation resumes the same active destination; omitted filters preserve its selection, while conflicting supplied configuration returns 409. Creating a pull destination requires a connected-agent credential; it creates a private subscription restricted to inbound email for the assigned address of that credential. Account API keys receive 403 pull_subscription_requires_agent_connection and can instead receive mail with GET /emails?since=<cursor>&wait=30 or an HTTP endpoint. Pulling or completing an account destination created earlier returns the same 403. Names are isolated per credential; revocation or replacement deletes its subscriptions. Address-scoped events contain parsed mail without raw MIME, signed download links, routing metadata, or sibling envelope recipients. Pull destinations do not occupy HTTP routing slots. Signing-secret setup and a test HTTP delivery are not required for pull receiving.\n\nAgent connection keys (pconn_) may use endpoints.pull:manage instead of endpoints:manage here, for their own pull subscriptions only.",
+		"description": "Creates a new webhook endpoint. A URL can have one endpoint per domain, route targets included (unlike the one default destination per domain), and endpoints with no domain_id count as one domain. A disabled endpoint still holds its URL; a deleted one does not. A create at a URL another endpoint has on the same domain is refused (400). A deleted endpoint's URL can be used again: the create makes a new endpoint, with a new id, and the deleted one stays as it was. Subject to plan limits on the number of active\nendpoints.\n\n**Signing.** A webhook is signed with the organization's webhook secret (`GET /account/webhook-secret`) unless it has its own. A webhook made as a person's own, or by an API key limited to some mailboxes, a third-party app or an agent delegate for itself, is made with its own secret: the response carries it once as `signing_secret`, and `GET /endpoints/{id}/signing-secret` returns it afterwards. Other webhooks, those a person who can read every mailbox makes among them, sign with the organization's secret until given their own. `signed_with` on the endpoint says which secret signs it. See the API-level \"Webhook\nsigning\" section for the full wire format (header name,\nsigned string, hash algo, secret format, tolerance) and a\nlanguage-agnostic verification recipe.\n\nAfter creating the endpoint, fire a test delivery against\nit via `POST /endpoints/{id}/test` to confirm your verifier\naccepts the signature.\n\n\nFor local receiving, use kind=pull and a stable name, without url, function_id or domain_id. Named creation resumes the same active destination; omitted filters preserve its selection, while conflicting supplied configuration returns 409. New unfiltered destinations receive all subsequently ready eligible event types within their credential scope. Connected-agent credentials automatically create private subscriptions restricted to inbound email for their assigned address. Names are isolated per credential; revocation or replacement deletes its subscriptions. Address-scoped events contain parsed mail without raw MIME, signed download links, routing metadata, or sibling envelope recipients. Pull destinations do not occupy HTTP routing slots. Signing-secret setup and a test HTTP delivery are not required for pull receiving.\n\nFor local receiving, use kind=pull and a stable name, without url, function_id or domain_id. Named creation resumes the same active destination; omitted filters preserve its selection, while conflicting supplied configuration returns 409. Creating a pull destination requires a connected-agent credential; it creates a private subscription restricted to inbound email for the assigned address of that credential. Account API keys receive 403 pull_subscription_requires_agent_connection and can instead receive mail with GET /emails?since=<cursor>&wait=30 or an HTTP endpoint. Pulling or completing an account destination created earlier returns the same 403. Names are isolated per credential; revocation or replacement deletes its subscriptions. Address-scoped events contain parsed mail without raw MIME, signed download links, routing metadata, or sibling envelope recipients. Pull destinations do not occupy HTTP routing slots. Signing-secret setup and a test HTTP delivery are not required for pull receiving.\n\nAgent connection keys (pconn_) may use endpoints.pull:manage instead of endpoints:manage here, for their own pull subscriptions only.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "createEndpoint",
@@ -22257,13 +22615,13 @@ const operationManifest = [
 					"type": "boolean"
 				},
 				"owner_key_id": {
-					"description": "The API key that owns this webhook. In endpoint responses it is set only for a caller who may read API key metadata, and is null otherwise and when the organization owns the webhook. After a rotation, the key that carries on for the key first named while it can act.",
+					"description": "The API key that owns this webhook. In endpoint responses it is set only for a caller who may read API key metadata, and is null otherwise and when the organization owns the webhook. After a rotation, the key that carries on for the key first named while it can act. When none can, the key delivery stops on: the key first named while it is suspended and not expired, otherwise the newest key of its rotation that is not revoked, otherwise the newest one (only the key first named when nothing may carry on for it).",
 					"type": ["string", "null"],
 					"format": "uuid",
 					"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
 				},
 				"owner_key_status": {
-					"description": "Whether the owning key can act now. In endpoint responses it is set only for a caller who may read API key metadata. Suspended also covers an expired key. A suspended or revoked owner is sent nothing.",
+					"description": "Whether the owning key can act now. In endpoint responses it is set only for a caller who may read API key metadata. It is the state delivery acts on. Suspended also covers an expired key. A suspended or revoked owner is sent nothing. Anyone who may read the endpoint learns that from delivery.reasons, which never names the key.",
 					"type": ["string", "null"],
 					"enum": [
 						"active",
@@ -22272,6 +22630,65 @@ const operationManifest = [
 						null
 					]
 				},
+				"disabled_reason": {
+					"description": "Why the platform turned this endpoint off, when it names a reason. owner_changed: it was given to a new owner while its URL stayed, and the URL was chosen under the previous owner; turning it on or giving it a new URL starts it again. owner_credential_revoked: the third-party app or agent delegate grant that owned it was revoked; an owner or admin who turns it back on takes it over. Null while it is on and when it was turned off by hand. An access suspension does not set it (a suspension is decided through its own record). Other values may be added.",
+					"type": ["string", "null"]
+				},
+				"delivery": {
+					"description": "For a webhook (kind http) in GET /endpoints and GET /endpoints/{id}: whether it is being sent received mail, and why not. Shown to anyone who may read the endpoint; it names a state, never a key. Null when it could not be checked just now. Absent from other kinds of endpoint and from create and update answers.",
+					"type": ["object", "null"],
+					"properties": {
+						"delivering": {
+							"type": "boolean",
+							"description": "Whether the webhook is being sent received mail at all now: it is on, it is not held, and its owner can receive mail. Which messages reach it is still decided per message, by routing, rule grants and its own rules."
+						},
+						"reasons": {
+							"type": "array",
+							"items": {
+								"type": "object",
+								"properties": {
+									"code": { "type": "string" },
+									"message": { "type": "string" }
+								},
+								"required": ["code", "message"],
+								"additionalProperties": {}
+							},
+							"description": "Every reason it is not, in the order delivery checks them; empty when it is. Codes, of which more may be added: disabled: the endpoint is off (disabled_reason on the endpoint says why). held: the endpoint, or the route the email came through, is held pending an owner or admin decision after its creator's access was reduced. acting_owner_revoked, acting_owner_suspended (which covers an expired key) and acting_owner_left: its owner cannot act now. acting_owner_permission: its owner does not read mail. acting_owner_depth: its owner sees headers only. acting_owner_scope: its owner does not read this email's mailbox, or, with no email to judge, reads no received mail at all now. These three name what the owner's access holds, so a caller who may not read API key metadata sees acting_owner_access in their place."
+						},
+						"held_for_owner": {
+							"description": "Rule-granted mail held for this webhook while its owner cannot act; null when none is. Only for a caller with access to every mailbox (held mail can be an earlier owner's), and absent when it could not be read just now.",
+							"type": ["object", "null"],
+							"properties": {
+								"count": {
+									"type": "integer",
+									"minimum": -9007199254740991,
+									"maximum": 9007199254740991,
+									"description": "Rule-granted emails waiting for this webhook because its owner could not act at their last check."
+								},
+								"oldest_queued_at": {
+									"type": "string",
+									"format": "date-time",
+									"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
+									"description": "When the oldest of them was queued."
+								},
+								"expires_at": {
+									"type": "string",
+									"format": "date-time",
+									"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
+									"description": "When the oldest is given up on if its owner still cannot act. Each is checked again periodically, so the count can trail a change of the owner's state."
+								}
+							},
+							"required": [
+								"count",
+								"oldest_queued_at",
+								"expires_at"
+							],
+							"additionalProperties": {}
+						}
+					},
+					"required": ["delivering", "reasons"],
+					"additionalProperties": {}
+				},
 				"signed_with": {
 					"description": "Which secret signs deliveries to this webhook: its own (read it from GET /endpoints/{id}/signing-secret), or the organization's webhook secret. Absent for an endpoint that is not a webhook.",
 					"type": "string",
@@ -22338,7 +22755,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-endpoint",
-		"description": "One endpoint, as GET /endpoints shows it, to a caller who would see it there. Any other id, a deleted endpoint's included, answers 404.",
+		"description": "One endpoint, as GET /endpoints shows it, to a caller who would see it there. Any other id, a deleted endpoint's included, answers 404. For a webhook, delivery says whether it is being sent received mail at all, why not, and how much rule-granted mail is held while its owner cannot act.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getEndpoint",
@@ -22525,13 +22942,13 @@ const operationManifest = [
 					"type": "boolean"
 				},
 				"owner_key_id": {
-					"description": "The API key that owns this webhook. In endpoint responses it is set only for a caller who may read API key metadata, and is null otherwise and when the organization owns the webhook. After a rotation, the key that carries on for the key first named while it can act.",
+					"description": "The API key that owns this webhook. In endpoint responses it is set only for a caller who may read API key metadata, and is null otherwise and when the organization owns the webhook. After a rotation, the key that carries on for the key first named while it can act. When none can, the key delivery stops on: the key first named while it is suspended and not expired, otherwise the newest key of its rotation that is not revoked, otherwise the newest one (only the key first named when nothing may carry on for it).",
 					"type": ["string", "null"],
 					"format": "uuid",
 					"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
 				},
 				"owner_key_status": {
-					"description": "Whether the owning key can act now. In endpoint responses it is set only for a caller who may read API key metadata. Suspended also covers an expired key. A suspended or revoked owner is sent nothing.",
+					"description": "Whether the owning key can act now. In endpoint responses it is set only for a caller who may read API key metadata. It is the state delivery acts on. Suspended also covers an expired key. A suspended or revoked owner is sent nothing. Anyone who may read the endpoint learns that from delivery.reasons, which never names the key.",
 					"type": ["string", "null"],
 					"enum": [
 						"active",
@@ -22540,6 +22957,65 @@ const operationManifest = [
 						null
 					]
 				},
+				"disabled_reason": {
+					"description": "Why the platform turned this endpoint off, when it names a reason. owner_changed: it was given to a new owner while its URL stayed, and the URL was chosen under the previous owner; turning it on or giving it a new URL starts it again. owner_credential_revoked: the third-party app or agent delegate grant that owned it was revoked; an owner or admin who turns it back on takes it over. Null while it is on and when it was turned off by hand. An access suspension does not set it (a suspension is decided through its own record). Other values may be added.",
+					"type": ["string", "null"]
+				},
+				"delivery": {
+					"description": "For a webhook (kind http) in GET /endpoints and GET /endpoints/{id}: whether it is being sent received mail, and why not. Shown to anyone who may read the endpoint; it names a state, never a key. Null when it could not be checked just now. Absent from other kinds of endpoint and from create and update answers.",
+					"type": ["object", "null"],
+					"properties": {
+						"delivering": {
+							"type": "boolean",
+							"description": "Whether the webhook is being sent received mail at all now: it is on, it is not held, and its owner can receive mail. Which messages reach it is still decided per message, by routing, rule grants and its own rules."
+						},
+						"reasons": {
+							"type": "array",
+							"items": {
+								"type": "object",
+								"properties": {
+									"code": { "type": "string" },
+									"message": { "type": "string" }
+								},
+								"required": ["code", "message"],
+								"additionalProperties": {}
+							},
+							"description": "Every reason it is not, in the order delivery checks them; empty when it is. Codes, of which more may be added: disabled: the endpoint is off (disabled_reason on the endpoint says why). held: the endpoint, or the route the email came through, is held pending an owner or admin decision after its creator's access was reduced. acting_owner_revoked, acting_owner_suspended (which covers an expired key) and acting_owner_left: its owner cannot act now. acting_owner_permission: its owner does not read mail. acting_owner_depth: its owner sees headers only. acting_owner_scope: its owner does not read this email's mailbox, or, with no email to judge, reads no received mail at all now. These three name what the owner's access holds, so a caller who may not read API key metadata sees acting_owner_access in their place."
+						},
+						"held_for_owner": {
+							"description": "Rule-granted mail held for this webhook while its owner cannot act; null when none is. Only for a caller with access to every mailbox (held mail can be an earlier owner's), and absent when it could not be read just now.",
+							"type": ["object", "null"],
+							"properties": {
+								"count": {
+									"type": "integer",
+									"minimum": -9007199254740991,
+									"maximum": 9007199254740991,
+									"description": "Rule-granted emails waiting for this webhook because its owner could not act at their last check."
+								},
+								"oldest_queued_at": {
+									"type": "string",
+									"format": "date-time",
+									"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
+									"description": "When the oldest of them was queued."
+								},
+								"expires_at": {
+									"type": "string",
+									"format": "date-time",
+									"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
+									"description": "When the oldest is given up on if its owner still cannot act. Each is checked again periodically, so the count can trail a change of the owner's state."
+								}
+							},
+							"required": [
+								"count",
+								"oldest_queued_at",
+								"expires_at"
+							],
+							"additionalProperties": {}
+						}
+					},
+					"required": ["delivering", "reasons"],
+					"additionalProperties": {}
+				},
 				"signed_with": {
 					"description": "Which secret signs deliveries to this webhook: its own (read it from GET /endpoints/{id}/signing-secret), or the organization's webhook secret. Absent for an endpoint that is not a webhook.",
 					"type": "string",
@@ -22786,13 +23262,13 @@ const operationManifest = [
 						"type": "boolean"
 					},
 					"owner_key_id": {
-						"description": "The API key that owns this webhook. In endpoint responses it is set only for a caller who may read API key metadata, and is null otherwise and when the organization owns the webhook. After a rotation, the key that carries on for the key first named while it can act.",
+						"description": "The API key that owns this webhook. In endpoint responses it is set only for a caller who may read API key metadata, and is null otherwise and when the organization owns the webhook. After a rotation, the key that carries on for the key first named while it can act. When none can, the key delivery stops on: the key first named while it is suspended and not expired, otherwise the newest key of its rotation that is not revoked, otherwise the newest one (only the key first named when nothing may carry on for it).",
 						"type": ["string", "null"],
 						"format": "uuid",
 						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
 					},
 					"owner_key_status": {
-						"description": "Whether the owning key can act now. In endpoint responses it is set only for a caller who may read API key metadata. Suspended also covers an expired key. A suspended or revoked owner is sent nothing.",
+						"description": "Whether the owning key can act now. In endpoint responses it is set only for a caller who may read API key metadata. It is the state delivery acts on. Suspended also covers an expired key. A suspended or revoked owner is sent nothing. Anyone who may read the endpoint learns that from delivery.reasons, which never names the key.",
 						"type": ["string", "null"],
 						"enum": [
 							"active",
@@ -22801,6 +23277,65 @@ const operationManifest = [
 							null
 						]
 					},
+					"disabled_reason": {
+						"description": "Why the platform turned this endpoint off, when it names a reason. owner_changed: it was given to a new owner while its URL stayed, and the URL was chosen under the previous owner; turning it on or giving it a new URL starts it again. owner_credential_revoked: the third-party app or agent delegate grant that owned it was revoked; an owner or admin who turns it back on takes it over. Null while it is on and when it was turned off by hand. An access suspension does not set it (a suspension is decided through its own record). Other values may be added.",
+						"type": ["string", "null"]
+					},
+					"delivery": {
+						"description": "For a webhook (kind http) in GET /endpoints and GET /endpoints/{id}: whether it is being sent received mail, and why not. Shown to anyone who may read the endpoint; it names a state, never a key. Null when it could not be checked just now. Absent from other kinds of endpoint and from create and update answers.",
+						"type": ["object", "null"],
+						"properties": {
+							"delivering": {
+								"type": "boolean",
+								"description": "Whether the webhook is being sent received mail at all now: it is on, it is not held, and its owner can receive mail. Which messages reach it is still decided per message, by routing, rule grants and its own rules."
+							},
+							"reasons": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"code": { "type": "string" },
+										"message": { "type": "string" }
+									},
+									"required": ["code", "message"],
+									"additionalProperties": {}
+								},
+								"description": "Every reason it is not, in the order delivery checks them; empty when it is. Codes, of which more may be added: disabled: the endpoint is off (disabled_reason on the endpoint says why). held: the endpoint, or the route the email came through, is held pending an owner or admin decision after its creator's access was reduced. acting_owner_revoked, acting_owner_suspended (which covers an expired key) and acting_owner_left: its owner cannot act now. acting_owner_permission: its owner does not read mail. acting_owner_depth: its owner sees headers only. acting_owner_scope: its owner does not read this email's mailbox, or, with no email to judge, reads no received mail at all now. These three name what the owner's access holds, so a caller who may not read API key metadata sees acting_owner_access in their place."
+							},
+							"held_for_owner": {
+								"description": "Rule-granted mail held for this webhook while its owner cannot act; null when none is. Only for a caller with access to every mailbox (held mail can be an earlier owner's), and absent when it could not be read just now.",
+								"type": ["object", "null"],
+								"properties": {
+									"count": {
+										"type": "integer",
+										"minimum": -9007199254740991,
+										"maximum": 9007199254740991,
+										"description": "Rule-granted emails waiting for this webhook because its owner could not act at their last check."
+									},
+									"oldest_queued_at": {
+										"type": "string",
+										"format": "date-time",
+										"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
+										"description": "When the oldest of them was queued."
+									},
+									"expires_at": {
+										"type": "string",
+										"format": "date-time",
+										"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
+										"description": "When the oldest is given up on if its owner still cannot act. Each is checked again periodically, so the count can trail a change of the owner's state."
+									}
+								},
+								"required": [
+									"count",
+									"oldest_queued_at",
+									"expires_at"
+								],
+								"additionalProperties": {}
+							}
+						},
+						"required": ["delivering", "reasons"],
+						"additionalProperties": {}
+					},
 					"signed_with": {
 						"description": "Which secret signs deliveries to this webhook: its own (read it from GET /endpoints/{id}/signing-secret), or the organization's webhook secret. Absent for an endpoint that is not a webhook.",
 						"type": "string",
@@ -22994,7 +23529,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "test-endpoint",
-		"description": "Sends a sample `email.received` event to the endpoint. The request\nincludes SSRF protection (private IP rejection and DNS pinning).\nRate limited to 4 per minute and 30 per hour (non-exempt).\nSuccessful deliveries and verified-domain endpoints are exempt\nfrom the rate limit.\n",
+		"description": "Sends a sample `email.received` event to the endpoint. The request\nincludes SSRF protection (private IP rejection and DNS pinning).\nRate limited to 4 per minute and 30 per hour (non-exempt).\nSuccessful deliveries and verified-domain endpoints are exempt\nfrom the rate limit.\n\n\nThe test is sent whether or not real mail would be. reachable says whether the endpoint answered it with a 2xx; delivery says, apart from that, whether real email.received events would be sent to the endpoint by its own conditions (on, not held, an owner that can receive mail, subscribed to the event), with every reason it would not be. A 200 from the test alone does not mean mail arrives.",
 		"hasJsonBody": false,
 		"method": "POST",
 		"operationId": "testEndpoint",
@@ -23031,9 +23566,58 @@ const operationManifest = [
 				"signature": {
 					"type": "string",
 					"description": "The signature header value sent, answered to a caller who may see it: for a webhook signed with the organization's secret, a caller who may read that secret; for one signed with its own, the person who owns it, calling as themselves."
+				},
+				"reachable": {
+					"type": "boolean",
+					"description": "Whether the endpoint answered the test with a 2xx status: the request reached it and its handler accepted it. It says nothing about whether real mail is sent to it: see delivery."
+				},
+				"delivery": {
+					"description": "Whether real email.received events would be sent to this endpoint, judged by the endpoint's own conditions as delivery judges them. Null when that could not be checked just now.",
+					"type": ["object", "null"],
+					"properties": {
+						"event_type": {
+							"type": "string",
+							"description": "The event type checked."
+						},
+						"would_deliver": {
+							"type": "boolean",
+							"description": "Whether this endpoint's own conditions let the event through: it is on, it is not held, its owner can receive it, and it subscribes to the event type. Which endpoint routing or a rule grant sends a message to is decided separately, per message: POST /routes/simulate answers that, and a rule grant can deliver an email outside its owner's mailboxes. A Function endpoint is also judged at delivery on its Function's run state and key."
+						},
+						"reasons": {
+							"type": "array",
+							"items": {
+								"type": "object",
+								"properties": {
+									"code": { "type": "string" },
+									"message": { "type": "string" }
+								},
+								"required": ["code", "message"],
+								"additionalProperties": {}
+							},
+							"description": "Every reason it would not be sent the event, in the order delivery checks them; empty when it would. Codes, of which more may be added: disabled: the endpoint is off (disabled_reason on the endpoint says why). held: the endpoint, or the route the email came through, is held pending an owner or admin decision after its creator's access was reduced. acting_owner_revoked, acting_owner_suspended (which covers an expired key) and acting_owner_left: its owner cannot act now. acting_owner_permission: its owner does not read mail. acting_owner_depth: its owner sees headers only. acting_owner_scope: its owner does not read this email's mailbox, or, with no email to judge, reads no received mail at all now. These three name what the owner's access holds, so a caller who may not read API key metadata sees acting_owner_access in their place. event_type_not_subscribed: rules.event_types leaves the event out."
+						},
+						"events_paused_until": {
+							"description": "While repeated failures have paused this webhook (its circuit breaker is open): when webhook events other than mail (interaction, sent mail and credential events) are next attempted. Received mail is attempted regardless, so this does not change would_deliver. Null when nothing is paused, and for a Function endpoint.",
+							"type": ["string", "null"],
+							"format": "date-time",
+							"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
+						}
+					},
+					"required": [
+						"event_type",
+						"would_deliver",
+						"reasons",
+						"events_paused_until"
+					],
+					"additionalProperties": {}
 				}
 			},
-			"required": ["status", "body"]
+			"required": [
+				"status",
+				"body",
+				"reachable",
+				"delivery"
+			]
 		},
 		"sdkName": "testEndpoint",
 		"summary": "Send a test webhook",
@@ -23044,7 +23628,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "test-endpoint-rules",
-		"description": "Evaluates the endpoint's filtering rules against an\nalready-received email WITHOUT delivering anything. The same\nshared matcher the live delivery paths use produces the\nverdict, so the response explains exactly why a webhook fired\nor was suppressed for that message.\n\nWhen delivery would be suppressed, `rule` names the failing\nrule and `reason` carries a human-readable explanation; both\nare null when the message matches. `evaluated` echoes the\nmessage metadata the matcher compared (size, attachments, and\nthe authenticated From identity versus the raw envelope\nsender), so a surprising verdict can be traced to its inputs.\n\nTwo independent gates are surfaced separately:\n`subscribed_to_event` reports the endpoint's event-type\nsubscription (checked before message matching), and\n`rules_valid` reports whether the stored rules blob parsed at\nall. Delivery fails OPEN on an invalid blob (the message is\ndelivered as if unfiltered), so `rules_valid: false` exposes a\nmisconfiguration that is otherwise silent.\n",
+		"description": "Evaluates the endpoint's filtering rules against an\nalready-received email WITHOUT delivering anything. The same\nshared matcher the live delivery paths use produces the\nverdict, so the response explains exactly why a webhook fired\nor was suppressed for that message.\n\nWhen delivery would be suppressed, `rule` names the failing\nrule and `reason` carries a human-readable explanation; both\nare null when the message matches. `evaluated` echoes the\nmessage metadata the matcher compared (size, attachments, and\nthe authenticated From identity versus the raw envelope\nsender), so a surprising verdict can be traced to its inputs.\n\nTwo independent gates are surfaced separately:\n`subscribed_to_event` reports the endpoint's event-type\nsubscription (checked before message matching), and\n`rules_valid` reports whether the stored rules blob parsed at\nall. Delivery fails OPEN on an invalid blob (the message is\ndelivered as if unfiltered), so `rules_valid: false` exposes a\nmisconfiguration that is otherwise silent.\n\n\nwould_deliver also covers the endpoint's own delivery conditions for this email (delivery): it is on, neither it nor the email's route is held, its owner may receive this email, and it subscribes to the event. Which endpoint routing sends the email to is decided separately: POST /routes/simulate answers that. A 503 means those conditions could not be read just now; retry.",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "testEndpointRules",
@@ -23082,15 +23666,15 @@ const operationManifest = [
 			"properties": {
 				"would_deliver": {
 					"type": "boolean",
-					"description": "Whether the delivery path would deliver this email to the endpoint."
+					"description": "Whether this email would be sent to this endpoint by the endpoint's own conditions: it is on, neither it nor the email's route is held, its owner may receive this email, it subscribes to the event, and its rules match. Which endpoint routing sends the email to is decided separately: POST /routes/simulate answers that. A rule grant can still deliver an email whose mailbox the owner does not read, and a Function endpoint is also judged at delivery on its Function's run state and key."
 				},
 				"rule": {
-					"type": ["string", "null"],
-					"description": "Name of the failing rule when delivery would be\nsuppressed; null when the message matches and the\nendpoint is subscribed to the event type.\n"
+					"description": "The first check that stops this email, in the order delivery makes them: disabled, held or an acting_owner_* code (see delivery.reasons), then event_types when the endpoint does not subscribe, then the name of the rule that does not match. Null when it would deliver.",
+					"type": ["string", "null"]
 				},
 				"reason": {
-					"type": ["string", "null"],
-					"description": "Human-readable explanation of the failing rule; null when the message matches."
+					"description": "Why, in words. Null when it would deliver.",
+					"type": ["string", "null"]
 				},
 				"rules_valid": {
 					"type": "boolean",
@@ -23137,6 +23721,46 @@ const operationManifest = [
 						"sender_authenticated",
 						"sender_trust_basis"
 					]
+				},
+				"delivery": {
+					"description": "The endpoint's own conditions for this email, as delivery judges them, the owner judged on this email's mailbox and time. Null for a pull destination, which nothing pushes to.",
+					"type": ["object", "null"],
+					"properties": {
+						"event_type": {
+							"type": "string",
+							"description": "The event type checked."
+						},
+						"would_deliver": {
+							"type": "boolean",
+							"description": "Whether this endpoint's own conditions let the event through: it is on, it is not held, its owner can receive it, and it subscribes to the event type. Which endpoint routing or a rule grant sends a message to is decided separately, per message: POST /routes/simulate answers that, and a rule grant can deliver an email outside its owner's mailboxes. A Function endpoint is also judged at delivery on its Function's run state and key."
+						},
+						"reasons": {
+							"type": "array",
+							"items": {
+								"type": "object",
+								"properties": {
+									"code": { "type": "string" },
+									"message": { "type": "string" }
+								},
+								"required": ["code", "message"],
+								"additionalProperties": {}
+							},
+							"description": "Every reason it would not be sent the event, in the order delivery checks them; empty when it would. Codes, of which more may be added: disabled: the endpoint is off (disabled_reason on the endpoint says why). held: the endpoint, or the route the email came through, is held pending an owner or admin decision after its creator's access was reduced. acting_owner_revoked, acting_owner_suspended (which covers an expired key) and acting_owner_left: its owner cannot act now. acting_owner_permission: its owner does not read mail. acting_owner_depth: its owner sees headers only. acting_owner_scope: its owner does not read this email's mailbox, or, with no email to judge, reads no received mail at all now. These three name what the owner's access holds, so a caller who may not read API key metadata sees acting_owner_access in their place. event_type_not_subscribed: rules.event_types leaves the event out."
+						},
+						"events_paused_until": {
+							"description": "While repeated failures have paused this webhook (its circuit breaker is open): when webhook events other than mail (interaction, sent mail and credential events) are next attempted. Received mail is attempted regardless, so this does not change would_deliver. Null when nothing is paused, and for a Function endpoint.",
+							"type": ["string", "null"],
+							"format": "date-time",
+							"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
+						}
+					},
+					"required": [
+						"event_type",
+						"would_deliver",
+						"reasons",
+						"events_paused_until"
+					],
+					"additionalProperties": {}
 				}
 			},
 			"required": [
@@ -23146,7 +23770,8 @@ const operationManifest = [
 				"rules_valid",
 				"subscribed_to_event",
 				"event_type",
-				"evaluated"
+				"evaluated",
+				"delivery"
 			]
 		},
 		"sdkName": "testEndpointRules",
@@ -23158,7 +23783,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "update-endpoint",
-		"description": "Updates an active webhook endpoint. Changing the URL keeps the endpoint: its id, recipient routes, signing secret, delivery history and any deliveries still owed to it stay with it, and owed deliveries go to the new URL. Another active endpoint at the new URL is refused.\n\n\nPull destinations cannot be assigned a URL, function or recipient-routing domain. Existing endpoint deletion disconnects the destination; creating a new destination does not backfill historical events.",
+		"description": "Updates an active webhook endpoint. Changing the URL keeps the endpoint: its id, recipient routes, signing secret, delivery history and any deliveries still owed to it stay with it, and owed deliveries go to the new URL. A URL can have one endpoint per domain, route targets included (unlike the one default destination per domain), and endpoints with no domain_id count as one domain. A disabled endpoint still holds its URL; a deleted one does not. A change onto a URL another endpoint has on the same domain is refused (400), and a move onto a domain where another endpoint has this URL is refused (409).\n\n\nPull destinations cannot be assigned a URL, function or recipient-routing domain. Existing endpoint deletion disconnects the destination; creating a new destination does not backfill historical events.\n\nGiving a webhook the organization does not own to a different key (owner_key_id), or a key's webhook back to the organization (owner_key_id null), turns it off unless the request also sets enabled: its URL was chosen under its previous owner. It then reads enabled false with disabled_reason owner_changed, and turning it on or giving it a new URL starts it again. A key that carries on for the owning key through rotation (its successor, at any depth up to 16 rotations) is not a different key: the webhook stays as it was, with the same signing secret. That does not hold when the owning key was made from a key a transfer moved or rotated away, or from one that has since been deleted: no successor carries on for it. The answer's warnings name each such change (turned_off_owner_changed, turned_on_new_url), so a client can say so.",
 		"hasJsonBody": true,
 		"method": "PATCH",
 		"operationId": "updateEndpoint",
@@ -23254,7 +23879,7 @@ const operationManifest = [
 					"description": "For a move to another domain_id whose slot already has an active endpoint: false (the default) answers 409 conflict with details.holder naming it; true retires that endpoint in the same request, after the checks deleting it would need."
 				},
 				"owner_key_id": {
-					"description": "Give this webhook to an API key of the organization. Only a route target can be given to a key; a default endpoint stays the organization's, and takeover is refused with it. null gives a key-owned webhook back to the organization (a caller with access to every mailbox only); it stays a route target.",
+					"description": "Give this webhook to an API key of the organization. Only a route target can be given to a key; a default endpoint stays the organization's, and takeover is refused with it. null gives a key-owned webhook back to the organization (a caller with access to every mailbox only); it stays a route target. Giving a webhook the organization does not own to a different key, or a key's webhook back to the organization, turns it off (enabled false, disabled_reason owner_changed) unless the same request sets enabled: its URL was chosen under its previous owner. A key that carries on for the key that owns it through rotation (its successor, at any depth up to 16 rotations) is not a different key: the webhook stays as it was, with the same signing secret. That does not hold for a webhook whose owning key was made from a key a transfer moved or rotated away, or from one that has since been deleted: no successor carries on for it, so giving the webhook to one is a change of owner. Turning it on, or a new URL, starts it again. A webhook that signs with its own secret keeps signing with one: the same one when it stays with the same key, or was the organization's (giving away one the organization owns needs webhook_secret:read, since the key and its holder can then read its secret), and a new one for any other owner's. The response's warnings say when an update turned the webhook off or on.",
 					"type": ["string", "null"],
 					"format": "uuid",
 					"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
@@ -23267,7 +23892,7 @@ const operationManifest = [
 			},
 			"minProperties": 1
 		},
-		"responseSchema": {
+		"responseSchema": { "allOf": [{
 			"type": "object",
 			"properties": {
 				"recipient": {
@@ -23437,13 +24062,13 @@ const operationManifest = [
 					"type": "boolean"
 				},
 				"owner_key_id": {
-					"description": "The API key that owns this webhook. In endpoint responses it is set only for a caller who may read API key metadata, and is null otherwise and when the organization owns the webhook. After a rotation, the key that carries on for the key first named while it can act.",
+					"description": "The API key that owns this webhook. In endpoint responses it is set only for a caller who may read API key metadata, and is null otherwise and when the organization owns the webhook. After a rotation, the key that carries on for the key first named while it can act. When none can, the key delivery stops on: the key first named while it is suspended and not expired, otherwise the newest key of its rotation that is not revoked, otherwise the newest one (only the key first named when nothing may carry on for it).",
 					"type": ["string", "null"],
 					"format": "uuid",
 					"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
 				},
 				"owner_key_status": {
-					"description": "Whether the owning key can act now. In endpoint responses it is set only for a caller who may read API key metadata. Suspended also covers an expired key. A suspended or revoked owner is sent nothing.",
+					"description": "Whether the owning key can act now. In endpoint responses it is set only for a caller who may read API key metadata. It is the state delivery acts on. Suspended also covers an expired key. A suspended or revoked owner is sent nothing. Anyone who may read the endpoint learns that from delivery.reasons, which never names the key.",
 					"type": ["string", "null"],
 					"enum": [
 						"active",
@@ -23452,6 +24077,65 @@ const operationManifest = [
 						null
 					]
 				},
+				"disabled_reason": {
+					"description": "Why the platform turned this endpoint off, when it names a reason. owner_changed: it was given to a new owner while its URL stayed, and the URL was chosen under the previous owner; turning it on or giving it a new URL starts it again. owner_credential_revoked: the third-party app or agent delegate grant that owned it was revoked; an owner or admin who turns it back on takes it over. Null while it is on and when it was turned off by hand. An access suspension does not set it (a suspension is decided through its own record). Other values may be added.",
+					"type": ["string", "null"]
+				},
+				"delivery": {
+					"description": "For a webhook (kind http) in GET /endpoints and GET /endpoints/{id}: whether it is being sent received mail, and why not. Shown to anyone who may read the endpoint; it names a state, never a key. Null when it could not be checked just now. Absent from other kinds of endpoint and from create and update answers.",
+					"type": ["object", "null"],
+					"properties": {
+						"delivering": {
+							"type": "boolean",
+							"description": "Whether the webhook is being sent received mail at all now: it is on, it is not held, and its owner can receive mail. Which messages reach it is still decided per message, by routing, rule grants and its own rules."
+						},
+						"reasons": {
+							"type": "array",
+							"items": {
+								"type": "object",
+								"properties": {
+									"code": { "type": "string" },
+									"message": { "type": "string" }
+								},
+								"required": ["code", "message"],
+								"additionalProperties": {}
+							},
+							"description": "Every reason it is not, in the order delivery checks them; empty when it is. Codes, of which more may be added: disabled: the endpoint is off (disabled_reason on the endpoint says why). held: the endpoint, or the route the email came through, is held pending an owner or admin decision after its creator's access was reduced. acting_owner_revoked, acting_owner_suspended (which covers an expired key) and acting_owner_left: its owner cannot act now. acting_owner_permission: its owner does not read mail. acting_owner_depth: its owner sees headers only. acting_owner_scope: its owner does not read this email's mailbox, or, with no email to judge, reads no received mail at all now. These three name what the owner's access holds, so a caller who may not read API key metadata sees acting_owner_access in their place."
+						},
+						"held_for_owner": {
+							"description": "Rule-granted mail held for this webhook while its owner cannot act; null when none is. Only for a caller with access to every mailbox (held mail can be an earlier owner's), and absent when it could not be read just now.",
+							"type": ["object", "null"],
+							"properties": {
+								"count": {
+									"type": "integer",
+									"minimum": -9007199254740991,
+									"maximum": 9007199254740991,
+									"description": "Rule-granted emails waiting for this webhook because its owner could not act at their last check."
+								},
+								"oldest_queued_at": {
+									"type": "string",
+									"format": "date-time",
+									"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
+									"description": "When the oldest of them was queued."
+								},
+								"expires_at": {
+									"type": "string",
+									"format": "date-time",
+									"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
+									"description": "When the oldest is given up on if its owner still cannot act. Each is checked again periodically, so the count can trail a change of the owner's state."
+								}
+							},
+							"required": [
+								"count",
+								"oldest_queued_at",
+								"expires_at"
+							],
+							"additionalProperties": {}
+						}
+					},
+					"required": ["delivering", "reasons"],
+					"additionalProperties": {}
+				},
 				"signed_with": {
 					"description": "Which secret signs deliveries to this webhook: its own (read it from GET /endpoints/{id}/signing-secret), or the organization's webhook secret. Absent for an endpoint that is not a webhook.",
 					"type": "string",
@@ -23474,7 +24158,24 @@ const operationManifest = [
 				"failure_count",
 				"consecutive_fails"
 			]
-		},
+		}, {
+			"type": "object",
+			"required": ["warnings"],
+			"properties": { "warnings": {
+				"default": [],
+				"description": "When this update turned the webhook off or on without the request setting enabled. turned_off_owner_changed: the webhook was given to a new owner, so it is now off (disabled_reason owner_changed) until it is turned on or given a new URL. turned_on_new_url: it was off because its owner changed, and the new URL turned it back on. Empty when the update did neither. Other codes may be added.",
+				"type": "array",
+				"items": {
+					"type": "object",
+					"properties": {
+						"code": { "type": "string" },
+						"message": { "type": "string" }
+					},
+					"required": ["code", "message"],
+					"additionalProperties": {}
+				}
+			} }
+		}] },
 		"sdkName": "updateEndpoint",
 		"summary": "Update a webhook endpoint",
 		"tag": "Endpoints",
@@ -45670,8 +46371,12 @@ const operationManifest = [
 					"type": "boolean",
 					"description": "Whether this is the latest attempt of its delivery: the one recorded last, where a record of no attempt (a rule skip or a held send, attempt_count 0) is latest only when no attempt was made. A retry is recorded as a new attempt with its own id and attempt_count (not always higher than the one before), so an earlier attempt never changes: follow the latest one, or read attempts on any of them."
 				},
+				"retry_scheduled": {
+					"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. Null on every attempt of a delivery retried or settled on a schedule of its own, which this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, a rule-granted one, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will.",
+					"type": ["boolean", "null"]
+				},
 				"next_attempt_at": {
-					"description": "When the next automatic retry of this delivery is due. Not reported yet: always null.",
+					"description": "When the next automatic retry of this delivery is due. Not reported: always null. Whether one is coming is retry_scheduled.",
 					"type": ["string", "null"]
 				},
 				"attempts": {
@@ -45699,6 +46404,10 @@ const operationManifest = [
 							"response_body": {
 								"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent.",
 								"type": ["string", "null"]
+							},
+							"retry_scheduled": {
+								"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. Null on every attempt of a delivery retried or settled on a schedule of its own, which this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, a rule-granted one, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will.",
+								"type": ["boolean", "null"]
 							}
 						},
 						"required": [
@@ -45709,7 +46418,8 @@ const operationManifest = [
 							"duration_ms",
 							"created_at",
 							"response_status",
-							"response_body"
+							"response_body",
+							"retry_scheduled"
 						]
 					},
 					"description": "Every attempt of this delivery in the order recorded, oldest first, this one included: the same endpoint, and the same event (or, for an attempt recorded without one, the same email). Each carries what the endpoint answered that attempt (response_status, response_body). Records of no attempt (attempt_count 0) are listed where they were recorded, so the last entry is not always the latest attempt (latest_attempt says which is). The newest 100 when there are more."
@@ -45734,6 +46444,7 @@ const operationManifest = [
 				"updated_at",
 				"email",
 				"latest_attempt",
+				"retry_scheduled",
 				"next_attempt_at",
 				"attempts"
 			]
@@ -45907,10 +46618,14 @@ const operationManifest = [
 						"type": "boolean",
 						"description": "Whether this is the latest attempt of its delivery: the one recorded last, where a record of no attempt (a rule skip or a held send, attempt_count 0) is latest only when no attempt was made. A retry is recorded as a new attempt with its own id and attempt_count (not always higher than the one before), so an earlier attempt never changes: follow the latest one, or read attempts on any of them."
 					},
+					"retry_scheduled": {
+						"type": ["boolean", "null"],
+						"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. Null on every attempt of a delivery retried or settled on a schedule of its own, which this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, a rule-granted one, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will."
+					},
 					"next_attempt_at": {
 						"type": ["string", "null"],
 						"format": "date-time",
-						"description": "When the next automatic retry of this delivery is due. Not reported yet: always null."
+						"description": "When the next automatic retry of this delivery is due. Not reported: always null. Whether one is coming is retry_scheduled."
 					}
 				},
 				"required": [
@@ -45929,6 +46644,7 @@ const operationManifest = [
 					"response_status",
 					"response_body",
 					"latest_attempt",
+					"retry_scheduled",
 					"next_attempt_at"
 				]
 			}
@@ -45985,6 +46701,16 @@ const operationManifest = [
 		"tagCommand": "webhook-deliveries"
 	}
 ];
+// ../packages/api-core/src/openapi/permissions.generated.ts
+/**
+* The keys of the built-in roles, from the spec's `BuiltinRoleKey`.
+* Template and custom roles use other keys.
+*/
+const BUILTIN_ROLE_KEYS = [
+	"owner",
+	"admin",
+	"member"
+];
 // src/oclif/api-path-commands.ts
 /**
 * The hand-rolled command that covers an operation, where the CLI offers one
@@ -46205,6 +46931,27 @@ const TOKEN_SKEW_MS = 6e4;
 const MAX_CACHED_ORG_TOKENS = 20;
 const USER_LOGIN_EXPIRED_MESSAGE = "Saved Primitive CLI login expired or was revoked. Run `primitive login` to sign in again.";
 const NO_CURRENT_ORG_MESSAGE = "No organization is selected for this login. Run `primitive orgs` to see where you can use the CLI, then `primitive org use <org>`.";
+/**
+* The CLI login and the organization list report a person's stored role:
+* the largest built-in role (owner, admin or member) their access fully
+* includes, or `restricted` when it includes none or they hold no role at
+* all. The role's own name is not in these answers.
+*/
+const BUILT_IN_ROLE_KEYS = new Set(BUILTIN_ROLE_KEYS);
+/** Whether a role key names one of the built-in roles. */
+function isBuiltInRoleKey(role) {
+	return BUILT_IN_ROLE_KEYS.has(role);
+}
+/** What the role key `restricted` stands for. */
+const RESTRICTED_ROLE_NOTE = "a template or custom role that does not fully include member, because it lacks some member permission (as Operator does) or reaches only some mailboxes";
+/** A stored role key, labelled for what it is: "built-in role admin", "role restricted". */
+function roleKeyLabel(role) {
+	return isBuiltInRoleKey(role) ? `built-in role ${role}` : `role ${role}`;
+}
+/** A stored role key for a sentence, saying what `restricted` stands for. */
+function roleKeyText(role) {
+	return role === "restricted" ? `role restricted (${RESTRICTED_ROLE_NOTE})` : roleKeyLabel(role);
+}
 const REFUSAL_FALLBACK_MESSAGES = {
 	not_a_member: "You are not a member of this organization.",
 	cli_access_disabled_by_org: "This organization does not allow CLI access.",
@@ -47104,7 +47851,7 @@ function errorDetail(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 /** `count` and the word for it: "1 expectation", "2 expectations". */
-function plural(count, one, many) {
+function plural$1(count, one, many) {
 	return `${count} ${count === 1 ? one : many}`;
 }
 function checkEmailId(id, label) {
@@ -47423,21 +48170,21 @@ function expectationsOutcome(expectations, testResults = []) {
 		exitCode: 1,
 		error: {
 			code: "expectations_failed",
-			message: `${plural(failedCount, "expectation", "expectations")} failed${failed.length > 0 ? `: ${failed.join(", ")}` : ""}.`
+			message: `${plural$1(failedCount, "expectation", "expectations")} failed${failed.length > 0 ? `: ${failed.join(", ")}` : ""}.`
 		}
 	};
 	if (unresolvable.length > 0) return {
 		exitCode: 1,
 		error: {
 			code: "expectations_unresolvable",
-			message: `${plural(unresolvable.length, "expectation is", "expectations are")} undecided, and testing again will not decide ${unresolvable.length === 1 ? "it" : "them"}: ${why(unresolvable)}.`
+			message: `${plural$1(unresolvable.length, "expectation is", "expectations are")} undecided, and testing again will not decide ${unresolvable.length === 1 ? "it" : "them"}: ${why(unresolvable)}.`
 		}
 	};
 	if (undecidedCount > 0) return {
 		exitCode: 3,
 		error: {
 			code: "expectations_undecided",
-			message: `${plural(undecidedCount, "expectation is", "expectations are")} undecided${undecided.length > 0 ? `: ${why(undecided)}` : ""}. Test again later.`
+			message: `${plural$1(undecidedCount, "expectation is", "expectations are")} undecided${undecided.length > 0 ? `: ${why(undecided)}` : ""}. Test again later.`
 		}
 	};
 	return {};
@@ -47501,14 +48248,14 @@ function writtenExpectationsOutcome(check, sentExpectations, ruleId) {
 		exitCode: 1,
 		error: {
 			code: "expectations_failed",
-			message: `${plural(failed.length, "expectation", "expectations")} failed on this write: ${failed.join(", ")}.`
+			message: `${plural$1(failed.length, "expectation", "expectations")} failed on this write: ${failed.join(", ")}.`
 		}
 	};
 	if (undecided.length > 0) return {
 		exitCode: 3,
 		error: {
 			code: "expectations_undecided",
-			message: `${plural(undecided.length, "expectation is", "expectations are")} undecided on this write, which judges them without classifying mail or asking the rule's questions: ${undecided.join(", ")}. Test them with ${test}.`
+			message: `${plural$1(undecided.length, "expectation is", "expectations are")} undecided on this write, which judges them without classifying mail or asking the rule's questions: ${undecided.join(", ")}. Test them with ${test}.`
 		}
 	};
 	if (check.passed !== true) return {
@@ -47557,6 +48304,33 @@ function emailRuleScopeReport(data) {
 	}
 	return { lines };
 }
+/** The delete-email-rule question, naming the rule. */
+function deleteEmailRuleQuestion(flags) {
+	return `Delete email rule ${typeof flags.id === "string" ? flags.id : "this rule"}? Its versions and decisions are deleted with it. [y/N] `;
+}
+/**
+* What a rule's delete left behind, read from the answer: the shares it
+* ended, and the keys that still list the rule and now read nothing through
+* it. An answer without these fields (an older server) prints nothing.
+*/
+function deleteEmailRuleReport(data, request) {
+	if (!isRecord(data)) return { lines: [] };
+	const answer = data;
+	const lines = [];
+	const ended = Array.isArray(answer.ended_shares) ? answer.ended_shares.length : 0;
+	if (ended > 0) lines.push(`Ended ${ended === 1 ? "1 share" : `${ended} shares`} of this rule (end_reason rule_deleted). ${ended === 1 ? "It keeps its record" : "Each keeps its record"}.`);
+	const keys = Array.isArray(answer.keys) ? answer.keys : [];
+	const others = typeof answer.other_keys === "number" && answer.other_keys > 0 ? answer.other_keys : 0;
+	const ruleId = typeof request.path.id === "string" ? request.path.id : "<rule-id>";
+	if (keys.length > 0) {
+		lines.push(`${keys.length === 1 ? "1 key still lists" : `${keys.length} keys still list`} this rule and now ${keys.length === 1 ? "reads" : "read"} nothing through it:`);
+		for (const key of keys) lines.push(`  ${key.id}  ${key.name ?? "(no name)"}  ${key.key_prefix}`);
+		lines.push(keys.length === 1 ? `Take the rule off with \`primitive keys update ${keys[0]?.id} --remove-rule ${ruleId}\`, or revoke the key.` : `Take the rule off each with \`primitive keys update <key-id> --remove-rule ${ruleId}\`, or revoke them.`);
+	}
+	if (others > 0) lines.push(keys.length > 0 ? `${others === 1 ? "1 more key" : `${others} more keys`} you cannot read ${others === 1 ? "lists" : "list"} this rule too.` : `${others === 1 ? "1 key" : `${others} keys`} you cannot read ${others === 1 ? "lists" : "list"} this rule and now ${others === 1 ? "reads" : "read"} nothing through it.`);
+	if (Array.isArray(answer.ended_shares) && answer.keys === void 0 && answer.other_keys === void 0) lines.push("Could not check which keys list this rule.");
+	return { lines };
+}
 function errorDetails(payload) {
 	if (!isRecord(payload)) return {};
 	if (isRecord(payload.details)) return payload.details;
@@ -47576,7 +48350,9 @@ function versionMovedHint(payload, ruleId) {
 	const read = `Read it again with \`primitive email-rules get-email-rule ${id}\` and reapply your change to what it shows`;
 	return current === void 0 ? `Hint: the rule's version is not the if_version you sent, so nothing was saved, and the answer did not give its current version. ${read}.` : `Hint: the rule's current version is ${current}, not the if_version you sent, so nothing was saved. ${read}, then retry with --if-version ${current}.`;
 }
-const EXPECTATION_FLAG_NOTE = "Replaces any expect in --body-file or --raw-body. The exit code follows the answer's expectations; see --help-full.";
+/** A write's --fail-on-expectations, the same on create and update. */
+const FAIL_ON_EXPECTATIONS_HELP = "Exit 1 when an expectation in the answer's expectations_check failed, and 3 when none failed but one is undecided or the expectations this write sent were not checked (test the rule to decide). Without it the command exits 0 whatever the check says.";
+const EXPECTATION_FLAG_NOTE = "Replaces any expect in --body-file or --raw-body. The answer reports them in expectations (passed, counts, results) and the exit code follows it; see --help-full.";
 const EMAIL_RULE_OPERATION_EXTENSIONS = {
 	testEmailRule: {
 		flags: {
@@ -47605,8 +48381,8 @@ const EMAIL_RULE_OPERATION_EXTENSIONS = {
 	},
 	createEmailRule: {
 		flags: {
-			"expectations-file": Flags.string({ description: "A JSON file holding the emails the rule must match and must not, such as {\"match\": [\"<email-id>\"], \"no_match\": [\"<email-id>\"]}. Sets expectations, over any in --body-file or --raw-body; the answer judges them in expectations_check." }),
-			[FAIL_ON_EXPECTATIONS_FLAG]: Flags.boolean({ description: "Exit 1 when an expectation in the answer's expectations_check failed, and 3 when none failed but one is undecided or the expectations this write sent were not checked (test the rule to decide). Without it the command exits 0 whatever the check says." })
+			"expectations-file": Flags.string({ description: "A JSON file holding the emails the rule must match and must not, such as {\"match\": [\"<email-id>\"], \"no_match\": [\"<email-id>\"]}. Sets expectations, over any in --body-file or --raw-body; the answer judges them in expectations_check (passed, decided, failed, undecided); the report test-email-rule answers with is named expectations instead." }),
+			[FAIL_ON_EXPECTATIONS_FLAG]: Flags.boolean({ description: FAIL_ON_EXPECTATIONS_HELP })
 		},
 		bodyFields: expectationsBodyFields(false),
 		bodyProperties: ["expectations"],
@@ -47615,8 +48391,8 @@ const EMAIL_RULE_OPERATION_EXTENSIONS = {
 	},
 	updateEmailRule: {
 		flags: {
-			"expectations-file": Flags.string({ description: "A JSON file holding the emails the rule must match and must not, such as {\"match\": [\"<email-id>\"], \"no_match\": [\"<email-id>\"]}, replacing its saved expectations; a file holding null removes them. Sets expectations, over any in --body-file or --raw-body; the answer judges them in expectations_check." }),
-			[FAIL_ON_EXPECTATIONS_FLAG]: Flags.boolean({ description: "Exit 1 when an expectation in the answer's expectations_check failed, and 3 when none failed but one is undecided or the expectations this write sent were not checked (test the rule to decide). Without it the command exits 0 whatever the check says." })
+			"expectations-file": Flags.string({ description: "A JSON file holding the emails the rule must match and must not, such as {\"match\": [\"<email-id>\"], \"no_match\": [\"<email-id>\"]}, replacing its saved expectations; a file holding null removes them. Sets expectations, over any in --body-file or --raw-body; the answer judges them in expectations_check (passed, decided, failed, undecided); the report test-email-rule answers with is named expectations instead." }),
+			[FAIL_ON_EXPECTATIONS_FLAG]: Flags.boolean({ description: FAIL_ON_EXPECTATIONS_HELP })
 		},
 		bodyFields: expectationsBodyFields(true),
 		bodyProperties: ["expectations"],
@@ -47626,6 +48402,18 @@ const EMAIL_RULE_OPERATION_EXTENSIONS = {
 	getEmailRuleScope: {
 		flags: {},
 		report: emailRuleScopeReport
+	},
+	deleteEmailRule: {
+		flags: { yes: Flags.boolean({
+			char: "y",
+			description: "Delete without asking for confirmation. Needed without a terminal, and with --json."
+		}) },
+		confirm: {
+			question: deleteEmailRuleQuestion,
+			noTerminal: "Not deleting: no terminal to confirm in. Pass --yes to delete the rule without a prompt.",
+			cancelled: "Cancelled. The rule was not deleted."
+		},
+		report: deleteEmailRuleReport
 	}
 };
 /** The classification in a listEmailRuleResults answer, or null. */
@@ -47642,15 +48430,208 @@ function noFactsMessage(data) {
 	if (classificationOf(data)) return "This email's classification has no facts.";
 	return (isRecord(data) && Array.isArray(data.rules) ? data.rules : []).some((rule) => isRecord(rule) && isRecord(rule.decision) && rule.decision.detail_withheld === true) ? "No classification to show: this email's content cannot be read (withheld, failed to parse or discarded)." : "No classification for this email yet. It has not been classified (recent mail can take a while, so try again later), it will not be, or its content cannot be read.";
 }
+// src/oclif/empty-mail-hint.ts
+/**
+* Query parameters that page, shape or modify a list without narrowing which
+* emails it holds on their own. Any other one the caller set is a filter.
+*/
+const NOT_FILTERS = /* @__PURE__ */ new Set([
+	"cursor",
+	"since",
+	"limit",
+	"include",
+	"wait",
+	"group",
+	"search_regex",
+	"search_case_sensitive",
+	"search_negate"
+]);
+/** How many addresses, domains or rules the hint names before "and N more". */
+const NAMED_MAX = 3;
+/** How long the hint waits for the grant before leaving it out. */
+const GRANT_TIMEOUT_MS = 2e3;
+/**
+* The caller's grant from GET /whoami/grant, or undefined when it cannot be
+* read in time: the hint then says only that the credential may be narrowed.
+* Reading mail follows `mail:read`'s own scope where it reaches fewer
+* mailboxes than the grant's.
+*/
+async function readCallerMail(client, timeoutMs = GRANT_TIMEOUT_MS) {
+	let timer;
+	const late = new Promise((resolve) => {
+		timer = setTimeout(() => resolve(void 0), timeoutMs);
+	});
+	try {
+		return await Promise.race([readGrant(client, timeoutMs), late]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+async function readGrant(client, timeoutMs) {
+	try {
+		const result = await getOwnGrant({
+			client,
+			fetch: (input, init) => globalThis.fetch(input, init),
+			responseStyle: "fields",
+			signal: AbortSignal.timeout(timeoutMs)
+		});
+		if (result.error) return void 0;
+		const grant = result.data?.data?.grant;
+		if (!grant || typeof grant !== "object") return void 0;
+		const g = grant;
+		const scoped = g.scoped_permissions && typeof g.scoped_permissions === "object" ? g.scoped_permissions["mail:read"] : void 0;
+		return {
+			credentialKind: g.credential_kind,
+			mailScope: scoped ?? g.mail_scope
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* What the caller reads, for the hint: a connected agent's key from the
+* address it was connected for (it may not ask GET /whoami/grant), any other
+* credential from GET /whoami/grant.
+*/
+async function readCallerMailFor(auth, client) {
+	const address = auth.connectedAgent?.agentAddress;
+	if (address) return {
+		credentialKind: "connected_key",
+		mailScope: {
+			addresses: [address],
+			domains: []
+		}
+	};
+	if (auth.apiKey?.startsWith("pconn_")) return {
+		credentialKind: "connected_key",
+		mailScope: void 0
+	};
+	return readCallerMail(client);
+}
+/** The query parameters the caller set that narrow which emails are listed. */
+function listFilters(query) {
+	return Object.keys(query).filter((name) => {
+		const value = query[name];
+		if (NOT_FILTERS.has(name) || value === void 0) return false;
+		const off = value === false || value === "false";
+		if (name.startsWith("exclude_")) return !off;
+		if (name === "include_presence") return off;
+		return true;
+	});
+}
+function strings(value) {
+	return Array.isArray(value) && value.every((v) => typeof v === "string") ? value : null;
+}
+/** What a mail scope from GET /whoami/grant reaches, as far as the hint needs. */
+function mailReach(scope) {
+	if (scope === "org") return { kind: "org" };
+	if (scope === "unreadable") return { kind: "unreadable" };
+	if (!scope || typeof scope !== "object" || Array.isArray(scope)) return { kind: "unknown" };
+	const record = scope;
+	const addresses = strings(record.addresses ?? []);
+	const domains = strings(record.domains ?? []);
+	const rules = strings(record.rules ?? []);
+	if (!addresses || !domains || !rules) return { kind: "unknown" };
+	if (record.direction === "outbound" && rules.length === 0) return { kind: "outbound_only" };
+	if (addresses.length === 0 && domains.length === 0) return rules.length > 0 ? {
+		kind: "rules_only",
+		rules
+	} : { kind: "none" };
+	const exceptPersonal = typeof record.excluded_personal_mailboxes === "number" && record.excluded_personal_mailboxes > 0;
+	return {
+		kind: "mailboxes",
+		names: [...addresses, ...domains.map((d) => exceptPersonal ? `addresses at ${d} other than other members' personal mailboxes` : `any address at ${d}`)],
+		rules
+	};
+}
+function named(names) {
+	const shown = names.slice(0, NAMED_MAX);
+	const rest = names.length - shown.length;
+	const all = rest > 0 ? [...shown, `${rest} more`] : shown;
+	return all.length <= 1 ? all[0] ?? "" : `${all.slice(0, -1).join(", ")} and ${all[all.length - 1]}`;
+}
+const plural = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
+const GRANT_POINTER = "`primitive whoami --json --grant` shows which mail it reaches.";
+/**
+* How a rule grants mail, and who can look at it: a key cannot read rules
+* itself. An id a key lists is an email rule, or a rule shared with the key's
+* holder, which its holder checks as a share.
+*/
+function rulesSentence(rules) {
+	return `A rule grants an email it matches when the email is evaluated, shortly after it arrives, while the rule is active, and the key reads that mail only while the rule stays active. Each id (${named(rules)}) is an email rule or a rule shared with the key's holder: a rule's author, signed in as themselves, can check it with \`primitive email-rules get-email-rule --id <id>\`, and a share's holder with \`primitive email-rules get-email-rule-share --id <id>\`.`;
+}
+function holderOf(kind) {
+	if (kind === "org_key" || kind === "function_key") return "key";
+	if (kind === "connected_key") return "connection";
+	return typeof kind === "string" ? "person" : "unknown";
+}
+const NOUN = {
+	key: "This key",
+	connection: "This connection key",
+	person: "This login",
+	unknown: "This credential"
+};
+/** A person also reads mail through rules colleagues shared with them, which sit beside the grant, not in it. */
+const SHARED = "mail from email rules colleagues shared with you (`primitive email-rules list-email-rule-shares` lists them)";
+/** A connection key also reads member mailboxes its owner gave it, asked for by name. */
+const GIVEN = "any member mailbox its owner gave it (pass that mailbox with --recipient)";
+/** What the credential reads, as sentences for the hint, or null when it reads every mailbox. */
+function reachSentence(reach, holder) {
+	const noun = NOUN[holder];
+	switch (reach.kind) {
+		case "org": return null;
+		case "unknown": return holder === "connection" ? `${noun} reads the address it was connected for, and ${GIVEN}.` : `${noun} may not read every mailbox; ${GRANT_POINTER}`;
+		case "outbound_only": return holder === "person" ? `${noun} reads no received mail through its grant, which covers sent mail only, but does read ${SHARED}. ${GRANT_POINTER}` : `${noun} reads no received mail: its grant covers sent mail only. ${GRANT_POINTER}`;
+		case "unreadable": return `The server could not read this credential's stored mail scope, so it reaches no mail through it. ${GRANT_POINTER}`;
+		case "none": return holder === "person" ? `${noun} reads no mailbox through its grant, only ${SHARED}. ${GRANT_POINTER}` : `${noun} reads no mail: its grant names no mailbox or domain, and no email rule or live share. ${GRANT_POINTER}`;
+		case "rules_only": return `${noun} reads only mail its ${plural(reach.rules.length, "email rule")} granted. ${rulesSentence(reach.rules)}`;
+		case "mailboxes": {
+			const parts = [
+				named(reach.names),
+				...reach.rules.length > 0 ? [`mail its ${plural(reach.rules.length, "email rule")} granted`] : [],
+				...holder === "connection" ? [GIVEN] : [],
+				...holder === "person" ? [SHARED] : []
+			];
+			const all = parts.length === 1 ? parts[0] : `${parts.slice(0, -1).join(", ")}, and ${parts[parts.length - 1]}`;
+			return holder === "connection" ? `${noun} reads only ${all}.` : `${noun} reads ${holder === "person" ? "" : "only "}${all}; other mail is not listed.`;
+		}
+	}
+}
+/**
+* The hint for an empty inbound email list: what was asked (the filter flags
+* given, or a page or tail past the last email), and what this credential
+* reads. `caller` is undefined when the grant could not be read, and null
+* when it was not asked for (a tail poll, which should not double its
+* requests, or a page with a next cursor, whose hint does not need it).
+*/
+function emptyEmailListHint(input) {
+	if (input.nextCursor) return `(no results) This page came back empty, but the list goes on: continue with --cursor ${input.nextCursor}.`;
+	const reach = input.caller === null ? { kind: "org" } : mailReach(input.caller?.mailScope);
+	const holder = holderOf(input.caller?.credentialKind);
+	const scope = reachSentence(reach, holder);
+	const withScope = (lead) => `${lead}${scope ? ` ${scope}` : ""}`;
+	const filters = holder === "connection" ? input.filterFlags.filter((f) => !f.startsWith("--include-presence")) : input.filterFlags;
+	if (filters.length > 0) return withScope(`(no results) No inbound emails match the filters given (${filters.join(", ")}).`);
+	if (input.pastFlag) return withScope(input.pastFlag === "--cursor" ? "(no results) No more inbound emails past the given --cursor." : "(no results) No inbound emails after the given --since.");
+	if (!scope) return input.orgHint ?? "(no results) No inbound emails received yet on this account. Send one to a verified domain to populate this list. For a compact view, prefer `primitive emails latest`.";
+	const noun = NOUN[holder].replace(/^This/, "this");
+	if (reach.kind === "rules_only") return `(no results) No mail ${noun}'s rules granted is readable now. ${scope}`;
+	if (reach.kind === "mailboxes") return `(no results) No inbound emails yet in the mail ${noun} reads. ${scope}`;
+	return `(no results) No inbound emails to show. ${scope}`;
+}
 // src/oclif/endpoint-event-types.ts
 const EVENT_TYPES_FLAG_OPERATIONS = /* @__PURE__ */ new Set(["createEndpoint", "updateEndpoint"]);
-const EVENT_TYPES_FLAG_DESCRIPTION = "Event types this endpoint subscribes to, comma separated or repeated (sets rules.event_types). Omitting the subscription means every event type except the opt-in sent_email.* events, which an endpoint receives only when it lists them; sent_email.* expands to all four. Keep email.received in the list if the endpoint also handles inbound mail. On update, the endpoint's other rules are kept.";
-const SENT_EMAIL_WILDCARD = "sent_email.*";
+const EVENT_TYPES_FLAG_DESCRIPTION = "Event types this endpoint subscribes to, comma separated or repeated (sets rules.event_types). Omitting the subscription means every event type except the opt-in sent_email.* and email_rule_request.* events, which an endpoint receives only when it lists them; sent_email.* and email_rule_request.* each expand to all four. Rule request events can be listed only when the webhook is created, signed in as yourself; such a webhook is yours and always a route target. Keep email.received in the list if the endpoint also handles inbound mail. On update, the endpoint's other rules are kept.";
+/** Shorthands the CLI expands, since the server would store them as literals that match nothing. */
+const WILDCARDS = {
+	"sent_email.*": SENT_EMAIL_EVENT_TYPES,
+	"email_rule_request.*": EMAIL_RULE_REQUEST_EVENT_TYPES
+};
 const KNOWN_EVENT_TYPES = new Set(WEBHOOK_EVENT_TYPES);
 var EventTypesFlagError = class extends Error {};
 /**
 * Turn the raw `--event-types` values into the list to store: split on
-* commas, trim, expand `sent_email.*`, and drop duplicates while keeping the
+* commas, trim, expand `sent_email.*` and `email_rule_request.*`, and drop duplicates while keeping the
 * order the caller gave.
 */
 function parseEventTypesFlag(values) {
@@ -47659,14 +48640,14 @@ function parseEventTypesFlag(values) {
 	for (const value of values) for (const raw of value.split(",")) {
 		const name = raw.trim();
 		if (name === "") continue;
-		const names = name === SENT_EMAIL_WILDCARD ? [...SENT_EMAIL_EVENT_TYPES] : [name];
+		const names = Object.hasOwn(WILDCARDS, name) ? [...WILDCARDS[name] ?? []] : [name];
 		for (const entry of names) {
 			if (seen.has(entry)) continue;
 			seen.add(entry);
 			out.push(entry);
 		}
 	}
-	if (out.length === 0) throw new EventTypesFlagError("--event-types needs at least one event type. To receive every event type except the opt-in sent_email.* events, omit the subscription instead.");
+	if (out.length === 0) throw new EventTypesFlagError("--event-types needs at least one event type. To receive every event type except the opt-in sent_email.* and email_rule_request.* events, omit the subscription instead.");
 	if (out.length > 50) throw new EventTypesFlagError(`--event-types accepts at most 50 event types (got ${out.length}).`);
 	return out;
 }
@@ -47975,6 +48956,92 @@ function formatAlreadySentNotice(sent, options = {}) {
 	if (deliveryStatus && deliveryStatus !== status) details.push(`delivery status ${deliveryStatus}`);
 	return `Already sent: this exact message went out earlier${details.length > 0 ? ` (${details.join(", ")})` : ""}. Nothing new was sent.`;
 }
+// src/oclif/member-role-mail.ts
+/**
+* Why an invitation for Member was refused, for the refusal the server gives
+* when every Member reads all of the organization's mail: offering Member is
+* then giving that, which only an invitation sent from the dashboard by
+* someone who can assign roles may do.
+*/
+const MEMBER_INVITE_READS_ALL_MAIL = "In this organization every Member reads all of its mail, so inviting someone as Member gives them every mailbox. Only an invitation sent from the dashboard itself, by someone who can assign roles, can offer that; a CLI request cannot, even with a step-up token. From the CLI you can invite them with --role none, where the organization can give limited roles, and once they have joined give them a role with `primitive roles-and-members set-member-role`, which needs roles:assign and an approval in the browser. Or invite them from the dashboard's Roles settings, which says what each role reads.";
+/** The same refusal for any role above Member, which is assigning a role: the same advice, without the mail clause. */
+const ROLE_INVITE_NEEDS_DASHBOARD = "Inviting someone with a role other than Member or none is assigning that role, and only an invitation sent from the dashboard itself, by someone who can assign roles, can do it; a CLI request cannot, even with a step-up token. From the CLI you can invite them with --role none, where the organization can give limited roles, and once they have joined give them the role with `primitive roles-and-members set-member-role`, which needs roles:assign and an approval in the browser. Or invite them from the dashboard's Roles settings.";
+/**
+* The hint for a refused invite-organization-member, or undefined when it is
+* not that refusal. That one carries no details; a refusal for a grant that
+* lacks a permission names it in its details, and is left to its own hint.
+*/
+function inviteRefusalHint(code, body, payload) {
+	if (code !== "grant_forbidden") return void 0;
+	const details = payload && typeof payload === "object" ? payload.details : void 0;
+	if (details && typeof details === "object" && Object.keys(details).length > 0) return void 0;
+	const role = body && typeof body === "object" ? body.role : void 0;
+	if (role === void 0 || role === "member") return MEMBER_INVITE_READS_ALL_MAIL;
+	return role === "none" ? void 0 : ROLE_INVITE_NEEDS_DASHBOARD;
+}
+/**
+* Control characters (C0, DEL and C1), line and paragraph separators and
+* format characters, which could fake a line of output: a role's name is free
+* text. Built from code points, as commands/roles.ts builds its pattern, so the
+* source holds no control character.
+*/
+const UNPRINTABLE = new RegExp(`[${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}-${String.fromCharCode(159)}${String.fromCharCode(8232)}${String.fromCharCode(8233)}\\p{Cf}]`, "gu");
+/**
+* The warning for giving someone `role`, from GET /roles, or null when it
+* reads less or cannot be told. A role, or a template the organization has
+* not copied yet, reads every mailbox when it holds mail:read over the whole
+* organization and the organization gives such roles all of its mail (whole-
+* organization access, which the dashboard also assumes when the answer does
+* not say).
+*/
+function roleReadsAllMailWarning(role, listed) {
+	if (!listed || typeof listed !== "object") return null;
+	const data = listed;
+	if ((data.invitations && typeof data.invitations === "object" ? data.invitations : null)?.members_read_all_mail === false) return null;
+	const byKey = (value) => value === role;
+	const byId = (value) => typeof value === "string" && value.toLowerCase() === role.toLowerCase();
+	const roles = Array.isArray(data.roles) ? data.roles : [];
+	const templates = Array.isArray(data.templates) ? data.templates : [];
+	const found = roles.find((r) => byKey(r.key) || byId(r.id)) ?? templates.find((t) => byKey(t.key));
+	const readsMail = Array.isArray(found?.permissions) && found.permissions.includes("mail:read");
+	if (!found || (found.mail_scope ?? "org") !== "org" || !readsMail) return null;
+	return `Warning: the role "${Array.from((typeof found.name === "string" ? found.name : "").replace(UNPRINTABLE, " ").replace(/\s+/g, " ").trim()).slice(0, 80).join("").trim() || role}" reads all of this organization's mail while this organization uses whole-organization access, so the person given it reads every mailbox. For only their own mail, use a narrower role: \`primitive roles list --json\` shows each role's mail_scope.`;
+}
+/** How long the warning waits for GET /roles before leaving it out. */
+const ROLES_TIMEOUT_MS = 3e3;
+/**
+* GET /roles, or null when it cannot be read in time: the warning is then
+* left out rather than guessed. The signal stops the request; the race bounds
+* everything around it too, such as a saved login's token exchange on a 401.
+*/
+async function readRoles(client, timeoutMs = ROLES_TIMEOUT_MS) {
+	let timer;
+	const late = new Promise((resolve) => {
+		timer = setTimeout(() => resolve(null), timeoutMs);
+	});
+	try {
+		return await Promise.race([fetchRoles(client, timeoutMs), late]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+async function fetchRoles(client, timeoutMs) {
+	try {
+		const result = await client.get({
+			responseStyle: "fields",
+			security: [{
+				scheme: "bearer",
+				type: "http"
+			}],
+			signal: AbortSignal.timeout(timeoutMs),
+			url: "/roles"
+		});
+		if (result.error) return null;
+		return result.data?.data ?? null;
+	} catch {
+		return null;
+	}
+}
 // src/oclif/runtime-session.ts
 /**
 * The variables each runtime sets to its exact session ID, first match wins.
@@ -48595,7 +49662,7 @@ const HINTS = /* @__PURE__ */ new Set([
 /** A printable `<protocol>/<version>`; anything else is treated as unknown. */
 const KIND = /^[a-z][a-z0-9._-]{0,63}\/[1-9][0-9]{0,3}$/;
 const UUID$2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function record$1(value) {
+function record$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function categoryOf(hint, kind, fyi, candidate) {
@@ -48628,12 +49695,12 @@ function replyExpectation(category) {
 * treated as `none`, as the API documents.
 */
 function readEmailInteraction(detail) {
-	const row = record$1(detail);
+	const row = record$2(detail);
 	if (!row || typeof row.interaction_hint !== "string") return null;
 	const hint = HINTS.has(row.interaction_hint) ? row.interaction_hint : "none";
 	const rawKind = row.interaction_kind;
 	const kind = (hint === "card" || hint === "status") && typeof rawKind === "string" && KIND.test(rawKind) ? rawKind : null;
-	const fyi = row.fyi === true || record$1(row.collaboration)?.fyi === true;
+	const fyi = row.fyi === true || record$2(row.collaboration)?.fyi === true;
 	const category = categoryOf(hint, kind, fyi, row.interaction_candidate === true);
 	const expectation = replyExpectation(category);
 	return {
@@ -49197,14 +50264,14 @@ function bareAddress$1(value) {
 	const address = (/<([^<>\s]+@[^<>\s]+)>\s*$/.exec(value)?.[1] ?? value).trim().toLowerCase();
 	return /^[^\s<>@]+@[^\s<>@]+$/.test(address) ? address : null;
 }
-function record(value) {
+function record$1(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function newerRows(value) {
 	if (!Array.isArray(value)) return void 0;
 	const rows = [];
 	for (const item of value.slice(-20)) {
-		const row = record(item);
+		const row = record$1(item);
 		const from = bareAddress$1(row?.from);
 		if (!row || typeof row.id !== "string" || !UUID.test(row.id) || !from || typeof row.received_at !== "string" || !Number.isFinite(Date.parse(row.received_at))) return void 0;
 		rows.push({
@@ -49240,10 +50307,10 @@ async function readThreadContext(client, threadId, afterEmailId, signal) {
 			result = await read();
 		}
 		if (result.error !== void 0) return null;
-		const body = record(result.data);
-		const data = record(body?.data);
+		const body = record$1(result.data);
+		const data = record$1(body?.data);
 		if (body?.success !== true || !data || !Array.isArray(data.messages)) return null;
-		const messages = data.messages.filter((message) => Boolean(record(message)) && typeof message.id === "string" && ["inbound", "outbound"].includes(message.direction));
+		const messages = data.messages.filter((message) => Boolean(record$1(message)) && typeof message.id === "string" && ["inbound", "outbound"].includes(message.direction));
 		const count = data.newer_inbound_count;
 		const newerInboundCount = typeof count === "number" && Number.isSafeInteger(count) && count >= 0 ? count : void 0;
 		const newerInbound = newerInboundCount === void 0 ? void 0 : newerRows(data.newer_inbound);
@@ -49307,7 +50374,7 @@ const SERVER_RELATIONSHIPS = {
 };
 /** The `collaboration` object of an email read, when the server sends one. */
 function collaborationOf(detail) {
-	return record(record(detail)?.collaboration);
+	return record$1(record$1(detail)?.collaboration);
 }
 /**
 * The sender relationship the server computed for this email
@@ -49327,7 +50394,7 @@ function serverRelationship(detail) {
 * older server sends neither and nothing is muted by it.
 */
 function serverMuted(detail) {
-	return collaborationOf(detail)?.muted === true || record(detail)?.muted === true;
+	return collaborationOf(detail)?.muted === true || record$1(detail)?.muted === true;
 }
 /**
 * An address fit to print as trusted metadata, or `unavailable`. The
@@ -49463,7 +50530,7 @@ function savedConnectedProfiles(configDir, exclude) {
 */
 async function otherProfiles(configDir, session, current) {
 	if (session) try {
-		const { connectedProfilesForSession } = await import("./machine-session-BIOGBT9g.js").then((n) => n.s);
+		const { connectedProfilesForSession } = await import("./machine-session-3H-rNH8v.js").then((n) => n.s);
 		return {
 			inSession: true,
 			profiles: connectedProfilesForSession(configDir, session, current)
@@ -49537,6 +50604,56 @@ async function explainPendingMailNotFound(configDir, emailId, write = (line) =>
 		if (outcome.kind === "dropped") write(`Dropped the pending notice for ${id} from profile ${current.profile} after ${outcome.reads} consecutive not_found reads; the email is no longer visible to this profile.\n`);
 	} catch {}
 }
+const RULE_REQUEST_WEBHOOK_CREATE_HINT = "Hint: a webhook for rule request events is made by the person it is for, signed in as themself: after `primitive login`, run this without --api-key, PRIMITIVE_API_KEY or PRIMITIVE_AGENT_PROFILE set, or create it in the dashboard. An API key, another app or an agent cannot make one. If you are already signed in as yourself, try again. It is a route target whatever your access, so it never takes a domain's or the organization's default slot.";
+const RULE_REQUEST_WEBHOOK_HTTP_HINT = "Hint: rule request events go only to an http webhook (kind http).";
+const RULE_REQUEST_WEBHOOK_SUBSCRIBE_HINT = "Hint: rule request events go only to a webhook made for them. If this webhook does not list them yet, it cannot be given them: create a new one with `--event-types 'email_rule_request.*'`, signed in as yourself. If it does, only its maker, signed in as themself, can change it.";
+const RULE_REQUEST_WEBHOOK_KEY_HINT = "Hint: a webhook for rule request events is made by the person it is for, signed in as themself, and stays theirs: it cannot be given to an API key.";
+const RULE_REQUEST_WEBHOOK_CHANGE_HINT = "Hint: only the person who made a webhook for rule request events, signed in as themself (not with an API key, another app or an agent), can change it. It can be deleted as any other webhook can.";
+const RULE_REQUEST_WEBHOOK_DEFAULT_HINT = "Hint: a webhook for rule request events is always a route target. Leave out --no-is-route-target, --takeover and --no-takeover (is_route_target: false and takeover in a raw body).";
+const RULE_REQUEST_EVENT_PREFIX = "email_rule_request.";
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+/**
+* Whether a create or update body lists any rule request event. Matched by
+* prefix, as the API matches it, so a raw body's literal
+* `email_rule_request.*` counts too.
+*/
+function listsRuleRequestEvents(body) {
+	const types = record(record(body)?.rules)?.event_types;
+	return Array.isArray(types) && types.some((t) => typeof t === "string" && t.startsWith(RULE_REQUEST_EVENT_PREFIX));
+}
+function refusalReason(payload) {
+	const top = record(payload);
+	return record(top?.details)?.reason ?? record(record(top?.error)?.details)?.reason;
+}
+/**
+* The hint after a refused createEndpoint, or undefined when none applies.
+* The one refusal reason covers a webhook given to a key, one that is not an
+* http webhook, and one made by anyone but a person signed in as themself (or
+* whose membership could not be confirmed), told apart by what was sent.
+*/
+function createEndpointRuleRequestHint(code, body, payload) {
+	const asked = record(body);
+	if (refusalReason(payload) === "rule_request_events_need_own_webhook") {
+		if (asked && "owner_key_id" in asked) return RULE_REQUEST_WEBHOOK_KEY_HINT;
+		if (asked?.kind !== void 0 && asked.kind !== "http") return RULE_REQUEST_WEBHOOK_HTTP_HINT;
+		return RULE_REQUEST_WEBHOOK_CREATE_HINT;
+	}
+	if (code === "validation_error" && listsRuleRequestEvents(body) && (asked?.is_route_target === false || asked?.takeover !== void 0)) return RULE_REQUEST_WEBHOOK_DEFAULT_HINT;
+}
+/**
+* The hint after a refused updateEndpoint, or undefined when none applies.
+* The one refusal reason covers three changes, told apart by what was sent:
+* the events added to an existing webhook, the webhook given to a key, and
+* any other change by someone who is not its maker acting as themself.
+*/
+function updateEndpointRuleRequestHint(_code, body, payload) {
+	if (refusalReason(payload) !== "rule_request_events_need_own_webhook") return void 0;
+	const asked = record(body);
+	if (asked && "owner_key_id" in asked) return RULE_REQUEST_WEBHOOK_KEY_HINT;
+	return listsRuleRequestEvents(body) ? RULE_REQUEST_WEBHOOK_SUBSCRIBE_HINT : RULE_REQUEST_WEBHOOK_CHANGE_HINT;
+}
 // src/oclif/sent-list-labels.ts
 /**
 * `sent list` under a connected agent profile returns this address's own
@@ -50232,7 +51349,7 @@ function forbiddenHint(payload) {
 	if (!permission || record.reason !== "permission_missing") return null;
 	return `Hint: This operation needs ${permission}, which this credential does not have. Some operations stay closed to keys and the CLI even with it. Check a credential with \`primitive whoami --check ${permission}\`.`;
 }
-function writeErrorWithHints(payload, response) {
+function writeErrorWithHints(payload, response, options = {}) {
 	const formatted = formatErrorPayload(payload);
 	process.stderr.write(`${formatted}\n`);
 	for (const line of cliCommandLines(formatted)) process.stderr.write(`${line}\n`);
@@ -50241,7 +51358,7 @@ function writeErrorWithHints(payload, response) {
 		process.stderr.write(`${rateLimitHint(response)}\n`);
 		return;
 	}
-	if (!code) return;
+	if (!code || options.codeHint === false) return;
 	if (code === "grant_forbidden") {
 		process.stderr.write(`${grantForbiddenHint(payload)}\n`);
 		return;
@@ -50412,6 +51529,7 @@ function buildFlags(operation) {
 		description: ATTACHMENT_WAIT_FLAG_DESCRIPTION
 	});
 	const extension = OPERATION_EXTENSIONS[operation.sdkName];
+	if (extension?.confirm && !("yes" in extension.flags)) throw new Error(`${operation.sdkName}: a CLI extension that asks for confirmation must add --yes`);
 	for (const [name, flag] of Object.entries(extension?.flags ?? {})) {
 		if (flags[name] !== void 0) throw new Error(`${operation.sdkName}: --${name} is both a generated flag and a CLI extension flag`);
 		flags[name] = flag;
@@ -50485,6 +51603,7 @@ function domainVerificationFailedHint(payload) {
 	].join("\n");
 }
 const OPERATION_HINTS = {
+	deleteEmailRule: "Asks for confirmation first in a terminal. Pass --yes (-y) to delete without a prompt; without a terminal, or with --json, it is required.",
 	addDomain: "Tip: after this returns a domain id, run `primitive domains zone-file --id <domain-id> --output <domain>.zone` when the user wants an importable DNS zone file.",
 	verifyDomain: "Tip: if DNS is still missing, run `primitive domains zone-file --id <domain-id> --output <domain>.zone` to give the user an importable DNS zone file.",
 	downloadDomainZoneFile: "Tip: prefer `primitive domains zone-file --id <domain-id> --output <domain>.zone` for CLI-friendly file output.",
@@ -50500,7 +51619,7 @@ const OPERATION_HINTS = {
 	deleteMemory: "Tip: prefer `primitive memories delete <key> [--function <function-id>]` for the common delete path.",
 	searchMemories: "Tip: prefer `primitive memories search [prefix] [--metadata-only] [--function <function-id>]` for the common search path.",
 	startAgentSignup: "Tip: pass --terms-accepted. Capture the signup_token from the response and feed it to `primitive agent verify-agent-signup --signup-token <token> --verification-code <6-digit-code>` (the verify flag accepts --code as an alias). The high-level `primitive signup <email>` command walks an interactive user through both steps with friendlier prompts.",
-	testEmailRule: "Tip: --expect-match and --expect-no-match (or --expect-file) set expect, the emails the rule must match and must not. When no expect is sent, by these flags or in the body, a saved rule's saved expectations are judged instead. The exit code follows whichever expectations the answer judged: 1 when one failed; 1 when one is undecided and testing again will not decide it (its email cannot be found or read, cannot be classified, or cannot be tested: skipped); 3 when the only undecided ones can be decided later (not classified yet, or a question unanswered), so test again later. Exit 1 also means the request failed. With --json, error.code tells these apart: expectations_failed, expectations_unresolvable, expectations_undecided (exit 3), or the API's own code. Without --json a readable report follows the JSON on stderr: warnings, how each condition held, the expectations, and the values each email that did not match was compared on.",
+	testEmailRule: "Tip: --expect-match and --expect-no-match (or --expect-file) set expect, the emails the rule must match and must not. When no expect is sent, by these flags or in the body, a saved rule's saved expectations are judged instead. Either way, the answer reports the expectations it judged in expectations: passed, counts and per-email results. (create-email-rule and update-email-rule instead judge the rule's saved expectations on the version they save, in expectations_check: passed, decided, failed and undecided.) The exit code follows that report: 1 when one failed; 1 when one is undecided and testing again will not decide it (its email cannot be found or read, cannot be classified, or cannot be tested: skipped); 3 when the only undecided ones can be decided later (not classified yet, or a question unanswered), so test again later. Exit 1 also means the request failed. With --json, error.code tells these apart: expectations_failed, expectations_unresolvable, expectations_undecided (exit 3), or the API's own code. Without --json a readable report follows the JSON on stderr: warnings, how each condition held, the expectations, and the values each email that did not match was compared on.",
 	verifyAgentSignup: "Tip: pass --verification-code <code> (or --code; both work). The response carries OAuth tokens but not your assigned inbox domain; run `primitive domains list` (or `primitive whoami`) after success to see the managed *.primitive.email address that routes to this account."
 };
 const OPERATION_FLAG_ALIASES = { verifyAgentSignup: { verification_code: ["code"] } };
@@ -50515,6 +51634,9 @@ const OPERATION_EXTENSIONS = {
 const MAIL_RELAY_NOT_ENABLED_MESSAGE = "Mail relay is not enabled for this account, so the domain was not added. Retry without --mail-relay to point the domain's MX at Primitive directly, or ask Primitive to enable mail relay for your account.";
 const MAIL_RELAY_UNAVAILABLE_MESSAGE = "No mail relay is available on this API server right now, so the domain was not added. Retry later, or retry without --mail-relay to point the domain's MX at Primitive directly.";
 const OPERATION_ERROR_HINTS = {
+	inviteOrganizationMember: (code, body, payload) => inviteRefusalHint(code, body, payload),
+	createEndpoint: (code, body, payload) => createEndpointRuleRequestHint(code, body, payload),
+	updateEndpoint: (code, body, payload) => updateEndpointRuleRequestHint(code, body, payload),
 	updateEmailRule: (code, _body, payload, path) => code === "email_rule_conflict" ? versionMovedHint(payload, path?.id) : void 0,
 	verifyDomain: (code, _body, payload) => code === "dns_verification_failed" ? domainVerificationFailedHint(payload) : void 0,
 	addDomain: (code, body) => {
@@ -50523,6 +51645,7 @@ const OPERATION_ERROR_HINTS = {
 		if (code === "feature_disabled" && mailRelay) return MAIL_RELAY_NOT_ENABLED_MESSAGE;
 	}
 };
+const OPERATION_ERROR_HINTS_REPLACING_CODE_HINT = /* @__PURE__ */ new Set(["inviteOrganizationMember"]);
 const OPERATION_SUCCESS_HOOKS = { verifyAgentSignup: ({ envelope, configDir, apiBaseUrl, writeStderr }) => {
 	const data = envelope?.data;
 	if (!data?.access_token || !data?.refresh_token) return;
@@ -50566,6 +51689,16 @@ function createOperationCommand(operation) {
 				if (value === void 0 || value === "") throw new Errors.CLIError(`Missing the ${positionalFlag}: pass it as the first argument or with --${positionalFlag}.`, { exit: 2 });
 				parsedFlags[positionalFlag] = value;
 			}
+			const confirm = extension?.confirm;
+			if (confirm && parsedFlags.yes !== true) {
+				if (parsedFlags.json === true || !(process.stdin.isTTY && process.stderr.isTTY)) throw new Errors.CLIError(confirm.noTerminal, { exit: 2 });
+				const answer = await promptLine(confirm.question(parsedFlags));
+				if (!/^y(es)?$/i.test(answer.trim())) {
+					process.stderr.write(`${confirm.cancelled}\n`);
+					process.exitCode = 1;
+					return;
+				}
+			}
 			const headers = collectHeaderFlags(parsedFlags, headerFlagToName);
 			if ([
 				"startAgentSignup",
@@ -50693,6 +51826,11 @@ function createOperationCommand(operation) {
 						});
 					}
 				};
+				if (operation.sdkName === "setMemberRole") {
+					const role = body && typeof body === "object" ? body.role : void 0;
+					const warning = typeof role === "string" ? roleReadsAllMailWarning(role, await readRoles(apiClient.client)) : null;
+					if (warning) process.stderr.write(`${warning}\n`);
+				}
 				const result = paged ? await callPaged() : takesStepUp(operation) ? await callWithApproval() : ATTACHMENT_WAIT_OPERATIONS.has(operation.sdkName) ? await withAttachmentWait(callOperation, {
 					wait: parsedFlags.wait !== false,
 					errorCode: (error) => extractErrorCode(extractErrorPayload(error)),
@@ -50702,8 +51840,8 @@ function createOperationCommand(operation) {
 				}) : await callOperation();
 				if (result.error) {
 					const errorPayload = extractErrorPayload(result.error);
-					writeErrorWithHints(errorPayload, result.response);
 					const operationErrorHint = OPERATION_ERROR_HINTS[operation.sdkName]?.(extractErrorCode(errorPayload), body, errorPayload, collectValues(operation.pathParams, parsedFlags, operation.sdkName));
+					writeErrorWithHints(errorPayload, result.response, { codeHint: !(operationErrorHint && OPERATION_ERROR_HINTS_REPLACING_CODE_HINT.has(operation.sdkName)) });
 					if (operationErrorHint) process.stderr.write(`${operationErrorHint}\n`);
 					if (stepUpUrl) process.stderr.write(approveThenRerunHint(stepUpUrl));
 					if (replyStateSurface && isAwaitingRejectedError(errorPayload)) process.stderr.write(`${awaitingRejectedError(replyStateSurface).message}\n`);
@@ -50779,11 +51917,17 @@ function createOperationCommand(operation) {
 				if (cursor && !jsonOutput) process.stderr.write(`next cursor: ${cursor}\n`);
 				if (pagingNote && !jsonOutput) process.stderr.write(`${pagingNote}\n`);
 				const summary = [];
-				if (Array.isArray(envelope?.data) && envelope.data.length === 0) {
-					const hint = EMPTY_RESULT_HINTS[operation.sdkName];
-					if (hint && jsonOutput) {
-						if (withEnvelope) summary.push(hint);
-					} else if (hint) process.stderr.write(`${hint}\n`);
+				if (Array.isArray(envelope?.data) && envelope.data.length === 0 && (!jsonOutput || withEnvelope)) {
+					const tail = query.since !== void 0;
+					const more = envelope?.meta?.cursor ?? null;
+					const hint = operation.sdkName === "listEmails" ? emptyEmailListHint({
+						filterFlags: listFilters(query).map((name) => `--${parameterFlagName(operation.sdkName, name)}`),
+						...tail ? { pastFlag: "--since" } : query.cursor !== void 0 ? { pastFlag: "--cursor" } : {},
+						nextCursor: tail ? null : more,
+						caller: tail || more ? null : await readCallerMailFor(auth, apiClient.client)
+					}) : EMPTY_RESULT_HINTS[operation.sdkName];
+					if (hint && jsonOutput) summary.push(hint);
+					else if (hint) process.stderr.write(`${hint}\n`);
 				}
 				if (operation.sdkName === "listSentEmails") {
 					const note = sentListOtherSendersNote(envelope?.data, auth.connectedAgent?.agentAddress);
@@ -50854,7 +51998,6 @@ function createOperationCommand(operation) {
 const EMPTY_RESULT_HINTS = {
 	listDeliveries: "(no results) No webhook deliveries logged yet. If you have an endpoint configured but expected to see test fires here: test deliveries from `primitive endpoints test` are NOT logged in this list, they're synchronous and visible only in the test-endpoint command's response. Real deliveries are logged when an event fans out to your endpoints: an inbound `email.received`, or a `sent_email.*` event for an endpoint that lists it in rules.event_types (they arrive within a few minutes of the result). If you have no endpoints, run `primitive endpoints list` to check.",
 	listEndpoints: "(no results) No webhook endpoints configured. Add one with `primitive endpoints create --url <your-url>`.",
-	listEmails: "(no results) No inbound emails received yet on this account. Send one to a verified domain to populate this list. For a compact view, prefer `primitive emails latest`.",
 	listDomains: "(no results) No domains on this account. Add one with `primitive domains add --domain <yourdomain.example>`.",
 	listFilters: "(no results) No filter rules configured.",
 	listFunctions: "(no results) No Functions configured yet. Start with `primitive functions templates`, then `primitive functions init --template <template>` and `primitive functions deploy --name <name> --file <bundle>`."
@@ -50862,4 +52005,4 @@ const EMPTY_RESULT_HINTS = {
 function canonicalizeCliReferences(description) {
 	return description.replaceAll("`primitive emails:latest`", "`primitive emails latest`").replaceAll("`primitive describe emails:get-email | jq '.responseSchema.properties'`", "`primitive describe emails:get | jq '.responseSchema.properties'`");
 }
-export { replyExpectation as $, refuseOrgSelectionForProfile as $t, bareAddress$1 as A, connectNextSteps as At, wakeReadCommand as B, withFlagSuggestion as Bt, terminalApprovalIo as C, sendWaitClampNotice as Ct, listenForCopyHotkey as D, thrownErrorExitCode as Dt, formatBrowserLoginInstructions as E, successfulSendOutcome as Et, readThreadContext as F, currentMailSessionKey as Ft, clearReadPendingMail as G, ATTACHMENT_WAIT_FLAG_DESCRIPTION as Gt, wakeRelationship as H, classificationOf as Ht, sentInThread as I, detectAgentRuntime as It, recordPendingMail as J, ConnectedAgentKeyRequiredError as Jt, pendingMailPath as K, ATTACHMENT_WAIT_MAX_MS as Kt, serverMuted as L, detectRuntimeSession as Lt, displayAddress as M, generatedAgentName as Mt, formatMailWakeLine as N, identitySuggestions as Nt, openBrowser as O, DEFAULT_ENROLL_NAME as Ot, latestOwnOutbound as P, loadSkillLine as Pt, readEmailInteraction as Q, refreshStoredCliCredentials as Qt, serverRelationship as R, runtimeSessionVariableList as Rt, promptLine as S, sendOutcomeExitCode as St, canOfferCopyHotkey as T, serializeErrorPayload as Tt, claimPendingMail as U, isEmailId as Ut, wakeRecipientField as V, classificationFactLines as Vt, clearConsumedPendingMail as W, noFactsMessage as Wt, interactionHumanLine as X, createAuthenticatedCliApiClient as Xt, removePendingMail as Y, SAVED_CLI_OAUTH_SESSION_EXPIRED_MESSAGE as Yt, interactionNextActions as Z, createCliApiClient as Zt, writeErrorWithHints as _, formatSendFailureSummary as _t, createOperationCommand as a, revokeUserLogin as an, apiResultHttpStatus as at, STEP_UP_TOKEN_FLAG_DESCRIPTION as b, reportSendCommandResult as bt, formatErrorPayload as c, sanitizeForTerminal as cn, buildThrownSendFailureEnvelope as ct, isGrantRefusal as d, deriveSendIdempotencyKey as dt, resolveCliApiRequestConfig as en, replyInteractionWarning as et, parameterFlagName as f, excludeSignalReplies as ft, takesStepUp as g, formatPriorRepliesWarning as gt, surfaceUnauthorizedHint as h, formatPriorRepliesCheckSkipped as ht, TIME_FLAG_DESCRIPTION as i, fetchCliOrgs as in, SEND_OUTCOME_HELP as it, describeWake as j, defaultConnectionName as jt, explainPendingMailNotFound as k, cliInvocation as kt, hasControlCharacter as l, setKnownCommands as ln, checkPriorReplies as lt, runWithTiming as m, formatDeletedEarlierSendNotice as mt, API_ERROR_CODES as n, CliOrgRefusedError as nn, IDEMPOTENCY_KEY_FLAG_DESCRIPTION as nt, extractErrorCode as o, switchCurrentOrg as on, assertValidIdempotencyKey as ot, readTextFileFlag as p, followUpCommandPrefix as pt, readPendingMail as q, withAttachmentWait as qt, OPERATION_PATH_FLAGS as r, credentialsFromUserLogin as rn, MAX_SEND_WAIT_TIMEOUT_MS as rt, extractErrorPayload as s, routeWarningLines as sn, buildFollowUpCommand as st, API_BASE_URL_FLAG_DESCRIPTION as t, selectedOrgFromEnv as tn, wakeInteractionSentence as tt, headerFlagName as u, operationManifest as un, classifySendError as ut, BROWSER_FLAG_DESCRIPTION as v, formatSendRecordFailureSummary as vt, withApproval as w, sentHistoryWindowStart as wt, approveThenRerunHint as x, sendIdentityFields as xt, STEP_UP_HEADER as y, priorRepliesThatWentOut as yt, skillFirstLine as z, formatAlreadySentNotice as zt };
+export { replyExpectation as $, createCliApiClient as $t, bareAddress$1 as A, connectNextSteps as At, wakeReadCommand as B, withFlagSuggestion as Bt, terminalApprovalIo as C, sendWaitClampNotice as Ct, listenForCopyHotkey as D, thrownErrorExitCode as Dt, formatBrowserLoginInstructions as E, successfulSendOutcome as Et, readThreadContext as F, currentMailSessionKey as Ft, clearReadPendingMail as G, isEmailId as Gt, wakeRelationship as H, readCallerMailFor as Ht, sentInThread as I, detectAgentRuntime as It, recordPendingMail as J, ATTACHMENT_WAIT_MAX_MS as Jt, pendingMailPath as K, noFactsMessage as Kt, serverMuted as L, detectRuntimeSession as Lt, displayAddress as M, generatedAgentName as Mt, formatMailWakeLine as N, identitySuggestions as Nt, openBrowser as O, DEFAULT_ENROLL_NAME as Ot, latestOwnOutbound as P, loadSkillLine as Pt, readEmailInteraction as Q, createAuthenticatedCliApiClient as Qt, serverRelationship as R, runtimeSessionVariableList as Rt, promptLine as S, sendOutcomeExitCode as St, canOfferCopyHotkey as T, serializeErrorPayload as Tt, claimPendingMail as U, classificationFactLines as Ut, wakeRecipientField as V, emptyEmailListHint as Vt, clearConsumedPendingMail as W, classificationOf as Wt, interactionHumanLine as X, ConnectedAgentKeyRequiredError as Xt, removePendingMail as Y, withAttachmentWait as Yt, interactionNextActions as Z, SAVED_CLI_OAUTH_SESSION_EXPIRED_MESSAGE as Zt, writeErrorWithHints as _, formatSendFailureSummary as _t, createOperationCommand as a, RESTRICTED_ROLE_NOTE as an, apiResultHttpStatus as at, STEP_UP_TOKEN_FLAG_DESCRIPTION as b, reportSendCommandResult as bt, formatErrorPayload as c, isBuiltInRoleKey as cn, buildThrownSendFailureEnvelope as ct, isGrantRefusal as d, roleKeyText as dn, deriveSendIdempotencyKey as dt, refreshStoredCliCredentials as en, replyInteractionWarning as et, parameterFlagName as f, switchCurrentOrg as fn, excludeSignalReplies as ft, takesStepUp as g, operationManifest as gn, formatPriorRepliesWarning as gt, surfaceUnauthorizedHint as h, setKnownCommands as hn, formatPriorRepliesCheckSkipped as ht, TIME_FLAG_DESCRIPTION as i, CliOrgRefusedError as in, SEND_OUTCOME_HELP as it, describeWake as j, defaultConnectionName as jt, explainPendingMailNotFound as k, cliInvocation as kt, hasControlCharacter as l, revokeUserLogin as ln, checkPriorReplies as lt, runWithTiming as m, sanitizeForTerminal as mn, formatDeletedEarlierSendNotice as mt, API_ERROR_CODES as n, resolveCliApiRequestConfig as nn, IDEMPOTENCY_KEY_FLAG_DESCRIPTION as nt, extractErrorCode as o, credentialsFromUserLogin as on, assertValidIdempotencyKey as ot, readTextFileFlag as p, routeWarningLines as pn, followUpCommandPrefix as pt, readPendingMail as q, ATTACHMENT_WAIT_FLAG_DESCRIPTION as qt, OPERATION_PATH_FLAGS as r, selectedOrgFromEnv as rn, MAX_SEND_WAIT_TIMEOUT_MS as rt, extractErrorPayload as s, fetchCliOrgs as sn, buildFollowUpCommand as st, API_BASE_URL_FLAG_DESCRIPTION as t, refuseOrgSelectionForProfile as tn, wakeInteractionSentence as tt, headerFlagName as u, roleKeyLabel as un, classifySendError as ut, BROWSER_FLAG_DESCRIPTION as v, formatSendRecordFailureSummary as vt, withApproval as w, sentHistoryWindowStart as wt, approveThenRerunHint as x, sendIdentityFields as xt, STEP_UP_HEADER as y, priorRepliesThatWentOut as yt, skillFirstLine as z, formatAlreadySentNotice as zt };