primcli 3.0.0-preview.5 → 3.0.0-preview.6

package/dist/oclif/index.js

@@ -1,14 +1,14 @@
-import { $ as replyExpectation, $t as refuseOrgSelectionForProfile, A as bareAddress, At as connectNextSteps, B as wakeReadCommand, Bt as withFlagSuggestion, C as terminalApprovalIo, Ct as sendWaitClampNotice, D as listenForCopyHotkey, Dt as thrownErrorExitCode, E as formatBrowserLoginInstructions, Et as successfulSendOutcome, F as readThreadContext, Ft as currentMailSessionKey, G as clearReadPendingMail, Gt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, H as wakeRelationship, Ht as classificationOf, I as sentInThread, It as detectAgentRuntime, J as recordPendingMail, Jt as ConnectedAgentKeyRequiredError, K as pendingMailPath, Kt as ATTACHMENT_WAIT_MAX_MS, L as serverMuted, Lt as detectRuntimeSession, M as displayAddress, Mt as generatedAgentName, N as formatMailWakeLine, Nt as identitySuggestions, O as openBrowser, P as latestOwnOutbound, Pt as loadSkillLine, Q as readEmailInteraction, Qt as refreshStoredCliCredentials, R as serverRelationship, Rt as runtimeSessionVariableList, S as promptLine$2, St as sendOutcomeExitCode, T as canOfferCopyHotkey, Tt as serializeErrorPayload, U as claimPendingMail, Ut as isEmailId, V as wakeRecipientField, Vt as classificationFactLines, W as clearConsumedPendingMail, Wt as noFactsMessage, X as interactionHumanLine, Xt as createAuthenticatedCliApiClient, Y as removePendingMail, Z as interactionNextActions, Zt as createCliApiClient, _ as writeErrorWithHints, _t as formatSendFailureSummary, a as createOperationCommand, an as revokeUserLogin, at as apiResultHttpStatus, b as STEP_UP_TOKEN_FLAG_DESCRIPTION, bt as reportSendCommandResult, c as formatErrorPayload, cn as sanitizeForTerminal, ct as buildThrownSendFailureEnvelope, d as isGrantRefusal, dt as deriveSendIdempotencyKey, en as resolveCliApiRequestConfig, et as replyInteractionWarning, f as parameterFlagName, ft as excludeSignalReplies, g as takesStepUp, gt as formatPriorRepliesWarning, h as surfaceUnauthorizedHint, ht as formatPriorRepliesCheckSkipped, i as TIME_FLAG_DESCRIPTION, in as fetchCliOrgs, it as SEND_OUTCOME_HELP, j as describeWake, k as explainPendingMailNotFound, kt as cliInvocation, l as hasControlCharacter$1, ln as setKnownCommands, lt as checkPriorReplies, m as runWithTiming, mt as formatDeletedEarlierSendNotice, n as API_ERROR_CODES, nn as CliOrgRefusedError, nt as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, o as extractErrorCode, on as switchCurrentOrg, ot as assertValidIdempotencyKey, p as readTextFileFlag, pt as followUpCommandPrefix, q as readPendingMail, qt as withAttachmentWait, r as OPERATION_PATH_FLAGS, rn as credentialsFromUserLogin, rt as MAX_SEND_WAIT_TIMEOUT_MS, s as extractErrorPayload, sn as routeWarningLines, st as buildFollowUpCommand, t as API_BASE_URL_FLAG_DESCRIPTION, tn as selectedOrgFromEnv, u as headerFlagName, un as operationManifest, ut as classifySendError, v as BROWSER_FLAG_DESCRIPTION, vt as formatSendRecordFailureSummary, w as withApproval, wt as sentHistoryWindowStart, x as approveThenRerunHint, xt as sendIdentityFields, y as STEP_UP_HEADER$1, yt as priorRepliesThatWentOut, zt as formatAlreadySentNotice } from "../api-command-DIo8Rg0w.js";
-import { $ as AUTOMATED_VALUES, $n as stopRepeatFromEmail, $t as getWakeSchedule, A as sinceFromFlags, At as downloadSentAttachmentArchiveMember, B as formatRepliesCell, Bn as runWakeSchedule, Bt as getFunction, C as SINCE_VALUE_HELP, Cn as listSentAttachmentArchiveMembers, Ct as deleteMemory, D as fetchEmailSearchPage, Dn as listWakeSchedules, Dt as downloadEmailAttachmentArchiveMember, E as encodeReceivedAtSearchCursor, En as listWakeDispatches, Et as deleteWakeSchedule, F as ReplyStateUnsupportedError, Fn as reorderRoutes, Gn as sendEmail, Gt as getMemory, H as isAwaitingRejectedError, Hn as searchEmails, Ht as getFunctionTestRunTrace, I as assertAwaitingFilterRows, In as replyToEmail, It as getConversation, Jn as setMemory, Jt as getOwnGrant, Kn as setFunctionRoute, Kt as getOrgRoutingTopology, L as awaitingRejectedError, Ln as resendAgentSignupVerification, Lt as getCreditBalance, M as AWAITING_FLAG_DESCRIPTION, Mt as getAccessMode, N as AWAITING_VALUES, Nn as redeemCreditCode, Nt as getAccount, O as filtersFromFlags, On as pollCliLogin, Ot as downloadEmailAttachmentByFilename, P as REPLY_STATE_UNSUPPORTED_CODE, Pn as removeDefaultNetworkMember, Pt as getAgentContactPolicy, Q as AUTOMATED_FLAG_DESCRIPTION, Qn as startCliLogin, Qt as getThread, R as ensureSearchReportsReplyState, Rn as revokeCredential, Rt as getDefaultNetworkAgent, S as transientFailure, Sn as listRoutes, T as cursorFromAcceptedRows, Tn as listWakeAuthorizations, Tt as deleteWakeAuthorization, U as queryUsesAwaiting, Un as searchMemories, Ut as getInboxStatus, V as hasReplyState, Vt as getFunctionRouting, Wn as semanticSearch, Wt as getKey, X as parseFromHeader, Xn as startAgentClaim, Xt as getSendFrom, Y as parseWebhookEvent, Yn as simulateRoute, Yt as getRepeatingSend, Z as AUTOMATED_FILTER_UNSUPPORTED_CODE, Zn as startAgentSignup, Zt as getSentEmail, _ as describeApiFailure, _n as listKeys, _t as createKey, a as REPEAT_IDLE_MAX_MINUTES, an as listAgentNetworks, ar as updateRepeatingSend, b as retryTransient, bn as listRepeatingSends, bt as createWakeSchedule, cn as listDefaultNetworkMembers, cr as updateWakeSchedule, ct as addDefaultNetworkMember, d as parseRepeatTick, dn as listEmailRuleResults, dr as whoami, dt as checkDefaultNetworkContactAdmission, er as testFunction, et as AutomatedFilterUnsupportedError, f as preparePresenceAliveEmail, fn as listEmails, ft as checkSendability, g as WaitDeadlineReached, gn as listGroups, gt as createFunction, hn as listFunctions, ht as createEndpoint, i as REPEAT_EVERY_MAX_MINUTES, in as listAgentContacts, ir as updateKey, j as sleep$3, jt as downloadSentAttachmentByFilename, k as quoteDslValue, kn as pullWebhookEvent, l as parseInteractionEnvelope, ln as listDomains, lr as verifyAgentClaim, lt as cancelSentEmail, m as repeatStopCommand, mn as listFunctionLogs, mt as completeWebhookEvent, nn as listActivityObjects, nr as updateDefaultNetworkMember, nt as automatedRejectedError, o as REPEAT_MAX_SENDS_MAX, or as updateRoute, ot as hasAutomatedVerdict, p as prepareSignalEmail, pn as listEndpoints, pt as cliLogout, q as isEmailReceivedEvent, qn as setFunctionSecret, qt as getOutboundStatus, rr as updateFunction, s as buildRepeatStopBody, sn as listDefaultNetworkAgents, sr as updateWakeAuthorization, st as isAutomatedRejectedError, tn as leaveOrganization, tr as unsetFunctionRoute, tt as assertAutomatedVerdict, u as parsePresenceEnvelope, un as listEmailAttachmentArchiveMembers, ur as verifyAgentSignup, ut as cancelSentEmailByIdempotencyKey, vn as listMailboxAccess, vt as createRoute, w as collectNewAcceptedEmails, wn as listSentEmails, wt as deleteRoute, x as retryingOperation, xn as listRoles, y as pauseForTransientFailure, yn as listOrganizationPeople, yt as createWakeAuthorization, z as formatAwaitingCell, zn as rotateKey, zt as getEmail } from "../repeats-Dj_o6c-X-Ix28GRRc.js";
-import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-o9hEtJ_c.js";
+import { $ as replyExpectation, $t as createCliApiClient, A as bareAddress, At as connectNextSteps, B as wakeReadCommand, Bt as withFlagSuggestion, C as terminalApprovalIo, Ct as sendWaitClampNotice, D as listenForCopyHotkey, Dt as thrownErrorExitCode, E as formatBrowserLoginInstructions, Et as successfulSendOutcome, F as readThreadContext, Ft as currentMailSessionKey, G as clearReadPendingMail, Gt as isEmailId, H as wakeRelationship, Ht as readCallerMailFor, I as sentInThread, It as detectAgentRuntime, J as recordPendingMail, Jt as ATTACHMENT_WAIT_MAX_MS, K as pendingMailPath, Kt as noFactsMessage, L as serverMuted, Lt as detectRuntimeSession, M as displayAddress, Mt as generatedAgentName, N as formatMailWakeLine, Nt as identitySuggestions, O as openBrowser, P as latestOwnOutbound, Pt as loadSkillLine, Q as readEmailInteraction, Qt as createAuthenticatedCliApiClient, R as serverRelationship, Rt as runtimeSessionVariableList, S as promptLine$2, St as sendOutcomeExitCode, T as canOfferCopyHotkey, Tt as serializeErrorPayload, U as claimPendingMail, Ut as classificationFactLines, V as wakeRecipientField, Vt as emptyEmailListHint, W as clearConsumedPendingMail, Wt as classificationOf, X as interactionHumanLine, Xt as ConnectedAgentKeyRequiredError, Y as removePendingMail, Yt as withAttachmentWait, Z as interactionNextActions, _ as writeErrorWithHints, _t as formatSendFailureSummary, a as createOperationCommand, an as RESTRICTED_ROLE_NOTE, at as apiResultHttpStatus, b as STEP_UP_TOKEN_FLAG_DESCRIPTION, bt as reportSendCommandResult, c as formatErrorPayload, cn as isBuiltInRoleKey, ct as buildThrownSendFailureEnvelope, d as isGrantRefusal, dn as roleKeyText, dt as deriveSendIdempotencyKey, en as refreshStoredCliCredentials, et as replyInteractionWarning, f as parameterFlagName, fn as switchCurrentOrg, ft as excludeSignalReplies, g as takesStepUp, gn as operationManifest, gt as formatPriorRepliesWarning, h as surfaceUnauthorizedHint, hn as setKnownCommands, ht as formatPriorRepliesCheckSkipped, i as TIME_FLAG_DESCRIPTION, in as CliOrgRefusedError, it as SEND_OUTCOME_HELP, j as describeWake, k as explainPendingMailNotFound, kt as cliInvocation, l as hasControlCharacter$1, ln as revokeUserLogin, lt as checkPriorReplies, m as runWithTiming, mn as sanitizeForTerminal, mt as formatDeletedEarlierSendNotice, n as API_ERROR_CODES, nn as resolveCliApiRequestConfig, nt as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, o as extractErrorCode, on as credentialsFromUserLogin, ot as assertValidIdempotencyKey, p as readTextFileFlag, pn as routeWarningLines, pt as followUpCommandPrefix, q as readPendingMail, qt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, r as OPERATION_PATH_FLAGS, rn as selectedOrgFromEnv, rt as MAX_SEND_WAIT_TIMEOUT_MS, s as extractErrorPayload, sn as fetchCliOrgs, st as buildFollowUpCommand, t as API_BASE_URL_FLAG_DESCRIPTION, tn as refuseOrgSelectionForProfile, u as headerFlagName, un as roleKeyLabel, ut as classifySendError, v as BROWSER_FLAG_DESCRIPTION, vt as formatSendRecordFailureSummary, w as withApproval, wt as sentHistoryWindowStart, x as approveThenRerunHint, xt as sendIdentityFields, y as STEP_UP_HEADER$1, yt as priorRepliesThatWentOut, zt as formatAlreadySentNotice } from "../api-command-CRjIK1QL.js";
+import { $ as parseFromHeader, $n as startAgentClaim, $t as getSendFrom, A as lateMailReread, An as listWakeSchedules, At as downloadEmailAttachmentArchiveMember, B as ensureSearchReportsReplyState, Bn as resendAgentSignupVerification, Bt as getCreditBalance, C as waitOutRetryAfter, Cn as listRepeatingSends, Ct as createWakeSchedule, D as encodeReceivedAtSearchCursor, Dn as listSentEmails, Dt as deleteRoute, E as cursorFromAcceptedRows, En as listSentAttachmentArchiveMembers, Et as deleteMemory, F as AWAITING_VALUES, Ft as getAccessMode, G as queryUsesAwaiting, Gn as searchEmails, Gt as getFunctionTestRunTrace, H as formatRepliesCell, Hn as rotateKey, Ht as getEmail, I as REPLY_STATE_UNSUPPORTED_CODE, In as redeemCreditCode, It as getAccount, Jn as sendEmail, Jt as getMemory, Kn as searchMemories, Kt as getInboxStatus, L as ReplyStateUnsupportedError, Ln as removeDefaultNetworkMember, Lt as getAgentContactPolicy, M as sinceFromFlags, Mn as pullWebhookEvent, N as sleep$3, Nt as downloadSentAttachmentArchiveMember, O as fetchEmailSearchPage, On as listWakeAuthorizations, Ot as deleteWakeAuthorization, P as AWAITING_FLAG_DESCRIPTION, Pt as downloadSentAttachmentByFilename, Q as parseWebhookEvent, Qn as simulateRoute, Qt as getRepeatingSend, R as assertAwaitingFilterRows, Rn as reorderRoutes, S as transientFailure, Sn as listOrganizationPeople, St as createWakeAuthorization, T as collectNewAcceptedEmails, Tn as listRoutes, U as hasReplyState, Un as runWakeSchedule, Ut as getFunction, V as formatAwaitingCell, Vn as revokeCredential, Vt as getDefaultNetworkAgent, W as isAwaitingRejectedError, Wt as getFunctionRouting, X as isEmailReceivedEvent, Xn as setFunctionSecret, Xt as getOutboundStatus, Yn as setFunctionRoute, Yt as getOrgRoutingTopology, Zn as setMemory, Zt as getOwnGrant, _ as describeApiFailure, _n as listFunctionLogs, _t as completeWebhookEvent, a as REPEAT_IDLE_MAX_MINUTES, an as listActivityObjects, ar as updateDefaultNetworkMember, at as automatedRejectedError, b as retryTransient, bn as listKeys, bt as createKey, cn as listAgentNetworks, cr as updateRepeatingSend, d as parseRepeatTick, dn as listDefaultNetworkMembers, dr as updateWakeSchedule, dt as addDefaultNetworkMember, en as getSentEmail, er as startAgentSignup, et as AUTOMATED_FILTER_UNSUPPORTED_CODE, f as preparePresenceAliveEmail, fn as listDomains, fr as verifyAgentClaim, ft as cancelSentEmail, g as WaitDeadlineReached, gn as listEndpoints, gt as cliLogout, hn as listEmails, ht as checkSendability, i as REPEAT_EVERY_MAX_MINUTES, in as leaveOrganization, ir as unsetFunctionRoute, it as assertAutomatedVerdict, j as quoteDslValue, jn as pollCliLogin, jt as downloadEmailAttachmentByFilename, k as filtersFromFlags, kn as listWakeDispatches, kt as deleteWakeSchedule, l as parseInteractionEnvelope, lr as updateRoute, lt as hasAutomatedVerdict, m as repeatStopCommand, mn as listEmailRuleResults, mr as whoami, mt as checkDefaultNetworkContactAdmission, nn as getWakeSchedule, nr as stopRepeatFromEmail, nt as AUTOMATED_VALUES, o as REPEAT_MAX_SENDS_MAX, or as updateFunction, p as prepareSignalEmail, pn as listEmailAttachmentArchiveMembers, pr as verifyAgentSignup, pt as cancelSentEmailByIdempotencyKey, qn as semanticSearch, qt as getKey, rr as testFunction, rt as AutomatedFilterUnsupportedError, s as buildRepeatStopBody, sn as listAgentContacts, sr as updateKey, tn as getThread, tr as startCliLogin, tt as AUTOMATED_FLAG_DESCRIPTION, u as parsePresenceEnvelope, un as listDefaultNetworkAgents, ur as updateWakeAuthorization, ut as isAutomatedRejectedError, vn as listFunctions, vt as createEndpoint, w as SINCE_VALUE_HELP, wn as listRoles, x as retryingOperation, xn as listMailboxAccess, xt as createRoute, y as pauseForTransientFailure, yn as listGroups, yt as createFunction, z as awaitingRejectedError, zn as replyToEmail, zt as getConversation } from "../repeats-Dj_o6c-X-CP0h4alF.js";
+import { S as readBundledConnectSkill, _ as NotificationOutcomeUnknownError, a as NotificationRetryError, b as installedConnectSkillFile, c as readConversationStatusContent, d as SESSION_UUID$1, g as NativeSessionNotLoadedError, h as NativeSessionError, i as notificationReceiptPage, l as createListenHandler, m as NativeSessionDisconnectedError, n as notificationSenders, o as isRoutineNotificationContent, p as defaultSessionSocket, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, u as readableDelivery, v as connectSkillTarget, x as installedVersion, y as installConnectSkill } from "../notify-session-DTyg-sfS.js";
 import { A as AGENT_ADDRESS_ENV, C as saveCliCredentials, D as loadActiveChatState, E as deleteChatState, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadChatConversationByLocalId, P as agentProfileName, R as loadConnectedAgentProfile, S as resolveCliAuth, T as chatStatePath, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as loadCliCredentials, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as saveActiveChatState, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveSignupCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-Ms_0vNjq.js";
 import { C as resolveListenSubscription, S as normalizeListenOrigin, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, y as listenIdentity } from "../shared-mail-files-BAQSGxxz.js";
-import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-BIOGBT9g.js";
-import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-DcymzGgB.js";
+import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-3H-rNH8v.js";
+import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-CvqdlWuX.js";
 import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, readWorkingLease, restoreAutoWorking } from "./auto-signals.js";
-import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-CRGoKO4A.js";
+import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-CPxRPbHK.js";
+import { a as backgroundListenStatus, c as runBackgroundListen, d as stopBackgroundListen, f as verifyBackgroundListenTarget, o as backgroundListenToken, r as backgroundListenConfiguration, u as startBackgroundListen } from "../listen-background-DyBYca28.js";
 import { i as runStreamingJson, n as guardJsonOutputCommands, r as jsonOutputRequested, t as JSON_OUTPUT_FLAG } from "../json-output-DWrJMakZ.js";
-import { c as startBackgroundListen, i as backgroundListenToken, l as stopBackgroundListen, o as runBackgroundListen, r as backgroundListenStatus, u as verifyBackgroundListenTarget } from "../listen-background-C0F9gNDD.js";
 import { ORG_SELECTION_ENV } from "./global-org-flag.js";
 import { n as createConfig, t as createClient } from "../client.gen-6rZvmHfx.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
@@ -2768,7 +2768,7 @@ const openapiDocument = {
 						"format": "email",
 						"maxLength": 320
 					},
-					"description": "Exact case-insensitive delivered recipient mailbox, applied before pagination. Combines with existing filters and cursors; does not search message text."
+					"description": "Exact case-insensitive delivered recipient mailbox, applied before pagination. Combines with existing filters and cursors; does not search message text. It filters only the mail the caller can read, and is never refused for that (200): a mailbox outside the caller's mail access lists nothing, and one the caller reads only in part (for example through an email rule) lists only that part. For a caller limited to some mailboxes, meta.recipient_outside_access or meta.recipient_rules_only says so when the mailbox is neither one of its addresses nor on one of its domains."
 				},
 				{
 					"name": "exclude_fyi",
@@ -2903,12 +2903,16 @@ const openapiDocument = {
 			"responses": {
 				"200": {
 					"description": "Paginated list of emails",
-					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/ListEnvelope" }, {
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
 						"type": "object",
-						"properties": { "data": {
-							"type": "array",
-							"items": { "$ref": "#/components/schemas/EmailSummary" }
-						} }
+						"properties": {
+							"data": {
+								"type": "array",
+								"items": { "$ref": "#/components/schemas/EmailSummary" }
+							},
+							"meta": { "$ref": "#/components/schemas/EmailListMeta" }
+						},
+						"required": ["data", "meta"]
 					}] } } },
 					"headers": {
 						"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
@@ -4762,7 +4766,7 @@ const openapiDocument = {
 			"post": {
 				"operationId": "createEndpoint",
 				"summary": "Create a webhook endpoint",
-				"description": "Creates a new webhook endpoint. If a deactivated endpoint\nwith the same URL and domain exists, it is reactivated\ninstead. Subject to plan limits on the number of active\nendpoints.\n\n**Signing.** A webhook is signed with the organization's webhook secret (`GET /account/webhook-secret`) unless it has its own. A webhook made as a person's own, or by an API key limited to some mailboxes, a third-party app or an agent delegate for itself, is made with its own secret: the response carries it once as `signing_secret`, and `GET /endpoints/{id}/signing-secret` returns it afterwards. Other webhooks, those a person who can read every mailbox makes among them, sign with the organization's secret until given their own. `signed_with` on the endpoint says which secret signs it. See the API-level \"Webhook\nsigning\" section for the full wire format (header name,\nsigned string, hash algo, secret format, tolerance) and a\nlanguage-agnostic verification recipe.\n\nAfter creating the endpoint, fire a test delivery against\nit via `POST /endpoints/{id}/test` to confirm your verifier\naccepts the signature.\n\n\nFor local receiving, use kind=pull and a stable name, without url, function_id or domain_id. Named creation resumes the same active destination; omitted filters preserve its selection, while conflicting supplied configuration returns 409. New unfiltered destinations receive all subsequently ready eligible event types within their credential scope. Connected-agent credentials automatically create private subscriptions restricted to inbound email for their assigned address. Names are isolated per credential; revocation or replacement deletes its subscriptions. Address-scoped events contain parsed mail without raw MIME, signed download links, routing metadata, or sibling envelope recipients. Pull destinations do not occupy HTTP routing slots. Signing-secret setup and a test HTTP delivery are not required for pull receiving.\n\nFor local receiving, use kind=pull and a stable name, without url, function_id or domain_id. Named creation resumes the same active destination; omitted filters preserve its selection, while conflicting supplied configuration returns 409. Creating a pull destination requires a connected-agent credential; it creates a private subscription restricted to inbound email for the assigned address of that credential. Account API keys receive 403 pull_subscription_requires_agent_connection and can instead receive mail with GET /emails?since=<cursor>&wait=30 or an HTTP endpoint. Pulling or completing an account destination created earlier returns the same 403. Names are isolated per credential; revocation or replacement deletes its subscriptions. Address-scoped events contain parsed mail without raw MIME, signed download links, routing metadata, or sibling envelope recipients. Pull destinations do not occupy HTTP routing slots. Signing-secret setup and a test HTTP delivery are not required for pull receiving.\n\nAgent connection keys (pconn_) may use endpoints.pull:manage instead of endpoints:manage here, for their own pull subscriptions only.",
+				"description": "Creates a new webhook endpoint. A URL can have one endpoint per domain, route targets included (unlike the one default destination per domain), and endpoints with no domain_id count as one domain. A disabled endpoint still holds its URL; a deleted one does not. A create at a URL another endpoint has on the same domain is refused (400). A deleted endpoint's URL can be used again: the create makes a new endpoint, with a new id, and the deleted one stays as it was. Subject to plan limits on the number of active\nendpoints.\n\n**Signing.** A webhook is signed with the organization's webhook secret (`GET /account/webhook-secret`) unless it has its own. A webhook made as a person's own, or by an API key limited to some mailboxes, a third-party app or an agent delegate for itself, is made with its own secret: the response carries it once as `signing_secret`, and `GET /endpoints/{id}/signing-secret` returns it afterwards. Other webhooks, those a person who can read every mailbox makes among them, sign with the organization's secret until given their own. `signed_with` on the endpoint says which secret signs it. See the API-level \"Webhook\nsigning\" section for the full wire format (header name,\nsigned string, hash algo, secret format, tolerance) and a\nlanguage-agnostic verification recipe.\n\nAfter creating the endpoint, fire a test delivery against\nit via `POST /endpoints/{id}/test` to confirm your verifier\naccepts the signature.\n\n\nFor local receiving, use kind=pull and a stable name, without url, function_id or domain_id. Named creation resumes the same active destination; omitted filters preserve its selection, while conflicting supplied configuration returns 409. New unfiltered destinations receive all subsequently ready eligible event types within their credential scope. Connected-agent credentials automatically create private subscriptions restricted to inbound email for their assigned address. Names are isolated per credential; revocation or replacement deletes its subscriptions. Address-scoped events contain parsed mail without raw MIME, signed download links, routing metadata, or sibling envelope recipients. Pull destinations do not occupy HTTP routing slots. Signing-secret setup and a test HTTP delivery are not required for pull receiving.\n\nFor local receiving, use kind=pull and a stable name, without url, function_id or domain_id. Named creation resumes the same active destination; omitted filters preserve its selection, while conflicting supplied configuration returns 409. Creating a pull destination requires a connected-agent credential; it creates a private subscription restricted to inbound email for the assigned address of that credential. Account API keys receive 403 pull_subscription_requires_agent_connection and can instead receive mail with GET /emails?since=<cursor>&wait=30 or an HTTP endpoint. Pulling or completing an account destination created earlier returns the same 403. Names are isolated per credential; revocation or replacement deletes its subscriptions. Address-scoped events contain parsed mail without raw MIME, signed download links, routing metadata, or sibling envelope recipients. Pull destinations do not occupy HTTP routing slots. Signing-secret setup and a test HTTP delivery are not required for pull receiving.\n\nAgent connection keys (pconn_) may use endpoints.pull:manage instead of endpoints:manage here, for their own pull subscriptions only.",
 				"tags": ["Endpoints"],
 				"requestBody": {
 					"required": true,
@@ -4890,7 +4894,7 @@ const openapiDocument = {
 			"patch": {
 				"operationId": "updateEndpoint",
 				"summary": "Update a webhook endpoint",
-				"description": "Updates an active webhook endpoint. Changing the URL keeps the endpoint: its id, recipient routes, signing secret, delivery history and any deliveries still owed to it stay with it, and owed deliveries go to the new URL. Another active endpoint at the new URL is refused.\n\n\nPull destinations cannot be assigned a URL, function or recipient-routing domain. Existing endpoint deletion disconnects the destination; creating a new destination does not backfill historical events.",
+				"description": "Updates an active webhook endpoint. Changing the URL keeps the endpoint: its id, recipient routes, signing secret, delivery history and any deliveries still owed to it stay with it, and owed deliveries go to the new URL. A URL can have one endpoint per domain, route targets included (unlike the one default destination per domain), and endpoints with no domain_id count as one domain. A disabled endpoint still holds its URL; a deleted one does not. A change onto a URL another endpoint has on the same domain is refused (400), and a move onto a domain where another endpoint has this URL is refused (409).\n\n\nPull destinations cannot be assigned a URL, function or recipient-routing domain. Existing endpoint deletion disconnects the destination; creating a new destination does not backfill historical events.\n\nGiving a webhook the organization does not own to a different key (owner_key_id), or a key's webhook back to the organization (owner_key_id null), turns it off unless the request also sets enabled: its URL was chosen under its previous owner. It then reads enabled false with disabled_reason owner_changed, and turning it on or giving it a new URL starts it again. A key that carries on for the owning key through rotation (its successor, at any depth up to 16 rotations) is not a different key: the webhook stays as it was, with the same signing secret. That does not hold when the owning key was made from a key a transfer moved or rotated away, or from one that has since been deleted: no successor carries on for it. The answer's warnings name each such change (turned_off_owner_changed, turned_on_new_url), so a client can say so.",
 				"tags": ["Endpoints"],
 				"requestBody": {
 					"required": true,
@@ -4901,7 +4905,7 @@ const openapiDocument = {
 						"description": "Updated endpoint",
 						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
 							"type": "object",
-							"properties": { "data": { "$ref": "#/components/schemas/Endpoint" } }
+							"properties": { "data": { "$ref": "#/components/schemas/UpdatedEndpoint" } }
 						}] } } },
 						"headers": {
 							"ratelimit-limit": { "$ref": "#/components/headers/ratelimit-limit" },
@@ -5086,7 +5090,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "getEndpoint",
 				"summary": "Get an endpoint",
-				"description": "One endpoint, as GET /endpoints shows it, to a caller who would see it there. Any other id, a deleted endpoint's included, answers 404.",
+				"description": "One endpoint, as GET /endpoints shows it, to a caller who would see it there. Any other id, a deleted endpoint's included, answers 404. For a webhook, delivery says whether it is being sent received mail at all, why not, and how much rule-granted mail is held while its owner cannot act.",
 				"tags": ["Endpoints"],
 				"responses": {
 					"200": {
@@ -5499,7 +5503,7 @@ const openapiDocument = {
 			"post": {
 				"operationId": "testEndpoint",
 				"summary": "Send a test webhook",
-				"description": "Sends a sample `email.received` event to the endpoint. The request\nincludes SSRF protection (private IP rejection and DNS pinning).\nRate limited to 4 per minute and 30 per hour (non-exempt).\nSuccessful deliveries and verified-domain endpoints are exempt\nfrom the rate limit.\n",
+				"description": "Sends a sample `email.received` event to the endpoint. The request\nincludes SSRF protection (private IP rejection and DNS pinning).\nRate limited to 4 per minute and 30 per hour (non-exempt).\nSuccessful deliveries and verified-domain endpoints are exempt\nfrom the rate limit.\n\n\nThe test is sent whether or not real mail would be. reachable says whether the endpoint answered it with a 2xx; delivery says, apart from that, whether real email.received events would be sent to the endpoint by its own conditions (on, not held, an owner that can receive mail, subscribed to the event), with every reason it would not be. A 200 from the test alone does not mean mail arrives.",
 				"tags": ["Endpoints"],
 				"responses": {
 					"200": {
@@ -5613,7 +5617,7 @@ const openapiDocument = {
 			"post": {
 				"operationId": "testEndpointRules",
 				"summary": "Dry-run endpoint rules against a received email",
-				"description": "Evaluates the endpoint's filtering rules against an\nalready-received email WITHOUT delivering anything. The same\nshared matcher the live delivery paths use produces the\nverdict, so the response explains exactly why a webhook fired\nor was suppressed for that message.\n\nWhen delivery would be suppressed, `rule` names the failing\nrule and `reason` carries a human-readable explanation; both\nare null when the message matches. `evaluated` echoes the\nmessage metadata the matcher compared (size, attachments, and\nthe authenticated From identity versus the raw envelope\nsender), so a surprising verdict can be traced to its inputs.\n\nTwo independent gates are surfaced separately:\n`subscribed_to_event` reports the endpoint's event-type\nsubscription (checked before message matching), and\n`rules_valid` reports whether the stored rules blob parsed at\nall. Delivery fails OPEN on an invalid blob (the message is\ndelivered as if unfiltered), so `rules_valid: false` exposes a\nmisconfiguration that is otherwise silent.\n",
+				"description": "Evaluates the endpoint's filtering rules against an\nalready-received email WITHOUT delivering anything. The same\nshared matcher the live delivery paths use produces the\nverdict, so the response explains exactly why a webhook fired\nor was suppressed for that message.\n\nWhen delivery would be suppressed, `rule` names the failing\nrule and `reason` carries a human-readable explanation; both\nare null when the message matches. `evaluated` echoes the\nmessage metadata the matcher compared (size, attachments, and\nthe authenticated From identity versus the raw envelope\nsender), so a surprising verdict can be traced to its inputs.\n\nTwo independent gates are surfaced separately:\n`subscribed_to_event` reports the endpoint's event-type\nsubscription (checked before message matching), and\n`rules_valid` reports whether the stored rules blob parsed at\nall. Delivery fails OPEN on an invalid blob (the message is\ndelivered as if unfiltered), so `rules_valid: false` exposes a\nmisconfiguration that is otherwise silent.\n\n\nwould_deliver also covers the endpoint's own delivery conditions for this email (delivery): it is on, neither it nor the email's route is held, its owner may receive this email, and it subscribes to the event. Which endpoint routing sends the email to is decided separately: POST /routes/simulate answers that. A 503 means those conditions could not be read just now; retry.",
 				"tags": ["Endpoints"],
 				"requestBody": {
 					"required": true,
@@ -5677,6 +5681,19 @@ const openapiDocument = {
 								}
 							}
 						} }
+					},
+					"503": {
+						"description": "Primitive is temporarily unable to process the request",
+						"content": { "application/json": {
+							"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+							"example": {
+								"success": false,
+								"error": {
+									"code": "outbound_capacity_exhausted",
+									"message": "Outbound capacity is temporarily exhausted"
+								}
+							}
+						} }
 					}
 				},
 				"security": [{ "BearerAuth": [] }],
@@ -16229,7 +16246,7 @@ const openapiDocument = {
 			"tags": ["Account"],
 			"security": [{ "BearerAuth": [] }],
 			"summary": "Get current caller identity",
-			"description": "Current authenticated identity. member_address is null for machine credentials or an unavailable member address.",
+			"description": "Current authenticated identity. member_address is null for machine credentials or an unavailable member address. email (your own sign-in email) and role_name (your role as the members list labels it) are set only when you are signed in as yourself, in the dashboard or with your own Primitive CLI or app login, and are null for API keys, Functions, connected agents, agent signup logins and other apps acting for you.",
 			"parameters": [
 				{
 					"name": "include",
@@ -16300,6 +16317,14 @@ const openapiDocument = {
 									"request_id": { "type": "string" },
 									"auth_method": { "type": ["string", "null"] },
 									"key_id": { "type": ["string", "null"] },
+									"email": {
+										"description": "Your own sign-in email, when you are signed in as yourself: in the dashboard, or with your own Primitive CLI or app login. Null for API keys, Functions, connected agents, agent signup logins and other apps acting for you.",
+										"type": ["string", "null"]
+									},
+									"role_name": {
+										"description": "Your role as the organization's members list labels it: a template or custom role as \"<name> (template)\" or \"<name> (custom)\", otherwise Owner, Admin, Member or Restricted. Null for the same credentials as email.",
+										"type": ["string", "null"]
+									},
 									"grant": {
 										"type": ["object", "null"],
 										"propertyNames": { "type": "string" },
@@ -16336,7 +16361,9 @@ const openapiDocument = {
 									"role",
 									"request_id",
 									"auth_method",
-									"key_id"
+									"key_id",
+									"email",
+									"role_name"
 								]
 							}
 						}
@@ -21726,16 +21753,28 @@ const openapiDocument = {
 		} },
 		"/activity/objects": { "get": {
 			"operationId": "listActivityObjects",
-			"summary": "List what you created",
-			"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules and rule requests. Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self.",
+			"summary": "List what you created, or what you were asked",
+			"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules and rule requests. Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, under their current membership, each naming the member who asked in created_through. A key, an app or an agent has none, and gets email_rule_request in withheld.",
 			"tags": ["Activity"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [
+				{
+					"name": "relation",
+					"in": "query",
+					"required": false,
+					"description": "created (the default) or asked.",
+					"schema": {
+						"default": "created",
+						"description": "created (the default): what you created. asked: what other members asked of you, open or answered: rule requests made to you. asked is for a person's own view only, and kind may then name only email_rule_request.",
+						"type": "string",
+						"enum": ["created", "asked"]
+					}
+				},
 				{
 					"name": "kind",
 					"in": "query",
 					"required": false,
-					"description": "Only these kinds, comma-separated: function, endpoint, function_trigger, pull_subscription, recipient_route, filter_rule, wake_schedule, repeating_send, scheduled_send, api_key, agent_connection, email_rule, email_rule_request. Defaults to every kind the caller can have created (a person's own kinds only for a person).",
+					"description": "Only these kinds, comma-separated: function, endpoint, function_trigger, pull_subscription, recipient_route, filter_rule, wake_schedule, repeating_send, scheduled_send, api_key, agent_connection, email_rule, email_rule_request. Defaults to every kind the caller can have created (a person's own kinds only for a person). With relation=asked, only email_rule_request, which is also the default.",
 					"schema": {
 						"type": "string",
 						"minLength": 1,
@@ -21782,7 +21821,7 @@ const openapiDocument = {
 			],
 			"responses": {
 				"200": {
-					"description": "List what you created",
+					"description": "List what you created, or what you were asked",
 					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
 						"type": "object",
 						"required": ["data"],
@@ -22688,7 +22727,7 @@ const openapiDocument = {
 			"delete": {
 				"operationId": "deleteEmailRule",
 				"summary": "Delete a rule",
-				"description": "Deletes a rule with its versions, its decisions and the access it granted. The author, or a caller who reads the whole organization's mail, may delete it; while it is shared with another member, only the author or someone who manages members from the dashboard. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "Deletes a rule with its versions, its decisions and the access it granted. A rule that was ever shared with another member keeps the record of its share: the share ends with end_reason rule_deleted, and the member who shared can still list what it handed over, while the rule is no longer shown and reads nothing. The answer lists the shares the delete ended (ended_shares) and the keys, not revoked, that still list the rule, which now read nothing through it: those you may read as key metadata by id, name and prefix (keys), and how many others (other_keys). keys and other_keys are left out when the keys could not be read. The author, or a caller who reads the whole organization's mail, may delete it; while it is shared with another member, only the author or someone who manages members from the dashboard. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -23339,7 +23378,7 @@ const openapiDocument = {
 			"post": {
 				"operationId": "createEmailRuleRequest",
 				"summary": "Ask a member for a rule",
-				"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated and nothing is shared until they accept, and they may change the rule first; they see the request and can preview what it matches in their own mail. You may have at most 5 pending requests to one member and 50 in all. If you can list members (members:read), the answer also says whether they can accept it under their role (target_can_accept), and if not, why (target_warning); the request is sent either way. To find out before asking, use POST /v1/email-rule-requests/target-check. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "Asks another member of the organization for a rule over their own mail, from a compile response or a tree you wrote. Name them by user id, or by their member mailbox address, or by their verified work email if you can list members (at most 30 lookups by address an hour). Nothing is evaluated and nothing is shared until they accept, and they may change the rule first; they see the request and can preview what it matches in their own mail. A message (up to 500 characters) tells them why you are asking; they see it with the request, and it cannot be changed later. You may have at most 5 pending requests to one member and 50 in all. If you can list members (members:read), the answer also says whether they can accept it under their role (target_can_accept), and if not, why (target_warning); the request is sent either way. To find out before asking, use POST /v1/email-rule-requests/target-check. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"requestBody": {
@@ -23356,7 +23395,7 @@ const openapiDocument = {
 						}] } } }
 					},
 					"400": {
-						"description": "validation_error: give exactly one of target_user_id and target_email and a tree that is valid for the column contract; details.reason self_request when the member named is you.",
+						"description": "validation_error: give exactly one of target_user_id and target_email, a tree that is valid for the column contract, and a message, if any, of 1 to 500 characters; details.reason self_request when the member named is you.",
 						"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 					},
 					"401": {
@@ -23674,7 +23713,7 @@ const openapiDocument = {
 			"get": {
 				"operationId": "getEmailRuleRequest",
 				"summary": "Read a rule request",
-				"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+				"description": "A rule request: the rule as proposed, who made it and to whom, and whether each of them is still a member. A request is visible to the member who made it, the member it was made to, and the organization's owners and admins. If you are the member asked, you can try the rule as proposed before answering: pass the request's tree to POST /v1/email-rules/test to test it on mail you have received. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up. Nothing is stored, and it needs no access beyond testing a rule of your own. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 				"tags": ["Email Rules"],
 				"security": [{ "BearerAuth": [] }],
 				"parameters": [{
@@ -23847,7 +23886,7 @@ const openapiDocument = {
 		"/email-rule-requests/{id}/decline": { "post": {
 			"operationId": "declineEmailRuleRequest",
 			"summary": "Decline a rule request",
-			"description": "Declines a pending request made to you. Nothing is written but the decision. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "Declines a pending request made to you. Nothing is written but the decision and, if you give one, its reason (reason, up to 500 characters), which the member who asked sees with the request. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -23870,6 +23909,10 @@ const openapiDocument = {
 					"maxLength": 255
 				}
 			}],
+			"requestBody": {
+				"required": false,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeclineEmailRuleRequestRequest" } } }
+			},
 			"responses": {
 				"200": {
 					"description": "Decline a rule request",
@@ -23885,6 +23928,10 @@ const openapiDocument = {
 						"ratelimit-policy": { "$ref": "#/components/headers/ratelimit-policy" }
 					}
 				},
+				"400": {
+					"description": "validation_error: reason is empty or longer than 500 characters.",
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
+				},
 				"401": {
 					"description": "Invalid or missing API key",
 					"content": { "application/json": {
@@ -24043,7 +24090,7 @@ const openapiDocument = {
 		"/email-rule-requests/{id}/accept": { "post": {
 			"operationId": "acceptEmailRuleRequest",
 			"summary": "Accept a rule request",
-			"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Also needs mail:share_own (sharing your own mail through email rules, which only shows it and never sends): a role without it is refused, whether or not it can send. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+			"description": "Writes the rule as yours, over your own mailboxes only, turns it on, and shares what it matches from now on with the member who asked. Send no body to accept it as asked, or change it first with english and tree together (and an explanation, or the server writes one). Because this gives your mail to someone else, it is limited to the dashboard and the Primitive CLI: other OAuth apps and agent tokens are refused. Before accepting, test it on your mail: pass the request's tree to POST /v1/email-rules/test. A test on mail already received shows only what has arrived. To see what the rule would do with an email that has not, such as one you would never want shared, pass the request's tree to POST /v1/email-rules/test-sample (testEmailRuleOnSample; in the Primitive CLI, primitive email-rules test-email-rule-on-sample --body-file sample.json) with an email you make up. Nothing is stored, and it needs no access beyond testing a rule of your own. Accepting also needs mail:share_own (sharing your own mail through email rules, which only shows it and never sends): a role without it is refused, whether or not it can send. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 			"tags": ["Email Rules"],
 			"security": [{ "BearerAuth": [] }],
 			"parameters": [{
@@ -32110,7 +32157,7 @@ const openapiDocument = {
 			"summary": "List every credential",
 			"tags": ["Credentials"],
 			"security": [{ "BearerAuth": [] }],
-			"description": "Every credential that can act in the organization: API keys, Function keys, agent connection keys, connected apps (OAuth), agent delegates and, where enabled, CLI logins. Secrets are never returned. A key's grant.mail_scope.depth is raw only when it holds mail.raw:read and its scope lists an address or a domain, otherwise content. Filter with kind. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.",
+			"description": "Every credential that can act in the organization: API keys, Function keys, agent connection keys, connected apps (OAuth), agent delegates and, where enabled, CLI logins. Secrets are never returned. A key's grant.mail_scope.depth is raw only when it holds mail.raw:read and its scope lists an address or a domain, otherwise content. A rule the key lists that reads nothing any more (a deleted rule, or a share that ended) is listed under grant.mail_scope.ended_rules, each with its id and reason (rule_deleted or share_ended), and not under rules. Filter with kind. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session. The person's role must hold credentials:read. API keys, agent connection keys and agents are refused.",
 			"x-primitive-person-only": { "access": "session" },
 			"parameters": [{
 				"name": "kind",
@@ -32239,7 +32286,7 @@ const openapiDocument = {
 			"summary": "Revoke a credential",
 			"tags": ["Credentials"],
 			"security": [{ "BearerAuth": [] }],
-			"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up keeps working and is listed in standing_objects for review. The person's own Primitive CLI login revokes an API key (kind org_key) as the person, with no step-up unless the organization's credential policy sets cli_writes_require_approval (then it takes a keys.create step-up); every other kind (a connected key named as org_key included, 403 grant_forbidden target_not_covered), and every other app even with a step-up, is refused outside the dashboard (403). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
+			"description": "Revoke one credential by kind and id. A Function key is rotated, never revoked (409 rotate_instead). An API key is revoked only by a person whose own access covers the key's access (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. What the credential set up or owns is listed in standing_objects for review, and for an API key also what it carries on for the keys it was rotated from. An organization-owned object (org_owned true) keeps working; any other keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to, except that a block filter an app made keeps blocking, within the reach the app had, unless the person revoking chose to stop it. An API key (kind org_key or connected_key) that is already revoked, and whose record is kept, answers 200 with already_revoked true and revoked 0, to a caller who could have revoked it; anyone else gets the answer they would get for a key that does not exist. The person's own Primitive CLI login revokes an API key (kind org_key) as the person, with no step-up unless the organization's credential policy sets cli_writes_require_approval (then it takes a keys.create step-up); every other kind (a connected key named as org_key included, 403 grant_forbidden target_not_covered), and every other app even with a step-up, is refused outside the dashboard (403). Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:manage. API keys, agent connection keys and agents are refused.",
 			"x-primitive-person-only": { "access": "session_or_cli" },
 			"parameters": [{
 				"name": "Primitive-Step-Up",
@@ -33221,7 +33268,7 @@ const openapiDocument = {
 				"summary": "List API keys",
 				"tags": ["Credentials"],
 				"security": [{ "BearerAuth": [] }],
-				"description": "Key metadata, never a secret: name, prefix, grant, creator, last use, expiry, suspension and whether each key works now (status). A grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
+				"description": "Key metadata, never a secret: name, prefix, grant, creator, last use, expiry, suspension and whether each key works now (status). Revoked keys are left out unless include_revoked is true, which lists them too with status revoked, revoked_at and revoked_by, under the same access rules as keys that work. A grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. A rule the key lists that reads nothing any more (a deleted rule, or a share that ended) is listed under grant.mail_scope.ended_rules, each with its id and reason (rule_deleted or share_ended), and not under rules. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
 				"x-primitive-person-only": { "access": "session_or_cli" },
 				"parameters": [{
 					"name": "cursor",
@@ -33232,6 +33279,15 @@ const openapiDocument = {
 						"type": "string",
 						"maxLength": 200
 					}
+				}, {
+					"name": "include_revoked",
+					"in": "query",
+					"required": false,
+					"description": "true to list revoked keys as well, newest first among the rest; false (the default) lists only keys that are not revoked. The cursor does not carry it: send it with every page.",
+					"schema": {
+						"type": "string",
+						"enum": ["true", "false"]
+					}
 				}],
 				"responses": {
 					"200": {
@@ -33344,7 +33400,7 @@ const openapiDocument = {
 			"summary": "Rotate an API key",
 			"tags": ["Credentials"],
 			"security": [{ "BearerAuth": [] }],
-			"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+			"description": "Mint a successor with a new id and the same name, grant, expiry and conditions, and return its secret once. The old key keeps working for overlap_seconds, then stops: 24 hours when overlap_seconds is omitted, at most 7 days, never past its own expires_at, and at once with 0 (which is how to rotate a key whose secret leaked). previous_key_expires_at says when the old key stops. Rotating does not extend a key: the successor keeps the old expiry unless expires_at gives it a new one. That needs keys:manage (403 forbidden otherwise), is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and someone limited to their own keys can only keep or bring it forward (403 grant_forbidden, details.reason own_key_tighten_only); the old key then never outlives the new one. The person rotating must cover the key's access (403 grant_forbidden, details.reason target_not_covered), and a key an owner holds is rotated by an owner only (403 forbidden, details.reason owner_key_rotation), since rotating hands over the new secret. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 			"x-primitive-person-only": {
 				"access": "step_up",
 				"step_up_purpose": "keys.create",
@@ -33511,7 +33567,7 @@ const openapiDocument = {
 				"summary": "Change an API key",
 				"tags": ["Credentials"],
 				"security": [{ "BearerAuth": [] }],
-				"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
+				"description": "Rename a key, change its expiry, its grant or its conditions, or suspend it. A later expires_at extends the key, which is how to keep a key working past its expiry (rotating keeps it, unless the rotation gives the new key an expires_at): it is held to the credential policy (400 when past its maximum lifetime, with the latest expiry it allows now in the message), and like any loosening needs the person to be allowed to create a key with the key's access. An expired key's expiry cannot be changed (409 conflict, details.reason key_expired); make a new key instead. Any change needs the person's own access to cover the key's access now (an owner covers every key); otherwise 403 grant_forbidden, details.reason target_not_covered. A grant change is a new version of the key and is held to the same rules as creating one (a custom grant that does not say which mail it reaches is refused with details.reason mail_scope_required), so it takes the same step-up. It replaces the whole grant: send expected_grant_ref (grant.ref from GET /v1/keys/{id}) to have it refused (409 conflict, details.reason grant_changed) if the grant changed since that read; a grant change sent without it answers grant_unguarded: true. On a key limited to selected resources (grant.resources), a grant change must drop the limits on purpose with a custom grant and grant.resources {}; one that leaves them out is refused (409 conflict, details.reason key_has_resource_limits) and nothing changes. The person's own Primitive CLI login needs no step-up (it acts as the person, held to the same rules) unless the organization's credential policy sets cli_writes_require_approval; the Primitive app's token is refused, even with one. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session, the person's own Primitive CLI login with no step-up (unless the organization's credential policy sets cli_writes_require_approval), or the person's own OAuth token with a step-up token for purpose `keys.create` in the Primitive-Step-Up header. Without one any other OAuth token is answered 403 step_up_required, whose details carry the dashboard URL that issues it (or 403 grant_forbidden when the person's role, or the client, could not do it anyway). The person's role must hold keys:manage. API keys and agent connection keys are refused. An agent acting for the person is refused unless it carries a step-up token the person issued in the dashboard.",
 				"x-primitive-person-only": {
 					"access": "step_up",
 					"step_up_purpose": "keys.create",
@@ -33663,7 +33719,7 @@ const openapiDocument = {
 				"summary": "Get an API key",
 				"tags": ["Credentials"],
 				"security": [{ "BearerAuth": [] }],
-				"description": "One key's metadata, never its secret, with whether it works now (status). Its grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
+				"description": "One key's metadata, never its secret, with whether it works now (status). A revoked key whose record is kept is answered too, with status revoked, revoked_at and revoked_by, under the same access rules as a key that works: one the caller may not read is 404, revoked or not. Its grant's mail_scope.depth is raw only when the key holds mail.raw:read and its scope lists an address or a domain, otherwise content. A rule the key lists that reads nothing any more (a deleted rule, or a share that ended) is listed under grant.mail_scope.ended_rules, each with its id and reason (rule_deleted or share_ended), and not under rules. The person needs access to the whole organization's mail. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled, with details.feature naming the feature. Contact Primitive to turn them on.\n\nPerson only: a dashboard session or the person's own Primitive CLI token; no other OAuth app. The person's role must hold keys:read. API keys, agent connection keys and agents are refused.",
 				"x-primitive-person-only": { "access": "session_or_cli" },
 				"parameters": [{
 					"name": "id",
@@ -45040,13 +45096,13 @@ const openapiDocument = {
 						"type": "boolean"
 					},
 					"owner_key_id": {
-						"description": "The API key that owns this webhook. In endpoint responses it is set only for a caller who may read API key metadata, and is null otherwise and when the organization owns the webhook. After a rotation, the key that carries on for the key first named while it can act.",
+						"description": "The API key that owns this webhook. In endpoint responses it is set only for a caller who may read API key metadata, and is null otherwise and when the organization owns the webhook. After a rotation, the key that carries on for the key first named while it can act. When none can, the key delivery stops on: the key first named while it is suspended and not expired, otherwise the newest key of its rotation that is not revoked, otherwise the newest one (only the key first named when nothing may carry on for it).",
 						"type": ["string", "null"],
 						"format": "uuid",
 						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
 					},
 					"owner_key_status": {
-						"description": "Whether the owning key can act now. In endpoint responses it is set only for a caller who may read API key metadata. Suspended also covers an expired key. A suspended or revoked owner is sent nothing.",
+						"description": "Whether the owning key can act now. In endpoint responses it is set only for a caller who may read API key metadata. It is the state delivery acts on. Suspended also covers an expired key. A suspended or revoked owner is sent nothing. Anyone who may read the endpoint learns that from delivery.reasons, which never names the key.",
 						"type": ["string", "null"],
 						"enum": [
 							"active",
@@ -45055,6 +45111,65 @@ const openapiDocument = {
 							null
 						]
 					},
+					"disabled_reason": {
+						"description": "Why the platform turned this endpoint off, when it names a reason. owner_changed: it was given to a new owner while its URL stayed, and the URL was chosen under the previous owner; turning it on or giving it a new URL starts it again. owner_credential_revoked: the third-party app or agent delegate grant that owned it was revoked; an owner or admin who turns it back on takes it over. Null while it is on and when it was turned off by hand. An access suspension does not set it (a suspension is decided through its own record). Other values may be added.",
+						"type": ["string", "null"]
+					},
+					"delivery": {
+						"description": "For a webhook (kind http) in GET /endpoints and GET /endpoints/{id}: whether it is being sent received mail, and why not. Shown to anyone who may read the endpoint; it names a state, never a key. Null when it could not be checked just now. Absent from other kinds of endpoint and from create and update answers.",
+						"type": ["object", "null"],
+						"properties": {
+							"delivering": {
+								"type": "boolean",
+								"description": "Whether the webhook is being sent received mail at all now: it is on, it is not held, and its owner can receive mail. Which messages reach it is still decided per message, by routing, rule grants and its own rules."
+							},
+							"reasons": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"code": { "type": "string" },
+										"message": { "type": "string" }
+									},
+									"required": ["code", "message"],
+									"additionalProperties": {}
+								},
+								"description": "Every reason it is not, in the order delivery checks them; empty when it is. Codes, of which more may be added: disabled: the endpoint is off (disabled_reason on the endpoint says why). held: the endpoint, or the route the email came through, is held pending an owner or admin decision after its creator's access was reduced. acting_owner_revoked, acting_owner_suspended (which covers an expired key) and acting_owner_left: its owner cannot act now. acting_owner_permission: its owner does not read mail. acting_owner_depth: its owner sees headers only. acting_owner_scope: its owner does not read this email's mailbox, or, with no email to judge, reads no received mail at all now. These three name what the owner's access holds, so a caller who may not read API key metadata sees acting_owner_access in their place."
+							},
+							"held_for_owner": {
+								"description": "Rule-granted mail held for this webhook while its owner cannot act; null when none is. Only for a caller with access to every mailbox (held mail can be an earlier owner's), and absent when it could not be read just now.",
+								"type": ["object", "null"],
+								"properties": {
+									"count": {
+										"type": "integer",
+										"minimum": -9007199254740991,
+										"maximum": 9007199254740991,
+										"description": "Rule-granted emails waiting for this webhook because its owner could not act at their last check."
+									},
+									"oldest_queued_at": {
+										"type": "string",
+										"format": "date-time",
+										"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
+										"description": "When the oldest of them was queued."
+									},
+									"expires_at": {
+										"type": "string",
+										"format": "date-time",
+										"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$",
+										"description": "When the oldest is given up on if its owner still cannot act. Each is checked again periodically, so the count can trail a change of the owner's state."
+									}
+								},
+								"required": [
+									"count",
+									"oldest_queued_at",
+									"expires_at"
+								],
+								"additionalProperties": {}
+							}
+						},
+						"required": ["delivering", "reasons"],
+						"additionalProperties": {}
+					},
 					"signed_with": {
 						"description": "Which secret signs deliveries to this webhook: its own (read it from GET /endpoints/{id}/signing-secret), or the organization's webhook secret. Absent for an endpoint that is not a webhook.",
 						"type": "string",
@@ -45262,7 +45377,7 @@ const openapiDocument = {
 						"description": "For a move to another domain_id whose slot already has an active endpoint: false (the default) answers 409 conflict with details.holder naming it; true retires that endpoint in the same request, after the checks deleting it would need."
 					},
 					"owner_key_id": {
-						"description": "Give this webhook to an API key of the organization. Only a route target can be given to a key; a default endpoint stays the organization's, and takeover is refused with it. null gives a key-owned webhook back to the organization (a caller with access to every mailbox only); it stays a route target.",
+						"description": "Give this webhook to an API key of the organization. Only a route target can be given to a key; a default endpoint stays the organization's, and takeover is refused with it. null gives a key-owned webhook back to the organization (a caller with access to every mailbox only); it stays a route target. Giving a webhook the organization does not own to a different key, or a key's webhook back to the organization, turns it off (enabled false, disabled_reason owner_changed) unless the same request sets enabled: its URL was chosen under its previous owner. A key that carries on for the key that owns it through rotation (its successor, at any depth up to 16 rotations) is not a different key: the webhook stays as it was, with the same signing secret. That does not hold for a webhook whose owning key was made from a key a transfer moved or rotated away, or from one that has since been deleted: no successor carries on for it, so giving the webhook to one is a change of owner. Turning it on, or a new URL, starts it again. A webhook that signs with its own secret keeps signing with one: the same one when it stays with the same key, or was the organization's (giving away one the organization owns needs webhook_secret:read, since the key and its holder can then read its secret), and a new one for any other owner's. The response's warnings say when an update turned the webhook off or on.",
 						"type": ["string", "null"],
 						"format": "uuid",
 						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
@@ -45289,9 +45404,58 @@ const openapiDocument = {
 					"signature": {
 						"type": "string",
 						"description": "The signature header value sent, answered to a caller who may see it: for a webhook signed with the organization's secret, a caller who may read that secret; for one signed with its own, the person who owns it, calling as themselves."
+					},
+					"reachable": {
+						"type": "boolean",
+						"description": "Whether the endpoint answered the test with a 2xx status: the request reached it and its handler accepted it. It says nothing about whether real mail is sent to it: see delivery."
+					},
+					"delivery": {
+						"description": "Whether real email.received events would be sent to this endpoint, judged by the endpoint's own conditions as delivery judges them. Null when that could not be checked just now.",
+						"type": ["object", "null"],
+						"properties": {
+							"event_type": {
+								"type": "string",
+								"description": "The event type checked."
+							},
+							"would_deliver": {
+								"type": "boolean",
+								"description": "Whether this endpoint's own conditions let the event through: it is on, it is not held, its owner can receive it, and it subscribes to the event type. Which endpoint routing or a rule grant sends a message to is decided separately, per message: POST /routes/simulate answers that, and a rule grant can deliver an email outside its owner's mailboxes. A Function endpoint is also judged at delivery on its Function's run state and key."
+							},
+							"reasons": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"code": { "type": "string" },
+										"message": { "type": "string" }
+									},
+									"required": ["code", "message"],
+									"additionalProperties": {}
+								},
+								"description": "Every reason it would not be sent the event, in the order delivery checks them; empty when it would. Codes, of which more may be added: disabled: the endpoint is off (disabled_reason on the endpoint says why). held: the endpoint, or the route the email came through, is held pending an owner or admin decision after its creator's access was reduced. acting_owner_revoked, acting_owner_suspended (which covers an expired key) and acting_owner_left: its owner cannot act now. acting_owner_permission: its owner does not read mail. acting_owner_depth: its owner sees headers only. acting_owner_scope: its owner does not read this email's mailbox, or, with no email to judge, reads no received mail at all now. These three name what the owner's access holds, so a caller who may not read API key metadata sees acting_owner_access in their place. event_type_not_subscribed: rules.event_types leaves the event out."
+							},
+							"events_paused_until": {
+								"description": "While repeated failures have paused this webhook (its circuit breaker is open): when webhook events other than mail (interaction, sent mail and credential events) are next attempted. Received mail is attempted regardless, so this does not change would_deliver. Null when nothing is paused, and for a Function endpoint.",
+								"type": ["string", "null"],
+								"format": "date-time",
+								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
+							}
+						},
+						"required": [
+							"event_type",
+							"would_deliver",
+							"reasons",
+							"events_paused_until"
+						],
+						"additionalProperties": {}
 					}
 				},
-				"required": ["status", "body"]
+				"required": [
+					"status",
+					"body",
+					"reachable",
+					"delivery"
+				]
 			},
 			"TestEndpointRulesInput": {
 				"type": "object",
@@ -45309,15 +45473,15 @@ const openapiDocument = {
 				"properties": {
 					"would_deliver": {
 						"type": "boolean",
-						"description": "Whether the delivery path would deliver this email to the endpoint."
+						"description": "Whether this email would be sent to this endpoint by the endpoint's own conditions: it is on, neither it nor the email's route is held, its owner may receive this email, it subscribes to the event, and its rules match. Which endpoint routing sends the email to is decided separately: POST /routes/simulate answers that. A rule grant can still deliver an email whose mailbox the owner does not read, and a Function endpoint is also judged at delivery on its Function's run state and key."
 					},
 					"rule": {
-						"type": ["string", "null"],
-						"description": "Name of the failing rule when delivery would be\nsuppressed; null when the message matches and the\nendpoint is subscribed to the event type.\n"
+						"description": "The first check that stops this email, in the order delivery makes them: disabled, held or an acting_owner_* code (see delivery.reasons), then event_types when the endpoint does not subscribe, then the name of the rule that does not match. Null when it would deliver.",
+						"type": ["string", "null"]
 					},
 					"reason": {
-						"type": ["string", "null"],
-						"description": "Human-readable explanation of the failing rule; null when the message matches."
+						"description": "Why, in words. Null when it would deliver.",
+						"type": ["string", "null"]
 					},
 					"rules_valid": {
 						"type": "boolean",
@@ -45364,6 +45528,46 @@ const openapiDocument = {
 							"sender_authenticated",
 							"sender_trust_basis"
 						]
+					},
+					"delivery": {
+						"description": "The endpoint's own conditions for this email, as delivery judges them, the owner judged on this email's mailbox and time. Null for a pull destination, which nothing pushes to.",
+						"type": ["object", "null"],
+						"properties": {
+							"event_type": {
+								"type": "string",
+								"description": "The event type checked."
+							},
+							"would_deliver": {
+								"type": "boolean",
+								"description": "Whether this endpoint's own conditions let the event through: it is on, it is not held, its owner can receive it, and it subscribes to the event type. Which endpoint routing or a rule grant sends a message to is decided separately, per message: POST /routes/simulate answers that, and a rule grant can deliver an email outside its owner's mailboxes. A Function endpoint is also judged at delivery on its Function's run state and key."
+							},
+							"reasons": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"code": { "type": "string" },
+										"message": { "type": "string" }
+									},
+									"required": ["code", "message"],
+									"additionalProperties": {}
+								},
+								"description": "Every reason it would not be sent the event, in the order delivery checks them; empty when it would. Codes, of which more may be added: disabled: the endpoint is off (disabled_reason on the endpoint says why). held: the endpoint, or the route the email came through, is held pending an owner or admin decision after its creator's access was reduced. acting_owner_revoked, acting_owner_suspended (which covers an expired key) and acting_owner_left: its owner cannot act now. acting_owner_permission: its owner does not read mail. acting_owner_depth: its owner sees headers only. acting_owner_scope: its owner does not read this email's mailbox, or, with no email to judge, reads no received mail at all now. These three name what the owner's access holds, so a caller who may not read API key metadata sees acting_owner_access in their place. event_type_not_subscribed: rules.event_types leaves the event out."
+							},
+							"events_paused_until": {
+								"description": "While repeated failures have paused this webhook (its circuit breaker is open): when webhook events other than mail (interaction, sent mail and credential events) are next attempted. Received mail is attempted regardless, so this does not change would_deliver. Null when nothing is paused, and for a Function endpoint.",
+								"type": ["string", "null"],
+								"format": "date-time",
+								"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z))$"
+							}
+						},
+						"required": [
+							"event_type",
+							"would_deliver",
+							"reasons",
+							"events_paused_until"
+						],
+						"additionalProperties": {}
 					}
 				},
 				"required": [
@@ -45373,7 +45577,8 @@ const openapiDocument = {
 					"rules_valid",
 					"subscribed_to_event",
 					"event_type",
-					"evaluated"
+					"evaluated",
+					"delivery"
 				]
 			},
 			"Filter": {
@@ -46033,10 +46238,14 @@ const openapiDocument = {
 						"type": "boolean",
 						"description": "Whether this is the latest attempt of its delivery: the one recorded last, where a record of no attempt (a rule skip or a held send, attempt_count 0) is latest only when no attempt was made. A retry is recorded as a new attempt with its own id and attempt_count (not always higher than the one before), so an earlier attempt never changes: follow the latest one, or read attempts on any of them."
 					},
+					"retry_scheduled": {
+						"type": ["boolean", "null"],
+						"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. Null on every attempt of a delivery retried or settled on a schedule of its own, which this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, a rule-granted one, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will."
+					},
 					"next_attempt_at": {
 						"type": ["string", "null"],
 						"format": "date-time",
-						"description": "When the next automatic retry of this delivery is due. Not reported yet: always null."
+						"description": "When the next automatic retry of this delivery is due. Not reported: always null. Whether one is coming is retry_scheduled."
 					}
 				},
 				"required": [
@@ -46055,6 +46264,7 @@ const openapiDocument = {
 					"response_status",
 					"response_body",
 					"latest_attempt",
+					"retry_scheduled",
 					"next_attempt_at"
 				]
 			},
@@ -48532,6 +48742,19 @@ const openapiDocument = {
 					}
 				}
 			},
+			"EmailListMeta": { "allOf": [{ "$ref": "#/components/schemas/PaginationMeta" }, {
+				"type": "object",
+				"properties": {
+					"recipient_outside_access": {
+						"type": "boolean",
+						"description": "Present, as true, when your credential is limited to some mailboxes, recipient names one that is neither one of its addresses nor on one of its domains (or the credential reads no received mail at all), and it reads through no email rule: the page is then empty however much mail that mailbox holds. Absent otherwise, and for an address on one of your domains, which may still list nothing."
+					},
+					"recipient_rules_only": {
+						"type": "boolean",
+						"description": "Present, as true, when your credential is limited to some mailboxes, recipient names one that is neither one of its addresses nor on one of its domains, and the credential reads some mail through email rules: the page holds only the mail those rules give it there. Absent otherwise."
+					}
+				}
+			}] },
 			"IncludedMessageHeaders": {
 				"type": "object",
 				"description": "Stored addressing and threading headers. A member is null when absent or withheld.",
@@ -48939,7 +49162,7 @@ const openapiDocument = {
 				"properties": {
 					"covers": {
 						"type": "string",
-						"description": "you: what a person created through any credential of theirs (their dashboard session, their own CLI or app login, apps and agent delegates acting for them, their API keys while theirs, their personal agents). this_credential: what the calling key, app or agent created itself."
+						"description": "you: what a person created through any credential of theirs, or with relation=asked what others asked of them (their dashboard session, their own CLI or app login, apps and agent delegates acting for them, their API keys while theirs, their personal agents). this_credential: what the calling key, app or agent created itself."
 					},
 					"items": {
 						"type": "array",
@@ -48971,21 +49194,21 @@ const openapiDocument = {
 								"owned_now": {
 									"type": "string",
 									"enum": ["you", "someone_else"],
-									"description": "you: it is still yours: never transferred, or transferred back to you. someone_else: it was transferred and another person holds it now."
+									"description": "you: it is still yours: never transferred, or transferred back to you. someone_else: it was transferred and another person holds it now, or, with relation=asked, another member made it."
 								},
 								"created_through": {
 									"type": "object",
 									"properties": {
 										"kind": {
 											"type": "string",
-											"description": "The kind of credential it was created through: org_key, function_key, connected_key, oauth, agent_delegate or member (the person themselves)."
+											"description": "The kind of credential it was created through: org_key, function_key, connected_key, oauth, agent_delegate or member (the person themselves). With relation=asked, member: the member who asked."
 										},
 										"id": {
-											"description": "In a person's view, the person's own user id for member, and an API key's id where they may read their keys (for a person limited to their own keys, only a key they still hold). Null otherwise, and always null in one credential's view, where it is the calling credential itself.",
+											"description": "In a person's view, the person's own user id for member, and an API key's id where they may read their keys (for a person limited to their own keys, only a key they still hold). Null otherwise, and always null in one credential's view, where it is the calling credential itself. With relation=asked, the user id of the member who asked.",
 											"type": ["string", "null"]
 										},
 										"name": {
-											"description": "In a person's view, what that credential of theirs is called: an app login by its app, an API key by its name, an agent's key by its address. Null otherwise, and for the person themselves.",
+											"description": "In a person's view, what that credential of theirs is called: an app login by its app, an API key by its name, an agent's key by its address. Null otherwise, and for the person themselves. With relation=asked, the name of the member who asked.",
 											"type": ["string", "null"]
 										}
 									},
@@ -49597,6 +49820,10 @@ const openapiDocument = {
 									"format": "date-time"
 								},
 								"from_address": { "type": ["string", "null"] },
+								"recipient": {
+									"description": "The mailbox this copy of the email was received in, as GET /v1/emails/{id} shows it. Given with received_at, from_address and subject, so absent for not_found.",
+									"type": "string"
+								},
 								"subject": { "type": ["string", "null"] },
 								"parts": {
 									"description": "How each top-level part of the rule decided. Present for matched, near_miss and no_match.",
@@ -50717,9 +50944,67 @@ const openapiDocument = {
 			"UpdateEmailRuleResult": { "$ref": "#/components/schemas/EmailRuleWritten" },
 			"DeleteEmailRuleResult": {
 				"type": "object",
-				"properties": { "deleted": { "type": "boolean" } },
+				"properties": {
+					"deleted": { "type": "boolean" },
+					"ended_shares": {
+						"description": "The shares of this rule that the delete ended (end_reason rule_deleted). Each keeps its record.",
+						"type": "array",
+						"items": {
+							"type": "string",
+							"format": "uuid"
+						}
+					},
+					"keys": {
+						"description": "The API keys, not revoked, that still list the rule and that you may read (GET /v1/keys). They now read nothing through it; edit or revoke them. Left out, with other_keys, when the keys could not be read.",
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"id": {
+									"type": "string",
+									"format": "uuid"
+								},
+								"name": { "type": ["string", "null"] },
+								"key_prefix": { "type": "string" }
+							},
+							"required": [
+								"id",
+								"name",
+								"key_prefix"
+							]
+						}
+					},
+					"other_keys": {
+						"description": "How many more keys, not revoked, list the rule that you may not read. They are not named.",
+						"type": "integer"
+					}
+				},
 				"required": ["deleted"]
 			},
+			"EmailRuleWithheldBy": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"name": { "type": "string" },
+					"reason": {
+						"type": "string",
+						"enum": [
+							"matched",
+							"undecided",
+							"outside_scope_stale"
+						],
+						"description": "undecided: it had not decided the email, which blocks too. outside_scope_stale: cleared as outside its scope, and its author now reads the email."
+					}
+				},
+				"required": [
+					"id",
+					"name",
+					"reason"
+				]
+			},
 			"ListEmailRuleDecisionsResult": {
 				"type": "array",
 				"items": {
@@ -50761,6 +51046,16 @@ const openapiDocument = {
 							"type": "boolean",
 							"const": true
 						},
+						"withheld_by": {
+							"description": "Set when do-not-share rules kept this match from being shared, so no key or webhook got it through the rule: those you can see, and why.",
+							"type": "array",
+							"items": { "$ref": "#/components/schemas/EmailRuleWithheldBy" }
+						},
+						"withheld_by_hidden": {
+							"type": "integer",
+							"minimum": 0,
+							"description": "With withheld_by: how many more kept it back that you cannot see, or that were deleted since. Those rules are not shown; an admin can see them."
+						},
 						"created_at": {
 							"type": "string",
 							"format": "date-time"
@@ -50795,6 +51090,36 @@ const openapiDocument = {
 			"ListEmailRuleResultsResult": {
 				"type": "object",
 				"properties": {
+					"email": {
+						"description": "The email these results are about, so a saved answer says which one it was.",
+						"type": "object",
+						"properties": {
+							"id": {
+								"type": "string",
+								"format": "uuid"
+							},
+							"from_address": {
+								"description": "The sender address, as GET /v1/emails/{id} shows it.",
+								"type": ["string", "null"]
+							},
+							"recipient": {
+								"type": "string",
+								"description": "The mailbox this copy of the email was received in, as GET /v1/emails/{id} shows it."
+							},
+							"subject": { "type": ["string", "null"] },
+							"received_at": {
+								"type": "string",
+								"format": "date-time"
+							}
+						},
+						"required": [
+							"id",
+							"from_address",
+							"recipient",
+							"subject",
+							"received_at"
+						]
+					},
 					"rules": {
 						"type": "array",
 						"items": {
@@ -50827,6 +51152,10 @@ const openapiDocument = {
 											"description": "The version of the rule that decided."
 										},
 										"matched": { "type": "boolean" },
+										"near_miss": {
+											"description": "Not matched, but nearly: its questions did not all say yes, or it needs several parts and exactly one failed while at least one part that held is not an exclusion (a top-level not, or is_false). False when detail_withheld is true. Decisions recorded under the earlier definition counted an exclusion too.",
+											"type": "boolean"
+										},
 										"parts": {
 											"type": "array",
 											"items": {
@@ -50873,10 +51202,20 @@ const openapiDocument = {
 											"anyOf": [{ "$ref": "#/components/schemas/EmailRuleTree" }, { "type": "null" }]
 										},
 										"detail_withheld": {
-											"description": "Present, as true, on a result for an email whose content cannot be read (withheld, failed to parse or discarded): matched still says what the rule decided, but how it got there was read from that content, so parts and question_answers are empty. Absent otherwise.",
+											"description": "Present, as true, on a result for an email whose content cannot be read (withheld, failed to parse or discarded): matched still says what the rule decided, but how it got there was read from that content, so parts and question_answers are empty and near_miss is false. Absent otherwise.",
 											"type": "boolean",
 											"const": true
 										},
+										"withheld_by": {
+											"description": "Set when do-not-share rules kept this match from being shared, so no key or webhook got it through the rule: those you can see, and why.",
+											"type": "array",
+											"items": { "$ref": "#/components/schemas/EmailRuleWithheldBy" }
+										},
+										"withheld_by_hidden": {
+											"type": "integer",
+											"minimum": 0,
+											"description": "With withheld_by: how many more kept it back that you cannot see, or that were deleted since. Those rules are not shown; an admin can see them."
+										},
 										"created_at": {
 											"type": "string",
 											"format": "date-time"
@@ -51157,6 +51496,12 @@ const openapiDocument = {
 						"maxLength": 200,
 						"description": "A short name for the rule."
 					},
+					"message": {
+						"type": ["string", "null"],
+						"minLength": 1,
+						"maxLength": 500,
+						"description": "A short note to the member asked about why you are asking, up to 500 characters; null or absent for none. They see it with the request; it cannot be changed later."
+					},
 					"english": {
 						"type": "string",
 						"minLength": 1,
@@ -51233,7 +51578,8 @@ const openapiDocument = {
 					},
 					"warnings": {
 						"type": "array",
-						"items": { "type": "string" }
+						"items": { "type": "string" },
+						"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
 					},
 					"compiled_by": { "type": "string" },
 					"vocabulary": { "type": "string" },
@@ -51267,6 +51613,14 @@ const openapiDocument = {
 						"format": "uuid",
 						"description": "The share accepting created, while it exists."
 					},
+					"message": {
+						"description": "What the member asking wrote about why; null when they wrote nothing.",
+						"type": ["string", "null"]
+					},
+					"decline_reason": {
+						"description": "Why the member asked declined it; null unless they gave a reason when declining.",
+						"type": ["string", "null"]
+					},
 					"target_can_accept": {
 						"description": "Whether the member asked can accept it now under their role. Null unless you can list members and their roles (members:read), or when it could not be read.",
 						"type": ["boolean", "null"]
@@ -51382,7 +51736,8 @@ const openapiDocument = {
 					},
 					"warnings": {
 						"type": "array",
-						"items": { "type": "string" }
+						"items": { "type": "string" },
+						"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
 					},
 					"compiled_by": { "type": "string" },
 					"vocabulary": { "type": "string" },
@@ -51415,6 +51770,14 @@ const openapiDocument = {
 						"type": ["string", "null"],
 						"format": "uuid",
 						"description": "The share accepting created, while it exists."
+					},
+					"message": {
+						"description": "What the member asking wrote about why; null when they wrote nothing.",
+						"type": ["string", "null"]
+					},
+					"decline_reason": {
+						"description": "Why the member asked declined it; null unless they gave a reason when declining.",
+						"type": ["string", "null"]
 					}
 				},
 				"required": [
@@ -51445,6 +51808,16 @@ const openapiDocument = {
 				"items": { "$ref": "#/components/schemas/EmailRuleRequest" }
 			},
 			"GetEmailRuleRequestResult": { "$ref": "#/components/schemas/EmailRuleRequest" },
+			"DeclineEmailRuleRequestRequest": {
+				"type": "object",
+				"properties": { "reason": {
+					"type": ["string", "null"],
+					"minLength": 1,
+					"maxLength": 500,
+					"description": "Why you are declining, up to 500 characters; null or absent for none. The member who asked sees it with the request."
+				} },
+				"additionalProperties": false
+			},
 			"DeclineEmailRuleRequestResult": { "$ref": "#/components/schemas/EmailRuleRequest" },
 			"WithdrawEmailRuleRequestResult": { "$ref": "#/components/schemas/EmailRuleRequest" },
 			"DeleteEmailRuleRequestResult": {
@@ -51546,8 +51919,10 @@ const openapiDocument = {
 							"removed_by_beneficiary",
 							"stopped_by_admin",
 							"rule_changed",
+							"rule_deleted",
 							null
-						]
+						],
+						"description": "Why it ended, once it has: stopped_by_granter, removed_by_beneficiary, stopped_by_admin, rule_changed (a new version of the rule was saved) or rule_deleted (the rule was deleted; the share keeps its record, and the rule is no longer shown). Null while it has not."
 					},
 					"accepted_rule_version": {
 						"type": "integer",
@@ -53974,8 +54349,12 @@ const openapiDocument = {
 						"type": "boolean",
 						"description": "Whether this is the latest attempt of its delivery: the one recorded last, where a record of no attempt (a rule skip or a held send, attempt_count 0) is latest only when no attempt was made. A retry is recorded as a new attempt with its own id and attempt_count (not always higher than the one before), so an earlier attempt never changes: follow the latest one, or read attempts on any of them."
 					},
+					"retry_scheduled": {
+						"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. Null on every attempt of a delivery retried or settled on a schedule of its own, which this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, a rule-granted one, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will.",
+						"type": ["boolean", "null"]
+					},
 					"next_attempt_at": {
-						"description": "When the next automatic retry of this delivery is due. Not reported yet: always null.",
+						"description": "When the next automatic retry of this delivery is due. Not reported: always null. Whether one is coming is retry_scheduled.",
 						"type": ["string", "null"]
 					},
 					"attempts": {
@@ -54003,6 +54382,10 @@ const openapiDocument = {
 								"response_body": {
 									"description": "The first 2 KB of the body the endpoint answered this attempt with, so a handler that answers 200 and ignores a delivery can be seen doing so. It is whatever came back, which may echo what was sent. Null when no answer came back, and cleared when the message's content is discarded or the sent email is deleted. Withheld from a caller who cannot read message content, since an answer can echo what was sent.",
 									"type": ["string", "null"]
+								},
+								"retry_scheduled": {
+									"description": "Whether an automatic retry will try this delivery again. A retry is a delivery pass for the email: it sends again to the endpoint the email's routing resolves then (its recorded route, or the current endpoint for its domain), unless the email already reached it, deciding it afresh (its rules, its owner's access, whether it is still on), so true promises a pass, not a delivery to this endpoint. Null on every attempt of a delivery retried or settled on a schedule of its own, which this does not report: a held one (its release settles it, including the attempts it makes itself), a pull attempt, a rule-granted one, and a sent email's or other event's delivery. On the latest attempt that failed, is pending or was skipped in a way still owed, of an email that was not rejected and still has its content, to an endpoint that is still on, takes the event, has an owner the pass would deliver to (a revoked or suspended key, or an owner that may not receive the message, reads false) and has not received the email by another delivery: null while a delivery pass for the email is running (whether another follows is decided when it ends), true when the email has another automatic pass to come (a scheduled retry, the reclaim of a pass that stopped, or the recovery of a first pass that did not finish), and false otherwise. False on every other attempt, including every attempt a later one followed: no automatic retry of the email's delivery will try it again, which does not mean nothing else ever will.",
+									"type": ["boolean", "null"]
 								}
 							},
 							"required": [
@@ -54013,7 +54396,8 @@ const openapiDocument = {
 								"duration_ms",
 								"created_at",
 								"response_status",
-								"response_body"
+								"response_body",
+								"retry_scheduled"
 							]
 						},
 						"description": "Every attempt of this delivery in the order recorded, oldest first, this one included: the same endpoint, and the same event (or, for an attempt recorded without one, the same email). Each carries what the endpoint answered that attempt (response_status, response_body). Records of no attempt (attempt_count 0) are listed where they were recorded, so the last entry is not always the latest attempt (latest_attempt says which is). The newest 100 when there are more."
@@ -54038,6 +54422,7 @@ const openapiDocument = {
 					"updated_at",
 					"email",
 					"latest_attempt",
+					"retry_scheduled",
 					"next_attempt_at",
 					"attempts"
 				]
@@ -55897,6 +56282,51 @@ const openapiDocument = {
 							},
 							"required": ["kind", "id"]
 						}
+					},
+					"already_revoked": {
+						"description": "true when the API key was already revoked, so nothing changed and revoked is 0. Absent otherwise. GET /v1/keys/{id} says when and by whom, to a caller who may read the key.",
+						"type": "boolean"
+					},
+					"keep_failed": {
+						"description": "Items you chose to keep that could not be taken over after the revocation. Each stopped with it, unless someone else had taken it over in the meantime.",
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"kind": { "type": "string" },
+								"id": { "type": "string" }
+							},
+							"required": ["kind", "id"]
+						}
+					},
+					"standing_objects": {
+						"description": "What the credential set up or owns, listed for review, and for an API key also what it carries on for the keys it was rotated from. Revoking deletes none of it.",
+						"type": "array",
+						"items": {
+							"type": "object",
+							"properties": {
+								"kind": {
+									"type": "string",
+									"description": "endpoint, function_trigger, pull_subscription, recipient_route, filter_rule or wake_schedule."
+								},
+								"id": { "type": "string" },
+								"label": {
+									"type": "string",
+									"description": "A webhook's URL, a pull subscription's name (or pull when it has none), a route's or filter's pattern, or a wake schedule's command and the address it wakes (command to address). A Function trigger's label is function: look it up by id."
+								},
+								"org_owned": {
+									"type": "boolean",
+									"description": "true: the organization owns it, and it keeps working. false: the credential owns it itself, as with everything a third-party app or agent delegate made, a webhook made with a narrowed API key, or a wake schedule made with a key that does not cover super_admin. It keeps working only while someone can still act for it, such as a key of the same rotation that still works, or whoever it was given to or kept it. Revoking a third-party app or agent delegate turns these off, except that a block filter it made keeps blocking, within the reach the app had, unless the person revoking chose to stop it."
+								}
+							},
+							"required": [
+								"kind",
+								"id",
+								"label",
+								"org_owned"
+							],
+							"additionalProperties": {}
+						}
 					}
 				},
 				"required": [
@@ -56537,7 +56967,7 @@ const openapiDocument = {
 						"type": "string",
 						"format": "date-time",
 						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
-						"description": "When the old key stops working: the time of the rotation plus overlap_seconds (24 hours when it was omitted, now when it was 0), or the key's own expires_at when that comes first."
+						"description": "When the old key stops working: the time of the rotation plus overlap_seconds (24 hours when it was omitted, now when it was 0), or the key's own expires_at, or the expires_at given to the new key, whichever comes first."
 					}
 				},
 				"required": [
@@ -56551,12 +56981,20 @@ const openapiDocument = {
 			},
 			"Credentials_rotateKey_Input": {
 				"type": "object",
-				"properties": { "overlap_seconds": {
-					"description": "How long the old key keeps working, in seconds, up to 604800 (7 days), and never past its own expires_at. 86400 (24 hours) when omitted. 0 stops the old key at once: use it when rotating because the secret leaked.",
-					"type": "integer",
-					"minimum": 0,
-					"maximum": 604800
-				} },
+				"properties": {
+					"overlap_seconds": {
+						"description": "How long the old key keeps working, in seconds, up to 604800 (7 days), and never past its own expires_at. 86400 (24 hours) when omitted. 0 stops the old key at once: use it when rotating because the secret leaked.",
+						"type": "integer",
+						"minimum": 0,
+						"maximum": 604800
+					},
+					"expires_at": {
+						"type": ["string", "null"],
+						"format": "date-time",
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
+						"description": "The new key's expiry. Omitted, it keeps the old key's expiry: rotating alone never extends a key. A time sets it, within the organization's credential policy (its maximum key lifetime counts from now); null makes it never expire, where the policy allows. Needs keys:manage, as changing a key does. The old key stops when the overlap ends, or at this expiry if that comes first."
+					}
+				},
 				"additionalProperties": false
 			},
 			"Credentials_updateKey_Result": {
@@ -56605,6 +57043,11 @@ const openapiDocument = {
 							],
 							"additionalProperties": {}
 						}
+					},
+					"grant_unguarded": {
+						"description": "Present, as true, when the grant was changed without expected_grant_ref, so the change was not checked against changes made since the key was read. Send grant.ref from GET /v1/keys/{id} as expected_grant_ref to have such a change refused instead (409 conflict, details.reason grant_changed).",
+						"type": "boolean",
+						"const": true
 					}
 				},
 				"required": [
@@ -56625,7 +57068,8 @@ const openapiDocument = {
 					"expires_at": {
 						"type": ["string", "null"],
 						"format": "date-time",
-						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
+						"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$",
+						"description": "A new expiry. A later time extends the key and an earlier one ends it sooner, within the organization's credential policy (its maximum key lifetime counts from now); null removes the expiry, where the policy allows. A rotated-out key's expiry can only be brought forward, and an expired key's cannot be changed."
 					},
 					"grant": { "anyOf": [{
 						"type": "string",
@@ -56976,12 +57420,25 @@ const openapiDocument = {
 								"grant": {
 									"type": "object",
 									"properties": {
+										"ref": {
+											"description": "The grant this read shows. Send it as expected_grant_ref on PATCH /v1/keys/{id} so the change is refused (409 conflict, details.reason grant_changed) if the grant has changed since this read.",
+											"type": "string"
+										},
 										"template": { "type": ["string", "null"] },
 										"permissions": {
 											"type": ["array", "null"],
 											"items": { "type": "string" }
 										},
-										"mail_scope": {}
+										"mail_scope": {},
+										"resources": {
+											"type": ["object", "null"],
+											"propertyNames": { "type": "string" },
+											"additionalProperties": {
+												"type": "array",
+												"items": { "type": "string" }
+											},
+											"description": "The Functions, domains, endpoints or routes the key is limited to, by type; null when it has no such limits. A grant change on a key with limits must drop them on purpose, with grant.resources {} (otherwise 409 conflict, details.reason key_has_resource_limits)."
+										}
 									},
 									"required": [
 										"template",
@@ -56997,14 +57454,31 @@ const openapiDocument = {
 								"expires_at": { "type": ["string", "null"] },
 								"suspended": { "type": "boolean" },
 								"status": {
-									"description": "Whether the key works now: active; suspended (refused until the suspension is lifted); expired (refused since expires_at); or inactive, for an agent connection key whose connection cannot act (not claimed, revoked, its domain not verified, or its owner no longer a member). A revoked key is not listed. An endpoint's owner_key_status reports an expired key as suspended.",
+									"description": "Whether the key works now: active; suspended (refused until the suspension is lifted); expired (refused since expires_at); inactive, for an agent connection key whose connection cannot act (not claimed, revoked, its domain not verified, or its owner no longer a member); or revoked, which it stays for good and which no unrevoked key ever shows. A revoked key is listed only with include_revoked=true, and GET /v1/keys/{id} answers it. An endpoint's owner_key_status reports an expired key as suspended.",
 									"type": "string",
 									"enum": [
 										"active",
 										"suspended",
 										"expired",
-										"inactive"
+										"inactive",
+										"revoked"
 									]
+								},
+								"revoked_at": {
+									"description": "When the key was revoked (ISO 8601); null for a key that is not revoked.",
+									"type": ["string", "null"]
+								},
+								"revoked_by": {
+									"description": "The user id of the person who revoked the key from their own dashboard session, step-up or Primitive CLI login; null for a key that is not revoked, and for one revoked any other way (by an API key, another app or token, or an automatic process such as secret scanning).",
+									"type": ["string", "null"]
+								},
+								"rotated_from": {
+									"description": "The id of the key this key was rotated from (POST /v1/keys/{id}/rotate made this key in its place); null for a key not made by rotation, when the caller may not read that key, or when its record is gone. A revoked one is still named: GET /v1/keys/{id} answers it.",
+									"type": ["string", "null"]
+								},
+								"rotated_to": {
+									"description": "The id of the newest key rotated from this key that the caller may read; null until it is rotated, or when the caller may read no key rotated from it. A revoked one is still named: GET /v1/keys/{id} answers it.",
+									"type": ["string", "null"]
 								}
 							},
 							"required": [
@@ -57045,12 +57519,25 @@ const openapiDocument = {
 					"grant": {
 						"type": "object",
 						"properties": {
+							"ref": {
+								"description": "The grant this read shows. Send it as expected_grant_ref on PATCH /v1/keys/{id} so the change is refused (409 conflict, details.reason grant_changed) if the grant has changed since this read.",
+								"type": "string"
+							},
 							"template": { "type": ["string", "null"] },
 							"permissions": {
 								"type": ["array", "null"],
 								"items": { "type": "string" }
 							},
-							"mail_scope": {}
+							"mail_scope": {},
+							"resources": {
+								"type": ["object", "null"],
+								"propertyNames": { "type": "string" },
+								"additionalProperties": {
+									"type": "array",
+									"items": { "type": "string" }
+								},
+								"description": "The Functions, domains, endpoints or routes the key is limited to, by type; null when it has no such limits. A grant change on a key with limits must drop them on purpose, with grant.resources {} (otherwise 409 conflict, details.reason key_has_resource_limits)."
+							}
 						},
 						"required": [
 							"template",
@@ -57066,14 +57553,31 @@ const openapiDocument = {
 					"expires_at": { "type": ["string", "null"] },
 					"suspended": { "type": "boolean" },
 					"status": {
-						"description": "Whether the key works now: active; suspended (refused until the suspension is lifted); expired (refused since expires_at); or inactive, for an agent connection key whose connection cannot act (not claimed, revoked, its domain not verified, or its owner no longer a member). A revoked key is not listed. An endpoint's owner_key_status reports an expired key as suspended.",
+						"description": "Whether the key works now: active; suspended (refused until the suspension is lifted); expired (refused since expires_at); inactive, for an agent connection key whose connection cannot act (not claimed, revoked, its domain not verified, or its owner no longer a member); or revoked, which it stays for good and which no unrevoked key ever shows. A revoked key is listed only with include_revoked=true, and GET /v1/keys/{id} answers it. An endpoint's owner_key_status reports an expired key as suspended.",
 						"type": "string",
 						"enum": [
 							"active",
 							"suspended",
 							"expired",
-							"inactive"
+							"inactive",
+							"revoked"
 						]
+					},
+					"revoked_at": {
+						"description": "When the key was revoked (ISO 8601); null for a key that is not revoked.",
+						"type": ["string", "null"]
+					},
+					"revoked_by": {
+						"description": "The user id of the person who revoked the key from their own dashboard session, step-up or Primitive CLI login; null for a key that is not revoked, and for one revoked any other way (by an API key, another app or token, or an automatic process such as secret scanning).",
+						"type": ["string", "null"]
+					},
+					"rotated_from": {
+						"description": "The id of the key this key was rotated from (POST /v1/keys/{id}/rotate made this key in its place); null for a key not made by rotation, when the caller may not read that key, or when its record is gone. A revoked one is still named: GET /v1/keys/{id} answers it.",
+						"type": ["string", "null"]
+					},
+					"rotated_to": {
+						"description": "The id of the newest key rotated from this key that the caller may read; null until it is rotated, or when the caller may read no key rotated from it. A revoked one is still named: GET /v1/keys/{id} answers it.",
+						"type": ["string", "null"]
 					}
 				},
 				"required": [
@@ -59844,6 +60348,25 @@ const openapiDocument = {
 				],
 				"description": "A default wake schedule the install creates for the function: the command it sends, a 5-field cron expression and timezone, and the scheduler sender localpart on the installed address's domain. The owner can change or delete it after install."
 			},
+			"EndpointUpdateWarning": {
+				"type": "object",
+				"properties": {
+					"code": { "type": "string" },
+					"message": { "type": "string" }
+				},
+				"required": ["code", "message"],
+				"additionalProperties": {}
+			},
+			"UpdatedEndpoint": { "allOf": [{ "$ref": "#/components/schemas/Endpoint" }, {
+				"type": "object",
+				"required": ["warnings"],
+				"properties": { "warnings": {
+					"default": [],
+					"description": "When this update turned the webhook off or on without the request setting enabled. turned_off_owner_changed: the webhook was given to a new owner, so it is now off (disabled_reason owner_changed) until it is turned on or given a new URL. turned_on_new_url: it was off because its owner changed, and the new URL turned it back on. Empty when the update did neither. Other codes may be added.",
+					"type": "array",
+					"items": { "$ref": "#/components/schemas/EndpointUpdateWarning" }
+				} }
+			}] },
 			"EndpointSigningSecretResponse": {
 				"type": "object",
 				"properties": {
@@ -60078,13 +60601,12 @@ const openapiDocument = {
 			},
 			"BuiltinRoleKey": {
 				"type": "string",
-				"description": "The key of a built-in role. `operator` has every permission `admin`\nhas except managing members, changing roles, sending invitations and\nbilling. By default the CLI may be used by `owner`, `admin` and\n`operator`.\n",
 				"enum": [
 					"owner",
 					"admin",
-					"operator",
 					"member"
-				]
+				],
+				"description": "The key of a built-in role. Every other role, including the `operator` template, is a template or custom role with a key of its own. A member's `role` (and the `stored_role` a role assignment returns) can also be `restricted`, which is not a built-in role and cannot be assigned: it stands for a template or custom role that does not fully include `member`, or for no role at all."
 			}
 		},
 		"headers": {
@@ -60295,6 +60817,32 @@ function formatActivityRows(covers, items) {
 	const line = (cells) => cells.map((cell, i) => i === cells.length - 1 ? cell : cell.padEnd(widths[i] ?? 0)).join("  ");
 	return [line(header), ...rows.map(line)].join("\n");
 }
+/**
+* One line per request asked of you: its state, when it was asked, its name,
+* and who asked. `complete` says the listing is the whole of it (every state,
+* from the first page to the last, nothing withheld), the only time an empty one means
+* nobody has asked.
+*/
+function formatAskedRows(items, complete = false) {
+	if (items.length === 0) return complete ? "Nobody has asked you for anything." : "Nothing to show.";
+	const rows = items.map((item) => [
+		item.state,
+		minute(item.created_at),
+		item.name ?? item.id,
+		item.created_through.name ?? item.created_through.id ?? "",
+		item.id
+	]);
+	const header = [
+		"STATE",
+		"ASKED (UTC)",
+		"NAME",
+		"FROM",
+		"ID"
+	];
+	const widths = header.map((h, i) => Math.max(h.length, ...rows.map((row) => (row[i] ?? "").length)));
+	const line = (cells) => cells.map((cell, i) => i === cells.length - 1 ? cell : cell.padEnd(widths[i] ?? 0)).join("  ");
+	return [line(header), ...rows.map(line)].join("\n");
+}
 /** What was left out, and why: no counts, only the kinds and what would show them. */
 function formatWithheld(withheld) {
 	if (withheld.length === 0) return null;
@@ -60305,9 +60853,9 @@ function shellWord(value) {
 	return SHELL_SAFE.test(value) ? value : `'${value.replaceAll("'", `'\\''`)}'`;
 }
 /** The command that continues this listing from `cursor`, with the same filters. */
-function resumeCommand(bin, flags, cursor) {
+function resumeCommand(bin, flags, cursor, subcommand = "created") {
 	return [
-		`${bin} activity created`,
+		`${bin} activity ${subcommand}`,
 		...flags.kind ? [`--kind ${shellWord(flags.kind)}`] : [],
 		...flags.state !== "all" ? [`--state ${flags.state}`] : [],
 		...flags.limit !== DEFAULT_LIMIT$3 ? [`--limit ${flags.limit}`] : [],
@@ -60315,6 +60863,60 @@ function resumeCommand(bin, flags, cursor) {
 		`--cursor ${shellWord(cursor)}`
 	].join(" ");
 }
+/** List one page, or every page with --all, of what the caller created or was asked. */
+async function runActivityList(command, flags, relation) {
+	const auth = await createAuthenticatedCliApiClient({
+		apiKey: flags["api-key"],
+		apiBaseUrl: flags["api-base-url"],
+		configDir: command.config.configDir
+	});
+	const items = [];
+	let covers = "";
+	let withheld = [];
+	let cursor = flags.cursor;
+	for (let page = 0; page < (flags.all ? 50 : 1); page += 1) {
+		const result = await call$1(listActivityObjects({
+			client: auth.apiClient.client,
+			query: {
+				...relation === "asked" ? { relation } : {},
+				state: flags.state,
+				limit: flags.limit,
+				...flags.kind ? { kind: flags.kind } : {},
+				...cursor ? { cursor } : {}
+			}
+		}));
+		if (!result.ok) {
+			if (flags.json) process.stderr.write(`${JSON.stringify(result.payload)}\n`);
+			else writeErrorWithHints(result.payload);
+			surfaceUnauthorizedHint({
+				auth: auth.auth,
+				baseUrlOverridden: auth.baseUrlOverridden,
+				configDir: command.config.configDir,
+				payload: result.payload
+			});
+			process.exitCode = 1;
+			return;
+		}
+		covers = result.data.covers;
+		withheld = result.data.withheld;
+		items.push(...result.data.items);
+		cursor = result.data.next_cursor ?? void 0;
+		if (!cursor) break;
+	}
+	if (flags.json) {
+		command.log(JSON.stringify({
+			covers,
+			items,
+			withheld,
+			next_cursor: cursor ?? null
+		}, null, 2));
+		return;
+	}
+	command.log(relation === "asked" ? formatAskedRows(items, flags.state === "all" && !flags.cursor && !cursor && withheld.length === 0) : formatActivityRows(covers, items));
+	const notShown = formatWithheld(withheld);
+	if (notShown) command.log(`\n${notShown}`);
+	if (cursor) command.log(`\nMore: ${resumeCommand(command.config.bin, flags, cursor, relation)}`);
+}
 var ActivityCreatedCommand = class ActivityCreatedCommand extends Command {
 	static description = `List what you created, newest first, with where each object stands now: Functions, endpoints, pull subscriptions, routes, filters, wake schedules, repeating and scheduled sends, including ones since disabled, deleted or revoked.
 
@@ -60352,56 +60954,44 @@ var ActivityCreatedCommand = class ActivityCreatedCommand extends Command {
 	};
 	async run() {
 		const { flags } = await this.parse(ActivityCreatedCommand);
-		const auth = await createAuthenticatedCliApiClient({
-			apiKey: flags["api-key"],
-			apiBaseUrl: flags["api-base-url"],
-			configDir: this.config.configDir
-		});
-		const items = [];
-		let covers = "";
-		let withheld = [];
-		let cursor = flags.cursor;
-		for (let page = 0; page < (flags.all ? 50 : 1); page += 1) {
-			const result = await call$1(listActivityObjects({
-				client: auth.apiClient.client,
-				query: {
-					state: flags.state,
-					limit: flags.limit,
-					...flags.kind ? { kind: flags.kind } : {},
-					...cursor ? { cursor } : {}
-				}
-			}));
-			if (!result.ok) {
-				if (flags.json) process.stderr.write(`${JSON.stringify(result.payload)}\n`);
-				else writeErrorWithHints(result.payload);
-				surfaceUnauthorizedHint({
-					auth: auth.auth,
-					baseUrlOverridden: auth.baseUrlOverridden,
-					configDir: this.config.configDir,
-					payload: result.payload
-				});
-				process.exitCode = 1;
-				return;
-			}
-			covers = result.data.covers;
-			withheld = result.data.withheld;
-			items.push(...result.data.items);
-			cursor = result.data.next_cursor ?? void 0;
-			if (!cursor) break;
-		}
-		if (flags.json) {
-			this.log(JSON.stringify({
-				covers,
-				items,
-				withheld,
-				next_cursor: cursor ?? null
-			}, null, 2));
-			return;
-		}
-		this.log(formatActivityRows(covers, items));
-		const notShown = formatWithheld(withheld);
-		if (notShown) this.log(`\n${notShown}`);
-		if (cursor) this.log(`\nMore: ${resumeCommand(this.config.bin, flags, cursor)}`);
+		await runActivityList(this, flags, "created");
+	}
+};
+var ActivityAskedCommand = class ActivityAskedCommand extends Command {
+	static description = `List what other members asked of you, newest first, open or answered: rule requests made to you for an email rule over your own mail, each with where it stands and who asked.
+
+  Signed in with \`primitive login\`, you see the requests made to you under your current membership. A key, an app or an agent is asked nothing. Read one with \`primitive email-rules get-email-rule-request --id <id>\`, then accept or decline it.`;
+	static summary = "List what other members asked of you";
+	static examples = [
+		"<%= config.bin %> activity asked",
+		"<%= config.bin %> activity asked --state live",
+		"<%= config.bin %> activity asked --all --json"
+	];
+	static flags = {
+		"api-key": API_KEY_FLAG$3,
+		"api-base-url": API_BASE_URL_FLAG$4,
+		state: Flags.string({
+			description: "all (default), live (still waiting on you), or ended (answered or withdrawn).",
+			options: [
+				"all",
+				"live",
+				"ended"
+			],
+			default: "all"
+		}),
+		limit: Flags.integer({
+			description: "Requests per page, 1 to 200.",
+			min: 1,
+			max: 200,
+			default: DEFAULT_LIMIT$3
+		}),
+		cursor: Flags.string({ description: "Resume from a next_cursor an earlier page printed." }),
+		all: Flags.boolean({ description: `Follow every page (at most 50).` }),
+		json: Flags.boolean({ description: "Print the answer as JSON." })
+	};
+	async run() {
+		const { flags } = await this.parse(ActivityAskedCommand);
+		await runActivityList(this, flags, "asked");
 	}
 };
 // src/oclif/agent-mail-check.ts
@@ -62491,12 +63081,12 @@ var AgentStatusCommand = class AgentStatusCommand extends Command {
 * Authenticated by the agent's own API key (the org is taken from the key).
 */
 var AgentUpgradeCommand = class AgentUpgradeCommand extends Command {
-	static description = "Upgrade an emailless agent account to a full developer account by confirming an email. Authenticated by the agent's own API key (PRIMITIVE_API_KEY). Upgrading raises the send cap and grants the developer plan's default features (such as Functions). It does not unlock sending to arbitrary recipients: the account's recipient rules still apply (see `primitive sending permissions`).";
-	static summary = "Upgrade an agent account to developer (email confirmation)";
+	static description = "Upgrade an emailless agent account to a full developer account by confirming an email. Authenticated by the agent's own API key (PRIMITIVE_API_KEY). Upgrading raises the send cap and grants the developer plan's default features (such as Functions). It does not unlock sending to arbitrary recipients: the account's recipient rules still apply (see `primitive sending permissions`). It emails a code and asks for it, so it needs a terminal; without one, use `primitive agent claim` and `primitive agent claim-verify`.";
+	static summary = "Upgrade an agent account to developer by email code (needs a terminal)";
 	static examples = ["<%= config.bin %> agent upgrade --email you@example.com"];
 	static flags = {
-		email: Flags.string({ description: "Email to confirm. Prompted if omitted." }),
-		code: Flags.string({ description: "Verification code from the email. Prompted if omitted." }),
+		email: Flags.string({ description: "Email to confirm. Prompted if omitted or blank." }),
+		code: Flags.string({ description: "Not accepted; for a code you already have, use `primitive agent claim-verify --verification-code <code>`. This command emails a new code, which replaces any code sent before." }),
 		"api-key": Flags.string({
 			env: "PRIMITIVE_API_KEY",
 			description: "Agent API key (defaults to PRIMITIVE_API_KEY or saved credentials)."
@@ -62505,14 +63095,17 @@ var AgentUpgradeCommand = class AgentUpgradeCommand extends Command {
 	};
 	async run() {
 		const { flags } = await this.parse(AgentUpgradeCommand);
+		const email = flags.email?.trim() || void 0;
+		if (flags.code !== void 0) this.error("Not upgrading: --code cannot be used here, because `primitive agent upgrade` emails a new code, which replaces the one you have. To use the code you have, run `primitive agent claim-verify --verification-code <code>`.", { exit: 2 });
+		if (!(process$1.stdin.isTTY && process$1.stderr.isTTY)) this.error(`Not upgrading: \`primitive agent upgrade\` emails a code and asks for it, so it needs a terminal. Without one, run \`primitive agent claim --email ${email ?? "<address>"}\` to send the code, then \`primitive agent claim-verify --verification-code <code>\`.`, { exit: 2 });
 		const { apiClient } = await createAuthenticatedCliApiClient({
 			apiKey: flags["api-key"],
 			apiBaseUrl: flags["api-base-url"],
 			configDir: this.config.configDir
 		});
-		const email = flags.email ?? await promptRequired$1("Email to confirm: ");
+		const address = email ?? await promptRequired$1("Email to confirm: ");
 		const started = await startAgentClaim({
-			body: { email },
+			body: { email: address },
 			client: apiClient.client,
 			responseStyle: "fields"
 		});
@@ -62521,8 +63114,8 @@ var AgentUpgradeCommand = class AgentUpgradeCommand extends Command {
 			this.exit(1);
 			return;
 		}
-		process$1.stderr.write(`Verification code sent to ${email}.\n`);
-		const code = flags.code ?? await promptRequired$1("Verification code: ");
+		process$1.stderr.write(`Verification code sent to ${address}.\n`);
+		const code = await promptRequired$1("Verification code: ");
 		const verified = await verifyAgentClaim({
 			body: { verification_code: code },
 			client: apiClient.client,
@@ -67339,7 +67932,7 @@ async function checkAccount(client) {
 		return {
 			outcome: {
 				status: "ok",
-				message: `${account.email ?? "account email not visible to this credential"} (plan: ${account.plan}, id: ${account.id})`
+				message: `account email ${account.email ?? "not visible to this credential"} (plan: ${account.plan}, id: ${account.id})`
 			},
 			account
 		};
@@ -67391,6 +67984,33 @@ async function checkDomains(client) {
 		};
 	}
 }
+/**
+* A background start that gave up, such as a receiver replacing its lost
+* supervisor, has no terminal to report to. Its saved reason is read
+* offline here, and only while the receiver is not receiving.
+*/
+function checkReceiverStart(configDir, profileName) {
+	try {
+		const receiver = savedReceiver(configDir, profileName);
+		if (receiver?.mode !== "native" || !receiver.session) return null;
+		const profile = loadConnectedAgentProfile(configDir, profileName);
+		if (!profile) return null;
+		const listener = backgroundListenStatus({
+			configDir,
+			scope: notificationScope(profile.api_base_url, profile.api_key),
+			threadId: receiver.session
+		});
+		const failure = listener.lastStartFailure;
+		if (!failure) return null;
+		return {
+			status: "warn",
+			message: `This profile's receiver is not receiving, and its last background start failed at ${new Date(failure.at).toISOString()} (${failure.reason}${failure.failureCode ? `, ${failure.failureCode}` : ""})`,
+			hint: `${listener.detail ? `${listener.detail} ` : ""}Inspect it with \`${receiverStatusCommand(configDir, profileName).command}\`.`
+		};
+	} catch {
+		return null;
+	}
+}
 var DoctorCommand = class DoctorCommand extends Command {
 	static description = `Run a one-shot environment health check: Node version, proxy env, CLI auth resolution, /account reachability, and verified-domain status. With PRIMITIVE_AGENT_PROFILE selected, reports saved identity offline and points to whoami and exact listener status instead of account-only checks. Prints actionable hints for each warning or failure.`;
 	static summary = "Check the local environment and live API for common problems";
@@ -67435,6 +68055,11 @@ var DoctorCommand = class DoctorCommand extends Command {
 			label: "Auth",
 			outcome: apiKeyCheck
 		});
+		const receiverStart = connected ? checkReceiverStart(this.config.configDir, connected.profileName) : null;
+		if (receiverStart) rows.push({
+			label: "Receiver",
+			outcome: receiverStart
+		});
 		if (!connected && apiKeyCheck.status !== "fail") {
 			const { apiClient, auth } = await createAuthenticatedCliApiClient({
 				apiKey: flags["api-key"],
@@ -68769,7 +69394,11 @@ var EmailsLatestCommand = class EmailsLatestCommand extends Command {
 			}
 			const rows = envelope?.data ?? [];
 			if (rows.length === 0) {
-				process.stderr.write(awaiting ? `No inbound emails with awaiting=${awaiting}.\n` : "No inbound emails yet. Send an email to one of your verified domains to populate this list.\n");
+				process.stderr.write(`${emptyEmailListHint({
+					filterFlags: awaiting ? [`--awaiting ${awaiting}`] : [],
+					caller: await readCallerMailFor(auth, apiClient.client),
+					orgHint: "(no results) No inbound emails yet. Send an email to one of your verified domains to populate this list."
+				})}\n`);
 				return;
 			}
 			const idWidth = pickIdWidth(Boolean(process.stdout.isTTY));
@@ -69008,7 +69637,9 @@ var EmailsWaitCommand = class EmailsWaitCommand extends Command {
 				await waiter?.close();
 			}
 		}
+		let reread = null;
 		while (!connected && (deadline === null || Date.now() < deadline)) {
+			const polledAt = Date.now();
 			let page;
 			try {
 				page = await fetchEmailSearchPage({
@@ -69044,11 +69675,29 @@ var EmailsWaitCommand = class EmailsWaitCommand extends Command {
 			const nextCursor = cursorFromAcceptedRows(page.rows);
 			const cursorAdvanced = Boolean(nextCursor && nextCursor !== cursor);
 			if (nextCursor) cursor = nextCursor;
+			if (cursor !== null) reread ??= lateMailReread({
+				pollIntervalMs: flags.interval * 1e3,
+				deadline,
+				start: polledAt
+			});
 			for (const email of collectNewAcceptedEmails(page.rows, seenIds)) {
 				printEmail(email);
 				if (matched >= flags.number) return;
 			}
 			if (cursorAdvanced) continue;
+			if (reread?.due()) {
+				const recent = await reread.read({
+					apiClient,
+					filters,
+					since,
+					fetchPage: fetchEmailSearchPage
+				});
+				for (const email of collectNewAcceptedEmails(recent.rows, seenIds)) {
+					printEmail(email);
+					if (matched >= flags.number) return;
+				}
+				if (!await waitOutRetryAfter(recent.failed, { deadline })) break;
+			}
 			if (deadline !== null && Date.now() >= deadline) break;
 			await sleep$3(flags.interval * 1e3);
 		}
@@ -69147,7 +69796,9 @@ var EmailsWatchCommand = class EmailsWatchCommand extends Command {
 		let failures = 0;
 		let printed = 0;
 		let headerPrinted = false;
+		let reread = null;
 		while (deadline === null || Date.now() < deadline) {
+			const polledAt = Date.now();
 			let page;
 			try {
 				page = await fetchEmailSearchPage({
@@ -69183,7 +69834,18 @@ var EmailsWatchCommand = class EmailsWatchCommand extends Command {
 			const nextCursor = cursorFromAcceptedRows(page.rows);
 			const cursorAdvanced = Boolean(nextCursor && nextCursor !== cursor);
 			if (nextCursor) cursor = nextCursor;
-			for (const email of collectNewAcceptedEmails(page.rows, seenIds)) {
+			if (cursor !== null) reread ??= lateMailReread({
+				pollIntervalMs: flags.interval * 1e3,
+				deadline,
+				start: polledAt
+			});
+			const recent = !cursorAdvanced && reread?.due() ? await reread.read({
+				apiClient,
+				filters,
+				since,
+				fetchPage: fetchEmailSearchPage
+			}) : { rows: [] };
+			for (const email of collectNewAcceptedEmails([...page.rows, ...recent.rows], seenIds)) {
 				if (flags.jsonl) this.log(JSON.stringify(email));
 				else {
 					if (!headerPrinted) {
@@ -69196,6 +69858,7 @@ var EmailsWatchCommand = class EmailsWatchCommand extends Command {
 				if (flags.number && printed >= flags.number) return;
 			}
 			if (cursorAdvanced) continue;
+			if (!await waitOutRetryAfter(recent.failed, { deadline })) break;
 			if (deadline !== null && Date.now() >= deadline) break;
 			await sleep$3(flags.interval * 1e3);
 		}
@@ -70352,8 +71015,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^3.0.0-preview.5";
-const CLI_VERSION_RANGE = "^3.0.0-preview.5";
+const SDK_VERSION_RANGE = "^3.0.0-preview.6";
+const CLI_VERSION_RANGE = "^3.0.0-preview.6";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -73102,6 +73765,30 @@ const APPROVAL_FLAGS = {
 		description: BROWSER_FLAG_DESCRIPTION
 	})
 };
+/**
+* A new expiry from --expires-at or --no-expiry: a time with its time zone,
+* null for none, or undefined when neither was given. The API checks the date
+* itself; this refuses what is plainly not such a time before sending it.
+*/
+function expiryFromFlags(flags) {
+	if (flags["no-expiry"]) return {
+		ok: true,
+		expiresAt: null
+	};
+	const at = flags["expires-at"]?.trim();
+	if (at === void 0) return {
+		ok: true,
+		expiresAt: void 0
+	};
+	if (!/^\d{4}-\d{2}-\d{2}T([01]\d|2[0-3]):[0-5]\d(:[0-5]\d(\.\d+)?)?(Z|[+-]([01]\d|2[0-3]):[0-5]\d)$/.test(at) || Number.isNaN(Date.parse(at))) return {
+		ok: false,
+		message: `--expires-at takes an ISO 8601 time with its time zone, such as 2027-02-08T00:00:00Z, not ${JSON.stringify(at)}.`
+	};
+	return {
+		ok: true,
+		expiresAt: at
+	};
+}
 function unwrap(data) {
 	return data?.data ?? data;
 }
@@ -73145,6 +73832,21 @@ function listFlag(values) {
 function stringList(value) {
 	return Array.isArray(value) && value.every((v) => typeof v === "string") ? [...value] : null;
 }
+/**
+* The rules a key's mail scope lists that read nothing any more, each with
+* why: a deleted rule (rule_deleted) or a share that ended (share_ended).
+*/
+function endedRules(scope) {
+	if (!Array.isArray(scope.ended_rules)) return [];
+	return scope.ended_rules.flatMap((entry) => {
+		if (!entry || typeof entry !== "object") return [];
+		const { id, reason } = entry;
+		return typeof id === "string" ? [{
+			id,
+			reason: typeof reason === "string" ? reason : "ended"
+		}] : [];
+	});
+}
 /** Which mail a key reaches, in words. */
 function describeMailScope(grant) {
 	if (grant.template === "super_admin") return "every mailbox";
@@ -73160,7 +73862,9 @@ function describeMailScope(grant) {
 	if (addresses.length > 0) parts.push(`addresses ${addresses.join(", ")}`);
 	if (domains.length > 0) parts.push(`domains ${domains.join(", ")}`);
 	if (rules.length > 0) parts.push(`rules ${rules.join(", ")}`);
-	return parts.length > 0 ? parts.join("; ") : "no mailbox";
+	const ended = endedRules(record);
+	const reaches = parts.length > 0 ? parts.join("; ") : "no mailbox";
+	return ended.length > 0 ? `${reaches}; ended rules ${ended.map((r) => `${r.id} (${r.reason})`).join(", ")}` : reaches;
 }
 /** What a key may do, in words. */
 function describePermissions(grant) {
@@ -73188,6 +73892,10 @@ function formatKeyDetail(key) {
 		`Last used:    ${key.last_used_at ?? "never"}`,
 		`Suspended:    ${key.suspended ? "yes" : "no"}`
 	];
+	if (key.status === "revoked") {
+		const by = key.revoked_by ? ` by user ${key.revoked_by}` : "";
+		lines.push(`Revoked:      ${key.revoked_at ?? "yes"}${by}`);
+	}
 	if (key.agent_address) lines.push(`Agent:        ${key.agent_address}`);
 	if (key.grant.template) lines.push(`Permissions:  ${describePermissions(key.grant)}`);
 	else {
@@ -73269,16 +73977,64 @@ function buildCreateGrant(choice) {
 		message: `--preset must be one of ${KEY_PRESETS.join(", ")}.`
 	};
 }
-/** The mail scope fields a change can send back unchanged. */
+/**
+* The mail scope fields a change can restate. `ended_rules` (rules the key
+* lists that read nothing any more: a deleted rule, or a share that ended) is
+* read only: a change never sends it back, so the key is saved without them.
+*/
 const RESTATABLE_SCOPE_FIELDS = /* @__PURE__ */ new Set([
 	"addresses",
 	"domains",
 	"rules",
-	"depth"
+	"depth",
+	"ended_rules"
 ]);
+/** Whether a change touches the key's email rules at all. */
+function changesRules(change) {
+	return change.rules !== void 0 || (change.addRules?.length ?? 0) > 0 || (change.removeRules?.length ?? 0) > 0;
+}
+/**
+* The rules a key lists after `change`: replaced by --rule, or the ones it has
+* with --add-rule added and --remove-rule taken off. The API takes a key's
+* whole grant, so a partial change is made here on the grant just read, and
+* the update is guarded by that grant's ref. Rule ids are compared as the
+* server stores them, lowercase.
+*/
+function nextRules(current, change) {
+	if (change.rules) return change.rules;
+	const removing = new Set((change.removeRules ?? []).map((r) => r.toLowerCase()));
+	const kept = current.filter((r) => !removing.has(r.toLowerCase()));
+	const have = new Set(kept.map((r) => r.toLowerCase()));
+	const adding = [];
+	for (const rule of change.addRules ?? []) {
+		const id = rule.toLowerCase();
+		if (have.has(id)) continue;
+		have.add(id);
+		adding.push(id);
+	}
+	return [...kept, ...adding];
+}
+/** Whether two lists hold the same values, in any order. */
+function sameSet(a, b) {
+	const left = new Set(a);
+	const right = new Set(b);
+	return left.size === right.size && [...left].every((v) => right.has(v));
+}
+/**
+* The rules a key's grant lists, or none: the ones it reads through, and the
+* ones that read nothing any more (`ended_rules`), which a change to the key
+* takes off.
+*/
+function keyRules(grant) {
+	const scope = grant.mail_scope;
+	if (!scope || typeof scope !== "object" || Array.isArray(scope)) return [];
+	const record = scope;
+	return [...stringList(record.rules ?? []) ?? [], ...endedRules(record).map((rule) => rule.id)];
+}
 /**
 * The grant that restates a key's current grant with permissions added or
-* removed, or its email rules replaced, and everything else as it is. Only a
+* removed, or its email rules replaced, added to or taken off (nextRules), and
+* everything else as it is. Only a
 * key with a permission list and a mail scope the CLI can restate exactly;
 * anything else is changed in the dashboard.
 */
@@ -73291,10 +74047,14 @@ function buildUpdatedGrant(current, change) {
 		ok: false,
 		message: `This key's permissions come from its template (${current.template}) and are not changed here.`
 	};
+	if (!("resources" in current)) return {
+		ok: false,
+		message: "The server does not say whether this key is limited to selected Functions, domains, endpoints or routes, so the CLI does not restate its grant: that could drop such limits. Change it in the dashboard."
+	};
 	const resources = current.resources;
 	if (resources !== void 0 && resources !== null && (typeof resources !== "object" || Object.keys(resources).length > 0)) return {
 		ok: false,
-		message: "This key is limited to selected resources, which the CLI cannot restate. Change it in the dashboard."
+		message: "This key is limited to selected Functions, domains, endpoints or routes, which a change to its grant cannot keep. To change what it can do, create a key with what you need and revoke this one."
 	};
 	const held = stringList(current.permissions);
 	if (!held) return {
@@ -73308,7 +74068,7 @@ function buildUpdatedGrant(current, change) {
 	};
 	const scope = current.mail_scope;
 	if (scope === "org") {
-		if (change.rules) return {
+		if (changesRules(change)) return {
 			ok: false,
 			message: "This key reaches every mailbox, so email rules cannot be set on it. Create a key limited to the rules instead."
 		};
@@ -73329,15 +74089,28 @@ function buildUpdatedGrant(current, change) {
 	const record = scope;
 	const addresses = stringList(record.addresses ?? []);
 	const domains = stringList(record.domains ?? []);
-	const rules = change.rules ?? stringList(record.rules ?? []);
-	if (!addresses || !domains || !rules || Object.keys(record).some((field) => !RESTATABLE_SCOPE_FIELDS.has(field))) return {
+	const heldRules = stringList(record.rules ?? []);
+	const ended = endedRules(record);
+	const readdedEnded = ended.find((rule) => [...change.addRules ?? [], ...change.rules ?? []].some((asked) => asked.toLowerCase() === rule.id.toLowerCase()));
+	if (readdedEnded) return {
 		ok: false,
-		message: "This key's mail scope has settings the CLI cannot restate. Change it in the dashboard."
+		message: `${readdedEnded.id} reads nothing any more (${readdedEnded.reason}), so it cannot be added back to the key.`
 	};
-	if (addresses.length === 0 && domains.length === 0 && rules.length === 0) return {
+	const rules = heldRules ? nextRules(heldRules, change) : null;
+	if (!addresses || !domains || !rules || Object.keys(record).some((field) => !RESTATABLE_SCOPE_FIELDS.has(field))) return {
 		ok: false,
-		message: "The key would reach no mail. Keep at least one address, domain or rule."
+		message: "This key's mail scope has settings the CLI cannot restate. Change it in the dashboard."
 	};
+	if (addresses.length === 0 && domains.length === 0 && rules.length === 0) {
+		if ((heldRules?.length ?? 0) === 0 && ended.length > 0) return {
+			ok: false,
+			message: "This key reads no mail any more: its only rules were deleted or their shares ended. Revoke it with `primitive keys revoke <key-id>`."
+		};
+		return {
+			ok: false,
+			message: "The key would reach no mail. Keep at least one address, domain or rule."
+		};
+	}
 	return {
 		ok: true,
 		grant: {
@@ -73552,9 +74325,15 @@ var KeysCreateCommand = class KeysCreateCommand extends Command {
 var KeysRotateCommand = class KeysRotateCommand extends Command {
 	static description = `Rotate an API key: make a successor with the same permissions and print its secret once. The old key keeps working for the overlap, then stops.
 
+  The new key keeps the old key's expiry: rotating alone does not extend a key. Pass --expires-at to give the new key another one, within your organization's credential policy, or --no-expiry for none where the policy allows. Either needs keys:manage. The old key never outlives the new one.
+
   The rotation runs directly; if your organization requires approval, the command prints the approval link and takes --step-up-token, as for a new key. Store the new secret right away: it is not shown again and the CLI does not save it.`;
 	static summary = "Rotate an API key";
-	static examples = ["<%= config.bin %> keys rotate 0f0e0d0c-0b0a-4908-8706-050403020100", "<%= config.bin %> keys rotate 0f0e0d0c-0b0a-4908-8706-050403020100 --overlap-seconds 0"];
+	static examples = [
+		"<%= config.bin %> keys rotate 0f0e0d0c-0b0a-4908-8706-050403020100",
+		"<%= config.bin %> keys rotate 0f0e0d0c-0b0a-4908-8706-050403020100 --overlap-seconds 0",
+		"<%= config.bin %> keys rotate 0f0e0d0c-0b0a-4908-8706-050403020100 --expires-at 2027-02-08T00:00:00Z"
+	];
 	static args = { id: Args.string({
 		description: "The key's id.",
 		required: true
@@ -73566,13 +74345,26 @@ var KeysRotateCommand = class KeysRotateCommand extends Command {
 			description: "How long the old key keeps working, in seconds. 0 stops it now.",
 			min: 0
 		}),
+		"expires-at": Flags.string({
+			description: "Give the new key this expiry (ISO 8601 with a time zone) instead of the old key's.",
+			exclusive: ["no-expiry"]
+		}),
+		"no-expiry": Flags.boolean({
+			description: "Give the new key no expiry, where the policy allows.",
+			exclusive: ["expires-at"]
+		}),
 		...APPROVAL_FLAGS,
 		json: Flags.boolean({ description: "Print the new key, its secret included, as JSON." })
 	};
 	async run() {
 		const { args, flags } = await this.parse(KeysRotateCommand);
+		const expiry = expiryFromFlags(flags);
+		if (!expiry.ok) this.error(expiry.message, { exit: 2 });
 		const auth = await authenticate(this, flags);
-		const body = flags["overlap-seconds"] === void 0 ? {} : { overlap_seconds: flags["overlap-seconds"] };
+		const body = {
+			...flags["overlap-seconds"] === void 0 ? {} : { overlap_seconds: flags["overlap-seconds"] },
+			...expiry.expiresAt === void 0 ? {} : { expires_at: expiry.expiresAt }
+		};
 		const result = await withApproval((token) => call(rotateKey({
 			client: auth.apiClient.client,
 			path: { id: args.id },
@@ -73584,22 +74376,25 @@ var KeysRotateCommand = class KeysRotateCommand extends Command {
 			return;
 		}
 		const rotated = result.data;
-		printSecret(this, Boolean(flags.json), rotated, rotated.key, `Rotated key ${rotated.previous_key_id}. The new key is ${rotated.id}, prefix ${rotated.key_prefix}. The old key works until ${rotated.previous_key_expires_at}.`);
+		printSecret(this, Boolean(flags.json), rotated, rotated.key, `Rotated key ${rotated.previous_key_id}. The new key is ${rotated.id}, prefix ${rotated.key_prefix}${rotated.expires_at === void 0 ? "" : `, and expires ${rotated.expires_at ?? "never"}`}. The old key works until ${rotated.previous_key_expires_at}.`);
 	}
 };
 var KeysUpdateCommand = class KeysUpdateCommand extends Command {
-	static description = `Change an API key's permissions, email rules or name. It keeps its id and secret.
+	static description = `Change an API key's permissions, email rules, name or expiry. It keeps its id and secret.
 
-  --add and --remove take permissions (repeatable, or comma-separated). --rule sets the email rules the key reaches, replacing the ones it has. Everything else about the key stays as it is.
+  --add and --remove take permissions (repeatable, or comma-separated). --add-rule and --remove-rule add email rules to the key or take them off, and keep its other rules. --rule replaces every rule the key has with the ones given, so pass all the rules it should keep; it cannot be combined with --add-rule or --remove-rule. --expires-at gives it a new expiry: a later one extends it, within your organization's credential policy, and is how to keep a key working past its expiry (rotating keeps the expiry). --no-expiry removes it where the policy allows. An expired key cannot be extended. Everything else about the key stays as it is, and the output lists any rules a change took off.
 
   The change runs directly; if your organization requires approval, the command prints the approval link and takes --step-up-token, as for a new key. A key never holds more than you do.
 
-  With --json it prints the key as it is now, in the shape keys get prints, with changed, warnings and address_warnings alongside, and notice when its permissions or mail changed. If the key cannot be read back after the change, key_error says why and only the change's fields are printed.`;
+  With --json it prints the key as it is now, in the shape keys get prints, with changed, warnings and address_warnings alongside, notice when its permissions or mail changed, rules_removed when a change took rules off, and rules_not_on_key for rules asked to be taken off that it did not have. A permission or rule change that leaves the grant as it is, with no --name, --expires-at or --no-expiry, sends nothing and prints the key with changed: []. If the key cannot be read back after the change, key_error says why and only the change's fields are printed.`;
 	static summary = "Change an API key";
 	static examples = [
 		"<%= config.bin %> keys update 0f0e0d0c-0b0a-4908-8706-050403020100 --add mail:send,mail:reply",
 		"<%= config.bin %> keys update 0f0e0d0c-0b0a-4908-8706-050403020100 --remove mail:send",
-		"<%= config.bin %> keys update 0f0e0d0c-0b0a-4908-8706-050403020100 --rule 3b0f6a1e-6c7a-4f43-9d8e-2a1b5c4d3e2f"
+		"<%= config.bin %> keys update 0f0e0d0c-0b0a-4908-8706-050403020100 --add-rule 3b0f6a1e-6c7a-4f43-9d8e-2a1b5c4d3e2f",
+		"<%= config.bin %> keys update 0f0e0d0c-0b0a-4908-8706-050403020100 --remove-rule 3b0f6a1e-6c7a-4f43-9d8e-2a1b5c4d3e2f",
+		"<%= config.bin %> keys update 0f0e0d0c-0b0a-4908-8706-050403020100 --rule 3b0f6a1e-6c7a-4f43-9d8e-2a1b5c4d3e2f",
+		"<%= config.bin %> keys update 0f0e0d0c-0b0a-4908-8706-050403020100 --expires-at 2027-02-08T00:00:00Z"
 	];
 	static args = { id: Args.string({
 		description: "The key's id.",
@@ -73617,24 +74412,58 @@ var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 			multiple: true
 		}),
 		rule: Flags.string({
-			description: "An email rule id the key reaches (repeatable). Replaces the key's rules.",
+			description: "An email rule id the key reaches (repeatable, or comma-separated). Replaces every rule the key has: pass all the rules it should keep, or use --add-rule and --remove-rule.",
+			multiple: true,
+			exclusive: ["add-rule", "remove-rule"]
+		}),
+		"add-rule": Flags.string({
+			description: "An email rule id to add to the key (repeatable, or comma-separated). Its other rules stay.",
+			multiple: true
+		}),
+		"remove-rule": Flags.string({
+			description: "An email rule id to take off the key (repeatable, or comma-separated). Its other rules stay.",
 			multiple: true
 		}),
 		name: Flags.string({ description: "A new name for the key." }),
+		"expires-at": Flags.string({
+			description: "A new expiry, ISO 8601 with a time zone. A later one extends the key.",
+			exclusive: ["no-expiry"]
+		}),
+		"no-expiry": Flags.boolean({
+			description: "Remove the key's expiry, where the policy allows.",
+			exclusive: ["expires-at"]
+		}),
 		...APPROVAL_FLAGS,
 		json: Flags.boolean({ description: "Print the result as JSON." })
 	};
 	async run() {
 		const { args, flags } = await this.parse(KeysUpdateCommand);
+		const expiry = expiryFromFlags(flags);
+		if (!expiry.ok) this.error(expiry.message, { exit: 2 });
 		const add = listFlag(flags.add);
 		const remove = listFlag(flags.remove);
 		const rules = flags.rule ? listFlag(flags.rule) : void 0;
+		const addRules = listFlag(flags["add-rule"]);
+		const removeRules = listFlag(flags["remove-rule"]);
 		const both = add.filter((p) => remove.includes(p));
 		if (both.length > 0) this.error(`Both added and removed: ${both.join(", ")}.`, { exit: 2 });
-		const changesGrant = add.length > 0 || remove.length > 0 || !!rules;
-		if (!changesGrant && flags.name === void 0) this.error("Nothing to change: pass --add, --remove, --rule or --name.", { exit: 2 });
+		const bothRules = addRules.filter((r) => removeRules.some((x) => x.toLowerCase() === r.toLowerCase()));
+		if (bothRules.length > 0) this.error(`Both added and removed: ${bothRules.join(", ")}.`, { exit: 2 });
+		const ruleChange = {
+			...rules ? { rules } : {},
+			...addRules.length > 0 ? { addRules } : {},
+			...removeRules.length > 0 ? { removeRules } : {}
+		};
+		const changesGrant = add.length > 0 || remove.length > 0 || Object.keys(ruleChange).length > 0;
+		if (!changesGrant && flags.name === void 0 && expiry.expiresAt === void 0) this.error("Nothing to change: pass --add, --remove, --add-rule, --remove-rule, --rule, --name, --expires-at or --no-expiry.", { exit: 2 });
+		let rulesBefore = [];
+		let rulesRemoved = [];
+		let rulesNotOnKey = [];
 		const auth = await authenticate(this, flags);
-		const body = { ...flags.name !== void 0 ? { name: flags.name } : {} };
+		const body = {
+			...flags.name !== void 0 ? { name: flags.name } : {},
+			...expiry.expiresAt !== void 0 ? { expires_at: expiry.expiresAt } : {}
+		};
 		if (changesGrant) {
 			const current = await call(getKey({
 				client: auth.apiClient.client,
@@ -73644,15 +74473,36 @@ var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 				reportKeysError(this, current, auth, Boolean(flags.json));
 				return;
 			}
+			if (current.data.status === "revoked") this.error(`Key ${args.id} is revoked, so it cannot be changed.`, { exit: 1 });
+			rulesBefore = keyRules(current.data.grant);
 			const next = buildUpdatedGrant(current.data.grant, {
 				add,
 				remove,
-				...rules ? { rules } : {}
+				...ruleChange
 			});
-			if (!next.ok) this.error(next.message, { exit: 2 });
-			body.grant = next.grant;
-			const ref = current.data.grant.ref;
-			if (typeof ref === "string") body.expected_grant_ref = ref;
+			if (!next.ok) this.error(next.message.replace("<key-id>", args.id), { exit: 2 });
+			rulesNotOnKey = removeRules.filter((r) => !rulesBefore.some((k) => k.toLowerCase() === r.toLowerCase()));
+			if (rulesNotOnKey.length > 0 && !flags.json) process.stderr.write(`Not on this key, so nothing to take off: ${rulesNotOnKey.join(", ")}.\n`);
+			const sentRules = stringList(next.grant.rules ?? []) ?? [];
+			rulesRemoved = rulesBefore.filter((r) => !sentRules.some((k) => k.toLowerCase() === r.toLowerCase()));
+			if (!(sameSet(next.permissions, stringList(current.data.grant.permissions) ?? []) && sameSet(sentRules.map((r) => r.toLowerCase()), rulesBefore.map((r) => r.toLowerCase())))) {
+				body.grant = next.grant;
+				const ref = current.data.grant.ref;
+				if (typeof ref === "string") body.expected_grant_ref = ref;
+				else if (!flags.json) process.stderr.write("Note: the server did not say which grant this key holds, so this change is not checked against changes made since it was read.\n");
+			} else if (flags.name === void 0 && expiry.expiresAt === void 0) {
+				if (flags.json) {
+					this.log(JSON.stringify({
+						...current.data,
+						changed: [],
+						warnings: [],
+						...rulesNotOnKey.length > 0 ? { rules_not_on_key: rulesNotOnKey } : {}
+					}, null, 2));
+					return;
+				}
+				this.log(`Key ${args.id} already matched; nothing changed.`);
+				return;
+			}
 		}
 		const result = await withApproval((token) => call(updateKey({
 			client: auth.apiClient.client,
@@ -73674,6 +74524,8 @@ var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 				...after?.ok ? after.data : {},
 				...result.data,
 				...grantChanged ? { notice: HELD_REQUEST_NOTICE } : {},
+				...grantChanged && rulesRemoved.length > 0 ? { rules_removed: rulesRemoved } : {},
+				...rulesNotOnKey.length > 0 ? { rules_not_on_key: rulesNotOnKey } : {},
 				...after && !after.ok ? { key_error: after.payload } : {}
 			}, null, 2));
 			return;
@@ -73685,11 +74537,25 @@ var KeysUpdateCommand = class KeysUpdateCommand extends Command {
 			this.log(`Permissions: ${describePermissions(after.data.grant)}`);
 			this.log(`Mail: ${describeMailScope(after.data.grant)}`);
 		}
+		if (grantChanged && rulesRemoved.length > 0) this.log(`Rules taken off: ${rulesRemoved.join(", ")}`);
+		if (changed.includes("expires_at")) this.log(`Expires: ${expiry.expiresAt ?? "never"}`);
 		if (grantChanged) process.stderr.write(`${HELD_REQUEST_NOTICE}\n`);
 	}
 };
+/**
+* What a revoked key set up or owns, split as revocation splits it: what the
+* organization owns keeps working, and what the key itself owned (its own
+* webhooks, say) keeps working only while someone can still act for it, such
+* as a key of the same rotation that still works. Null when there is none.
+*/
+function standingSummary(standing) {
+	if (!Array.isArray(standing) || standing.length === 0) return null;
+	const keyOwned = standing.filter((item) => item.org_owned === false).length;
+	const kept = standing.length - keyOwned;
+	return `${[...kept > 0 ? [`${kept} item(s) the organization owns keep working.`] : [], ...keyOwned > 0 ? [`${keyOwned} item(s) the key owned itself or carried on for the keys it was rotated from, such as its own webhooks, which keep working only while someone can still act for them, such as a key of the same rotation that still works.`] : []].join(" ")} Review them with --json.`;
+}
 var KeysRevokeCommand = class KeysRevokeCommand extends Command {
-	static description = `Revoke an API key. It stops working at once; what it set up keeps working and is listed for review.
+	static description = `Revoke an API key. It stops working at once. What the organization owns keeps working; what the key itself owns, such as its own webhooks, keeps working only while someone can still act for it, such as a key of the same rotation that still works. What it set up or owns is listed for review.
 
   Asks for confirmation first; pass --yes to skip the prompt in scripts. Revoking runs directly. If your organization requires approval, the command prints the approval link, opens it where it can and waits for the one-time token; in a script, approve and run it again with --step-up-token.`;
 	static summary = "Revoke an API key";
@@ -73738,9 +74604,9 @@ var KeysRevokeCommand = class KeysRevokeCommand extends Command {
 			this.log(JSON.stringify(result.data, null, 2));
 			return;
 		}
-		this.log(`Revoked key ${args.id}.`);
-		const standing = result.data.standing_objects;
-		if (Array.isArray(standing) && standing.length > 0) this.log(`It set up ${standing.length} item(s) that keep working. Review them with --json.`);
+		this.log(result.data.already_revoked === true ? `Key ${args.id} was already revoked; nothing changed.` : `Revoked key ${args.id}.`);
+		const summary = standingSummary(result.data.standing_objects);
+		if (summary) this.log(summary);
 	}
 };
 const hash = (value) => createHash("sha256").update(value).digest("hex");
@@ -75779,14 +76645,13 @@ var ListenCommand = class ListenCommand extends Command {
 			threadId: flags["notify-session"]
 		} : void 0;
 		const socketPath = target && !flags.status && !flags.stop ? flags["session-socket"] ?? defaultSessionSocket() : void 0;
-		const configuration = target ? createHash("sha256").update(JSON.stringify({
-			version: this.config.version,
+		const configuration = target ? backgroundListenConfiguration({
 			contacts: Boolean(flags.contacts),
 			contactRequests: Boolean(flags["contact-requests"]),
-			senders: [...senders ?? []].sort(),
+			senders: senders ?? [],
 			socketPath,
-			events: flags.events?.split(",").map((event) => event.trim()).sort()
-		})).digest("hex") : void 0;
+			events: flags.events?.split(",")
+		}) : void 0;
 		if (target) verifyBackgroundListenTarget({
 			...target,
 			configuration
@@ -76702,7 +77567,7 @@ var LoginCommand$1 = class extends Command {
 		process.stderr.write("Logged in as yourself. Switch organizations with `primitive org use <org>`, or pass --org <org> to one command.\n");
 		if (login.org) {
 			const name = login.org.org_name ? ` (${login.org.org_name})` : "";
-			process.stderr.write(`Current organization: ${login.org.org_id}${name}, role ${login.org.role}.\n`);
+			process.stderr.write(`Current organization: ${login.org.org_id}${name}, ${login.org.role ? roleKeyText(login.org.role) : "role unknown"}.\n`);
 		} else if (login.org_refusal) process.stderr.write(`The organization chosen in the browser (${login.org_refusal.org_id}) cannot be used from the CLI: ${login.org_refusal.message} [${login.org_refusal.reason}]\nRun \`primitive orgs\` to see where you can, then \`primitive org use <org>\`.\n`);
 		const wantedOrg = process.env[ORG_SELECTION_ENV]?.trim();
 		const alreadyThere = wantedOrg && login.org && (wantedOrg.toLowerCase() === login.org.org_id.toLowerCase() || wantedOrg.toLowerCase() === (login.org.org_name ?? "").toLowerCase());
@@ -76715,7 +77580,7 @@ var LoginCommand$1 = class extends Command {
 				selection: wantedOrg
 			});
 			const name = org.org_name ? ` (${org.org_name})` : "";
-			process.stderr.write(`Switched to organization ${org.org_id}${name}, role ${org.role ?? "unknown"}.\n`);
+			process.stderr.write(`Switched to organization ${org.org_id}${name}, ${org.role ? roleKeyText(org.role) : "role unknown"}.\n`);
 		} catch (error) {
 			const detail = error instanceof Error ? error.message : String(error);
 			const reason = error instanceof CliOrgRefusedError ? ` [${error.reason}]` : "";
@@ -76730,6 +77595,7 @@ const INVALID_VERIFICATION_CODE = "invalid_verification_code";
 const EXPIRED_TOKEN = "expired_token";
 const INVALID_SIGNUP_TOKEN = "invalid_signup_token";
 const SLOW_DOWN = "slow_down";
+const MANAGED_DOMAIN = "managed_domain";
 const PENDING_SIGNUP_FILE = "signup.json";
 const DEFAULT_SIGNUP_COMMAND_COPY = {
 	actionNoun: "signup",
@@ -76741,6 +77607,52 @@ const DEFAULT_SIGNUP_COMMAND_COPY = {
 function cliError$2(message) {
 	return new Errors.CLIError(message, { exit: 1 });
 }
+function usageError$1(message) {
+	return new Errors.CLIError(message, { exit: 2 });
+}
+function canPrompt(interactive) {
+	return interactive ?? Boolean(process$1.stdin.isTTY && process$1.stderr.isTTY);
+}
+/** The email address given, or undefined when none (or only blanks) was. */
+function givenEmail(email) {
+	return email?.trim() ? email : void 0;
+}
+/**
+* Refuse an email-code start that would have to prompt when there is no one
+* to answer. Commands call it before taking the credentials lock, so the
+* refusal comes before anything is read, written or sent.
+*/
+function refuseEmailCodeStartWithoutTerminal(params) {
+	if (canPrompt(params.interactive)) return;
+	const copy = params.copy ?? DEFAULT_SIGNUP_COMMAND_COPY;
+	const email = givenEmail(params.email);
+	if (email === void 0) throw usageError$1(`Not starting ${copy.actionNoun}: no terminal to ask for the email address in. Pass the address as an argument, for example \`primitive ${copy.startCommand("<email>")} --accept-terms\`.`);
+	if (!params.flags["accept-terms"]) throw usageError$1(`Not starting ${copy.actionNoun}: no terminal to accept the terms in. To accept Primitive's Terms of Service (https://primitive.dev/terms) and Privacy Policy (https://primitive.dev/privacy), add --accept-terms to the same command, for example \`primitive ${copy.startCommand(email)} --accept-terms\`.`);
+}
+/** `signup interactive` asks for everything, so it needs a terminal. */
+function refuseInteractiveSignupWithoutTerminal(interactive) {
+	if (canPrompt(interactive)) return;
+	throw usageError$1("Not starting signup: `primitive signup interactive` needs a terminal to ask for the email address and code in. Run `primitive signup <email> --accept-terms`, then `primitive signup confirm <email> <code>`.");
+}
+function emailDomain(email) {
+	const at = email.lastIndexOf("@");
+	const domain = at === -1 ? "" : email.slice(at + 1).trim().toLowerCase();
+	return domain === "" ? null : domain;
+}
+/**
+* The server sends no emailed code to an address on a domain Primitive
+* receives mail for. Its refusal is worded for signup; someone logging in
+* needs to hear which way does sign them in.
+*/
+function managedDomainLoginError(params) {
+	const domain = emailDomain(params.email);
+	const subject = domain ? `Primitive sends no emailed code to addresses on ${domain}, a domain it receives mail for.` : "Primitive sends no emailed code to this address, which is on a domain it receives mail for.";
+	const run = params.interactive ? `\`primitive ${params.browserLoginCommand}\`` : `\`primitive ${params.browserLoginCommand} --no-browser\` and open the link it prints`;
+	return new Errors.CLIError(`${subject} Use browser login instead: run ${run}.`, {
+		code: MANAGED_DOMAIN,
+		exit: 1
+	});
+}
 function unwrapData$1(value) {
 	return value?.data ?? null;
 }
@@ -76964,7 +77876,7 @@ async function confirmTerms() {
 	process$1.stderr.write("  https://primitive.dev/terms\n");
 	process$1.stderr.write("  https://primitive.dev/privacy\n");
 	const answer = (await promptRequired("Type 'yes' to continue: ")).toLowerCase();
-	if (answer !== "yes" && answer !== "y") throw cliError$2("You must accept the terms to create an account.");
+	if (answer !== "yes" && answer !== "y") throw cliError$2("You must accept the terms to continue.");
 }
 async function checkExistingCredentials(params) {
 	const copy = params.copy ?? DEFAULT_SIGNUP_COMMAND_COPY;
@@ -76990,7 +77902,7 @@ async function checkExistingCredentials(params) {
 		credentialsLockHeld: true
 	});
 	if (existingStatus.status === "removed_stale") {
-		process$1.stderr.write("Continuing with Primitive signup...\n");
+		process$1.stderr.write(`Continuing with Primitive ${copy.actionNoun}...\n`);
 		return;
 	}
 	if (existingStatus.status === "blocked") {
@@ -77032,8 +77944,14 @@ async function startSignup(params) {
 		responseStyle: "fields"
 	});
 	if (started.error) {
-		writeErrorWithHints(extractErrorPayload(started.error));
-		throw cliError$2("Could not start Primitive agent signup.");
+		const payload = extractErrorPayload(started.error);
+		if (copy.browserLoginCommand && extractErrorCode(payload) === MANAGED_DOMAIN) throw managedDomainLoginError({
+			browserLoginCommand: copy.browserLoginCommand,
+			email: params.email,
+			interactive: canPrompt(params.deps.interactive)
+		});
+		writeErrorWithHints(payload);
+		throw cliError$2(`Could not start Primitive ${copy.actionNoun}.`);
 	}
 	const startResult = unwrapData$1(started.data);
 	if (!startResult) throw cliError$2("Primitive API returned an empty agent signup response.");
@@ -77074,13 +77992,19 @@ async function resendVerificationCode(params) {
 	}
 	if (code === EXPIRED_TOKEN || code === INVALID_SIGNUP_TOKEN) deletePendingAgentSignup(params.configDir);
 	writeErrorWithHints(payload);
-	throw cliError$2("Could not resend Primitive agent signup verification email.");
+	throw cliError$2(`Could not resend the Primitive ${(params.copy ?? DEFAULT_SIGNUP_COMMAND_COPY).actionNoun} verification email.`);
 }
 async function runSignupStartWithCredentialLock(params) {
 	const { configDir, flags } = params;
 	const deps = params.deps ?? {};
+	refuseEmailCodeStartWithoutTerminal({
+		copy: params.copy,
+		email: params.email,
+		flags,
+		interactive: deps.interactive
+	});
 	const promptRequiredFn = deps.promptRequired ?? promptRequired;
-	const email = params.email ?? await promptRequiredFn("Email: ");
+	const email = givenEmail(params.email) ?? await promptRequiredFn("Email: ");
 	await checkExistingCredentials({
 		apiBaseUrl: flags["api-base-url"],
 		configDir,
@@ -77149,10 +78073,16 @@ async function runSignupConfirmWithCredentialLock(params) {
 	}
 	const payload = extractErrorPayload(verified.error);
 	const code = extractErrorCode(payload);
-	if (code === INVALID_VERIFICATION_CODE) throw cliError$2(`Invalid verification code. Try again, run ${(params.copy ?? DEFAULT_SIGNUP_COMMAND_COPY).resendCommand(params.email)}, or run primitive signup status.`);
+	const copy = params.copy ?? DEFAULT_SIGNUP_COMMAND_COPY;
+	if (code === INVALID_VERIFICATION_CODE) throw cliError$2(`Invalid verification code. Try again, run ${copy.resendCommand(params.email)}, or run primitive signup status.`);
+	if (copy.browserLoginCommand && code === MANAGED_DOMAIN) throw managedDomainLoginError({
+		browserLoginCommand: copy.browserLoginCommand,
+		email: params.email,
+		interactive: canPrompt(deps.interactive)
+	});
 	if (code === EXPIRED_TOKEN || code === INVALID_SIGNUP_TOKEN) deletePendingAgentSignup(configDir);
 	writeErrorWithHints(payload);
-	throw cliError$2("Primitive agent signup failed while verifying the account.");
+	throw cliError$2(`Primitive ${copy.actionNoun} failed while verifying the account.`);
 }
 async function runSignupResendWithCredentialLock(params) {
 	const deps = params.deps ?? {};
@@ -77167,11 +78097,12 @@ async function runSignupResendWithCredentialLock(params) {
 		configDir: params.configDir,
 		email: params.email
 	}) : loadPendingAgentSignup(params.configDir, requestConfig.resolvedApiBaseUrl);
-	if (!pending) throw cliError$2(`No pending ${copy.actionNoun} found. Run \`primitive signup status\` to inspect pending state, or start one with \`${pendingSignupStartCommand()}\`.`);
+	if (!pending) throw cliError$2(`No pending ${copy.actionNoun} found. Run \`primitive signup status\` to inspect pending state, or start one with \`primitive ${copy.startCommand("<email>")} --accept-terms\`.`);
 	const resend = await resendVerificationCode({
 		apiBaseUrl: requestConfig.resolvedApiBaseUrl,
 		apiClient,
 		configDir: params.configDir,
+		copy,
 		deps,
 		start: pending
 	});
@@ -77180,6 +78111,7 @@ async function runSignupResendWithCredentialLock(params) {
 async function runSignupInteractiveWithCredentialLock(params) {
 	const { configDir, flags } = params;
 	const deps = params.deps ?? {};
+	refuseInteractiveSignupWithoutTerminal(deps.interactive);
 	const promptRequiredFn = deps.promptRequired ?? promptRequired;
 	await checkExistingCredentials({
 		apiBaseUrl: flags["api-base-url"],
@@ -77243,7 +78175,7 @@ async function runSignupInteractiveWithCredentialLock(params) {
 }
 function commonStartFlags() {
 	return {
-		"accept-terms": Flags.boolean({ description: "Confirm acceptance of Primitive's Terms of Service and Privacy Policy" }),
+		"accept-terms": Flags.boolean({ description: "Confirm acceptance of Primitive's Terms of Service and Privacy Policy. Required when there is no terminal to ask in." }),
 		"api-base-url": Flags.string({
 			description: "Override the primary API base URL. Internal testing only; not documented to customers.",
 			env: "PRIMITIVE_API_BASE_URL",
@@ -77271,6 +78203,10 @@ var SignupCommand = class SignupCommand extends Command {
 	static flags = commonStartFlags();
 	async run() {
 		const { args, flags } = await this.parse(SignupCommand);
+		refuseEmailCodeStartWithoutTerminal({
+			email: args.email,
+			flags
+		});
 		let releaseCredentialsLock;
 		try {
 			releaseCredentialsLock = acquireCliCredentialsLock(this.config.configDir);
@@ -77399,7 +78335,7 @@ var SignupConfirmCommand = class SignupConfirmCommand extends Command {
 			fromFile: flags["code-from-file"],
 			fromEnv: flags["code-from-env"]
 		});
-		if (resolvedCode.kind === "error") throw cliError$2(resolvedCode.message);
+		if (resolvedCode.kind === "error") throw usageError$1(resolvedCode.message);
 		let releaseCredentialsLock;
 		try {
 			releaseCredentialsLock = acquireCliCredentialsLock(this.config.configDir);
@@ -77486,6 +78422,7 @@ var SignupInteractiveCommand = class SignupInteractiveCommand extends Command {
 	static flags = commonStartFlags();
 	async run() {
 		const { flags } = await this.parse(SignupInteractiveCommand);
+		refuseInteractiveSignupWithoutTerminal();
 		let releaseCredentialsLock;
 		try {
 			releaseCredentialsLock = acquireCliCredentialsLock(this.config.configDir);
@@ -79758,6 +80695,8 @@ var OrgLeaveCommand = class OrgLeaveCommand extends Command {
 	};
 	async run() {
 		const { flags } = await this.parse(OrgLeaveCommand);
+		const interactive = Boolean(process.stdin.isTTY && process.stderr.isTTY);
+		if (!flags.yes && !interactive) this.error("Not leaving: no terminal to confirm in. Pass --yes to leave without confirmation.", { exit: 2 });
 		await runWithTiming(flags.time, async () => {
 			const { auth, baseUrlOverridden, requestConfig } = await createAuthenticatedCliApiClient({
 				apiKey: flags["api-key"],
@@ -79772,7 +80711,7 @@ var OrgLeaveCommand = class OrgLeaveCommand extends Command {
 				orgLabel,
 				yes: flags.yes,
 				stepUpToken: flags["step-up-token"],
-				interactive: Boolean(process.stdin.isTTY && process.stderr.isTTY),
+				interactive,
 				prompt: promptLine,
 				write: (text) => process.stderr.write(text)
 			});
@@ -79786,7 +80725,7 @@ var OrgLeaveCommand = class OrgLeaveCommand extends Command {
 					return;
 				case "needs_confirmation":
 					process.stderr.write("Not leaving: no terminal to confirm in. Pass --yes to leave without confirmation.\n");
-					process.exitCode = 1;
+					process.exitCode = 2;
 					return;
 				case "error":
 					writeErrorWithHints(outcome.payload);
@@ -80062,13 +81001,15 @@ function loadSavedLogin(configDir) {
 /** One line per organization, the current one marked with `*`. */
 function formatOrgRows(rows) {
 	if (rows.length === 0) return "You do not belong to any organization.";
-	return rows.map((row) => {
+	const lines = rows.map((row) => {
 		const marker = row.current ? "*" : " ";
 		const name = row.name ?? "(unnamed)";
-		const role = row.role ? ` ${row.role}` : "";
+		const role = row.role ? ` ${roleKeyLabel(row.role)}` : "";
 		const status = row.available ? "available" : `unavailable: ${row.message ?? row.reason ?? "no CLI access"}${row.reason ? ` [${row.reason}]` : ""}`;
 		return `${marker} ${name} (${row.id})${role}, ${status}`;
-	}).join("\n");
+	});
+	if (rows.some((row) => row.role === "restricted")) lines.push(`role restricted: no role at all, or ${RESTRICTED_ROLE_NOTE}.`);
+	return lines.join("\n");
 }
 var OrgsCommand = class OrgsCommand extends Command {
 	static description = `List the organizations you can switch the CLI to, with your role and whether the CLI may be used there. The current organization is marked with *.
@@ -80174,7 +81115,7 @@ var OrgUseCommand = class OrgUseCommand extends Command {
 				}, null, 2));
 				return;
 			}
-			this.log(`Now using ${org.org_name ?? org.org_id} (${org.org_id}), role ${org.role ?? "unknown"}.`);
+			this.log(`Now using ${org.org_name ?? org.org_id} (${org.org_id}), ${org.role ? roleKeyText(org.role) : "role unknown"}.`);
 		} catch (error) {
 			if (error instanceof CliOrgRefusedError) throw new Errors.CLIError(`Cannot switch to ${args.org}: ${error.message} [${error.reason}]`, {
 				code: error.reason,
@@ -81253,7 +82194,7 @@ function formatRoles(list) {
 }
 function formatGroups(list) {
 	if (list.groups.length === 0) return "No groups.";
-	return list.groups.map((group) => `${group.id}  ${group.name}  ${group.members.length} members  role ${group.role_id ?? "none"}`).join("\n");
+	return list.groups.map((group) => `${group.id}  ${group.name}  ${group.members.length} members  role id ${group.role_id ?? "none"}`).join("\n");
 }
 function formatMailboxAccess(list) {
 	if (list.entries.length === 0) return "No mailbox access entries.";
@@ -81289,7 +82230,7 @@ function formatAccessMode(mode) {
 	return `Access mode: ${mode.mode} (version ${mode.version}${mode.changed_at ? `, changed ${mode.changed_at}` : ""}).`;
 }
 var RolesListCommand = class RolesListCommand extends Command {
-	static description = "List the organization's roles (built-in, template and custom) with their permission counts, the templates that can be assigned, and whether role assignment is available. The built-in roles are owner, admin, operator and member; operator has every permission admin has except managing members, changing roles, sending invitations and billing.";
+	static description = "List the organization's roles (built-in, template and custom) with their permission counts, the templates that can be assigned, and whether role assignment is available. The built-in roles are owner, admin and member. Operator is a template with every permission admin has except managing members, changing roles, managing mailbox delegations, sending invitations and billing.";
 	static summary = "List roles";
 	static examples = ["<%= config.bin %> roles list", "<%= config.bin %> roles list --json"];
 	static flags = SHARED_FLAGS;
@@ -82794,9 +83735,13 @@ var SignalCommand = class SignalCommand extends Command {
 function cliError(message) {
 	return new Errors.CLIError(message, { exit: 1 });
 }
+function usageError(message) {
+	return new Errors.CLIError(message, { exit: 2 });
+}
 const SIGNIN_OTP_COPY = {
 	actionNoun: "sign-in",
 	actionGerund: "signing in",
+	browserLoginCommand: "signin browser",
 	confirmCommand: (email) => `signin otp confirm ${email} <code>`,
 	resendCommand: (email) => `signin otp resend ${email}`,
 	startCommand: (email) => `signin otp ${email}`
@@ -82804,6 +83749,7 @@ const SIGNIN_OTP_COPY = {
 const SIGNIN_EMAIL_COPY = {
 	actionNoun: "sign-in",
 	actionGerund: "signing in",
+	browserLoginCommand: "signin browser",
 	confirmCommand: (email) => `signin confirm ${email} <code>`,
 	resendCommand: (email) => `signin resend ${email}`,
 	startCommand: (email) => `signin ${email}`
@@ -82811,6 +83757,7 @@ const SIGNIN_EMAIL_COPY = {
 const LOGIN_EMAIL_COPY = {
 	actionNoun: "login",
 	actionGerund: "logging in",
+	browserLoginCommand: "login browser",
 	confirmCommand: (email) => `login confirm ${email} <code>`,
 	resendCommand: (email) => `login resend ${email}`,
 	startCommand: (email) => `login ${email}`
@@ -82818,6 +83765,7 @@ const LOGIN_EMAIL_COPY = {
 const LOGIN_OTP_COPY = {
 	actionNoun: "login",
 	actionGerund: "logging in",
+	browserLoginCommand: "login browser",
 	confirmCommand: (email) => `login otp confirm ${email} <code>`,
 	resendCommand: (email) => `login otp resend ${email}`,
 	startCommand: (email) => `login otp ${email}`
@@ -82825,10 +83773,12 @@ const LOGIN_OTP_COPY = {
 const OTP_COPY = {
 	actionNoun: "email-code auth",
 	actionGerund: "authenticating",
+	browserLoginCommand: "login browser",
 	confirmCommand: (email) => `otp confirm ${email} <code>`,
 	resendCommand: (email) => `otp resend ${email}`,
 	startCommand: (email) => `otp ${email}`
 };
+const EMAIL_CODE_ACCOUNT_NOTE = "The code logs you in to the account that uses the address, or creates a new account when none does. Primitive sends no emailed code to an address on a domain it receives mail for: use browser login instead.";
 function acquireCredentialsLock(configDir) {
 	try {
 		return acquireCliCredentialsLock(configDir);
@@ -82838,7 +83788,7 @@ function acquireCredentialsLock(configDir) {
 }
 function commonOtpStartFlags() {
 	return {
-		"accept-terms": Flags.boolean({ description: "Confirm acceptance of Primitive's Terms of Service and Privacy Policy" }),
+		"accept-terms": Flags.boolean({ description: "Confirm acceptance of Primitive's Terms of Service and Privacy Policy. Required when there is no terminal to ask in." }),
 		"api-base-url": Flags.string({
 			description: "Override the primary API base URL. Internal testing only; not documented to customers.",
 			env: "PRIMITIVE_API_BASE_URL",
@@ -82853,13 +83803,15 @@ function commonOtpStartFlags() {
 }
 var SigninCommand = class extends LoginCommand$1 {
 	static args = { email: Args.string({
-		description: "Email address for email-code sign-in. Omit it to use browser approval.",
+		description: "Email address for email-code auth, which logs in to the account that uses it or creates one when none does. Omit it to use browser approval.",
 		required: false
 	}) };
-	static description = `Sign in or log in to an existing Primitive account and save an org-scoped OAuth session locally.
+	static description = `Sign in to Primitive and save the session locally.
 
-Run \`primitive signin <email> --accept-terms\` for email-code sign-in, then \`primitive signin confirm <email> <code>\`. Run \`primitive signin\` with no email to use browser approval; \`primitive signin browser\` is the explicit browser form. \`primitive login\` supports the same flows with login-shaped commands. \`primitive otp <email>\` is the shortest email-code auth form. For new account creation, use \`primitive signup <email>\`. Browser approval logs you in as yourself where the server supports it, so you can switch organizations with \`primitive org use <org>\` or \`--org <org>\` on any command.`;
-	static summary = "Sign in to an existing account";
+Run \`primitive signin\` with no email to use browser approval; \`primitive signin browser\` is the explicit browser form. Browser approval logs you in as yourself where the server supports it, so you can switch organizations with \`primitive org use <org>\` or \`--org <org>\` on any command.
+
+Run \`primitive signin <email> --accept-terms\` for email-code sign-in, then \`primitive signin confirm <email> <code>\`. ${EMAIL_CODE_ACCOUNT_NOTE} \`primitive login\` supports the same flows with login-shaped commands. \`primitive otp <email>\` is the shortest email-code auth form; \`primitive signup <email>\` is the same flow, worded for creating an account.`;
+	static summary = "Sign in with browser approval or an emailed code";
 	static examples = [
 		"<%= config.bin %> signin",
 		"<%= config.bin %> signin browser",
@@ -82880,12 +83832,17 @@ Run \`primitive signin <email> --accept-terms\` for email-code sign-in, then \`p
 	async run() {
 		const commandClass = this.constructor;
 		const { args, flags } = await this.parse(commandClass);
-		if (args.email && flags.permission?.length) throw cliError("--permission applies to browser login. Run the command without an email to use it.");
+		if (args.email && flags.permission?.length) throw usageError("--permission applies to browser login. Run the command without an email to use it.");
 		if (!args.email) {
-			if (flags["accept-terms"]) throw cliError(`Email-code auth needs an email address. Run \`primitive ${this.emailCodeCopy().startCommand("<email>")} --accept-terms\`.`);
+			if (flags["accept-terms"]) throw usageError(`Email-code auth needs an email address. Run \`primitive ${this.emailCodeCopy().startCommand("<email>")} --accept-terms\`.`);
 			await this.runBrowserLogin(flags, this.retryCommand());
 			return;
 		}
+		refuseEmailCodeStartWithoutTerminal({
+			copy: this.emailCodeCopy(),
+			email: args.email,
+			flags
+		});
 		const releaseCredentialsLock = acquireCredentialsLock(this.config.configDir);
 		try {
 			await runSignupStartWithCredentialLock({
@@ -82907,10 +83864,12 @@ Run \`primitive signin <email> --accept-terms\` for email-code sign-in, then \`p
 };
 var LoginCommand = class extends SigninCommand {
 	static args = SigninCommand.args;
-	static description = `Log in or sign in to an existing Primitive account and save an org-scoped OAuth session locally.
+	static description = `Log in to Primitive and save the session locally.
+
+Run \`primitive login\` with no email to use browser approval; \`primitive login browser\` is the explicit browser form. Browser approval logs you in as yourself where the server supports it, so you can switch organizations with \`primitive org use <org>\` or \`--org <org>\` on any command.
 
-Run \`primitive login <email> --accept-terms\` for email-code login, then \`primitive login confirm <email> <code>\`. Run \`primitive login\` with no email to use browser approval; \`primitive login browser\` is the explicit browser form. \`primitive signin\` supports the same flows with signin-shaped commands. \`primitive otp <email>\` is the shortest email-code auth form. For new account creation, use \`primitive signup <email>\`. Browser approval logs you in as yourself where the server supports it, so you can switch organizations with \`primitive org use <org>\` or \`--org <org>\` on any command.`;
-	static summary = "Log in to an existing account";
+Run \`primitive login <email> --accept-terms\` for email-code login, then \`primitive login confirm <email> <code>\`. ${EMAIL_CODE_ACCOUNT_NOTE} \`primitive signin\` supports the same flows with signin-shaped commands. \`primitive otp <email>\` is the shortest email-code auth form; \`primitive signup <email>\` is the same flow, worded for creating an account.`;
+	static summary = "Log in with browser approval or an emailed code";
 	static examples = [
 		"<%= config.bin %> login",
 		"<%= config.bin %> login browser",
@@ -82959,13 +83918,18 @@ var SigninOtpCommand = class extends Command {
 		description: "Email address to sign in with",
 		required: false
 	}) };
-	static description = "Start email-code sign-in using Primitive's signup/auth OTP flow, send a verification code, and save the pending token locally.";
+	static description = `Start email-code sign-in using Primitive's signup/auth OTP flow, send a verification code, and save the pending token locally. ${EMAIL_CODE_ACCOUNT_NOTE}`;
 	static summary = "Start OTP sign-in";
 	static examples = ["<%= config.bin %> signin otp user@example.com --accept-terms", "<%= config.bin %> signin otp confirm user@example.com 123456"];
 	static flags = commonOtpStartFlags();
 	async run() {
 		const commandClass = this.constructor;
 		const { args, flags } = await this.parse(commandClass);
+		refuseEmailCodeStartWithoutTerminal({
+			copy: this.emailCodeCopy(),
+			email: args.email,
+			flags
+		});
 		const releaseCredentialsLock = acquireCredentialsLock(this.config.configDir);
 		try {
 			await runSignupStartWithCredentialLock({
@@ -82984,7 +83948,7 @@ var SigninOtpCommand = class extends Command {
 };
 var LoginOtpCommand = class extends SigninOtpCommand {
 	static args = SigninOtpCommand.args;
-	static description = "Start email-code login using Primitive's signup/auth OTP flow, send a verification code, and save the pending token locally.";
+	static description = `Start email-code login using Primitive's signup/auth OTP flow, send a verification code, and save the pending token locally. ${EMAIL_CODE_ACCOUNT_NOTE}`;
 	static summary = "Start OTP login";
 	static examples = ["<%= config.bin %> login otp user@example.com --accept-terms", "<%= config.bin %> login otp confirm user@example.com 123456"];
 	static flags = SigninOtpCommand.flags;
@@ -82994,7 +83958,7 @@ var LoginOtpCommand = class extends SigninOtpCommand {
 };
 var OtpCommand = class extends SigninOtpCommand {
 	static args = SigninOtpCommand.args;
-	static description = "Start email-code authentication, send a verification code, and save the pending token locally.";
+	static description = `Start email-code authentication, send a verification code, and save the pending token locally. ${EMAIL_CODE_ACCOUNT_NOTE}`;
 	static summary = "Start email-code auth";
 	static examples = ["<%= config.bin %> otp user@example.com --accept-terms", "<%= config.bin %> otp confirm user@example.com 123456"];
 	static flags = SigninOtpCommand.flags;
@@ -84662,7 +85626,7 @@ function formatGrantLines(identity, options = {}) {
 	const lines = [];
 	const org = options.orgName ? `${options.orgName} (${identity.org_id})` : identity.org_id;
 	lines.push(`Organization: ${org}`);
-	lines.push(`Role: ${identity.role}`);
+	if (isPersonIdentity(identity)) lines.push(identity.role === "member" ? "Built-in role: member (also shown for a template or custom role that does not fully include member; the Grant line is what this login can do)" : isBuiltInRoleKey(identity.role) ? `Built-in role: ${identity.role}` : `Role key: ${identity.role}`);
 	const grant = identity.grant;
 	if (grant) lines.push(...formatGrant(grant));
 	if (options.userLogin) lines.push("Signed in as yourself. Switch organizations with `primitive org use <org>`.");
@@ -84672,10 +85636,32 @@ function formatPermissionCheck(check) {
 	if (check.allow) return `${check.permission}: allowed`;
 	return `${check.permission}: not allowed${check.reason ? ` (${check.reason})` : ""}`;
 }
-function formatWhoamiSummary(account, managedInboxDomain, orgName = null) {
+/** Whether GET /whoami answered for an API key. */
+function isKeyIdentity(identity) {
+	return Boolean(identity.key_id) || identity.auth_method === "api_key";
+}
+/** Whether GET /whoami answered for a person's own session or OAuth login. */
+const PERSON_AUTH_METHODS = /* @__PURE__ */ new Set([
+	"oauth",
+	"session",
+	"dashboard_bridge"
+]);
+function isPersonIdentity(identity) {
+	return !isKeyIdentity(identity) && typeof identity.auth_method === "string" && PERSON_AUTH_METHODS.has(identity.auth_method);
+}
+/** What the summary's first line says about who is calling. */
+function identityLine(identity) {
+	if (!identity || identity.member_address === void 0) return "Authenticated";
+	if (identity.member_address) return `Authenticated as ${identity.member_address.address} (your member address)`;
+	if (isKeyIdentity(identity)) return "Authenticated (API keys have no member address)";
+	if (!isPersonIdentity(identity)) return "Authenticated (this credential has no member address)";
+	return `Authenticated (you have no member address in this organization${identity.member_address_suggestion ? `; \`primitive account provision-member-address --address ${identity.member_address_suggestion}\` sets one` : ""})`;
+}
+function formatWhoamiSummary(account, managedInboxDomain, orgName = null, identity = null) {
 	const lines = [
-		account.email ? `Authenticated as ${account.email}` : "Authenticated (this credential may not see the account email)",
+		identityLine(identity),
 		orgName ? `Organization: ${orgName} (${account.id})` : `Organization id: ${account.id}`,
+		...account.email ? [`Account email: ${account.email} (the email the account was opened with)`] : [],
 		`Plan: ${account.plan}`
 	];
 	if (managedInboxDomain) lines.push(`Managed inbox: any-local-part@${managedInboxDomain}`);
@@ -84726,7 +85712,7 @@ var WhoamiCommand = class WhoamiCommand extends Command {
 			hidden: true
 		}),
 		json: Flags.boolean({ description: "Print the account JSON response, or the saved connected identity marked verification: offline. Never prints credentials." }),
-		grant: Flags.boolean({ description: "With --json, add `grant`: the organization, role and grant of this credential. The summary always shows them when the server reports them." }),
+		grant: Flags.boolean({ description: "With --json, add `grant`: the organization, role and grant of this credential. The summary shows them when the server reports them; only a person's own login has a role line." }),
 		check: Flags.string({ description: "Ask whether this credential may use a permission, such as mail:send. Prints the decision and exits 1 when it is not allowed. Nothing is enforced by asking." }),
 		resource: Flags.string({
 			description: "With --check, the resource to check against, as function:<id>, domain:<id>, endpoint:<id> or route:<id>.",
@@ -84855,7 +85841,7 @@ var WhoamiCommand = class WhoamiCommand extends Command {
 				}, null, 2));
 				return;
 			}
-			const summary = [formatWhoamiSummary(account, managedInboxDomain, orgName)];
+			const summary = [formatWhoamiSummary(account, managedInboxDomain, orgName, identity)];
 			if (identity?.grant) summary.push(...formatGrantLines(identity, {
 				orgName: auth.credentials?.org_name ?? null,
 				userLogin: auth.credentials?.auth_method === "user_grant"
@@ -85318,6 +86304,7 @@ const COMMANDS = {
 	orgs: OrgsCommand,
 	"org:use": OrgUseCommand,
 	"cli:list-cli-orgs": OrgsCommand,
+	"activity:asked": ActivityAskedCommand,
 	"activity:created": ActivityCreatedCommand,
 	"keys:list": KeysListCommand,
 	"keys:get": KeysGetCommand,